The application of 3rd party certification programme in Malaysia- Trustgate

Posted by quatre-Ecomz Monday, June 29, 2009 comments (0)


MSC Trustgate.com Sdn Bhd is an organization that involved in the application of third party certification programme in Malaysia. It is an accredited Certification Authority (CA) running within the Multimedia Super Corridor. It is authorized by the Digital Signature Act 1997 (DSA). Their primary business is to offer digital certification services such as digital certificates, cryptographic products and software development. Trustgate obligated to provide the finest Public Key Infrastructure (PKI) to help all types of companies and institutions carrying their business over the Internet. Security is the primary concern of entering into the new Internet economy. Due to this reason, the vision of Trustgate is to allow organizations to operate their business securely over the Internet, as much as what they have been enjoying in the physical world. It provides a number of products and services to organizations in Malaysia, including SSL Certificate, Managed PKL, Personal ID, MyTRUST, MyKAD ID and so on.

Nowadays, there are increased phishing and spoofing attacks on the Internet, all organizations want to ensure that they are dealing with trusted parties when they manage business online and ensure that their information transferred over the Internet get to the expected recipients and is safe from intruders. SSL Certificate for Internet, Intranet and Server Security offer two type of SSL Certificates for server security such as Global Server ID and Secure Server ID. Global Server ID implements today's strongest encryption commercially accessible for secure communications via Server Gated Cryptography (SGC) technology. GSID verifies company’s web sites and allows 128- or 256-bit encryption to secure communications and transactions between the site and its visitors. Every purchase of GSID comes with a VeriSign Secured Seal that can show on company’s web site. The seal is an instant proof that the web site is genuine because it has been authorized by the World Leader of SSL Provider, and customers can conduct business with the company free of worry. Secure Site SSL Certificates safeguard the transfers of sensitive data on Web sites, intranets, and extranets using a minimum of 40-bit and up to 256-bit encryption. It includes VeriSign Secured Seal.

Managed Public Key Infrastructure (MPKI) service is a fully integrated enterprise platform created to secure intranet, extranet, and Internet applications by combining maximum flexibility, performance, and scalability with high availability and security. The service enable enterprise to quickly and cost-effectively set up a robust PKI and Certification Authority (CA) system with absolute control over security policies, PKI hierarchies, authentication models, and certificate lifecycle management. Trustgate’s robust is a high-availability certificate processing services. It allows enterprise to easily organize a PKI while relieving itself from the high expense of designing, provisioning, staffing, and maintaining its own PKI backbone. Managed PKI helps enterprise to issue 250 or more digital certificates to customers, suppliers, partners, or employees. This solution assists to defend on-line transactions, digitally sign them and regulate the access to intranets and extranets.

Digital ID is used for Secure Transaction, CryptoSuite and Secured E-mail. It makes sure user’s confidential information remains private in transit, user need to use Digital ID to sign & encrypt its transactions. Digital ID uses private key and public key to aid the several operations such as Authentication, Privacy, Authorization, Integrity and Non-repudiation.

MyKad with PKI capability enables its holder to run online transaction with government agencies and private sectors. MyKey, is the MyKad PKI solution that works with physically MyKad, allowing holder to validate himself online and to digitally sign documents or transactions and is recognized by the Malaysian government. Trustgate is the PKI developer and integrator for MyKad. It provides severalc MyKad PKI modules such as MyKey Application Programming Interface (API), Signing module, Verification module and MyKad Client Kit for developer who wishes to improve MyKad applications.
Security is significant for distributed, heterogeneous and mission critical applications. Trustgate provides a lot of managed security services, including Vulnerability scanning, Security assessment, Security architecture design, Intrusion prevention, Software integrity / application control, Security audit and Security consultancy. By employing these services, users can save their time and money from having to constantly react to security problems.

Besides that, Trustgate also offers many other services to public such as MyTRUST for Mobile Signature, SSL VPN for Remote Access Services, Verisign Certified Training and Application Development and System Integration. Trustgate is an essential party in Malaysia that participated in certification programme to provide security and protect confidentiality of users's data and information.
.


Related useful link:

TOP

Safeguarding your personal and financial data

Posted by quatre-Ecomz Sunday, June 28, 2009 comments (0)

Undeniably, nowadays we rely increasingly and heavily on computers and internet for help. We use them to manage our personal finances, store sensitive personal data,or perform work-related activities away from office. Yes, the digital world is helpful. But that does not mean it is risk-free. In fact, the personal or financial data that we store in computer or post on the internet is prone to theft without us knowing. The risk is even more if you share your computer with others. Thus, it is extremely crucial to take security precautions to safeguard your electronic assets. Following are some tips to keep your electronic personal and financial data away from risk.

A) Choose your password wisely. A strong password will surely provide you a certain level of security. Try to go for a long and more complicated one, a combination of uppercase and lowercase letters, numbers, and symbols is a good choice. It is not encouraged to have your birth date, or cellphone's numbers as your password.Cyber thieves are more clever than you could imagine.

B) Get a biometric authentication if possible. This is a very secured way to prevent unauthorized access to your valuable data. Using advance technology of unique biological characteristic identification on computer might be the best password available. There's no way for other people to access your private data unless they get a part of your body.

C) Install an appropriate antivirus software. After your hardware is set, it's time for software to show up. You will need a reliable anti virus software to protect your computer against viruses or trojan horses that may steal or manipulate your data. Certainly, you ought to keep your virus definition up to date as there are many new viruses born each day.

D) Have a spyware or adware detector too. Spyware and adware may not as deadly as the threats mentioned earlier.But they will slow down the performance of your computer and give chances to hackers to access to your data. Make it a habit to scan your computer regularly to remove these threats.

E) Firewall is essential when your computer is connected to the internet. It filters incoming and outgoing IP addresses to discard any unwanted and dangerous connection from internet.

F) Encrypt your confidential data.
Encryption is used to protect the data sent or stored from hackers who are trying to spy or manipulate the data.Whenever possible, encrypt your data , whether it is being sent or stored. Ensure that only the receiver and sender should have the key to encrypt or decrypt the data.


G) Always backup the important data. It's better to have a copy of your precious data at a secured place. Backup prevent your data from unsuspected hardware failures and natural disaster. Several ways to back up your data is by external hardisk, CD/DVD data storage, or rent an trusted online server.

H) Dispose the unwanted sensitive data properly. Deleting the files by pressing the delete button on your keyboard does not completely erase them from your computer. Clever hackers or attackers will be able to retrieve them in few seconds effortlessly.To prevent this from happening, be sure to discard the files in a proper and safe way.


There is no guarantee of total risk-free for your personal and financial data if you practices these all, but yeah, they will help ensure your electronic assets are safer. For further reading on this topic, please kindly go to the links listed below.


TOP

Review: Favourite Passwords Used Online

Posted by quatre-Ecomz comments (0)

Passwords give painful headaches to many people, especially when the person has multiple passwords for multiple programs they have subscribed to. It annoys me sometimes because the main problem with passwords is that I tend to forget them.

Thus, in the effort to not forgetting them, users will opt to simple tings which could be remembered easily forever. For example, their dog’s name, first child’s name, birth dates, special occasions date and many more – anything that will give them clue to remember what their passwords is. This is the main factors of human habit that hackers used to gain access to people’s computer system. Without resorting to any specialized tools, a hacker can discover the basic personal information needed to hack into the person’s system by trying out all the potential passwords from it.

A good password is one that cannot be easily guessed. In the blog read, it stated “For better protection, it is safer to choose a password that is longer than 8 characters with one capital letter and one symbol.” I agree to that very much. Longer password means lesser possibility for hackers to crack the password used. It is generally recommended that passwords be between 6 and 9 characters. Greater length is acceptable as long as the system or application allows it. Most important of all, passwords longer than 9 characters are encouraged if the user can remember it. In a nut shell, longer is better.

Besides that, the user can also use a password with mixed-case letters, for example AppLEpiE. This will add the security to your passwords from being hacked easily too. Good passwords can also be added punctuations, alphanumerical characters because they are hard to predict. Random selections of letters and numbers are as well very useful seeing that hackers could not foresee the possibility of that phrase would be used as a password. Moreover, passwords must also be able to be type in quickly. This is for the reason that it makes it harder for someone to steal your passwords by looking at your keyboard.

A common theme for passwords used should be easy for users to remember them. Avoid passwords that need to be written down in order to be remembered and never use short easy passwords for convenience purposes. It is a thousand NO to use real word for your passwords.



Related useful link:
> About.com - Creating Secure Passwords


om

TOP

The Threat of Online Security- How Safe Is Our Data?

Posted by quatre-Ecomz Friday, June 26, 2009 comments (1)

As technology is getting more advances, everyone can easily access to the internet by just clicking one button. When a person connects its personal computer to a network and start communicating with others, the person is facing security threat such as computer viruses, Trojan horses and spyware. Most business that has made the move towards an online presence have experienced security threat to their business since the internet is a public system which each and every transaction can be tracked, logged, monitored and stored by hackers.

Security has three main concepts: confidentiality, integrity, and availability. Confidentiality allows only authorized parties to read protected information. Integrity ensures data remains as is from the sender to the receiver. Availability ensures you have access and are authorized to resources.

Computer viruses, Trojan horses and spyware are normally hidden in the useful programs with malicious intent. Computer viruses are a piece of software code which are able to insert itself into a host and designed to threaten or modify the actions or data of the host device or system without consent. On the other hand, Trojan horses appear to be useful but actually are the mask destructive program by stealing information, altering it or cause other problems to the computer. Spyware attacks are something that we are probably all familiar with, as they are the most common online security threat faced by Internet users. This is a simple program that is designed to steal information from your computer without your knowledge.

In today e-business world, online fraud is getting more popular due to the advancement of technology. Online fraud involves Internet transaction where user uses fake identity, qualification, recommendation letter etc. Identity theft is one major form of online fraud or misrepresentation. Thieves can steal users’ information such as name, credit card numbers and back account details to commit crimes and frauds with other people identity. This is one of the reasons for which it is critical for consumers and organisations to equip themselves with appropriate computer security tools which serve to prevent such interceptions. Alternatively, data theft is a term used to describe not only the theft of information but also unauthorised glance and manipulation of private data.

Well, there are many ways to terminate our data from being distorted without our consent and authorization. There are simple and effective ways to reduce the risk to an acceptable level without spending large amount of money.

i. Spam- Is a program or software which helps us to ‘cleans’ our emails of spam and removes viruses at the same time ensuring what we receive in our mail inbox is safe and relevant.

ii. Firewalls- Is a network designed to block unauthorized access while permitting authorized communications. This is a set of device that configured permit, deny, encrypt, decrypt or proxy all (in and out) computer traffic between different security domains based upon a set of rules.

iii. Anti-Virus software- Anti virus software are used to prevent, detect and remove malware including computer viruses, worms and Trojan horses. In addition, it may also prevent and remove adware, spyware and other forms of malware. Having a superior anti virus software is very important as it can help user to prevent their information from being stolen by hacker. There are many types of anti virus software such as McAfee VirusScan and Norton Antivirus.


In a nutshell, every individual plays an important roles in maintaining own data from being abuse and embezzle in order to enhance the internet security.

Related useful link:
- Georgia Tech
- Wikipedia
- TechFAQ
- IT Online

by, melsiew


TOP

Phishing: Examples and Prevention Methods

Posted by quatre-Ecomz Wednesday, June 24, 2009 comments (0)

Phishing, in the field of computer security, is the criminal fraudulent process of attempting to acquire sensitive information such as user names, passwords and credit card details by camouflaging as a trustworthy entity in an electronic communication. It is a term which described hackers who imitate legitimate companies in emails to entice people to reveal their private and confidential information or data.

Phishing through fraudulent e-mails, will usually tells the targeted victim to verify their personal information or account details through a link provided in the e-mail sent. These e-mails will usually appear to be from a legitimate Internet address with a valid request.

Examples of Phishing
One example would be if you received an e-mail that is from your bank, requesting you to click on a hyperlink in the e-mail and verify your online banking information. There will also be a consequences stated in the e-mail for not following the link. The goal of the sender is clear and easy, which for you to disclose your personal and confidential information for their next misconduct performance. This type of e-mail scam is called PHISHING.

Another example: (adopted from chase.com)
To: Recipient
Subject: Add 50$ to your account in 2 minutes!

Dear Customer,
You are invited to take part in our nation-wide 5 question survey. Your time is very important to us so $50 will be credited to your account upon the completion of this survey.

Please note that no sensitive information will be required, collected or stored. The information will be used to further improve our services.

To take part please click here.

© 2008 JPMorgan Chase & Co.

More examples could be found from the Chase website.

There are also examples of phishing from the famous online website – eBay. One of the example was the member of eBay was told to respond to the message sent to confirm that the transaction was really void by mutual agreement. Once the respond button is clicked, the link will direct the user to an exact cloned eBay and personal information of that person will be stolen. For more examples, you may proceed to this link. It will lead you to more examples on phishing scams which occurred in eBay.

Besides phishing e-mails, there are also phishing websites. These websites will often have poor resolution, poor quality. This is because they are created with urgency manner and have a short span of life. Moreover, even if the website contains a link has a name which is familiar to you, it does not mean that it links to the real organization. Explanation from PhishTank said that you should read the URL carefully. The “https” shows a big deal. The “s” in the “https” stand for secure, which means the website is secured. If there is no “https”, you should be alarmed and alert, because the website is not secured and likely phishes. Of course, with the combination of the two factors mentioned just now. extract of the website is as follow:


Methods of Prevention
Tips on how to avoid the Internet scam known as phishing:

  • If you feel uncertain that it might be a legitimate e-mail, type the URL yourself to the Web Browser yourself. DO NOT click through the link from the E-mail received. This will provide you with accurate information about your account and allow you to completely avoid the possibility of landing on a spoof Web site and giving your information to someone you shouldn't.
  • Before submitting financial information through a Web site, look for the "lock" icon on the browser's status bar. It means your information is secure during transmission.
  • The golden rule to avoid being phished is to never ever click the links within the text of the e-mail. Always delete the e-mail immediately. Once you have deleted the e-mail then empty the trash box in your e-mail client as well. This will prevent "accidental" clicks from happening as well.
  • If you are uncertain about the information, contact the company through an address or telephone number you know to be genuine.

More on how to the details of phishing and how to prevent it, these are some very useful websites which you can learn more about Phishing:

> Watch Out for "Phishing" Emails
> Anti-Phishing Working Group (APWG)
> All About Phishing


om

TOP

Subscribe to: Posts (Atom)

nuffnang..