Some of the stuff I hear at security events is interesting, thought provoking, pertinent and pretty useful for our readers. Most of it though is grandmother-sucking-eggs type stuff. And yet it still apparently needs to be said. At the ISSE conference this year, which has always claimed to have one of the more discerning audiences on the security conference circuit – the great and good from the information security community – one or two presentations fell into the latter category.

Case in point: A presentation on security for small and medium-sized enterprises (SMEs) by a researcher from Cardiff University told us that, um, SMEs aren’t very good at security. Well, to be fair there was a little more to it than that. Specific points he raised from his research were that very few have requirements in place for security, few people test their backup data, even if they actually backup, and most tellingly, only around a quarter said they actually know what information assets they have. A bit worrying, especially when you consider that SMEs, as we’ve all heard, employ about two-thirds of the workforce and contribute in total more to the economy than large organisations.

And then the more useful stuff for chief IT security officers: Obviously many in the security industry get a lot of value from sharing best practice, looking at the things their peers are doing that have proven to work. And so Roland Muller, corporate information security officer from Daimler Financial Services, explained the value of security assessments in a multinational organisation. To put it simply - it’s very valuable, according to Roland. But the key points he made for anyone wanting to do similar were:

1)    Get management buy-in for any security assessment scheme

2)    Link it to international standards, rather than a local approach.

3)    Maintain regular contact with management and local security guys, “the people who are always the victims”, according to Muller.

4)    User education is vital – “Policies are written by security guys for security guys. You need a simple way to bring the message to people”

By Phil Muncaster

Apparently, 45 per cent of women and 10 per cent of men were happy to give up their email system passwords in exchange for a bar of chocolate at a London railway station.

Infosecurity Europe surveyed 576 office workers at Liverpool Street station, asking for names, passwords, phone numbers and dates of birth.

Researchers also collected names and telephone numbers from 60 per cent of men and 62 per cent of women who thought they would be entered into a draw to win a trip to Paris.

While it would seem that Londoners are becoming less gullible – overall 64 per cent of people were happy to exchange their password details for a bar of chocolate when the survey was conducted in 2007 - respondents had to be subsequently told that they'd inadvertently participated in a survey.

I’m all for raising awareness of data security and I’m sure the survey gave a couple of hundred people something to think about, but this research cannot paint a true picture. It only represents the behaviour of a few people that allow themselves to be quizzed. I wouldn’t mind betting that people who don’t talk to strangers are less likely to disclose their personal information.

And what really baffles me is that there is a Thorntons at Liverpool Street anyway. Has the credit crunch got that bad?

By Janie Davies

Phishing – the notorious ruination of luddite police officers and pensioners who wander online – has been widely covered in the IT press over the past three years or so.

This is largely thanks to some well-oiled press machines in the IT security market – these companies have some money to burn.

Phishing also makes it into the red top and mid-market national tabloids from time to time.

For example, see Big phish in the Mirror or Bank details being sold over the internet for just £1 in the Daily Mail.

Both articles were driven by security vendors.

And there was even a leader in the Sun - Something phishy afoot .

Now you wouldn't know it from reading the IT press – or indeed the national press – but phishing has been significantly reduced in the last year.

According to banking industry body Apacs – a highly reliable barometer -  online banking fraud losses in 2007 were £22.6m - 33 per cent less than in 2006.

And yet the security company press releases still continue to churn out. Here's an excerpt from a recent one from RSA – which came out the same week as the Apacs figures:

"RSA has seen a growing number of phishing groups or networks that utilise botnets of proxies and Fast-Flux techniques. Since RSA first flagged these new trends in December 2007, it has identified five new phishing networks that rely on hijacked proxies. RSA expects this trend to continue in 2008," it said.

It was reported with headlines such as: Banks under attack: Phishing on the rise and Phishers widen attacks on banking industry by other IT news sites, and Phishing attacks hit six-month high on our own site Computing.co.uk.

This is in no way a highbrow criticism of the journalists – I have written countless versions of similar stories in the past, sometimes with far more sensationalist headlines than these. I am merely pointing out how someone who did not understand the technicalities might get a skewed perspective of the problem – especially if they only read the headline.

The stories are entirely accurate – but don't point out the difference between the number of phishing emails sent out and the number that successfully scam money.

Improvements in technologies such as fraud detection and two-factor authentication have reduced the amount of successful scams.

In his book Flat Earth News, which angered many journalists, Nick Davies finds that more than half of national newspaper stories consisted mainly of wire copy and /or PR material.

And interestingly, his book highlights the fact that recycling scare stories is a particular danger when it comes to technology – precisely because people (both the public and journalists) don't really understand the issues.

So the millennium bug produced the headlines:

‘National Health Service patients could die’ (Telegraph).

‘Banks could collapse’ (Guardian)

‘Riots, terrorism and a health crisis’ (Sunday Mirror)

‘Pensions contributions could be wiped out’ (Independent)

‘Nato alert over Russian missile millennium bug’ (Times).

The government spent millions on the problem as a result. Countries such as Russia, Italy and Korea who spent next to nothing on fixing the bug suffered hardly any ill effects.

Like most journalists I am guilty of what Davies calls “churnalism” as much as anyone – perhaps more so. But from now on - whatever the pressure -  I'm going to try and make an effort to improve, and to make sure I understand the things I'm writing about.

By Tom Young

In last week’s Computing, we discussed consumer confidence online on the back of a YouGov study commissioned by software vendor VeriSign.

According to the report, more than half (57 per cent) of the 2000 consumers polled by the researcher said they are concerned about online crime and an even larger chunk (78 per cent) is concerned about identity theft.

But comparing the results of the research with our real-life online habits paints a confusing picture.

We buy goods online via sites such as TK Maxx, even though the card details of 45 million of its customers were in hackers’ hands for 16 months before the theft was discovered.

We book our holidays from businesses such as Travelodge, that exposed customer data, including credit card details to other customers due to a web site glitch.

Convenience is a very powerful driver of consumer confidence. For many people - myself included - if it means that food delivered to my door is just a few clicks away, I will happily give my name and address to my supermarket of choice. If it means that I won’t need to brave the crowds to buy that pair of shoes, I will definitely buy it online.

Even though we say we are worried about internet crime, we comfortably share all manner of personally identifiable information with social networking sites, retailers, banks and so on. In short, a fair amount of what we do online requires us to disclose personal or financial data, so there is no way out.

And how do we know that we are safe online? I try and look out for the little padlock at the bottom of the screen when I enter my private information on a web site, but is that enough, I wonder? I normally take vendor comments with a pinch of salt.

So research suggests we don’t know what the online security options are and experience suggests we don’t like anything that gets in the way of convenience.

In the meantime, we continue clueless and keep getting supposedly helpful technology we don’t necessarily like, or is inefficient. Attempts to tackle online crime include two-factor authentication tokens, but many claim they that can be easily hacked

Besides, if every bank decides to offer tools such as authentication tokens, am I going to have to use three gadgets if I have three different bank accounts? Forget about it.

By Angelica Mari