Mobile

What Next-Gen Security Looks Like

100%
0%

Virtualization and Cloud Solutions Architect Bill Kleyman shows how the nightmare of BYOD is giving rise to a new generation of intelligent, highly scalable security products and platforms.

Comment  | 
Print  | 
Comments
Oldest First  |  Newest First  |  Threaded View
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
12/9/2013 | 9:49:44 AM
Mobile security
Bill, great video, I liked seeing the detailed example showing a specific security product and the different functionality it includes. Can you recommend other vendors that offer similar mobile security platforms as well?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 10:45:53 AM
Application Firewalls
Bill, I'm struck by your mention of application firewalls, which ties in very nicely with a recent column by Jeff Williams, CEO & Co-Founder, Aspect Security and also a founding members of the Open Web Application Security Project (OWASP). Jeff's point was that the industry still has a long way to go with application security within the development environment. Another contributor, Levi Gundert, mentioned behaviour scoring as defensive measure in his column about Zero-Day Drive-By Attacks: Accelerating & Expanding

That's kind of a roundabot way of asking you where you  see the most bang for the back in next generation secruity -- baked into the applicaton itself, in the intellegient platforms and tools that you speak about in your vblog, or a combination of the two.
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
12/9/2013 | 12:10:23 PM
Re: Mobile security
@Susan - Absolutely, NetScaler platforms are just one example. Next-generation security is really making a boom right now around application, data, and cloud security. Solutions from Checkpoint, Palo Alto, and Sourcefire (Cisco) all introduce new ways to secure the logical layer.

Remember, next-generation security is a concept -- not just one singular product. For example, an F5 Big-IP ADC (like the NetScaler) can also have components that fall into the next-generation security definition. 
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
12/9/2013 | 12:16:29 PM
Re: Application Firewalls
@Marilyn - It's definitely a combination of the two. Applications, APIs, and information all require good security practices. In some cases, security components are built into Apps, APIs and the infrastructure that supports it all. 

On the other hand, having overall environment security is a must as well. This means having intelligent systems which act proactively to mitigate as much threat to your infrastructure as possible. In all honesty this is what the future looks like too. Developers will build in security components into their apps. That will then couple with  infrastructure security solutions to ensure data and application integrity. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/9/2013 | 12:29:38 PM
Re: Application Firewalls
Thanks Bill. That sounds like an ecosystem that will require some greater standardization. Is that happening? 
Bill Kleyman
50%
50%
Bill Kleyman,
User Rank: Apprentice
12/9/2013 | 12:34:01 PM
Re: Application Firewalls
@Marilyn - That's a great question. I'm not sure if it's something we'll see standardized. Instead, it's the new application of security technologies around platforms like cloud, big data and applications.

Even then it's hard to tell. The entire security model is shifting to support a more dispersed and dynamically connected user. 
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
12/9/2013 | 8:43:19 PM
Re: Application Firewalls
Bill, that's a great point. One other trend I see gaining a lot of ground is toward securing the data itself, as well as the environement, devices, and apps. Especially now that companies are adopting cloud services and may have less control over their environments, data security becomes even more important.
Cultus
50%
50%
Cultus,
User Rank: Apprentice
4/2/2014 | 1:47:43 PM
Security
If you can make it more simple, but more safe it will be a success. This is the direction that we should be thinkings.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If youíre still focused on securing endpoints, youíve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1421
Published: 2014-11-25
mountall 1.54, as used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, which allows local users to bypass intended access restrictions via unspecified vectors.

CVE-2014-3605
Published: 2014-11-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6407. Reason: This candidate is a reservation duplicate of CVE-2014-6407. Notes: All CVE users should reference CVE-2014-6407 instead of this candidate. All references and descriptions in this candidate have been removed to pre...

CVE-2014-6093
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 7.0.x before 7.0.0.2 CF29, 8.0.x through 8.0.0.1 CF14, and 8.5.x before 8.5.0 CF02 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-6196
Published: 2014-11-25
Cross-site scripting (XSS) vulnerability in IBM Web Experience Factory (WEF) 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework (WDF) and Lotus Widget Factory (LWF), allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSp...

CVE-2014-7247
Published: 2014-11-25
Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?