SecurityChef | Your daily diet of security goodness!

CAT | Featured articles

Chicago, United States – August 4th, 2009TechTrex Inc. receives certification from Chase-Paymentech for its PrimeTrex IP POS terminal.

TechTrex Inc. (TTI), a leading provider of turnkey custom solutions for the Card Issuance and Payment Industries, today announced that its PrimeTrex IP POS terminal has received Class B certification from Chase-Paymentech. This certification allows Chase-Paymentech to offer the fast, secure and reliable PrimeTrex IP to its merchant base for both dial and IP transactions (optional GPRS wireless). The affordable PrimeTrex IP supports a 32-bit ARM9 processor for amazing dial and IP processing capacity. Its 64 MB of memory provides ample space for multiple merchants and multiple applications.“A strong combination” says Dave Ninesling, Sr. VP of Sales, TechTrex, Inc. “The addition of this robust application to our USA flagship PrimeTrex IP offers Chase-Paymentech customers flexibility and reliability at the terminal level. As well, it provides access to unparalleled business building products and support capability behind the scenes.”About TechTrex Inc.TechTrex Inc. (TTI) is a leading provider of turnkey custom solutions for the Card Issuance and Payment Industries. The company’s strength lies in its ability to provide a comprehensive blend of superior technology and customized software solutions. These range from the most basic dial terminal to custom applications to branding to complex networking solutions.TechTrex leverages its international manufacturing and software development capabilities to provide unique, innovative and cost-effective products around the globe. TTI has operations in Canada, the United States, Japan, China, Korea and authorized dealers worldwide.

Website: www.techtrex.com

No tags

Actions announced today by Prime Minister John Key to target methamphetamine are welcome, Police Association President Greg O’Connor said today.

“The Prime Minister’s package of announcements shows a welcome recognition, at the highest level of Government, of the extent of the ‘P’ problem,” Mr O’Connor said.

“The ultimate success of some the initiatives, like restricting access to pseudoephedrine-based medicines, will be measured in terms of ‘P’ availability and street price. Information from our frontline investigators is that large scale, organised crime-linked ‘P’ labs already tend to use imported ContacNT, rather than locally-sourced cold and flu pills, so moves to increase Customs’ focus in this area are critical.

“As the Prime Minister himself said, we won’t solve the problem overnight – but there is a clear determination on Mr Key’s part to take firm action which has at some times in the past been lacking.

“The Police Association first started warning about the threat of a looming methamphetamine epidemic as far back as 1997. Unfortunately, those warnings were largely ignored by the Police and political leadership of the day and written off as scare mongering. It needs to be understood that as a result, we are now dealing not just with a drugs problem, but also a serious organised crime problem.”

Mr O’Connor also welcomed the Prime Minister’s announcement that confiscated criminal assets would be put back into policing and treating methamphetamine addiction.

“New Zealanders will see the poetic justice in criminals being stripped of their ill-gotten gains, and seeing that money poured back into the fight against gangs and drugs,” Mr O’Connor said.

“Obviously, there are issues of detail that will need to be worked through. For example, overseas experience shows it can take several years before asset restraining actions actually result in money being confiscated, because of legal processes and challenges. The amount of money confiscated each year can also vary wildly. Combating organised crime requires long-term commitment of resources to in-depth investigations, so vital policing tasks mustn’t grow to be dependent on delayed and unpredictable cash flow from proceeds of crime recoveries,” Mr O’Connor warned.

No tags

Smart security tool brings peace of mind

A smart security tool developed by a Wellington company is providing affordable, world class IT surveillance for a growing number of Kiwi businesses and organisations.

Dubbed the RedEye, the system offers a total security solution, remotely and automatically scanning networks once a day or more frequently if required. If a problem is detected, IT security experts at Aura RedEye Security contact customers to discuss risks and provide solutions.

The RedEye, developed with investment of $50,000 from Techno, the business investment programme of the Foundation for Research, Science and Technology, has been sold to 20 customers, less than a year after its launch, and has recently signed its first Australian client.

“The RedEye is delivering an outstanding return on our investment,” says Foundation Senior Investment Manager Joseph Stuart. “Aura RedEye Security’s product is providing high quality, round-the-clock IT security to both small and large organisations and has strong potential to be sold internationally.”

Aura RedEye Security Managing Director Andy Prow says the RedEye can scan networks from both the inside and the outside with the latter service most in demand.

“Historically, there has been limited technology available to help organisations monitor their network from the outside. The products that do exist tend to be expensive, designed for large networks and deliver long complex reports that only an IT expert would understand.

“Part of what got us thinking about the RedEye is that, as Internet security specialists, we were often called in to help clients make sense of reports their existing security systems were generating, which they didn’t understand.”

With the RedEye, information from regular scans of clients’ networks is analysed by the “Red Brain” which will alert Aura RedEye Security staff to any faults. “We report the problem to the client the next day, or immediately if necessary, and help them decide what actions to take.”

At a starting cost of $200 a month for a daily, external scan, Andy Prow says the service has, for the first time, made it possible for smaller businesses to access rigorous IT surveillance.

The RedEye was developed in 2007 by Aura RedEye Security’s parent company, Aura Software Security Ltd. The company used a commonly available secure system as underpinning architecture, added the best available open-source scanning tools and used the TechNZ investment for in-house development of capability to operate remotely and to build tools for intelligent data mining and analysis.

Andy Prow says the TechNZ investment gave the company the impetus to proceed with its R&D .

“We may not have done it without the TechNZ dollars,” says Mr Prow. “It’s hard for a small company to fund research and development from cash flow and easy to put it off. The investment gave us a window of three months and some dedicated funds to do the work.”

Organisations already using the RedEye include Xero, the online accounting company, Audit New Zealand and the Ministry of Research, Science and Technology (MORST).

Grant Riley, MORST’s Director of Knowledge Management, says the RedEye performs a daily scan of the ministry’s network, ensuring security and reducing the costs of ongoing IT audits. 

“We have outsourced the hosting of our servers and have many third party vendors supporting our business systems. Our hosting vendor ensures we have a secure network, but multiple vendors supporting our business applications can create potential security risks. Previously we were carrying out an audit once a year but RedEye is like having our own IT auditors on the job every day. It has cut our IT audit costs significantly.”

Export growth is the next goal for Aura RedEye Security. Andy Prow says the first Australian customer has been signed with the company’s business model proving highly attractive.

“That client has been using a United States product to provide a similar service but is switching because of the added value we offer through the analysis we provide.

“The RedEye has given us the ability to grow our business quickly. Previously, we could only grow by taking on more experts but we now have technology to provide our service globally, backed up by our technical consulting team.”

Aura Software Security has a team of just five IT experts who, Andy Prow says, have capacity to service hundreds of customers. “With the Red Brain analysing all the scanning reports, our staff can focus on what really matters – identifying problems that occur and advising on the best solutions.” 

Those IT experts are also specialists in penetration testing, attacking client’s IT systems with real-world hacking tools, and some of its own inventions, to analyse robustness and identify vulnerabilities. They are what’s known as “Certified Ethical Hackers”, legally allowed to use hacking tools to penetrate computer networks and systems.

Proof that they are top of their game has come this year with one of the company’s security consultants, Graeme Neilson, being invited to present at three international security conferences, including the world’s biggest, held in Las Vegas in July.

“It’s a great endorsement for us. It shows our customers that we are serious about IT security and really know what we are talking about,” says Mr Prow.

Aura Software Security Ltd has its head-office in Te Horo, north of Wellington, and an office in central Wellington. From here they “hack” customer’s through-out New Zealand as well as Australia and the UK.

Further Information
Andy Prow, Managing Director, Aura Software Security
Tel 027 2872 151
Email Andy@AuraSoftwareSecurity.co.nz  

No tags

Jan/10

19

Bankcard Security

To protect your credit cards, we recommend the following guidelines

  • Sign new cards as soon as you receive them. Also destroy any old cards you have replaced, immediately.
  • Get a PIN on your card. If your card has chip technology, you must have a PIN.
  • Every time you complete a transaction1 with your credit card at a BNZ ATM the security information on your card will be updated. This will help reduce the chance of skimming fraud on your card.  So,
     - use your credit card at a BNZ ATM as often as possible even if just for a free balance enquiry or mini statements; and
     - prior to going overseas and upon your return to New Zealand complete a transaction with your BNZ credit card at any BNZ ATM.
  • Read the New Zealand Bankers’ Association leaflet, ‘Protecting your Cards, Pins & Passwords’ (PDF 733KB).
  • Never give your card or card number to anyone, except for the purposes of completing a transaction.
  • Keep your card in sight during a transaction, and watch for double swiping of your card.
  • Always take your card receipts with you when you have completed your transaction.
  • Only deal with known and reputable companies when using your credit card over the Internet or telephone and unless you have initiated the call, we strongly recommend that you do not give your credit card details over the phone.
  • When using your credit card online, make sure the padlock symbol, indicating a secure environment, appears at the bottom of the browser. Or, look for a ‘s’ after the http in the web address. We are committed to ensuring that you are protected when shopping online with NetPledge & NetPromise.

Look out for suspicious devices on ATMs.

No tags

This is a guest post by Darren Whitaker-Barnett; Founder of locatingus.com, an online visitor/event management service.

In this article I examine some of the key issues every organization should consider when looking to deploy a Visitor Management solution. If you are serious about deploying a solution that meets all of your needs and not one that simply prints nice visitor labels – this is a must read.

Introduction

When considering a solution that enables your organization to manage who is on-site – few people take the time to consider all of the implications when looking to deploy a visitor management solution.

During a 22 year career in sales I have spent a lot of time visiting customers all over the world. My customer visit experiences range from corporate offices, warehouses, manufacturing plants, storage facilities, government departments, universities, branch offices, retail outlets, and even wind farms and dams. Many times I would wait around at security gates and in corporate receptions waiting for my host to arrive. So, for better or worse, I have a good deal of experience in how organizations manage visitors.

Out of every 10 visits most use one of the following visitor management processes:

  1. 2 out of 10 did NOTHING: The receptionist asks me who I am visiting and then advises me to take a seat while they track down the host.
  2. 2 out of 10 have SIGN-IN SHEETS: The reception or security gate team have me sign a Visitor Sheet on a clipboard, assume I must be who I say I am, and ask me take a seat while they track down the host.
  3. 3 out of 10 have BRANDED SIGN-IN BOOKS: The reception or security gate team have me sign their paper-based sign-in book/register (often Kalamazoo type books), assume I must be who I say I am, and ask me take a seat while they track down the host.
  4. 1 out of 10 have a PHONE HOST REGISTER: There is no receptionist or security gate and I am directed by a ‘Sign’ to look up the extension number of my host (normally printed on a laminated sheet hanging beside a phone) and to call them to announce my arrival
  5. 1 out of 10 have a VISITOR LABEL PRINTER: Some organizations have purchased a label printer to issue visitors with personalized visitor labels.
  6. 1 out of 10 has a VISITOR MANAGEMENT SYSTEM: A growing trend is for organizations to use a visitor management system. These will look like the Visitor Label Printer system above and may have Label printing at the kiosk, but the similarities end there. Visitor Management systems improve organizational security ten-fold. They allow organizations to pre-register visitors, check visitors in and out from a combination of kiosks and reception PC’s, send arrival alerts to staff, run reports on visitor vs. contractor presence, track responses to visitor answers, manage evacuations, hazard notices to visitors and contractors, manage multiple locations, and much more…

In most countries knowing who is on-site is a matter of compliance as well as good practice for managing evacuations in an emergency. Visitor books, sheets, or PC-based visitor label printers don’t address these issues. This always strikes me as strange since the vast majority of the companies I visit are concerned with staff safety and security.

Here are the top five reasons why you should consider improving your visitor management system:

1. You need to have a record of who is in your building/location

Let’s start with the basics: why do we care? For some companies visitor management is a matter of internal policy (Security, Health and Safety), whereas for others it is more about legal compliance or maintaining a good visitor experience at reception/security. Regardless of the motivation consider the following:

  • Do you have an obligation to your staff to protect them from non-approved visitors?
  • Do you have to record visitor details unique to your location? For example food processing sites might want to know if the visitor has been to South America in the last 7 days, a highly sensitive commercial site might want to know if visitors are carrying a phone with a camera, a government department might want to know if you are parked in the Visitor Car Park, and a bank might wish to know if you are an authorized contractor… and so on.
  • If visitors or contractors are visiting for a specified period of time and they are overdue, do you have a responsibility to verify their safety?
  • Most companies have intellectual property, private data or high-value assets that may be available to any visitor who finds him/herself in the right place at the right time. Without accurate records, there is no hope of recovery. Do the processes you have in place to manage and protect your organization’s assets, IP, and sensitive information incorporate systems for managing who is on-site if they are a non-staff member.
  • If there was an Occupational Safety and Health or theft incident last week and you can’t easily identify who was on-site that day between 1.30pm and 2.30pm what would be the consequences?
  • Organizations throughout Australasia are obligated under various Acts and Regulations to ensure the safety of people while on-site. In New Zealand this is covered under the Fire Safety and Evacuation of Buildings Regulations 2006 and the Health and Safety in Employment Act (1992). In Australia it is the Workplace Health and Safety Act, Regulations and Codes of Practice. Unless you have a robust process for reporting on non-staff presence in real-time, it is difficult to demonstrate compliance.

These points are not, however, unique to NZ or Australian regulation. From our own experiences we are seeing an increase in global demand for comprehensive, on-demand reporting about who is on-site, at all locations in the organizational network.

Even if regulatory compliance is not an issue for your firm, avoidance of legal liability is. Failure to provide a safe workplace is a lot harder to prove if a company has taken reasonable steps to provide access and visitor control.

2. No one else should know who is in your building/location

One of the areas often overlooked by companies with a paper log book is loss of privacy. Any visitor or contractor can tell you that the visitor log is an invaluable source of information and can tell quite a story about the deals a company is pursuing or what competitors may be bidding on a job. In the case of a multi-tenant facility, these privacy concerns can create a real liability for the landlord that can outweigh the need for security.

This is a concern that completely goes away with an automated system, since the historical information in the application will not be available to any visitor. .Information about who is visiting you should be confidential.

3. A paper log says “I never really intend to look at this again”

Have you looked at your paper log lately? How many of the names are legible? Are the purpose of the visit and the host’s name filled out? How about the arrival and departure times? Most people fill out the arrival time, but hardly anyone bothers on the way out. Even if they did, the times are notoriously inaccurate and certainly not verifiable.

If your procedure calls for verifying identity with a driver’s license, can you prove the procedure was followed? What about the logs themselves? Do you know where all old logs are? Has anyone “accidentally” removed a page? Are there back-up copies off-site? Are you gathering all of the data you should be gathering, or are you limited by the log you use and the time it takes to fill it out? How long does it take you to search through the data to find the entries you need?

If you are not sure about the answers to any of these questions, stop and think about the risk you are placing your company under if an incident does occur. An electronic visitor log program can solve all of these issues.

4. Many of your visitors are customers

One of the key reasons companies are moving to visitor management systems and away from paper logs is the impression it makes on their customers. Not only does the kiosk and/or the badges have a professional look, but the lobby process leaves the right impression. A company with long lines of visitors waiting to check in starts out a visit on a really bad note. Having Bob the security guard or Sally the receptionist misspell your customer’s name is even worse.

Having the capability to allow the visitor to self-register is another feature that many new systems have that leaves a high-tech impression on visitors. Even if it is followed up with an ID verification and badge printing a guard station, the overall process will be faster, more reliable and less of an aggravation for the visitor.

Customers or not, you also have a responsibility to protect visitors. In the event of an emergency, you have the responsibility to ensure that all employees and visitors have been marshalled to a safe area. Visitors represent a significant issue since they will have no idea what the proper evacuation procedures are. Additionally, you want to make sure none elect to remain inside with your assets while they are unsupervised.

While visitors can be accounted for using a paper log – the log must be available at potentially multiple marshalling points outside, and the information it contains must be correct. Both assumptions are easier to accomplish with a computerized visitor system.

5. Some of your visitors may not be friends

Visitor management systems have capabilities far beyond those of the paper log, and those features can make an enormous difference in your overall security. Take for example, the ability for staff to pre-register visitors. This capability is becoming very popular in the government and corporate sector. This allows reception or security to view’ a list of who is due on-site that day. If it is the policy of your organization to pre-authorize all visitors, pre-registration capabilities by staff is crucial and impossible with a visitor log book.

Logging meetings, dates and attendees can also be very useful in disputes over intellectual property. In the case of manufacturing or process plants, executing a general release helps the company avoid liability for accidents by making it clear the visitor knew the risks of being on premises. If your company is like many that I visit, maybe it’s time to have another look at the way you deal with visitors. Not only can you improve security, make your investigations easier and lower your risk, but you have a real chance to enhance your company’s image with its customers.

No tags

Theme Design by devolux.nh2.me