Saturday, March 15, 2008

[ISN] Don't forget to secure your BlackBerry, companies told


http://software.silicon.com/security/0,39024655,39170322,00.htm

By Natasha Lomas
Silicon.com
10 March 2008

Companies are being warned to make sure they correctly configure
BlackBerrys - or risk weakening their IT security.

Internet security consultancy company NTA Monitor says recent testing
showed that organisations are still failing to ensure the smart phone
devices are locked down.

It said the BlackBerry architecture can be insecure if no firewalls are
used to separate the BlackBerry Enterprise Server (BES) router component
from the central BES server on the internal network. If the BES is
compromised and there is no separation of the BES router, it can lead to
the whole network becoming insecure, it claims.

Roy Hills, technical director at NTA, said in a statement: "A hacker
could potentially use this back channel to move around inside an
organisation undetected."

Hills said the ideal scenario for BlackBerry security is to create a
'demilitarised zone' to separate the router component from the BES. He
explained: "If the BES router gets compromised, the demilitarised zone
will ensure that there is no direct access to the local area network."

But Scott Totzke, VP of global security at RIM, said while this
demilitarised zone may work for some BlackBerry customers it is just one
approach to securing the devices - stressing there is no
"one-size-fits-all answer" to security.

He told silicon.com: "We actually have customers who look at information
security in an even stricter sense - say no component should exist
without a firewall and actually distribute BlackBerrys amongst multiple
servers with multiple firewalls. And the good news is the documentation
support for that is readily available on our website.

"At the same time we have other customers who look at the risks and say
if I just control access to third party applications I can have maybe a
more simplified network infrastructure behind the firewall. There's not
going to be a one-size-fits-all answer here. But it's that flexibility
that allows us [BlackBerrys] to exist within whatever the existing IT
framework is for securing network systems and services that's built into
the platform."

Totzke said the BlackBerry platform includes more than 400 configurable
security policies - which gives customers the ability to mitigate their
own level of risk. He said: "Having something that is flexible and
adaptable and can be modified to suit the needs of your customer is
really important."

He added: "One of the biggest things that we've learned over the years
with our solution is that you have to balance security and usability -
if you make a product that's way too secure you're likely going to
compromise usability so we always look at how we can balance that."

NTA Monitor also recommends BlackBerry admins turn off Bluetooth
altogether. But Totzke said this is again down to the discretion of
individual customers, adding that the BlackBerry platform allows users
to enable parts of Bluetooth and disable others - which may be the most
appropriate response.

He added: "If you look at probably our largest and most paranoid
customer in North America - the United States Department of Defense -
they publish about a 125-page configuration guide for BlackBerry… That's
the extreme - but that's not going to be for everybody."



___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn


[ISN] BlackBerry servers ripe for the hacking


http://www.techworld.com/security/news/index.cfm?newsID=11663

By John E. Dunn
Techworld
10 March 2008

Many companies running BlackBerry Enterprise Server (BES) could be
inadvertently opening a door to attackers, a penetration testing company
has found.

Penetration testing consultancy NTA Monitor found that most of its
customers running the BlackBerry Server with Microsoft Exchange were
taking the path of least resistance by opening unencrypted ports from
the heart of their network to service providers. The providers, in turn,
opened a return back to the BES that would pass through firewalls
without any policies being applied.

This left the network open on several levels, including session
hijacking, IP spoofing, or just the interception of unencrypted traffic.

"A hacker could potentially use this back channel to move around inside
an organisation undetected, removing confidential information or
installing malware on to the network," said Roy Hills, NTA's technical
director.

According to NTA Monitor's technical manager, Adrian Goodhead, the open
configuration was no accident of poor implementation, accounting for a
sizeable 10-15 of the company's enterprise-level customers using
BlackBerry handhelds (roughly 70-80 percent of the total base they
surveyed). The commonest cause was simply cost.

The company recommends implementing a BES in a demilitarised zone (DMZ),
which would isolate attacks against the sever from the wider network.
However, this added complexity, and added complexity added expense.

"You have to add various software and hardware. People are trying to
keep costs down," said Goodhead.

He characterised the flaw as low-to-medium in severity because "it
requires a fair amount of knowledge" to exploit, but nevertheless one
that needed to be addressed.

Goodhead criticised the service providers for not explaining that a more
expensive implementation was usually necessary for security reasons.
BlackBerry, for its part, gave details of how to implement its
technology securely, he said, and so couldn't be blamed.

NTA Monitor, which recently found holes in VPNs, offers several general
security recommendations for clients using BES. These include using SSL
encryption, enabling content protection on the handheld, disallowing
non-approved applications – including P2P messaging – and turning off
Bluetooth on the handheld.



___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn


MacFamilyTree 5.1b5 - Genealogy application. (Demo)

MacFamilyTree 5.1b5MacFamilyTree's fifth release offers an entirely new GUI a highly modern, graphical user interface that is individually configurable to your needs.

By the use of Apple's revolutionary Core Data technology it is possible to easily sift through huge databases. These may consist of information about thousands of individuals, including digitized photographic images, sound files and movies.

To achieve this, MacFamilyTree 5 has been completely rewritten with the use of the most recent development technique.

Updates from previous versions are available for $25 (US)

More information

VueScan 8.4.63 - Software for scanners, demo now fully functional. (Demo)

VueScan 8.4.63VueScan is a scanning program that works with most high-quality flatbed and film scanners to produce scans that have excellent color fidelity and color balance. VueScan is easy to use, and has advanced features for restoring faded colors, batch scanning and other features used by professional photographers.

Why should you use VueScan?

  • Easy to use - just run VueScan, press Preview, adjust the cropping, then press Scan
  • Accurate colors - uses ICC profiles and IT8 calibration
  • Powerful - dozens of advanced options
  • Faster workflow - can edit one image while the next image is being scanned (most scanner software won't let you work with one image while another is being scanned)
  • Simple to install - installing VueScan changes nothing on your system, installs nothing in your operating system and all other scanner software will continue to function.
  • Award winning - 2002 "Best Utility", Mac Addict Magazine

The list of supported scanners is available here.

The list of supported digital camera RAW files is available here.

You can improve your Optical Character Recognition (OCR) results if you download a dictionary containing common US English, French, Dutch and UK English words. Put this file (vuedict.dat) in the same directory as the VueScan program. You can choose the language using the "Output|OCR text language" option.More information

[ISN] MTV Breach Underscores Company's Need For DLP


http://www.crn.com/security/206902848

By Stefanie Hoffman
ChannelWeb
March 10, 2008

MTV Networks might still be reeling after the leakage of 5,000
confidential files containing personal and sensitive employee
information were illegally accessed by an individual outside the
company. But experts say that the incident might prompt companies to
reevaluate data loss protection capabilities throughout their networks.

The security breach occurred when data was compromised over an Internet
connection on an employee's computer, according to a statement released
by the network Friday. An internal memo by Catherine Houser, executive
vice president of Human Resources at MTV Networks, said that the
compromised personal information included names, birth dates, Social
Security numbers and compensation data of network employees. A Reuters
report said that MTV declined to provide any further information about
the number of affected employees or the nature of the compromised
information.

MTV is currently conducting an investigation regarding the breach. While
the network notified law enforcement and a credit monitoring company to
alert and protect the identities of the affected employees, it was not
immediately clear whether the password protected files were opened or
actively exploited.

However, security experts say that this most recent breach could prompt
companies to further invest in data protection technologies.

"It underscores the need for better endpoint control and visibility of
corporate assets, that's really the bottom line here," said Mike Haro,
senior security analyst for Sophos.

Other security experts say this latest incident speaks to the fact that
many organizations have yet to implement comprehensive processes that
can monitor and regulate internal access to data and systems.

"Depending upon if it was an outsourcer, or contractor, who might have
been working for the organization, what we're seeing is that
organizations are struggling to keep up with change," said Brian Cleary,
vice president of marketing for Aveksa, an enterprise access governance
software company. "If you're using an outsourcer, you cannot outsource
your liability. If you lose customer information and employee
information, at the end of the day, you own that liability."

In order to better secure data and reduce that liability, Cleary said
that companies needed to subject their outsourcers and contractors to
the same kind of scrutiny and review as their regular employees. In
addition, companies also need to ensure that their payroll employees are
given appropriate access when roles change within a company, Cleary
said.

"The company has an obligation to make sure that these kinds of events
don't occur," said Cleary. "You can't just trust an outsourcer to fill
out an SAS 70 report. You can't count on that for having a good control
framework. That report is meaningless if there's no process behind it."

To help prevent possible identity theft or stolen credentials, MTV
strongly encouraged affected employees to place a 90-day fraud alert on
their credit files with the three major credit agencies, and offered
them complementary credit monitoring services for a period of two years.

Cleary said that companies will likely continue to be more aggressive
about implementing controls and access management policies as breaches
become more common, noting that "this continues to be on a weekly basis
a headline in the business news section."

"I think the right way to look at this is inside out," said Cleary. "Our
enterprises are somewhat porous. We outsource a lot of different
functions. We need to stop thinking just about the perimeter. How do we
protect the resource?"

"A data loss isn't just for a retailer. It can happen to everybody," he
added.


___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn


Senior PHP developer required for Helpdesk/Issue Reporting Module - oDesk

The project is to create a "Helpdesk / Issue Reporting" module. This will be used in my existing web-based PHP applications. Among them are File Tracking System, Fixed Asset Management System, Job Application and Membership Management System. Helpdesk / Issue Reporting module functionality is to provide integrated helpdesk and issue tracking. Currently, my customers request support / report bug via email and phone calls.  Even though we have prepared...

Work Load: FullTime
Estimated Duration: 1 week
Starting On: March 12, 2008
Posted On: March 12, 2008
ID: 709449
Category: Web Development > Web Applications
Skills: PHP, MySQL
Country: Malaysia
Hours Billed: 0

click to apply

Senior PHP or ASP Programmer Needed - oDesk

California based web and graphic design studio is looking for a web programmer to develop simple code for a new and upcoming website. This code must be compatible to our custom designed website. We are developing a website to promote a weight loss program for the local community. What we need is the programmer to develop a log-in/registration application. Registrants will be able to log-in and update their weight and how many pounds lost. We also would like a calculation of the total amount o...

Budget: $300.00
Starting On: March 12, 2008
Ending On:
Posted On: March 12, 2008
ID: 709445
Category: Web Development > Web Programming
Skills: PHP/MySQL, ASP.NET+ADO
Country: United States
Hours Billed: 0

click to apply

Adobe Lightroom 1.4 - Demo also available. (Updater)

Adobe Lightroom 1.4Adobe Lightroom is the efficient new way for professional photographers to import, select, develop, and showcase large volumes of digital images. So you can spend less time sorting and refining photographs, and more time actually shooting them. Its clean, elegant interface literally steps out of the way and lets you quickly view and work with the images you shot today, as well as the thousands of images that you will shoot over the course of your career. Because no two photographers work alike, Adobe Lightroom adapts to your workflow, not the other way around.

Lightroom lets you view, zoom in, and compare photographs quickly and easily. Precise, photography-specific adjustments allow you to fine tune your images while maintaining the highest level of image quality from capture through output. And best of all, it runs on most commonly used computers, even notebook computers used on location.More information

Symfony/PHP/MySQL Web Developer - oDesk

Looking for a website and web application.  Customers will come to the site to post requirements.  Vendors will sign up to be a site member and receive these requests and be able to reply with a quote through the website.  The website will mark up the price given by the vendor and present to the customer.  More details of the exact product will be given during interview and/or development. The information captured from users will include basic conta...

Work Load: FullTime
Estimated Duration: 1 week
Starting On: March 12, 2008
Posted On: March 12, 2008
ID: 709182
Category: Web Development > Web Applications
Skills: Symfony, MySQL, PHP
Country: United States
Hours Billed: 0

click to apply

Inflation And Your Retirement: A Dangerous Combination

The Danger in 'Senior' Inflation

For Aging Americans, Rising Prices Will Take an Even Bigger Toll

Worried about inflation? It may be an even bigger danger than most of us realize.

That's because the American population is aging. The Baby Boomer generation is heading into retirement. And inflation for older Americans is considerably higher than it is for the rest of the population.

This is an underappreciated topic. There isn't much research on it. People usually talk about the average inflation figure, the Consumer Price Index.

But common sense, as well as official statistics, tells the story.

Look, first, at the products where inflation in recent times has been lowest, such as high-tech gear, and clothes.

In both areas, prices are actually falling, and have been for years. Last year's computers are on sale. Even the hottest product in recent memory, the iPhone, has had its price slashed. Through January, reports the Bureau of Labor Statistics, information-technology prices fell around 6.2% on average, and apparel by 0.2%.

But these are mostly products bought by younger Americans.

Meanwhile, according to BLS data, the cost of food in the supermarket is rising by 5.7% a year. Home energy is up 5.5%. Gasoline is up 34%.

It costs 8.9% more to fly than it did a year ago. Medical services are rising by 5.7% a year, hospital services by 8.5%, home health-care and nursing-home fees by 4.5%. Funerals are up 4.8%.

Overall, this "senior" inflation is running well ahead of the official CPI, even though that just scared investors by rising at a 4.4% annual rate. The latest producer-price data, out Tuesday, added to concerns.

Falling house prices, while deflationary, actually hurt seniors as well. Many of those heading into retirement are, effectively, net sellers of real estate. Empty nesters often hope to cash out of their big family homes and move to something smaller, pocketing the difference. Via reverse mortgages, many also may want to tap into their homes' values in the years ahead.

If "senior" inflation continues to run well ahead of general inflation, it could raise two extra problems, even for those who are a long way from retirement.

The first is that tens of millions of Americans may be in even worse shape financially than they realize. We already have a savings crisis in this country. The national savings rate is on the floor, and millions of Americans are financially unprepared for retirement. Yet most of their personal retirement calculations factor in "standard" CPI estimates. Raise those numbers by a percentage point or two per year, and what looks like a savings "shortfall" by the time you reach 65 will stretch into a yawning chasm.

The second risk is that as the population ages, so this "senior" inflation figure will become closer and closer to the norm. And that would add further impetus to rising official inflation.

Plan Now For A Boomer Retirement

Lying in a hammock or perfecting the old golf game for 20 years might seem the ideal retirement to baby boomers at 3 p.m. on a hectic Wednesday, but it will likely lose its luster after a few years.

Unlike their parents, baby boomers have plenty of healthy years ahead of them once they reach 65, thanks to modern medicine. Add to that the shortage of skilled employees in the workforce, and baby boomers have the option of working through what was once considered the traditional retirement years.

Since trudging to the office until age 85 sounds horrific, the question is: What will an enjoyable and fulfilling retirement look like? In her new book, Retire Retirement: Career Strategies for the Boomer Generation, Tamara Erickson explores boomers' options and offers guidance for achieving them.

Ideally, the workplace will be flexible and boomers will work on a project basis as opposed to five days a week from 9 to 5. Or it will be a time when they can explore a second or even third career. But the key is to start planning now.

"Most people have not gotten their head around the idea of the next 20 to 30 years," says Erickson. "When you ask most people what they're going to do when they retire, most people are lucky if they can come up with a one year plan."

That's not enough. Although Retire Retirement is written for individuals, Erickson urges companies to have an equal role in figuring out the best way to put boomers, those born between 1946 and 1964, to work after age 65. Instead of fretting over the "brain drain" employers say will happen when droves of boomers retire, she tells companies to change the traditional model. And that shouldn't be beyond them; just look at how accommodating most employers are when it comes to flexible working arrangements for new parents, for instance.

Erickson recently spoke to Forbes.com about what the ideal retirement world will look like to boomers. Here is an edited transcript.

Forbes.com: What should boomers do to prepare before they reach the typical retirement?

Erickson: First, they need to ask themselves if they want to work at their existing company or branch off into something new. The reality is most companies don't have policies in place that will make it easy to stay. That's why boomers should start talking to their company five to 10 years before the typical retirement age.

Many companies suggest putting these experienced employees into mentor roles as a way to transfer their knowledge to the younger staffers. Is that an option?

I think that's ridiculous. How many advisers can any corporation have? The most attractive option is to create project work. Companies have to get a lot smarter about breaking jobs down into projects that can be done cyclically or in chunks.

So not necessarily working Monday through Friday, 9 to 5?

Right. They might work intensively for two or three months, but then they'll take a break and come back when they're needed on another project.

That sounds complicated for companies, logistically.

That's why companies need to get started today. It will take time to get these jobs into place. I can't tell you how many times companies say, "We don't have those kinds of jobs." I say, create them. Jobs that aren't naturally project-based can be chunked out into time slots.

Look at one of the hottest trends in nursing. It's having contract nurses travel to hospitals around the country and the world for periods of time. They sign up for contracts of about three months and then take time off and then they sign up again. Companies need to look at that model for their older employees who don't want to fully retire.

Have you seen examples like that in other professions?

We're starting to see signs of that in specialized science areas. There are online services where retired scientists and engineers can go to tap into projects. They work on the project and then they can sign up for something new.

What if a boomer wants to go in the other direction and start a new career?

You can't sit in a cubicle and think up something. The way to find this second path is by trying different things. If you're a few years away from making a transition, start now to experiment with your hobby, volunteer organization or some other interest. Start doing more and explore if can turn it into a commercial activity. Learn by doing.

What's the big message to boomers who are approaching age 65?

Start thinking about this early. I want people to change their assumptions. There's an assumption that old people are not welcome in the workplace. That's continuing to change. We're not our parents' generation. We have a longer period of time after retirement. Work doesn't have to be a very rigid 9 to 5 and going into the office. We assume our kids will leave us. That assumption is untrue. Boomers will continue to have warm relationships with their kids, and that will influence what they want to do later in life. We're seeing reversal of dispersion of the nuclear family. Some boomers will want to change their geographic location because they will want to follow their kids. And the work they want to do should have spontaneous flexibility to accommodate that.

This is all great to talk about, but the reality is many companies are offering buyout packages to their older, more expensive employees. Those people are then having a hard time finding work because other companies think they'll be too expensive to hire. Isn't that the harsh reality?

You see the most innovation at the ends of the spectrum. You see it in higher-skilled technical jobs and in places like Wal-Mart. We've still got this big middle which is the norm. It's an interesting question and I don't know how fast those two ends will overtake the middle.

What industries or companies are being most progressive in this area?

Aerospace and petroleum engineers tend to be progressive since they need engineers and they're highly skilled fields. Generally, though, it will happen in whatever industry experiences a talent shortage. The truth is nobody will do it unless they face necessity.

16 Ways To Save $100

16 Ways to Save $100
Simple, sensible ways to save money.
By Susan Berger

From Reader's Digest

As the government and Federal Reserve campaign to head off a recession, many families are working hard to save money and reduce debt. Credit-card debts and other loans hang over us like a sword. By saving modest amounts, however, you can reap big rewards over time. And that doesn't require clipping coupons and washing out used coffee filters. Here are easy ways you can save $100 or more this year:

1. Plug into bargain electricity.
Mickey Greenblatt was spending nearly $250 a month on electricity for his home in Potomac, Md. When the retired executive called his utility company to find out why his bills were so high, the company offered to do a free home-energy audit. Greenblatt learned that simple things such as running his dishwasher at night rather than during the day could cut his bill by 40 percent. Taking advantage of such options as off-peak rates can save most consumers $100 a year.

Savings are also possible under "load management" programs. You get discounts for allowing your utility company to put a device on your water heater and air conditioner that switches them off briefly during periods of high demand.

2. Hit the brakes on automobile-insurance rates.
You can save substantially by increasing the deductibles on the comprehensive and collision portions of your policy. According to the Insurance Information Institute, raising collision deductibles from $200 to $500 could reduce your collision and comprehensive coverage by 15-30 percent. Squeeze out additional savings by asking about every possible discount, such as for carpooling, air bags, annual mileage below 10,000 miles -- even for teenage drivers with grade averages above a B.

3. Challenge your property tax.
Ruth Rejnis, author of Squeeze Your Home for Cash, recommends going to your local assessor's office and finding out what property taxes your neighbors are paying. If your house is similar but your taxes are higher, you may want to challenge your bill. Also, read the description of your home. Errors in square footage or the number of bathrooms could mean an overcharge. The assessor's office or local board of tax review can tell you how to file an appeal.

4. Shop for a bargain bank.
Look for free checking and no ATM fees. Also, if you have direct deposit of your paycheck, your bank might waive its monthly fee.

5. Remedy pricey prescriptions.
Cut your bills in half by buying generic drugs instead of name brands. Also, buy your prescriptions via mail order through a drugstore chain or your company health plan.

6. Pay off your plastic.
If you carry a credit-card balance from month to month, pay it back pronto. A $1000 balance at 18 percent blows nearly $200 a year in interest. If you can't pay it off in full, transfer your debt to a lower-rate card.

7. Say no to car extras.
Your car dealer may sell rustproofing and fabric protection at $100 a pop, and paint protection for as much as $250. "Usually these extras are the dealer's way to squeeze more money out of you," says Bob Elliston, author of What Car Dealers Won't Tell You. Do-it-yourself fabric protector costs about $10 a bottle. Paint protection is unnecessary, since most cars have many layers of paint. And skip rustproofing: cars come already treated so that they won't need it.

8. Take a longer waiting period for disability insurance.
If you can't work, disability insurance pays your living expenses. Many employers offer this. But if you must buy your own, accept the longest waiting period before benefits kick in -- as long as you can cover those expenses, suggests Shelly Branch, author of Dollar Pinching: A Consumer's Guide to Smart Spending. A healthy male carpenter earning $40,000 annually could pay up to $1800 a year for a policy with a 30-day wait. With a 90-day wait it could cost $800 to $1100.

9. Cancel mortgage insurance.
When you buy a house with less than 20 percent down, your lender may insist you buy private mortgage insurance (PMI) to protect against default. The average cost of this insurance is $45 a month, or $540 a year. However, once you have 20-percent equity (either because you've paid down your mortgage or because area property values have risen), you may be allowed to cancel the PMI.

10. Explore DRIPs.
If you buy stock, you can save on brokerage commissions by enrolling in a dividend reinvestment plan (DRIP). Offered by more than 900 companies, DRIPs allow shareholders to buy stock directly. You may have to be a shareholder of record, however, so find out if you'll need to use a broker to buy your first few shares. Then enroll in the DRIP.

11. Buy straight from the Treasury.
Another way to bypass brokers and save money on fees is to buy Treasury notes, bills or bonds directly. The minimum investment is $1000 for bonds and for notes with maturities between five and ten years, $5000 for notes with shorter maturities and $10,000 for bills. Ask the nearest branch of the Federal Reserve Bank for an application for a Treasury Direct account.

12. Clean out your closet.
When you deduct charitable donations of clothing at tax time, do you just guess $100? William Lewis, author of Cash for Your Used Clothing, says most people underestimate the worth of such items.

Before you donate, price each item against similar ones sold at the store where you drop them off. If you're in a 28-percent tax bracket, a donation worth $400 will earn you a tax deduction of at least $112.

13. Skip the service contract.
Extended warranties on electronics are rarely a good deal. According to Tom Garman, a Virginia Tech professor of consumer affairs, most product breakdowns occur in the first year and are covered by the manufacturer's warranty.

14. Flex your company's flexible spending account.
These accounts allow you to set aside part of your pretax salary for dependent-care costs and unreimbursed medical expenses. You decide at the beginning of the year how much money you want to set aside in the account. The downside is that if you don't use all the money, you lose it. However, if you're in the 28-percent tax bracket and allocate $500 to cover your health-insurance deductible, you'll cut taxes by $140.

15. Buy in bulk.
Items you may use a lot, such as paper towels and diapers, are often far cheaper when you buy in quantity. For example, Alan and Denise Fields, co-authors of Baby Bargains, say new parents buy an average of 2400 disposable diapers in their baby's first year alone. Diapers that cost 20 cents apiece in the packages sold at grocery shops and drugstores might go for 15 cents when bought in bulk at a discount store or warehouse club. Just a nickel a diaper could add up to an annual savings of $120.

16. Rethink your vacations.
"Homestay" programs offer free lodging all over the world to travelers who are themselves willing to host other members in their homes. Some groups charge an annual membership fee, but your savings can easily be worth more than a hundred dollars a day.

More On Saving Money

Reduce Your Income Taxes

Itemize Deductions
Part of sound financial planning is ensuring that you don't pay more taxes than necessary, which means you need to have at least a basic understanding of itemized deductions, even if an accountant prepares your taxes. It's especially important if you prepare your own taxes.

What Is Itemizing?


Each year when you file your income tax return, you have to choose between using the standard deduction (a flat amount) or claiming your actual allowed deductions, called itemizing. If your actual expenses exceed the standard deduction, you'll save money by itemizing.

What's the Difference Between the Standard Deduction and Exemptions?


The standard deduction is a flat amount that you deduct from your taxable income if you don't itemize, and shouldn't be confused with exemptions, which you're entitled to whether you itemize or not (unless your income exceeds certain limits).

Either way, for 2007 you get a $3,400 personal exemption for yourself, $3,400 for your spouse, and up to $3,400 for each person you can claim as a dependent. Personal exemptions are phased out at certain income levels. See Publication 501 for details.

If you don't itemize, the standard deduction for tax year 2007 is as follows:

* $5,350 if you file as single
* $7,850 if you file as Head of Household
* $10,700 if you're married filing jointly or are a qualifying widow(er)
* $5,350 if you're married filing separately

You're entitled to an additional deduction, depending on your filing status, if you're over age 65 or legally blind (see Form 1040). If you can be claimed as a dependent on someone else's return, your standard deduction may be limited.

Should I Itemize or Take the Standard Deduction?


To determine if you have enough deductions to itemize, use Schedule A (included with the long version of Form 1040) to list all of your allowable expenses, and compare the total to the standard deduction for your filing status. If your allowable expenses are more than the standard deduction, you can itemize.

Over the years, the number of allowable deductions has been shrinking, so it's increasingly difficult to itemize. Mortgage interest is the major allowable deduction for most people, and unless you have a very small mortgage, you probably paid enough interest to put you over the standard deduction and make it possible for you to itemize.

What Expenses Are Allowable Deductions If I Itemize?

Some of the most common allowable expenses include:

* State and local income taxes
* Real estate taxes (if your taxes include service fees for things like trash pickup, recycling, etc., only the portion related to the value of your property is deductible)
* State and local personal property taxes based on the value of personal property such as cars or boats
* Mortgage interest
* Charitable contributions
* Medical expenses (but only if they exceed 7.5% of your Adjusted Gross Income

Get The 2007 Tax Refund You Deserve

Uncle Sam cuts you a deal on mortgage insurance, college bills and retirement savings

Procrastinators, rejoice! You don't have to feel quite so guilty if you get a late start on your income taxes this year. Thanks to Congress's tardiness in passing tax legislation, the IRS couldn't begin to process some returns until mid February -- about a month later than usual. Unfortunately, that delay will also postpone refunds for millions of taxpayers who usually file simple returns early in the season.

But if your tax situation is complicated, you probably won't even notice the slowdown. You may be waiting for the stragglers among your 1099s to arrive from brokers, mutual funds and IRA sponsors. By the time you've gathered all of your paperwork, the IRS backlog should be cleared out. At least, that's the plan.

The stealth tax

Why the holdup? Blame it on the alternative minimum tax. Congress created the AMT back in 1969 to ensure that 155 wealthy Americans paid their fair share of taxes. But the tax was never indexed to inflation. Lately, it's been entrapping millions of unsuspecting taxpayers -- mainly upper-middle-income Americans with big families and fat state write-offs.

That's because this parallel tax system requires you to figure your taxes twice. First you calculate your taxes under the regular rules, claiming all your allowable credits and deductions. Then you do it again under the AMT rules, which don't allow many of those adjustments. You owe whichever tax is higher (the table on page 61 shows which taxpayers are most likely to pay the AMT). Although the AMT taxes more of your income, it does so at a rate of 26% or 28%. So wealthy taxpayers in the 33% and 35% tax brackets are often unaffected by the AMT.

Last year, the AMT snared four million people, whose tax bills increased by an average of about $2,000. Without congressional intervention, another 20 million taxpayers would have been hit by the AMT when they filed their 2007 tax returns this spring. After prolonged squabbling, Congress finally approved a one-year patch that boosted AMT-exemption amounts slightly above 2006 levels to prevent the expansion of this stealth tax.

That means that if you didn't pay the AMT in 2006, you're probably safe for 2007. But if you paid the AMT in 2006, and your financial situation is essentially unchanged, you can expect to pay it again in 2007.

Ironically, many people affected by this season's delay won't be paying the AMT. They file certain tax forms that can't be processed until the IRS reprograms its computers to reflect the AMT change. For example, if you claim the Hope or Lifetime Learning credit for college tuition -- which is available only to individuals whose income is less than $57,000 and to married couples with incomes less than $114,000 -- mid February is the earliest you can file your tax return.

The delay also applies to taxpayers with incomes less than $100,000 who claim child-care or elder-care credits on the 1040A form. (They can skip around the delay and claim the credit, though, by filing a standard 1040.) Also affected: anyone, regardless of income, who claims a tax credit for installing energy-efficient windows and doors. In either case, if you try to file your return electronically too early, it will be rejected. Paper returns mailed too soon will languish in the to-be-processed pile.

Filing made easy

If you are still filing a paper tax return, this may be a good year to switch to electronic preparation and filing to reduce errors and speed your refund. With direct deposit, you can expect your refund in as little as ten days, the IRS says, compared with four to six weeks in the case of a paper return. If you buy tax-preparation software in a box (such as TurboTax, which includes tax advice from Kiplinger's), download all the latest updates to ensure that you are using the correct forms. If you use the online versions, the programs are updated automatically.

If your adjusted gross income is $54,000 or less (as it is for 97 million taxpayers), you can prepare and electronically file your federal tax return free (go to www.irs.gov and click on "Free File" for details).

When it comes to filing tax returns, the majority of Americans take the easy route. Only 35% of us itemize our deductions; the rest claim the standard deduction. For 2007, that's $5,350 for individuals, $7,850 for heads of households, and $10,700 for married couples filing jointly, all up slightly from 2006.

But don't let habit (or just plain laziness) cost you money. If you bought your first home in 2007, that could be the trigger that makes itemizing make sense. You can deduct your mortgage interest and property taxes, which, along with state income or sales taxes and charitable contributions, may push your total write-offs over the standard deduction.

If you had a baby or adopted a child, you can claim a $1,000-per-child tax credit for each child under 17 whether you itemize or not.

If you turned 65 in 2007, you may benefit by switching from itemizing to taking the standard deduction -- particularly if your mortgage is paid off -- because you are now entitled to a larger standard deduction than younger taxpayers.

And if you have paid the AMT in the past but recently became an empty nester, losing the $3,400 personal exemption for your former dependent might be enough to slip you back into regular-tax territory, says Donna Cocovinis, a tax lawyer and contributing editor to J.K. Lasser's Your Income Tax Guide series.

If you itemize, you need to know about a tough new rule for charitable contributions: You now need documentation -- in the form of a bank record, credit-card statement or acknowledgment from the charity noting the date, amount and recipient -- for every contribution you deduct.

Breaks for homeowners

If you bought a house last year and made a down payment of less than 20%, you are probably paying for mortgage insurance. If your income is $100,000 or less, you can now deduct all of your private mortgage insurance, or mortgage insurance that you purchase through the Veterans Administration, Federal Housing Administration or Rural Housing Administration. (The IRS added a line to the Form 1098 from your lender to show how much mortgage insurance you paid in 2007.) The deduction phases out completely once your AGI tops $110,000.

Some homeowners affected by the subprime-mortgage mess will also benefit from new tax relief. Ordinarily, if you lose your home to foreclosure or your lender forgives some of your mortgage debt, that debt relief is considered taxable income. For example, if a bank forecloses when you owe $400,000 on your home and then sells the property for $310,000 in full satisfaction of the debt, you would normally owe tax on the $90,000 difference. Ouch!

But a new law excludes up to $2 million of forgiven indebtedness from taxes, if the debt is secured by a principal residence and if the money was used to buy, build or substantially improve your home. The exclusion does not apply to second homes or vacation property, or to home-equity debt resulting from cash-out refinancing. The relief is temporary and applies only to debts that are eliminated in 2007, 2008 and 2009.

Also new in 2007: relief for taxpayers who paid the AMT in 2003 or earlier because they exercised options on company stock that later lost value. As a result, they were taxed on gains they never realized, and received AMT credits they could never fully recover under old tax rules. Starting in 2007, these taxpayers can claim a refund of $5,000 or 20% of their unused AMT credit, whichever is greater. The refundable AMT credit is phased out for taxpayers with incomes of more than $278,900 for individuals and $357,100 for married couples.

Trim tuition costs

Thanks to inflation adjustments, some education tax breaks now have slightly more generous income-eligibility levels. Individuals with incomes up to $57,000, and married couples with incomes up to $114,000, can claim some or all of the Hope credit for first- and second-year college students, which is worth up to $1,650 per student. The same income limits apply to the Lifetime Learning credit for any postÐhigh school education. That credit is worth up to $2,000 per tax return.

A tax credit is more valuable than a deduction; it reduces your tax bill dollar for dollar compared with a deduction, which merely reduces the amount of income subject to tax. Still, if you earn too much to qualify for education tax credits, you can benefit by deducting $4,000 of college tuition if your income is $130,000 or less on a joint return ($65,000 for others), or $2,000 if your joint income is between $130,001 and $160,000 ($65,001 to $80,000 for others).

But wait, there's more. If you are single and your income is $70,000 or less, or married with a joint income of $140,000 or less, you can also deduct up to $2,500 of student-loan interest for yourself, your spouse or your dependent. And you can take the deduction regardless of whether you itemize.

Even if your income is too high to qualify, you can pay back the student loan on behalf of your child. The IRS will treat it as though you gave the money to your child, who then paid the debt and can claim the tax break, says Bob Scharin, senior tax analyst with Thomson Tax & Accounting.

Bear in mind that if your child takes the deduction, you can't claim him or her as a dependent. But this strategy makes even more sense if you're subject to the AMT, because you lose the dependent deduction anyway.

If you used savings bonds to pay for college expenses, the interest is tax-free if your income doesn't exceed certain thresholds. For married couples, the exclusion begins to phase out above $98,400 and disappears when your income reaches $128,400. For other taxpayers, the interest exclusion is available to those with incomes of $65,500 or less and disappears once your income hits $80,600.

Teachers and aides can deduct up to $250 of out-of-pocket expenses for classroom supplies, regardless of their income or whether they itemize deductions.

Deduct sales taxes?

In 2007, taxpayers who itemize get another chance to choose between deducting state income taxes or state and local sales taxes on their federal returns. In most cases, going the income-tax route will result in a bigger deduction. But for residents of states such as Florida, Nevada, Texas and Washington, which have no income tax, the sales-tax deduction is an easy choice.

If you elect the sales-tax deduction, you have two options: Add up the tax on all of your receipts throughout the year, or use the IRS's sales-tax tables or online calculator for your state, family size and income level. Either way, you can tack on the sales tax for major expenses, such as a car, boat or mobile home.

But the sales-tax deduction is easy to overlook. Last year, more than two million taxpayers who were eligible to deduct their state and local sales taxes didn't, missing out on more than $3.5 billion in potential tax breaks.

Blake Young is a self-confessed fanatic about keeping records, and it's paying off. Young, who lives in Bellaire, Tex., racked up roughly $10,000 in sales-tax payments for 2007, thanks in part to the purchase of a new Mercedes and jewelry for his wife, Mindy. That compares with just $3,100 the IRS sales-tax tables say he could deduct based on his situation: a family of four with more than $200,000 in income. "The trick is to be diligent about collecting receipts throughout the year," says Young. His diligence allowed him to claim $5,000 in general sales taxes, plus an additional $5,000 for the car.

In Young's 35% tax bracket, the $10,000 sales-tax deduction could trim $3,500 from his tax bill. But there's a catch: High earners such as Young lose part of their itemized deductions when their income exceeds certain thresholds. (If you're subject to the AMT, which Young is not, you lose the state and local sales-tax deduction altogether.)

If your 2007 adjusted gross income exceeds $156,400, regardless of whether you are married or single, your deductions will be reduced by 2% of the amount by which your AGI exceeds the trigger point. Let's say, for example, that your AGI is $200,000. Your itemized deductions would be reduced by $872 (2% of the $43,600 in income that tops $156,400). If you are single with an AGI of more than $156,400, or married with a combined income of $234,600 or more, you also lose a portion of the personal exemptions that you claim for yourself, your spouse and your dependents. Normally those are worth $3,400 each.

More ways to save

There's still time to trim your 2007 taxes by contributing to a tax-deductible IRA. You can contribute up to $4,000 (or $5,000 if you're 50 or older) until the time you file your tax return, but no later than April 15. And for 2007 you can earn more than in 2006 and still deduct your IRA contributions.

Even if you participate in a retirement plan at work, you can deduct some or all of your IRA contributions if you are married and your joint income is $103,000 or less, or if you are single and your income is $62,000 or less. If you don't participate in a workplace-based retirement plan but your spouse does, you can deduct some or all of your IRA contributions as long as your joint income doesn't exceed $166,000.

In addition, lower-income taxpayers, such as young workers and retirees who work part-time, can reduce their tax bill or increase their refund by claiming the retirement savers tax credit. This tax credit, which has been made permanent, is worth up to $1,000 when you contribute $2,000 to a traditional or Roth IRA, 401(k) or other workplace-based retirement plan. To claim the credit, you must be at least 18 years old and not a student, and you cannot be claimed as a dependent by anyone else. You are eligible if you are single with an income of $26,000 or less; head of a household with an income of $39,000 or less; or married filing jointly with an income of $52,000 or less.

Retirees who donated some or all of their 2007 IRA distribution to charity can exclude the donated amount from their adjusted gross income. Although you can't claim the contribution as a charitable deduction, your lower income may mean that the taxes you pay on your Social Security benefits will be reduced. Or it may be easier for you to qualify for other tax breaks, such as deducting medical expenses that exceed 7.5% of your AGI. When calculating your medical expenses, don't forget to include your Medicare Part D premiums for prescription-drug coverage.

Target-date Funds: How They're Faring In A Down Market

Investments for Individuals in or Near Retirement Lost Less Than S&P 500 Index

While the gyrating stock market may have scrambled some retirement nest eggs, holdings in near-term target-date funds have emerged relatively uncracked.



Target-date funds for those in or near retirement -- those structured for people retiring between 2005 and 2010 -- have lost less than the Standard & Poor's 500-stock index, according to Morningstar Inc. The average total return among these funds was a decline of 4.8% from Oct. 1 through Feb. 20, compared with a decline of 10.2% for the S&P 500, including dividends.

Although that is a good relative return, any decline can be unnerving, especially if the investor has already exited from the work force and is relying on savings for income. While not perfect, staying in a target-date fund is a good choice for many investors, especially those who don't have the time, knowledge or professional help to build a diversified portfolio.

One advantage to the funds is that they stay invested in stocks throughout retirement, something even the most risk-averse investor shouldn't avoid. That is because most investors need to continue to build their portfolios in retirement.

"The growth of capital is as important as the preservation of capital," says Gary Terpening, a product manager with Seligman Advisors Inc., an affiliate of New York-based J. & W. Seligman & Co.

Target-date funds, which first began to appear in the 1990s, offer a diversified portfolio that automatically adjusts as investors age, taking less risk as they approach and enter retirement by moving into cash and bonds. They were designed for the disengaged investor but have grown in popularity. There are now close to 40 companies offering 260 individual funds.

"A lot of people will eventually use this type of product for retirement needs," says Tom Roseen, a senior research analyst at Lipper Inc. He says that investors may be able to get better returns if they select their own mutual funds, but most don't know how to create well-diversified portfolios.

Participation in target-date funds is expected to increase because a growing number of employers are opting to automatically enroll workers into 401(k) plans with a default option of a target-date fund, says Clare Bergquist, director of 401(k) strategies at Charles Schwab Corp.

Investment in the market always entails volatility. But target-date funds vary significantly in how much they move in reaction to the market's swings, according to Tom Idzorek, director of research and product development at Ibbotson Associates.

For example, some funds for retirees have as much as 70% in stocks while others have less than 40%. "Different people have different tolerance to risk," he says. "Some of us are comfortable with volatility and some are not."

Mr. Idzorek expects the number of funds to grow and the funds to become even more individualized. The downside is that it could make the funds more complicated. He says investors should consider not only risk tolerance but also what else they have in their portfolios. For example, he says, investors could pick a more aggressive target-date fund if they expect to receive a pension during retirement.

Jeff Tyler, a senior portfolio manager at American Century Investments, says its income portfolio funds have 45% in stocks. "Maybe you won't be the richest kid on the block, but you won't be the poorest either, and you're much more likely to reach your target," he says.

Mr. Idzorek does, however, note one problem with target-date funds: Investors may set it, forget it and not know until it is too late whether they have saved enough for retirement. He advises not to leave the workplace without running the numbers.

Bottom line: With volatility looking as though it may stay awhile, target-date funds can bring some measure of stability.

How To Choose Suitable Home Loans

When we decision to sign a contract for the sale, we should start looking for mortgage companies to get loans in accordance with contracts on time transactions, the purchase of the entire housing process to be completed. In your application for housing loans, we must first understand the current market individual banks which products to choose from, according to their own situation to determine which loans, which are a lot of knowledge. Most choose 15, 30 fixed interest rate, or five or seven years of the 30 fixed loan amount. In fact there are dozens of projects for which loans are available, more importantly, the majority of people do not understand there are more and better and the majority of mainstream American society by the project. Below me to introduce them loans:

(A) fixed-rate loans

Fixed-rate loans are locked necessarily mean life remain unchanged, there are usually 10, 15, 30 years and 40 (less), 10 and 15 years APR 20 and 30 years APR basically the same, because they bond with the same period . If higher income and stability, orientation 15, or 30 years. 15 of the 30 low interest rates than 0.5% to 0.75%, but because the relationship between the short period, the monthly payment higher.

( Adjustable rate loans

Adjustable rate loans to 30 years for the loans, the interest rate fixed a certain period of time, and then adjust according to the prevailing market. Adjustable Rate often 3 / 1 ARM, 5 / 1 ARM, 7 / 1 ARM and 10 / 1 ARM, and so on, and five years respectively for three years ? ? fixed seven years and 10 years, and then adjusted once a year. The recent: 5 / 1 ARM Interest only is a very good project, it is 5 / 1 ARM, but the main interest can be paid monthly, pay more money can be automatically reduce the principal, and interest rates than the 5 / 1 ARM, lower is recommended. As in the United States for the frequent moving, a lot of people are willing to choose five or seven years ARM. Because the many state does not allow any prepay penalty, so the money could be paid loans.

© Special loan

Housing loan applications are usually ordinary type (Conventional), there are still some special loans, as the Chinese community rarely used, it refers only to this.

1 FHA loans: Federal Housing Agency-financed loans, targeted at the low-income families apply for the loan; the federal government provides subsidies, generally reflected in the interest rate, the preferential interest rate of 1%. The high average household income, and their loans will be limited, very few people able to meet this standard.

2 VA loans: Veteran Agency subsidized housing loans for veterans, some pine for the terms and conditions, but the interest rate is not much different. 3lot and construction loans: loans for the purchase of that land and build their own house. There are many requirements of such a loan, for instance, the first phase of the requirements of more than 30%, to 2 to 3 years in building houses, or houses to be completed in two years, the interest rate is usually higher than ordinary loans 0.75% ~ 1%, and commercial loans are basically the same.

4 The average interest rates on adjustable loans: MTA (Monthly Treasury Average), also known as Option ARM. MTA loans compared with a lot of other characteristics:

1, low initial interest rates, usually 1%
2, the monthly ? ? every three months or every six months adjusted annual rate
3, the interest rate from the previous 11, the average interest rate decision.
4, have the highest interest rate adjustment restrictions (? 9.95%);
5, per month in five different form of payment options:
a. pay a minimum amount; b. pay interest only; c. 5 / 1 ARM; d. 30 fixed ; 15 years fixed.
6, next year should not exceed the minimum amount of the previous year's 7.5%
7, interest can be deferred for up to 12 months without penalty;
8, all interest can be tax-deductible;
9, as low interest rates and low monthly payments , the first phase, requires less the same circumstances can be more amount of the loan;
10, no credit demand, which poor people credit is particularly appropriate.

The aforementioned characteristics of a recent MTA is the most popular loan
product, which is why Americans more than 50% of the population use the loans
because of this. As far as the real estate broker, they are enthusiastic about MTA,
because they can sell even big house to buyer.

(D) housing loans star - MTA (Option ARM)

MTA is Monthly Treasury Average, also known as Option ARM, can be transferred, the
average rate loans. For the mainstream American society in housing loans, more than
60 percent of the population using MTA. Here to explain all this in detail.

(a) Basic terms

Deferred Interest: If you choose to meet the minimum monthly payments on the interest, the remaining interest will be added to the principal, this would lead to "Negative Amortization."

Fully Indexed Rate: ARM loans with interest rates Margin Index are calculated.

Index: ARM is used to calculate the interest rate adjustment of the economic indicators, usually with the Federal Rate equal to or close.

Introductory Period: Option ARM and Home Equity loans, the lending bank to customer

concessionary period, during this period of time the interest rate will be very low (like when you apply for new credit card ).

Lifetime Interest Rate Cap: ARM loans in the entire course of the loan ceiling for the maximum, usually the existing interest rates +5%.

Margin: lending rate minus the margin Index (Spread), Margin of them is fixed, usually at 2.75 percent.

Negative Amortization: As Deferred Interest, the loan repayment period to table shows the principal will continue to grow.

Payment Change Cap: Monthly loans to the largest percentage of the annual, for example, in 2008 $ 1,000 / month, if the 7% Cap, 2008 should be ? (1000 × N $ 1070/ month).

Recast: Option ARM loans based on interest rates and the remaining unpaid principal amount of years to re-calculate the minimum monthly payments, generally every five years, or more than the initial loan principal amount of 125% (110% NY) will be recast.

Stact Rate: Introductory Period interest rates.

( the basic characteristics of MTA

Option ARM compared with other loans, there are many features:
1, the only super-low interest rates, usually 1% -1.75%;
2, every 12 months adjusted interest rates;
3, and its interest rates from the first 11 months of 20 points in 10 Margin to decide, is always lower than the Prime Rate;
4, the highest interest rate adjustment restrictions (? 9.95%);
5, a monthly five different payment methods available (see below);
6, next year's minimum monthly payments should not exceed the previous year's 7.5%;
7, deferred interest (Interest Deferred) can be up to 12 months without penalty;
8, check-free income, free check deposits as the interest rate of loan applications;
9, all the interest may be tax deductible;
10, no credit requirements;
11, and requires minimal down payment, monthly payments low, under the same conditions can be more amount of the loan.

© The MTA monthly payment option
MTA As mentioned above, there are many advantages, there are different monthlypayment methods to choose from:

1, the minimum amount of pay;
2, interest only;
3 by 5 / 1 ARM pay;
4, the interest rate on 30-year fixed pay;
5, by 15 to pay a fixed rate of interest.

(E) How to apply for refinance loans

When you do refinance, the existing loan is usually paid (Payoff) and the re-signing of a new loan, the new loan may or may not from original bank (Lender).

(a) The purpose of refinancing Refinance said there are three objectives:
1, lower loan rates and / or change the loan period (Rate / Term);
2, cash for its use (Cash Out);
3, removed Loan Insurance (Mortgage insurance).

( The timing of new loans
When the home loan interest rates for low-level, there will be the wave of refinancing, many people for the purpose of lowering interest rates to reduce the monthly payment, or to change from the 30 years of loans to 15 or 10 loans, or adjustable interest rates loans into fixed interest rate, or vice versa. If it is cash out for business investment, or for their children's education or other paid high interest debt such as credit cards, and so on, select the time not so calmly.
To know that the interest rate of housing loans to the general difficult, but in order to know that short period of time (1-2 days) direction, it is necessary to analyze the market dynamics.

© To reconsider the choice of loans
When you re-apply for loans, we must first decide whether or not to pay Closing Cost, if you think that interest rates really low, and your will continue to live a fairly long period of time (3-4 years), then choose to pay the Cost cost-effective, because you will henceforth save the contrary, if you think that interest rates will decline, and also re-No Cost lending opportunities, or will be moving within three years, you will have to calculate how much use the money saved time you pay to offset the Cost. Calculation methods can refer to the table below.

Generally speaking, the Closing Cost broadly equivalent to 1% of the loan amount,large loans <1%, while loans for small> 1%. Of course, when re-choice No Cost loans, the interest rates it should pay Cost higher than 0.25%, equivalent to selling point (1% loan to buy a 0.25% interest rate).

(d) The application procedures for the refinance
Refinance loans VS the purchase of home loans much simpler, but also on loan applications is FullDoc, or NoDoc LowDoc.

1, 2-Pay Checks
2, 2-years W-2
3, 2-monthy Bank Statement
4, Deed (& HUD-1)
5, Drive License

If it is in the same bank (Lender) , for refinance there is no need to provide documents.

[ISN] NSA extends access control to network storage


http://www.gcn.com/online/vol1_no1/45944-1.html

By Joab Jackson
GCN.com
03/10/08

PHILADELPHIA — The National Security Agency is leading an effort to
extend its access control work into the arena of network file storage.
The effort involves integrating NSA's Flask mandatory access control
(MAC) architecture — now the basis of Security-Enhanced Linux (SELinux)
— into the Network File System (NFS) protocol widely used for
network-attached storage devices.

David Quigley of NSA's National Information Assurance Research
Laboratory presented the latest work on the project, called Labeled NFS
at the 71st meeting of the Internet Engineering Task Force this week in
Philadelphia. IETF currently oversees the NFS protocol.

NSA initiated and led the effort to develop SELinux, an implementation
of NSA's Flask MAC architecture for Linux. With MAC, programs and users
are assigned attributes such as security levels. Whenever a program
spawns a process thread or calls a file, the attributes are checked
against the organization's authorization rules.

By deploying MAC, organizations can ensure that machine intruders don't
hijack programs to execute malicious tasks, and they can prevent
employees from accessing documents they don't have permission to view.

Labeled NFS extends those features across the network. By having NFS
handle MAC labels, someone using a trusted computer can read and write
files and execute programs that reside on NFS-based network storage.
Today, the Flask architecture requires that all programs and files be
stored locally.

Labeled NFS can work in smart mode, which allows the file server to make
access control decisions, or dumb mode, which means it takes
instructions from the client machine.

James Morris, principal software engineer at Red Hat, published the
first recommendation for this approach, originally called Security
Enhanced NFS, last summer. The company incorporates SELinux into its Red
Hat Enterprise Linux operating system.

In addition to SELinux, Labeled NFS could also support Solaris Trusted
Extensions, TrustedBSD and Security Enhanced Darwin, a MAC-enhanced
version of the Apple operating system.



___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn


[ISN] Cutting-edge PDP Tech Leaked to Chinese Firm


http://english.donga.com/srv/service.php3?bicode=040000&biid=2008030681038

dongA.com
March 06, 2008

A new plasma display panel technology developed by LG Electronics has
been leaked to a Chinese company, dealing a loss of one trillion won, or
more than one billion dollars, to the Korean economy.

Seoul prosecutors indicted yesterday a former LG manager for corporate
espionage. The 49-year-old man, identified only by his last name Jeong,
allegedly leaked the new technology to Changhong-Orion PDP-Chaihong of
China.

Two other LG employees also face charges of corporate espionage.

Sources said Jeong copied 1,182 files on his portable hard disk in July
2005 just before leaving LG. The files contained key pieces of the PDP
technology, including information on equipment arrangement and setup in
the plant and what types of equipment were used.

The Chinese company hired Jeong in February last year, giving him an
annual salary of 300,000 dollars, an apartment and a vehicle. In return,
he handed over secret information on LG.

Between March and September last year, the other two suspects
collaborated with Jeong and provided him with sensitive information via
e-mail and CD-ROM on the plants power structure and construction
blueprints. Upon receipt, Jeong gave the information to the Chinese
company.

In February last year, Jeong moved to Szechuan, where the Chinese
company was building a plant, to consult on technical matters.

He dropped by Korea to visit his family this year, and was arrested Jan.
19, three days prior to his scheduled return to China to help
Changhong-Orion PDP-Chaihong install production equipment.

The technology Jeong sold can dramatically improve PDP production,
enabling the taking of eight panels from a single glass. LG Electronics
has been producing plasma panels with the new technology since July last
year, and is only the third company to have it along with Samsung SDI
and Matsushita of Japan.

Changhong-Orion PDP-Chaihong was formed after Changhong Electric of
China bought Orion PDP of Korea in 2006 to acquire PDP technology. The
Chinese company will start making plasma panels from this December with
the LG technology that it bought from Jeong.

Copyright 2002 donga.com. All rights reserved.


___________________________________________________
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn