Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
Primary Storage's Three Faces
Primary storage has three faces. There is active data and inactive data; both of these data sets actually consume space, which we can compress and then remove. Then there is the third face, with the capacity that is allocated but not in use. Each needs to be handled in a different way.
Account & Identity Mismanagement
Companies' lack of proper identity management and account revocation never ceases to amaze me. Why aren't these things integrated with the human resources hiring process and subsequent exit procedure when an employee leaves or is fired?
Google Chrome Patch Released
Google has released an important patch for its Chrome browwer. If you're running Chrome, patch now.
Fannie Mae Logic Bomb Makes Case For Strong IDM
The indictment of an IT contractor working at Fannie Mae, who schemed to destroy the data on 4,000 servers, confirms what we know: bad economic times and layoffs are perilous, and identity and access management has never been more important.
Are We In A Tech 'War' With Russia?
I was reading the withering comments Vladimir Putin made to Michael Dell in response to Dell's offer to help Russia. Though Putin is Russia's prime minister, he clearly is also the guy who is running the country. Reading between the lines, I think it is likely he is driving a technology w
Click Fraud Rises As Economy Sinks
Fake clicks on ad links are climbing as fast as the economy falls,up a full percentage point in the last three months of 2008, according to pay per click monitoring company Click Forensics.
The Inevitable Has Occurred: Heartland Payment Sued
The payment processor Heartland Payment Systems just got served with a lawsuit over the allegedly massive data breach.
Hardware Vendor-Induced Vulnerabilities
During a recent penetration test, a friend encountered some really strange findings that he asked me to review. Several of the desktops located in one of the departments had a process listening on an ephemeral, nonstandard TCP port. He provided his Nmap and Nessus findings, which both reported an Apache Web server was running on this mysterious port. The fact they were all running Apache was cert
IE8 Security: Some Questions Answered, Others Raised
Internet Explorer 8, which Microsoft has now labeled "Release Candidate 1," meaning it's ready to be tried out by (or on) the public, promises some leaps in browser security. Does it deliver? Yes and, depending on who you ask, not quite.
The Death Of PCI DSS? Don't Be Silly
Yes, in the past year two big retailers, who were apparently compliant to the Payment Card Industry Data Security Standard, were breached. Does that mean PCI DSS has grown increasingly irrelevant? That's absurd.
How To Celebrate Privacy Day (And How Not To)
Wednesday, Jan. 28, has been designated International Data Privacy Day, and I'm still not sure how to celebrate. Should I invite all of my friends and family over, then go in the bathroom, lock the door, and make an entry in my personal diary? Or maybe we should all put on funny hats and go outside with noisemakers, screaming, "It's none of your friggin' business!!" Ah, those holiday traditions.
NFS On VMware, Not NetApp's Sole Domain
Using NFS to store and boot virtual machine images is becoming an attractive option, and for obvious reasons NetApp has been promoting the use of its solutions as the perfect complement to a VMware on NFS strategy. However, NFS isn't the sole domain of NetApp any longer. It now has company from a variety of vendors, including EMC, ONStor, BlueArc, and
USB Drives Dropped Off With Laundry: Whole New Meaning For "Clean Data"
9,000 USB drives were left in clothes dropped at UK dry cleaners last year. With numbers that high, you can bet that some, and maybe most, of those drives held private, sensitive, confidential data.
Software Piracy Places Everyone At Risk
On Monday, the United States claimed victory in a World Trade Organization case against China for that country's alleged lax stance toward software piracy. What's that have to do with IT security? Plenty, as the recent Downadup outbreak, as well as a number of new Trojans to hit the Mac OS X platform, highlight.
OS X Trojan Resurfaces In Photoshop CS4
I guess too many people got wind of the iWork 09 Trial Trojan application that was circulating in some peer-to-peer networks. The bad guys have changed their strategy: they're now targeting people downloading pirated versions of Adobe Photoshop.
Get Your Pentesting Permission Slip
As infosec professionals, we are often tasked with performing duties that would be considered illegal if we did not receive proper authorization beforehand. For example, if you were performing a penetration test against a system that you or your employer doesn't own, or for which you don't have authorization to access, then you could be violating a number of laws leading to termination and possible criminal prosecution.
Monster.Com Loses Millions MORE Job Seekers' Records
Monster.com has been hacked again, with possibly millions of customer records -- including names, phone numbers, e-mails, passwords and more -- stolen from its obviously poorly protected database. The company's handling of the news of the breach (the third in less than two years!) is as sloppy as its security.
Netgear ProSecure Brand Launches With New Security Appliances
Netgear -- well known for its networking products -- is moving into the SMB security arena with its new ProSecure brand and a new line of Security Threat Management (STM) Web and Email Threat Management Appliances.
Spread Of Downadup Worm, New Apple Mac Trojan
Security firm Symantec notes that the Downadup worm has swept through China, Argentina, Taiwan, Brazil, India, Chile, and Russia. The infection doesn't even register in the United States. Why?
Journalism School 'Ricochets' Spam Messages
If you get a message this weekend from RJICONTACTS as part of the Missouri School of Journalism, don't reply. It's the result of a mail server snafu.
Downadup Worm Infects 1 In 16 Of World's PCs, Adding A Million A Day
The rapid (to say the least) spread of the Downadup (also known as Confickr) worm is getting worse fast, with security companies noting that one in every sixteen of the world's PCs is infected. And that number may be very conservative.
Cloud Storage Matures
The cloud is becoming tangible and definable. Customers are beginning to store data on it and companies like Bycast, Cleversafe, Amazon and Nirvanix have real customers paying real money to use their products or services. Companies like EMC and HP are bringing legitimacy to the co
The Trouble With Phishing
Any person who is familiar with even the basics of modern computer threats will know the term phishing. It is an example of the more generic threat known as social engineering, or using psychology as a primary attack vehicle. In general, people tend to be trusting and helpful (although, of course, we can all quickly bring to mind those who are neither). Phishing and other social engineering attacks make use of these traits to trick computer users into giving up valuable information, fr
Obama Administration Outlines Plan To Secure IT Infrastructure
Barren of details, it's really not a plan -- yet. But the administration did publish a number of goals aimed at better protecting the nation's critical IT networks.
Honing Security Skills Outside Of The Workplace
Here at the Sundance Film Festival, I've noticed varying levels of credentialed people. Some work for Sundance directly; others are volunteers. Some are folks who dropped down a couple thousand dollars for a ticket package that includes an extra level of access the public doesn't have. And, of course, we can't forget the cast and crew of the films. In the four years I've been attending, you can count me as part of the rest of the bunc
Obama Cyber Security Agenda: The Opening Moves
The broad outlines of President Obama's cyber security strategy are posted on the White House website, and offer both a glimpse of priorities and the chance to ask a few questions.
Apple Patches QuickTime Flaws
Apple on Wednesday released QuickTime 7.6, a new version of its multimedia software that improves quality, compatibility, and security.
The Danger Of IT At Capacity
As the IT budget has every ounce of excess rung out of it and storage optimization technologies promise to delay future purchases by delivering maximum utilization, for the first time storage administrators are living at much higher utilization rates. While this looks good, it has a dangerous underbelly.
How Hackers Will Crack Your Password
I've been cracking passwords lately for pen tests, and I'm surprised at how corporate guidelines don't really help people choose passwords. As in many places in security, a disconnect exists between how people secure systems and how hackers break systems. So the following is a brief description of what hackers do (or, at least, what I do when pen-testing systems).
Heartland Payment Systems' Big Breach & Lame PR Tactic
A recent breach at Princeton, N.J.-based payment processor Heartland Payment Systems, by some accounts, may have totaled tens of millions of individual credit and debit card transactions. And what does the company do? It pulls a cheap PR tactic by announcing the breach on inauguration day.
Record Breach! Heartland Leak May Affect Millions Of Credit Records
Credit card processor Heartland Payment Systems admitted today that a 2008 malware-caused breach may have compromised millions -- maybe tens of millions -- of credit card records, including card holder names and card numbers. Early reports are that the breach was caused by a keystroke logger inside Heartland's network.
U.S. To Sharpen Cyber-Weaponry
Last month, the Center for Strategic & International Studies (CSIS) Commission on Cybersecurity for the 44th Presidency warned that the United States is losing the battle to protect cyberspace. This is an arms race we can't afford to lose.
Question The Internet
While many people have embraced Timothy Leary's advice to question authority, too few demonstrate willingness to question the Internet.
Largest Data Breach In History Tries To Hide Behind Inauguration
Heartland Payment Systems, a credit card processor out of Princeton, N.J., that mostly supports small and midsize businesses, announced during today's presidential inauguration that it was the victim of a massive data breach that could include more than 100 million credit card numbers.
Virtualization Driving SMB Storage
As server virtualization begins to work its way down the data center food chain, it is making small to medium-sized enterprises (SME) change their plans for storage selection. Shared storage is almost an agreed-to requirement to get the full potential out of a virtualization investment, but how can an SME find the right product and not vaporize its budget?
Ask Not What Cybersecurity Can Do For You, Ask What You Can Do For Cybersecurity
Whether or not cybersecurity is mentioned directly in the inaugural address, there is little doubt that questions of national information security have been on President-elect Obama's mind. Question is, will he make personal cybersecurity a national issue as well?
Botnets: A Look Ahead
While the infamous Storm botnet ran its course, and at least one hoster that was accused of hosting a good number of botnet command and control servers was shut down, don't expect spam or the botnet threat to disappear anytime soon.
Downadup Worm Growth Explodes
Finnish security firm F-Secure calculates more than 6 million newly infected systems with the Downadup worm in the past few days. This makes Downadup one of the most virulent infections we have witnessed in quite some time.
5 Ways To Stretch Your 2009 Security Budget
The economy stinks, and as usual, IT is under more pressure than ever to do more with less. While budgets shrink, the complexity of keeping your data safe grows. With some creativity, you can do more with what you have, or in some cases, add necessary new capabilities on the cheap. Here are some of my ideas on where to start.
Worm Warning: New Would-be Botnet Growing Explosively
A new botnet. and a big one, could be in the early stages of existence, with more than 3.5 million PCs, by some estimates, already enrolled as a result of a fast-spreading worm. As many as a third of the world's Windows machines may be vulnerable.
If It Walks Like A Botnet
There's something fishy going on with the Confickr/Downadup worm. So far, it hasn't crossed the line to an official botnet, but this thing is fast becoming a monster that just won't stop spreading, no matter what Microsoft does to warn users to patch (the patch has been available since October, people) or how security vendors scramble to scan for it as it evolves and changes.
The Downadup Worm Hits 3.5 Million
Security firm F-Secure says that the Downadup worm has spread to more than 3.5 million computers by exploiting a vulnerability Microsoft patched last October.
Disaster Recovery Audits: Free Webinar Addresses What's Missing
Disaster recovery specialist Continuity Software is hosting a free webinar today to address gaps in typical DR audits. The biggest gap for many small and midsize businesses, of course, is a DR audit, or plan itself.
Paris Hilton's Site Hacked: Expect Much More of This Throughout 2009
More than 15,000 Web sites have been infected with the same Trojan that has been by detected at Paris Hilton's Web site, ParisHilton.com. This certainly won't be the last time this happens this year.
Geek Productivity Tough To Measure
Measuring productivity is difficult when it comes to IT security professionals and, in general, most IT geeks. It's not as bad as trying to measure the return on investment (ROI) for security products, but it can be difficult if you focus on the number of hours worked as opposed to employee output.
Popup Phishing: Online Banking In-Session Phish Need No E-Mail Hook
A new research report shows a new phishing vector -- one that can take place inside supposedly secure banking and other protected session, using a pop-up window rather an e-mail to fool their victims. According to researchers, every browser is vulnerable to the exploit. It's called in-session phishing, and it has the potential to be very troublesome.
Futility Of Microsoft's Exploitability Index
As far as Microsoft patch Tuesdays are concerned, 2009 treads in like a lamb, with the software maker issuing only one security bulletin in its MS09-001 January patch rollout. Yet, even as MS09-001 is rated as "critical" for popular versions of its operating system -- the company's Exploitability Index hails: "Functioning exploit code unlikely." What's with the mixed signals?
Out Of Space? Thin Provisioning Vs. Traditional Provisioning
There has been a lot written about thin provisioning and how it can optimize capacity and increase efficiency of the storage administrator. The constant response is that thin provisioning is "risky" compared with traditional hard-provisioned volumes. Is it really?
New Year, New Fears (And Even More Of The Same Old Ones)
A just-released Commtouch Threat Trend Report puts the spotlight on user-generated content as one of the hottest arenas for malware and phishing attacks. In other words, the bad guys have met their allies and they are us.
The List Developers Need To Know
There seems an almost endless number of mistakes that can be made to make applications susceptible to attack. Fortunately, the list of programming mistakes that really matter in today's risk environment is relatively small. Here's that list.
|
The 10 Most Impactful Types of Vulnerabilities for Enterprises TodayManaging system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
