Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/30/2010
08:24 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

nCircle And Core Security Announce Support For CAG

Companies announce jointly developed coverage map of the SANS Consensus Audit Guidelines

SAN FRANCISCO—November 30, 2010—nCircle, the leader in security and compliance auditing solutions, and Core Security Technologies, the leading provider of IT security testing solutions, today announced a jointly-developed coverage map of the SANS Consensus Audit Guidelines (CAG). Developed by a consortium of public and private security leaders, CAG requirements specifically cite the need for cyber-security controls that are tacitly proactive and can "inform defense" of actual attacks that have compromised systems, or those that could aspire to do so.

For government agencies and commercial businesses, use of nCircle and Core Solutions in concert allows for compliance with specific controls within eighteen of the twenty CAG requirements, including the ability to fully meet many of the security mandates.

“The twenty critical controls usher in a paradigm shift in cyber situational awareness. Offense must inform defense, and the CAG serves as an enlightened foundation upon which organizations should build their castles in cyberspace,” said Tom Kellermann, Vice President of Security Awareness, Core Security. “The partnership between nCircle and Core Security endows users with real-time, threat based risk metrics on the effectiveness of your twenty critical controls. The advanced blended attacks of 2010 demand it.”

“Many agencies and organizations have found the twenty critical controls to be a powerful way of prioritizing security requirements because they are meaningful to technical and business people alike – but organizations need an integrated approach to getting their hands around all of those moving parts,” noted Keren Cummins, nCircle's Director, Federal Market. “nCircle and Core Security have come together to show that you don’t need twenty vendors to provide best of breed coverage for the majority of the CAG controls.”

Click here to access the nCircle/Core Security Coverage Map of the Consensus Audit Guideline Critical Security Controls.

nCircle's solutions includes IP360™ for vulnerability management and risk management, WebApp360™ for web application vulnerability auditing, Configuration Compliance Manager™ (CCM) for configuration auditing of servers, desktops and network devices and file integrity monitoring, and Suite360 Intelligence Hub™ for IT governance, risk and compliance (ITGRC) reporting and analytics. nCircle Suite360 includes policies for NIST, CIS benchmarks, Microsoft, Oracle, VMware, HIPAA, Sarbanes-Oxley, FDCC, DISA STIG, ISO 27001 and more, enabling organizations to efficiently determine the security and compliance of their networks.

About nCircle

nCircle is the leading provider of automated security and compliance auditing solutions. More than 4,500 enterprises, government agencies and service providers around the world rely on nCircle's proactive solutions to manage and reduce security risk and achieve compliance on their networks. nCircle has won numerous awards for growth, innovation, customer satisfaction and technology leadership. nCircle is headquartered in San Francisco, CA, with regional offices throughout the United States and in London and Toronto. Additional information about nCircle is available at www.ncircle.com.

About Core Security Technologies Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and prove real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security’s software solutions build on over a decade of trusted research and leading-edge threat expertise from the company’s Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at on the Web at: http://www.coresecurity.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).