Attacks/Breaches
3/14/2014
03:00 PM
Becca Lipman
Becca Lipman
News
100%
0%

7 Behaviors That Could Indicate A Security Breach

Breaches create outliers. Identifying anomalous activity can help keep firms in compliance and out of the headlines.

Here's a rather uncontested statement: In the world of cybersecurity, there are many things that can go wrong.

Some breaches are intentional, others accidental. A case in which an employee unwittingly discloses confidential information or is working from an infected machine may look similar to the actions of employee who has gone rogue by uploading or downloading inappropriate data.

Regardless of its cause, determining whether a behavior is normal or not is important when it comes to detecting a variety of security breaches.

Skyhigh Networks compiled the following real-world examples of behaviors that security teams identified as several standard deviations outside of normal activity.

Read the rest of this article on Wall Street & Technology.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
pfretty
100%
0%
pfretty,
User Rank: Apprentice
3/17/2014 | 3:32:50 PM
Not just staying out of headlines, but avoiding the costs
It's crucial to pay close attention to the warning signs. According to the Ponemon 2013 Cost of Cyber Crime Report (http://www.hpenterprisesecurity.com/ponemon-study-2013), the average company experiences 100+ attacks per year at a cost of $11.6 million. These make breaches not just cause embrassment, but in many instances can be crippling to even the most otherwise stable organizations. Fighting off attacks starts with strategy and technology and continues to improve through education. 

 

Peter Fretty, IDG blogger working on behalf of HP
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.