Netsky causing billions in damages - News - ZDNet:
"Despite requiring the computer user to actively run an attachment, Netsky.C seems to be spreading fast, with anti-virus vendor Central Command claiming it had discovered 1,500 infections of the virus within 40 minutes of its discovery. Like Netsky.B the latest virus uses its own SMTP engine to e-mail itself to addresses found on the computer, and copies itself into any folder it finds whose name includes 'shar'. "

UK security company mi2g estimated the economic damage done by Netsky.B worldwide to be at least US$3.12 billion. This was calculated "on the basis of helpdesk support costs, overtime payments, contingency outsourcing, loss of business, bandwidth clogging, productivity erosion, management time reallocation, cost of recovery, and software upgrades".…

http://zdnet.com.com/2100-1105_2-5165642.html

Caller ID for E-Mail Technical Specification:
"'Caller ID for E-Mail: The Next Step to Deterring Spam' is the Microsoft draft specification to address the widespread problem of domain spoofing. Domain spoofing refers specifically to the use of someone else's domain name when sending a message, and is part of the larger spoofing problem, the practice of forging the sender's address on e-mail messages.

Caller ID for e-mail would verify that each e-mail message originates from the Internet domain it claims to come from. Eliminating domain spoofing will help legitimate senders protect their domain names and reputations, and help recipients more effectively identify and filter junk e-mail."

http://www.microsoft.com/mscorp/twc/privacy/spam_callerid.mspx

Fresh Worms Attack E-Mail, Internet Explorer, User Data:
"A series of new worms spread on the Internet on Wednesday, spreading through conventional e-mail methods. The new versions have escalated their attacks and destructiveness. "

On the prowl is MyDoom.F worm, which began action on Monday. It is the latest version one of most successful worms on record; earlier MyDoom variants in January launched a series of distributed denial of service attacks (DDoS) against Microsoft Corp. and The SCO Group. The new version retains its predecessors' capability to perform a DDoS attack.

"What is interesting about these latest worm trends is that they are very politically motivated. More than your curious teenage hacker at work; these attacks are stemming from groups seeking to make a statement on some of today's most controversial technology issues," said Scott Chasin, chief technology officer of MX Logic Inc., in a statement.

Beyond its DDoS target, MyDoom.F is also more destructive. A PC Magazine analysis of MyDoom.F, said the worm attempts to delete files on the system based on a probabilistic formula, adding an element of destructiveness rarely seen in such worms.

The worm also attempts to spread to file sharing users. For all these reasons, antivirus vendors are giving it a higher threat ranking than usual.

The latest threat is NetSky.C, which arrived on Wednesday. The worm is a variant of NetSky.B, which spread rapidly earlier this month, according to security vendors. It is also called Moodown.C.

According to F-Secure Corp.'s analysis of the worm, the new version is compressed with a different program. It also behaves differently in several ways than its predecessor, such as searching far more files for e-mail addresses that it can use to spread itself.

The worm arrives in a ZIP file attachment to an e-mail message. The file inside the ZIP will have two file extensions, the first for an innocuous file type such as .RTF and the second for an executable file type, such as .SCR.…

http://www.eweek.com/article2/0,4149,1538954,00.asp?kc=EWNWS022604DTX1K0000599

Security Guru Unmoved by Gates' RSA Remarks:
"Schneier's Gates comments followed some anecdotes about how everyone can help solve the security problems facing all enterprises. 'Get involved,' he said. 'That's how we make changes. Otherwise security is something done to us.'

Most security systems affect multiple parties, he explained, but usually only one person makes the decision about how security is implemented. 'At this point it's a negotiation. The players with most power are the ones who get to decide what the final answer is,' Schneier said. 'The best way to effect security is to gain power in negotiations. The best way is to change the environment in which security decisions are being made. Change the agenda of the players. Change the outcome.'

Every person has to make security work for himself, he said. 'The goal of security systems is the most security for the least amount of trade-offs. The way to do that is to make the party who is best able to mitigate the risk responsible for the risk,' he said, saying that computer software companies at this point do not share in the risks of software security or insecurity. "

Schneier said one of the best and simplest "security systems" he's seen is the local convenience store or fast food restaurant that displays a sign at the cash register that says, "Purchase free if you don't get a receipt." The system is not designed as a customer service, as it may appear, he said. Rather, it's a means of co-opting the customer into keeping an eye on the store employee who may be suspected of skimming from the cash register. Nevertheless, the customer will be watching if he knows he could get something for free.

"Good security systems are in line with their capabilities," he said. "The store manager is hiring you, aligning your interests with your capabilities. Very cheap security system. For the money it's really good. That's what we should strive for in security systems. The goal is to make them as effective as possible and work with the natural tendencies of people already there."

http://www.eweek.com/print_article/0,3048,a=120200,00.asp

News: Special Reports:
"RSA Conference: New lines of defense

The security companies and experts gathering at the RSA Conference 2004 in San Francisco are showing off smarter ways to ward off attacks. The problem is that hackers are becoming more sophisticated, too. At best, it's hoped that damage can be kept to a minimum."

http://zdnet.com.com/2251-1110-5163906.html

Service-Oriented Architecture: Chapter 13: Thirty best practices for integrating Web services. Pt. 1. - WebReference.com -:
"Service-Oriented Architecture: Chapter 13: Thirty best practices for integrating Web services, Pt. 1.

'This chapter is from the book 'Service-Oriented Architecture: A Field Guide to Integrating XML and Web Services' by Thomas Erl. (ISBN 0131428985)."

http://www.webreference.com/programming/soa/index.html

Download details: Office 2003/XP Add-in: Remove Hidden Data:
"With this add-in you can permanently remove hidden data and collaboration data, such as change tracking and comments, from Microsoft Word, Microsoft Excel, and Microsoft PowerPoint files."

Thanks to WinXPnews at http://www.winxpnews.com

http://www.microsoft.com/downloads/details.aspx?FamilyID=144e54ed-d43e-42ca-bc7b-5446d34e5360&displaylang=en

Order the Windows Security Update CD:
"Order the Windows Security Update CD
Updated Date: February 23, 2004

The Windows Security Update CD will be shipped to you free of charge. This CD includes Microsoft critical updates released through October 2003 and information to help you protect your PC. In addition, you will also receive a free antivirus and firewall trial software CD.

This CD is only available for Windows XP, Windows Me, Windows 2000, Windows 98, and Windows 98 Second Edition (SE).
Please allow 2-4 weeks for delivery."

http://www.microsoft.com/security/protect/cd/order.asp