Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
|
State Sues WellPoint Over Data Breach Notification
The state of Indiana's attorney general is suing insurer WellPoint Inc. for $300,000 for not notifying customers in a timely enough manner that their data was at risk.
Java Worm Targets Mac OS X
A just uncovered Trojan horse is employing an old social engineering ploy on social networks to lure Mac users.
The Futility Of A Single Storage Platform
Every storage supplier wants to be your only vendor. It sounds like a good idea. It would simplify storage management, simplify purchasing and make it easier to train new IT staff and protect you if the current staff has some turnover. While meeting with users at SNW Europe, I was reminded just how futile of a goal this really is.
Talk About Evasion
Security research, like fashion, sometimes gets recycled, restyled, and even rebranded. Take network security evasion and sidejacking attacks, both of which have recently re-emerged with researchers taking new spins on these known threats.
Talk About Evasion
What's new is old and what's old is still news
Why Windows Phone 7 Could Be Most Secure Smartphone At Launch
One of the interesting things I learned from spending a few days with McAfee recently was that the iPhone is actually one of the most secure smartphones.
More Patient Data Dumps
Yet another case where patient medical records are left in a dumpster and out in plain sight.
What Business Data Should Be In The Cloud?
In our last entry we discussed different ways that you can move data into the cloud, something I call onramps. In theory the ability now exists to put all your data types on a cloud storage platform, but is that the right choice for your business? How do you determine which data you should put in the cloud?
How To Get Data To The Cloud: Onramps
As we discussed in our last entry, deciding when to use cloud storage is an important decision that data center mangers are now trying to make. While adding the capabilities to your own software was an early approach most were waiting for an easier way to get to the cloud and it comes in the form of software that allows near seamless access. We call these onramps.
Apple FaceTime Mac Beta Ships With Pedestrian Security Flaw
On Wednesday Apple announced its FaceTime for Mac beta. Problem is the beta software shipped with a security flaw that could enable attackers to access iTunes accounts. However, the flaw could be indicative of much more systemic problems.
Does Compliance Drive Patching?
A thought-provoking comment was made in response to Ericka Chickowski's recent article "Best Practices For Oracle And Database Patching."
Schwartz On Security: Can Apple Minimalism Stop Botnets?
Why applying Steve Jobs' iPhone "walled garden" model to limit what PCs can do makes sense for combating cybercriminals.
How To Use Cloud Storage
This entry kicks off a new series on cloud storage. In this series we will look at cloud storage and what it means from a number of different view points; the storage manufactures, the service providers, the providers of the tools that onramps data to the cloud and of course the people that will actually use cloud storage. This first set of entries will look at you the users and provides some ideas on how you can use cloud storage.
An SMB Guide To Credit Card Regulations, Part I: PCI DSS Q&A
This article is the first in a short series designed to help small businesses understand the regulations around securing credit card transactions, specifically the PCI DSS (Payment Card Industry's Data Security Standard) requirements.
Social Media Best Practices For Healthcare
It's no secret that there have been instances of medical workers abusing social networking sites and violating patient privacy rights. A medical association has recently published a social media toolkit designed to help with more responsible use of social media.
It's About The User
E-commerce was born 15 years ago when a bunch of us, thrilled by all of the possibilities and promise of the Web, said, "Let's adapt this new medium to do business." Even at that early moment, it was clear that user authentication would have to play an essential role if the adaptation was going to be successful.
Disk Backup Challenges
In most enterprises, disk is looked to as a cure for all your backup woes. The goal of adding disk to the process is to reduce backup windows, improve recovery windows and make the whole process more reliable. Reality is though that while it does help the situation it seldom cures the backup problem and fails to fully address any of these problems.
CloudAudit Now Under Cloud Security Alliance Umbrella
We've blogged often about the need for organizations to be able to see and understand the regulatory compliance and security efforts of their cloud providers. Now, two organizations - the Cloud Security Alliance and CloudAudit - that have been working toward exactly that are joining forces.
Stuxnet: An Amateur's Weapon
Stuxnet, a Trojan supposedly designed to attack Iran's nuclear program, is so technically advanced that it is said to be able to remotely explode a power plant without the controller noticing. Such an advanced weapon was developed by people with means. But whoever they are, they're amateurs.
Fall 2010 SNW Recap Part I
We just wrapped up Storage Networking World Fall 2010, and while I am packing to get ready to go to SNW Europe to speak on "The Storage Challenges Caused By Desktop Virtualization" It makes sense to review what we are seeing as emerging or maturing trends in storage for 2011.
Microsoft Steps Up To Dethrone Zeus
Microsoft is throwing another punch at this most nasty and extremely active botnet.
The Case For Wiretapping The Internet
The directors of National Intelligence and the FBI say tech-savvy extremists pose a growing threat, setting the stage for a national debate over the need for Internet eavesdropping.
Zero-Day Pen Testing Under Fire
A blog post I wrote recently about using zero-day exploits for testing seems to have ruffled some feathers: I got a flood of email about why the concept is immoral, tests like that are not valid, and a host of other problems. Rather than responding to emails individually, this post answers a few common grievances with my testing methodology.
HTML 5's Privacy Problem
Lately there's been a lot of news and concern about perceived security and privacy problems in HTML 5. But while these concerns are certainly legitimate, for the most party there isn't really anything new here.
Dragging Physical Security Monitoring Into 2010
It is fairly common to see router, firewall, and intrusion-detection system logs in addition to server, workstation, and application logs consolidated within an enterprise security information management (ESIM) system. Logs generated from network-based devices are generally responsible for the bulk of logs monitored by an ESIM, with the remainder consisting of logs from the various endpoints and software deployed throughout the infrastructure. Perhaps one of the most overlooked sources of data t
A Peek At The Intel-McAfee Strategy
This week is McAfee's annual customer and partner event, and the first one since the announcement that Intel would acquire McAfee. The message at Focus is that the Intel-McAfee plan to secure all parts of the emerging highly distributed and massively diverse ecosystem -- from devices such as smartphones and tablets to large-scale virtualized servers -- in what is increasingly a SaaS and virtualized environment.
It's Not (Just) About EMR Software Security
We recently discussed a report that provided an overview of the security breach trends at 300 health care providers. Some took the post to be a condemnation of EHR security. That is too narrow of an interpretation. The post was meant to convey the lack of maturity, pervasive in the health care industry, when it comes to security controls.
Selecting Storage For Server Virtualization - Capacity
In this entry we will return to our series on selecting storage solutions for the virtualized server environment focusing now on dealing with capacity, storing the virtual server images and all their related data. For most environments shared storage is a presumed need, but making sure you purchase a system that can scale to meet future capacity requirements is critical.
Monitoring With Network Flow Technology
A network flow is a data entity that contains information related to a unidirectional sequence of packets on an IP network. Comprised of source and destination port and IP address information as well as IP protocol, ingress interface, and type of service (ToS) entries, the data (organized as flow records) serves to provide high-level insight into what is happening on the network. Every major routing and switching infrastructure vendor supports the generation of network flows in some iteration.
Insiders Still Remain Potential Powerful Threat
While malware and hacker attacks continue to make the headlines, recent events remind us that insiders still pose a potent threat.
Record Microsoft Patch Tuesday Ahead
Administrators, get your rest this weekend. According to Microsoft's advanced warning, next Tuesday is going to be a record-setter when it comes to software vulnerability updates.
Microsoft's PC Quarantine Plan
A plan by Microsoft Security Chief Scott Charney would place infected or unsecured PCs in an Internet isolation ward. And block users from Internet access.
Desktop Virtualization's Storage Challenges - Data Preservation
One of the biggest potential problems that desktop virtualization brings to a data center is the change to the data protection process. Often the assumption is that when the move to desktop virtualization happens the data center will protect the newly virtualized laptops/desktops. If that hadn't been the case before, the impact of the storage requirements of the virtual desktop may take the backup administrator off-guard.
Blocking Zero Days With EMET 2.0
Few security products I've used over the years are ones I would run on a Windows system on a daily basis. Of course, that would require me to run Windows on a daily basis, but if I did and I used it for daily activities like Web browsing, e-mail, etc., I wouldn't do so without the Microsoft Mitigation Experience Toolkit (EMET).
Which SSD Integration Method Is Best
As we continue our series on determining the best solid state storage system makes the most sense for your environment, another area to discuss is what integration method is best. In other words once the solid state storage is installed how will you get data to it and from it?
Who's Driving Your Security Bus?
When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.
Data Security: You're Doing It Wrong!
Pete Finnegan's recent webinar, "The Right Way to Secure Oracle," was pretty controversial. His message? Database security is not what's important -- data security is.
Understanding The Mindset Of The Evil Insider
Technology is typically going to serve as the basis for insider threat attacks. One of the major key technology areas is information extraction, and it must be clearly understood so an organization can try to stay one step ahead of the malicious insider.
Desktop Virtualization And Storage - Dealing With The Cost
In this entry we continue our series on Desktop Virtualization and the challenges it creates for the storage infrastructure. Today we focus on the problem of cost. As I mentioned in the opening entry of this series, cost is always a big concern. You are taking your least expensive storage, desktops and laptops, and more than likely putting it on your most expensive, shared storage. How do you keep cost
|
Everything You Need to Know About DNS AttacksIt's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask.
Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted.
Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Incident Readiness and Building Response Playbook
In this special report, learn the Xs and Os of any good security incident readiness and response playbook.
Tweet This
1 Comments
