Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/26/2007
04:00 AM
50%
50%

The Gifts That Keep on Giving

Holiday gifts of gadgets and storage devices can create nightmares for IT

2:00 PM -- With Christmas only one day behind us, are you ready for the influx of new digital gifts into your network? New storage devices in the form of portable musical players and USB thumb drives hidden in a pen. Phones that include digital organizers and PDAs. Laptops. New 802.11 WiFi or Bluetooth wireless networking devices.

These new devices pose a real threat to your organization's security. If you haven't already taken measures to protect yourself, then it's time to hunt down rogue devices that could accidentally lead to a breach in your network.

New laptops plugging into the network are an everyday issue for many organizations. In an ideal world, companies facing this problem will already have a mechanism in place to prevent unknown machines from plugging in: network access control, network port security that restricts access to known MAC addresses, or a program that requires machines be registered before getting a usable IP address.

Some methods for protecting the network against rogue laptops will be similar to those used to restrict mobile device access. Most users don't realize that the convenience of wireless networking, especially when unsecured and unknown to corporate IT, is a huge security risk.

Portable storage devices -- MP3 players, thumb drives, and even digital photo frames -- are a stickier situation. Some organizations take the extreme approach, putting epoxy in the USB ports to prevent their use. This is the poor man’s way of stopping unauthorized USB devices, and it isn't very practical.

There are other ways to handle the problem, such as modifying the Windows Registry or buying a software solution that can control USB devices. Many antivirus vendors are including security features that can control USB device access -- some even allow access only to pre-defined device serial numbers.

These threats aren't new, but they require closer attention during the holiday season, when users get new gifts that they are itching to try out and impress their coworkers with. If you've not already taken measures to protect against these things, it may be too late now. But look on the bright side -- you've got a year to prepare for the next holiday season.

— John H. Sawyer is a security geek on the IT Security Team at the University of Florida. He enjoys taking long war walks on the beach and riding pwnies. When he's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .