Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
New Project Takes Aim At Web Vulnerabilities
New open source honeypot sets bait to lure attackers and to gain first hand information on current attack techniques underway.
LinkedIN With 'Bill Gates'
Bill Gates invited me to join his LinkedIN network. OK, so it wasn't really Bill Gates, but as far as my email system, spam filter, and email client were concerned, it's perfectly normal for Gates to send me a LinkedIn invitation.
Global CIO: SAP Eliminates All-Up-Front Payment Requirement
In a striking move, SAP is extending to 580 very large customers a plan allowing them to spread payment across multiple years instead of making one big capital-expense payment up front.
Getting To Know Your Infrastructure
Knowing your network is a fundamental step for building a successful vulnerability management (VM) project.
Global CIO: Hewlett-Packard's Hurd Says Bad IT Means A Bad CEO
Hurd offers a startling observation about how the roots of bad IT almost always reside in the corner office, and he explains how HP attempts to address the needs of both the CEO and the CIO.
Know Your Tools
Ever have one of those days where nothing really seems to go right? You're working on something that should be simple and it ends up throwing seemingly unexplainable errors back at you no matter what you try? Then when it does work, you're not sure what you changed that fixed it. Yeah -- me, too.
Global CIO: Greenpeace Shakedown Targets Google, Microsoft, And IBM
Greenpeace is mounting a major assault on the business practices of not just those three companies but the entire IT industry. They will lie to get what they want--and here's the proof.
File Virtualization, The Ultimate Cloud Gateway?
In our last entry we talked about the use of cloud storage as a backup target, but another ideal use case for cloud storage is to use it as an archive area. Almost every IT organization has old data that they want or must keep, but are struggling with where to keep it. Its ability to identify, automatically move and transparently recall data could make file virtualization the ultimate cloud gateway.
Patch Your Firefox
Mozilla just released 16 patches for vulnerabilities in Firefox. Eleven of the flaws are critical, and affect a number of components in the browser.
Global CIO: What CIOs Can Learn From Kindle
The real lesson is in the growing power of machine-to-machine wireless links.
SMB Security Survey Shows Sorry State Of Cyber Safety
A new survey of small business cybersecurity offers a bleak picture of the state of things. Bleak unless you're a cybercrook, of course.
AVG Sends Speedy Small Business Security Signal
New Internet security and anti-virus products for small businesses from AVG are being touted by the company as both secure and speedy, with an array of promised features and administrative tools that address some of the tech-challenges smaller firms face.
UK Jobs Website Hacked
The news site Guardian is warning members of its UK jobs site that the site has been breached, and that personal data may been snagged.
Christian Site's Poll Backfires
The Alpha Course, a Christian Website, has created an instant Internet poll asking if God exists. So far, 96 percent of respondents clicked on "NO."
Cloud Based Backup, Ready For Business?
Cloud based backup services have been successful in the consumer space. Companies like Mozy, Carbonite and others are protecting thousands of laptops and home desktops, but can cloud based backups services move beyond protecting consumer or prosumer data and into the data center? Are cloud based backups ready for business?
Using Evil WiFi To Educate Users, IT Admins
For my keynote at Operation WebLock, I was asked to include a demo or two that would leave attendees rethinking some of their current practices. It didn't take a long to come up with a few different possibilities, but I settled on one of my favorite attacks: wireless network- impersonation and connection hijacking.
Smartphones Call For Security-Smarter Users
Smartphones, and all the other smartstuff filling our pockets, bags, lives, make for mobile convenience and access -- including access by crooks. Time to get your smartphone-using staff to dial up their security practices.
The ABCs Of DAM
Database activity monitoring (DAM) has been the biggest advancement in database security in the past decade. Identity management controls access, and encryption protects data on media, but monitoring verifies usage.
Application Security Is National Security
Hacks targeting U.S. government computers are coming from China. We knew that. The Chinese hackers are relying on zero-day software vulnerabilities to exploit critical systems. So, tell me again: why aren't we doing more to require applications be built secure from the start?
Trusting Trust
An old and respected paper about compilers teaches us a lot about network security architecture.
Reducing Storage Complexity In Server Virtualization
The storage component of a virtualized server infrastructure has been labeled as complex and expensive. In our prior entries about selecting a storage foundation we discussed what systems and protocols are available that might help simplify and reduce costs for storage in a virtualized environment. Beyond physi
My Hat Is Blue
For the past two days I have been back in Seattle. It was almost two years ago I left the city, and was not sure when I'd get a chance to return. Microsoft's BlueHat security conference was a great reason to come back to my favorite rainy city.
What is BlueHat?
Microsoft And Mozilla Compete, Cooperate
In its patch release last week, Microsoft described an interesting side effect in one of its bulletins.
Understanding Hard Drive Performance
In the last performance entries we discussed understanding storage bandwidth and understanding storage controllers. Next up is to understand the performance characteristics of the hard drive itself and how the mechanical hard drive can be the performance bottleneck.
Firefox Web Browser Weaponization Redux
I've written about the Samurai Web Testing Framework (WTF) LiveCD project and some of the Firefox Add-Ons that can be used to transform Firefox into a highly capable Web application penetration testing tool. Now the Add-Ons included in Samurai and a few others have been bundled together into the Samurai WTF Firefox Collection--essentially, a one-stop shop for Web browser weaponization.
Gumblar: Back With A Vengeance
Earlier this year, the botnet Gumblar made a splash when it infected more than 2,300 Websites, including popular destinations such as Tennis.com, Variety, and Coldwellbanker.com. Now, security researchers say Gumblar is back in strength and is changing its tactics.
Phishing Alert: Get Your Guards Up! Botnet On The Move And It Looks Like It's Coming From YOU
Odds are you or someone in your business have received some dangerously convincing e-mails in the last few days. Mail that claims to come from Microsoft, warning of Conficker infections and, more dangerously, mail that appears to be from your administrator at your own domain, announcing a server upgrade. They're phishing attacks, of course, and particularly nasty ones.
Using USBs For Incident Response
I was honored to be the keynote speaker this week at Operation WebLock, a cyber incident response two-day seminar hosted by the Florida Department of Law Enforcement. The event focused on helping administrators and IT staff respond better to cyber-threats that could affect their networks and Florida's infrastructure -- a very worthwhile endeavor, and awesome that it was offered free to local business, government, and law enforcement.
Full Nelson: The Growing Threat Of Cyberwarfare
Many more casualities will pile up, but policy and agreements will prove meaningless against today's anonymous cyberwarrior.
Scammers Up The 'Rogueware' War
Attackers have been known to encrypt user files (such as happened with Gpcode), and then demand payment for the decryption key, for some time. These so-called rogueware, including scareware, attacks have been underway for some time. Now scammers have upped their attack tactics.
Here Comes Automated Storage Tiering
At Storage Networking World, at least one new category in storage is coming to the forefront; Automated Storage Tiering. These are typically devices that can sit in front of your existing storage platform and allow some of it to leverage a high speed solid state front end without you manually having to move data to a Solid State Disk (SSD).
App Whitelisting Potentially More Effective Against Bots
Application whitelisting is beginning to look more and more appealing. Don't get me wrong. It has had its merits all along. But lately I've seen way too many failures of antivirus against bots, and that has me rethinking a few things.
UPDATE Sidekick Data Restored: Security And Cofidence Questions Remain
So now the missing Microsoft/T-Mobile Sidekick is back, doubtless relieving both hundreds of thousands of customers and the legal departments at the affected companies. But the questions about confidence in cloud-based data remain. And that's a good thing.
The Priority Patches From This Month's Batch
Tuesday's patch releases by Microsoft and Adobe are creating plenty of work for IT administrators -- quite possibly involving multiple groups with further coordination and meetings. But there are two patches that IT administrators should be focusing on to roll out quickly:
Getting Around Vertical Database Security
A few database administrators told me they wanted to know why database security is vertical and how they can fix it. True, database access controls are vertical. The basic construct of a database is a table, and access controls grant access to tables or columns. This means you can see all of the entries from top to bottom, or none at all. Access is vertical and it lacks granularity.
Understanding Storage Controller Performance
Storage controllers are the engine that drives the storage system you own. They are essentially a compute engine for storage arrays. Understanding storage controller performance and what can impact storage controllers is an important step in the optimization of your storage environment. It is also something that many storage managers assume is good enough.
Sidekick Failure Highlights Security Demands Cloud Customers Must Make
Whether or not Sidekick recovers from the data debacle that may have cost hundreds of thousands of customers their cloud-stored material, the disaster shows into sharp relief a couple of great and greatly unasked questions about doing business in and with the cloud: How confident can you be of your cloud service providers? How confident should you insist on being?
RAND: U.S. Should Not Prioritize Cyberwarfare
The think tank RAND came out with an Air Force funded paper that concludes spending money on operational cyberwarfare is a waste of budget. I agree.
McAfee Rolls Out Centralized Security Solution For Macs
Security vendor McAfee has announced McAfee Endpoint Protection for Mac, a unified suite of security features that can be managed from a central console. The product is intended to address the security needs of the growing number of Macintoshes in businesses.
In Support of Poor Ol' Windows Vista
We just released the October issue of the CSI Alert to CSI members, and this month we focus on Windows 7. This issue is, in some ways, a follow-up to last year's issue, "The Fate of the Secure OS," in which I said some nice things about Windows Vista, and advised it would be imprudent to completely ignore Windows Vista -- eyes-closed, fingers-in-ears, chanting I'm-not-listening-I'm-not-listening.
Dark Reading Launches Vulnerability Management Tech Center
Today Dark Reading launches a new feature: the Vulnerability Management Tech Center, a subsite of Dark Reading devoted to bringing you news, product information, opinion, and analysis of the technologies and practices used to identify and eradicate security vulnerabilities from enterprise IT environments.
Phishing Your Users for Better Security
A couple of years ago, William Perlgrin taught users about phishing...by phishing them. In doing so, the director of the New York State Office of Cyber Security and Critical Infrastructure Coordination, created an awareness program that (for the most part) worked.
Patch Alert! Microsoft Releasing Largest Patch Array Ever
Use BOLD when you mark next Tuesday on your patch calendar-- that's when Microsoft is releasing the biggest patch array ever: 13 patches addressing close to 3 dozen vulnerabilities.
October's Scary Patch Tuesday
Next Tuesday Microsoft plans to release 13 separate security bulletins that will cover more than 30 individual patches. More than half of the bulletins are ranked as "critical."
Understanding Storage Bandwidth Performance
Storage bandwidth is the connectivity between servers and the storage they are attached to. When it comes to understanding storage bandwidth performance you have two challenges to deal with. The first and most obvious is can the storage get the data to the application or user fast enough? The second and less obvious is can the applications and hardware those applications run on take advantage of that bandwidth?
The Future Of Digital Forensics
Last week's 10th annual IT Security Awareness Day at the University of Florida had IT workers from all over the state in attendance to hear experts from InGuardians, F-Response, Sunbelt Software, and Microsoft. Though I enjoyed every presentation, I keep thinking about one in particular -- the future of forensics, by F-Response's Matt Shannon.
You Can't Always Be Proactive
Having your car serviced regularly, stretching before working out, and visiting the dentist twice a year are known to prevent engine failure, physical injury, and potentially life-threatening gingivitis. In addition, being proactive also extends to the world of information security.
Avoiding Database Audit Pitfalls
Many seasoned database administrators howl in protest at the mere suggestion of running native auditing functions due to the poor performance and log management headaches that often come with auditing.
Understanding Storage Performance
For most storage managers improving storage performance is an endless loop of upgrades that are taken until the problem goes away. Understanding where to look and how to configure the environment is often a series of "best guesses" instead of a thorough understanding of it. In today's economy best guesses are not allowed. Making the right move, the first time, is critical.
Hotmail Phishers Pull In Poor Passwords By The Thousands
Tens of thousands of email accounts from Hotmail, Gmail, Earthlink, Yahoo and Comcast compromised by phishing scams had those those details posted briefly online for all to see. One thing that was seen was how many of those accounts had lousy passwords.
|
Everything You Need to Know About DNS AttacksIt's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask.
Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted.
Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
