Reputations in Web security

I linked onto a site today

http://www.builderau.com.au/news/soa/IT-security-The-trends-to-watch-in-2009-/0,339028227,339293963,00.htm

that mentions several trends in IT Security for 2009. One item that caught my eye was "Reputation" as in Web Reputation or IP Reputation. As a grad student in Information Security we study many of the common vulnerabilities that organizations succumb to: malware, phishing and spam attacks. I really have not heard of this term "Web Reputation" before today but it makes perfect sense. If I go to my email account and see an email that claims to originate from my bank I am conditioned to immediately assume that it is spam or an attempt to steal my user id and password. I delete it.

However, if my bank really needed to send me an email for some important data they are out of luck. What if I could immediately tell from some kind of visual indicator that this email was in fact from my bank? Some kind of image next to it that gives its "reputation"? Wow, that would really be useful. And to standardize that look and feel across all of my many email accounts: Outlook at work, Outlook Web Access at work from home, Google Mail. Yahoo Mail, and my university mail? Even cooler.

Of course, it would have to be hack-proof. If you were a company that offers Web reputation solutions and a media report surfaces that mentions how your software was hacked, your company would be out of business pretty soon.

Web reputation seems to involve analyzing items about a sender and calculating a reputation score for that sender. The score can take into account sending habits and information about the URL that the sender is using. The idea is to close the gap that traditional security measures like keyword lists, signature databases and antivirus engines. Web reputation software can flag incoming data even if it doesn't end up on McAfee's latest update for example.

I Googled "Web Reputation" and found many hits on this idea. I also found that there are a lot of organizations out there who are doing this thing. Here is a small listing:

1. IronPort - http://www.ironport.com/technology/ironport_web_reputation.html
2. Secure Computing - http://www.securecomputing.com/gateway/web_reputation.cfm
3. Symantec - http://www.pdfzone.com/c/a/Content-Management/Symantec-Betas-WebReputation-Protection-Software/

Fred

First posting!

Hello!

I've always had people ask me questions about what I do for a living. "Play around with computers!" I always reply. lol. It's not bad work if you can get it - even in the post computer bust of the early 2000's.

I've built software professionally for over 10 years now and the market today is just as good as ever. Anyone can get into this business and the older generation has as just a good a chance as anyone.

There are many different types of jobs in the computer field that don't involve programming:

• Computer support
• Office skills - Microsoft Word, Excel and Powerpoint
• Graphic artists
• Quality assurance
• Security

Keep checking back on this blog for future postings on this subject and more. My goal is to get into small tutoring. My expertise and recommendations are there for motivated individuals who want a change in careers. Or high school students who don't have any ideas what to study once they get to college.

Email me at fredwi@yahoo.com for more information.