Customer Authentication and Fraud Detection: The Contact Center’s Looming Challenges

Ken Landoline
Ken Landoline

Summary Bullets:

  • The costs of compromised security in the customer care environment are high to both the enterprise and the customer, and the occurrences of security breaches continue to grow briskly.
  • Although not widely used technologies today, the combination of voice biometrics and predictive analytics has great potential to enhance fraud deterrence.

The methods of customer identification and verification used in contact centers today take too much time and are a major source of customer irritation. Agents’ questions inquiring about personal identification numbers (PINs) or asking pre-arranged security questions, such as “What is your father’s middle name?”, have outgrown their usefulness and are often easily circumvented by fraudsters seeking illegal access to customer accounts and private corporate information. High on the list of technologies destined to replace these traditional techniques are voice biometrics coupled with sophisticated predictive analytics. Continue reading “Customer Authentication and Fraud Detection: The Contact Center’s Looming Challenges”

VMware Has a Security Attention Deficit Disorder

Paula Musich
Paula Musich

Summary Bullets:                

  • VMware continues to shift its virtualization security priorities around, this time with a focus on the new Service Composer in the NSX virtual networking platform.
  • Despite the lack of focus on VMware’s part, third-party security providers continue to make progress with existing products, building up greater maturity and expanding their installed bases.

VMware’s attempts to deliver a cohesive set of security services for its dominant server virtualization technology in partnership with leading security providers appears to be a bit of a shell game.  Just when you thought the gold security coin was under one shell, you discover that you missed the last move and now it is under another.  In this case, VMware had been working to create a set of higher level APIs developed in conjunction with leading security partners that would be easier to work with than the former VMsafe APIs and reflect the requirements of a broader set of security functions—not just anti-virus signature scanning.  But that was before VMware acquired software-defined networking startup Nicera for over $1 billion around the time of VMworld 2012.  Fast forward to VMworld 2013 and voila!  No progress report on the security APIs, no expansion of the partners writing to those APIs, no case studies demonstrating real world deployments of security products using those APIs to deliver better security for VMware hosted applications.  Instead what you find is that VMware has shifted its attention (and resources) to trying to establish a virtual networking platform that it hopes will do for networking what the virtual machine did for computing. Continue reading “VMware Has a Security Attention Deficit Disorder”

Is the Gmail Privacy Flap Just a Big Misunderstanding?

itcblog-marcusSummary Bullets:

  • Google has come under fire recently from a consumer organization which pointed to a company filing to claim Gmail users can have “no expectation of privacy”, given the company’s email processing function described in the public document. With Gmail in use by thousands of enterprises, business owners may be concerned about a potential breach in trust.
  • As it happens, the claims reveal no new information about any processes used by Google to manage its popular email service. Unfortunately, the press loves a story that makes Google out as “Big Brother” or worse, especially given the NSA surveillance revelations of recent months. Users should continue to trust Google as much or as little as they did prior to this press storm.

What Happened?

Google is in court over privacy concerns, fighting a class-action lawsuit that accuses it of breaking wiretap laws when it scans emails in order to target advertisements to Gmail users. It claims Google “unlawfully opens up, reads, and acquires the content of people’s private email messages”. In a bid to dismiss the suit, filed in May, Google explained that in the delivery of its service, messages could not be hidden from the company, seeing as it needs to process and display them for users. An unfortunate wording in its filing implies users shouldn’t expect “objective confidentiality”, but the company was trying to be transparent about the reality of electronic communication, the messages transmitted by which are by definition exposed to the software and machines running the system. Continue reading “Is the Gmail Privacy Flap Just a Big Misunderstanding?”

Wired Authenticated Access is a Chicken and Egg Problem, and It’s Scrambled Up

Mike Fratto
Mike Fratto

Summary Bullets:

  • Strong wired authentication and access control is available using 802.1X, which is needlessly complex in wired networks and 802.1ae which is not widely available.
  • Lack of customer demand doesn’t give equipment vendors any inducement to simplify 802.1X wired functions or add 802.1ae to network equipment. You can change that.

Ever wonder why 802.1X and 802.11i is so well supported in wireless LANs—even consumer grade access points—yet is complex and fragile in wired ports? It’s not the technology or differences in the capability of wireless compared to wired equipment. The reason is customer demand. You. The average enterprise user hasn’t demanded the same level of functionality in the wired network as they did in the wireless. Continue reading “Wired Authenticated Access is a Chicken and Egg Problem, and It’s Scrambled Up”

Are M2M Communications Secure?

Kathryn Weldon
Kathryn Weldon

Summary Bullets:

  • If M2M grows the way the ecosystem hopes it will, there will be millions and even billions of end points sending continuous (as well as more sporadic) data across wired and wireless networks, including proprietary and mission-critical pieces of information about customers and businesses
  • What are operators, systems integrators, and security software and services specialists doing about this? Why doesn’t security seem to be discussed as openly as other M2M requirements?

When holding briefings with operators involved in M2M, security and privacy issues come up occasionally. Generally mobile operators offer APNs, which means that an M2M device is connected to the customer’s private IP network or cloud rather than directly to the carrier’s wireless network or the public internet. This provides a level of built-in network security but doesn’t deal with breaches that come through a corrupted end-point.  Nor does it always prevent unwarranted or malicious access to data behind the firewall. Adding encryption to sensors or other low-end M2M endpoints let alone putting it in a chipset or module may be overly expensive, as is adding end to end encryption to the entire data flow in between the “machine” and wherever the collected data is being sent. SIM cards within embedded modules generally have some level of built-in authentication, but how about application security, device OS security, or the kind of proactive security practiced routinely for remote laptops and mobile devices such as frequently updated anti-virus/spam/denial of service software, intelligent threat detection, and all-purpose managed security services?  Continue reading “Are M2M Communications Secure?”

BYOA and the Enterprise Application Portal: Create Your Own Internal Company Storefront

Joel Stradling
Joel Stradling

Summary Bullets:

  • The concept of ‘consumerization of IT’ is sure to evolve naturally in your organization, as employees want to use applications of their own choosing.
  • Some policy control is essential, and a sanctioned company app store is a good idea.
  • Companies such as Intel give employees an official app store, but users can also freely consume ‘unofficial’ apps from outside this domain.

First, the Chief Information Officer had to deal with the complexities that BYOD brought up; now, there is an increasing momentum to BYOA – in other words ’bring your own application.’  Extending beyond this is the concept of an open storefront for appliances, computing power, storage, OS, databases and so on – in other words, all IT.  Service providers are on board, as evidenced by the launches of several online store initiatives: Interoute launched CloudStore, offering applications, appliances, professional services and more; Belgacom offers Becloud; KPN offers a cloud store; and Orange’s VPN Galerie offers access to many apps developed both by Orange and by independent ISVs.  It is fair to say that the concept is already mature for the SME market place, with Belgacom’s Becloud offerings tailored for the mass SME segment but with more sophistication for larger companies.  Similarly, KPN’s Open Cloud Store gives its reseller partners (ISPs, SIs and other telcos) the opportunity to sell, provision and support cloud services to the diverse Dutch SME market. Continue reading “BYOA and the Enterprise Application Portal: Create Your Own Internal Company Storefront”

When Worlds Collide: Augmented Reality Meets the Enterprise

Brad Shimmin
Brad Shimmin

Summary Bullets:

  • Microsoft, Google, Apple, Sony and other manufacturers are actively building wearable computers that will supposedly usher in the next step in human-computer interaction.
  • Ready or not, when these reality augmenting devices will find their way into the enterprise, IT will have to deal not just with new hardware but more importantly with potentially litigious challenges in “human-human interaction.”

Yesterday the rumor mill began citing some rather convincing evidence that Microsoft was readying a new smart watch. That’s right, your shiny new tablet and smartphone are about to become history. The future of the human-computer interface isn’t fingers tapping on glass. As Google’s Sergey Brin showed us at the last Google IO conference, the sky is quite literally the limit when it comes to redefining how we interact with one another through the medium of technology. And they’re not alone. Sony has been working on a wearable computer (the Nextep) for some time now. Samsung and LG have as yet undisclosed projects in the works, and Apple has patented (no surprise there) a wearable computer with a curved screen. Continue reading “When Worlds Collide: Augmented Reality Meets the Enterprise”

The Bamital Botnet Bust Takes an Interesting Turn

Amy Larsen DeCarlo
Amy Larsen DeCarlo

Summary Bullets:

  • Microsoft and Symantec disclosed that they have successfully (they believe) shut down the Bamital botnet, which was netting at least $1 million a year for the perpetrators.
  • The companies went beyond the usual legal and technical responses, employing the botnet’s own mechanisms to inform targeted users that their systems had been infected to carry out so-called ‘click fraud.’

Where there is a will, there always seems to be a way when it comes to hackers using new techniques and variations on old methods to breach systems for their own gain.  This is what makes the IT security discipline as relentlessly frustrating as it is endlessly challenging.  No matter how innovative IT security technologies become and practices evolve, determined cybercriminals seem to be finding new ways to penetrate even the best enterprise defenses.  Continue reading “The Bamital Botnet Bust Takes an Interesting Turn”

SAP Takes on IBM in 2013 with Simplified Enterprise Mobile Solution

Charlotte Dunlap
Charlotte Dunlap

Summary Bullets:

  • SAP’s rebranded SAP Mobile Platform integrates Sybase SUP, Syclo Agentry, and eventually all of Mobiliser
  • SAP’s go-to-market strategy is based on simplified MEAP, channel support, continued third-party development tool support

Following a whirlwind year in which SAP appeared to spend all its marketing dollars on its SAP HANA database product, SAP’s mobile platform news will be finally coming out of the shadows. Following the acquisition of Syclo early last year, the company has aggressive integration plans in 2013 aimed at simplifying and strengthening its mobile portfolio and insuring it stays on the radar of core competitors including IBM, Antenna, and eventually Oracle.  Continue reading “SAP Takes on IBM in 2013 with Simplified Enterprise Mobile Solution”

Where Is the Enterprise Campus Network Heading?

Mike Spanbauer
Mike Spanbauer

Summary Bullets:

  • Enterprise access networks are still largely wired today, but with wireless stability and performance improvements providing a relatively similar experience, the all-wireless campus access environment may be imminent.
  • How much will the access switch port taper off once 802.11ac begins to ship?

In a recent conversation with a colleague, we were discussing how quickly (or if) the enterprise access environment will shift from the traditional wired access methods to an all-wireless environment.  While nearly every enterprise has some wireless support today (of the many enterprises to which I have spoken, I cannot name one that does not), very few have committed to solely wireless access for the clients.  Printers, the odd workstation or two, and other peripherals may always demand some wired access, but with the prevalence of the mobile worker and the multitude of devices they tote around, it is very easy to envision the WLAN in any campus being the access method of choice.  In the past year, the market has seen an aggressive maturation of unified access solution messaging, with some extending into the adjacent space of mobile device management (where acquisition and/or consolidation will likely occur in the next 18 months).  Continue reading “Where Is the Enterprise Campus Network Heading?”