I know, it sounds like the name of an oldschool rock band, but it’s not. It’s actually going to be one of themost pressing issues for IT in 2008. With millions beginning to enterthe workforce from Generation Y, CIOs are scrambling to understand andaddress perhaps their greatest risk ever.

In 2007 IT is just beginning to get its hands around the concept ofIT risk management and figuring out how to translate that forexecutives and the board. Now they’re confronted by the millennialworker, which is almost cause to rethink IT risk management all overagain. Trying to implement IT risk management policies with a"Millennial" workforce—one with members who have been labeled as "risktakers"—is very problematic. In general most "Millennials" tend tobelieve in a "no-walls" approach when it comes to sharing information.Why shouldn’t all information be shared? Their strength is digitalsophistication; some would even claim that the true concept ofinformation technology...

Antiphishing filters basically work eitheron block listing or on heuristics. "Rock phish" attacks are quite arecent phenomenon that has posed a major challenge to both of the abovementioned antiphishing filters, simply because the unique structure ofa Rock phish attack circumvents antiphishing filters. This phishingtechnique can be traced back to somewhere around August 2006. The URLstructure was comparatively simpler then, consisting of a randomizedroot domain and three sub folders. But the principle cause in therecent surge in the number of such attacks is traced to the botnetphenomenon. So, what then is so special about Rock phish? Well, thistechnique has a trademark method of striking naïve targets.

The URLs that navigate to the fraudulent Web sites have a uniquestructure. For example, the structure of this URL is Rock phishingspecific: http://www.xxx.xxx.user123990.com/login/challange/2b593cba/login.php.As a matter of fact,...

Hello, and welcome to this month’s blog onthe Microsoft patch releases. Microsoft released seven bulletins thismonth, covering a total of eleven vulnerabilities. Nine of thevulnerabilities affect Microsoft Vista either directly or throughapplications running on that operating system.

The first three bulletins discuss seven client-side vulnerabilitiesrated “Critical” by Microsoft. Four of those are vulnerabilities inInternet Explorer, two more affect DirectX, and the seventh is avulnerability affecting the Windows Media Format Runtime. These issuesdo require some sort of user interaction (such as visiting a maliciousWeb page, opening a malicious email, or opening a malicious file), butcan aid in the remote compromise of a victim’s computer. Users areadvised to use security best practices, including avoiding sites ofunknown or questionable integrity.

The remaining vulnerabilities (four issues rated as “Important”) areeach documented in their own...

On November 2, 2007 I had the opportunityto participate in a panel at the Federal Trade Commission on the futureof online behavioral advertising. While this topic is not one that isnormally associated with information protection issues, there are someinteresting implications that I touched upon at the panel and that Ithought I’d reiterate here.

First, let’s think about some of the overall trends related to Webadvertising. To begin with, the Web has certainly exploded inpopularity and people are spending more and more time each day surfingtheir favorite sites.

Second, online advertising has proven itself to be a viable businessmodel for many companies. Countless Web sites display ads that areviewed by an even greater number of people.

Third, along these same lines the online advertising supply chain isfairly complex. In the simplest incarnation, an advertiser might workwith an ad network who will arrange to have the ad published throughone...