Network Security

  • Most Topular Stories

  • Hackers could start abusing electric car chargers to cripple the grid, researcher says

    Computerworld Network Security News
    11 Apr 2013 | 8:07 am
    Hackers could use vulnerable charging stations to prevent the charging of electric vehicles in a certain area, or possibly even use the vulnerabilities to cripple parts of the electricity grid, a security researcher said during the Hack in the Box conference in Amsterdam on Thursday.

  • Large Attacks Hide More Subtle Threats In DDoS Data

    Dark Reading - All Stories
    18 May 2013 | 5:19 am
    While distributed denial-of-service attacks topping 100Gbps garner the headlines, they are not the threat that should worry most companies

  • Security War Games

    Dark Reading - All Stories
    17 May 2013 | 1:53 pm
    Information security keeps evolving but our educational methods are not evolving rapidly enough to win the cold cyberwar.

  • Network Security Podcast, Episode 308

    Network Security Blog
    netsecpodcast@mckeay.net (Martin McKeay)
    2 Apr 2013 | 3:51 pm
    Getting three security professionals to slow down long enough to record a podcast together is always a challenge and tonight was harder than usual.  Part of the problem is that there are so many interesting stories going on right now.  But the fact that we all have jobs and families is a much bigger part of it.  This week we talk about HSM in the cloud, DDoS attacks, and of course, our government spying on us.  Such unfamiliar territory. Network Security Podcast, Episode 308, April 2, 2013 Time: 40:17 Show notes: AWS CloudHSM – Secure Key Storage and Cryptographic Operations Killing…

  • How can we keep infosec pros a step ahead of the bad guys?

    Computerworld Security News
    16 May 2013 | 6:24 am
    Attacks on digital assets are on the rise, and the black hats get more inventive every day. How should educators prepare tomorrow's information security gurus?
 
  • add this feed to my.Alltop

    Computerworld Security News

  • Texas drone bill sparks a battle

    17 May 2013 | 1:11 pm
    The battle to find a balance between privacy concerns and the beneficial use of drones for commercial and law enforcement purposes is in sharp focus in a bill that's winding its way through the Texas legislature.

  • Police arrest Anonymous suspects in Italy

    17 May 2013 | 10:42 am
    Italian police arrested four suspected hackers Friday, accusing them of having taken control of the Italian branch of the Anonymous network.

  • Tech Titans Talk: The IDG Enterprise Interview Series

    17 May 2013 | 7:15 am
    In the IDG Enterprise Interview Series, you'll hear from technology CIOs and CEOs on today's burgeoning trends, ongoing headaches and upcoming product plans. Check out this informative series from IDG Enterprise Chief Content Officer John Gallant and his team of editors.

  • Four former LulzSec members sentenced to prison in the UK

    16 May 2013 | 11:11 am
    Four British men associated with the LulzSec hacker collective received prison sentences Thursday for their roles in cyberattacks launched by the group against corporate and government websites in 2011.

  • How can we keep infosec pros a step ahead of the bad guys?

    16 May 2013 | 6:24 am
    Attacks on digital assets are on the rise, and the black hats get more inventive every day. How should educators prepare tomorrow's information security gurus?
 
  • add this feed to my.Alltop

    Network Security Blog

  • Network Security Podcast, Episode 312

    netsecpodcast@mckeay.net (Martin McKeay)
    14 May 2013 | 4:38 pm
    Rich is dealing with some sick babies, so Martin and Zach inadvertently make the show about corporate and government (not just the U.S. this time!) surveillance. Network Security Podcast, Episode 312, May14, 2013 Time: 38:26 Show notes: How the Syrian Electronic Army Hacked The Onion U.S. Weighs Wide Overhaul of Wiretap Laws FBI’s Latest Proposal for a Wiretap-Ready Internet Should Be Trashed Bloomberg reporters allegedly used financial terminals to spy on Wall Street A Saudi Arabia Telecom’s Surveillance Pitch Tonight’s Music: London Girl by Lato What didn’t make the show:…

  • Network Security Podcast, Episode 311

    netsecpodcast@mckeay.net (Martin McKeay)
    1 May 2013 | 6:10 pm
    Long show with short notes this week as Wade Baker of Verizon and Josh Corman of Akamai join us to talk about the Verizon Data Breach Investigations Report. This is a must-read report and our short podcast can’t possibly do it justice, but we made our best effort.  Listen to the end, we have some big news! Network Security Podcast, Episode 311, May 1, 2013 Time: 48:49 Show notes: The 2013 Verizon DBIR Tonight’s Music: Tipping – Marucci – Dube  with I’m Confused

  • Network Security Podcast, Episode 310

    netsecpodcast@mckeay.net (Martin McKeay)
    23 Apr 2013 | 3:36 pm
    After a hectic couple of weeks — conferences, travel, and city-wide lockdowns – recovery is sorely needed, but we push through a relatively lively show with a teaser for a bigger debate^Wdiscussion slated for next week.  And somehow the podcast just keeps getting a little longer every week. Network Security Podcast, Episode 310, April 23, 2013 Time: 43:06 Show notes: Japanese police ask ISPs to start blocking Tor Post Boston: Privacy advocates warn about coming tsunami of surveillance cameras Law professor makes a case for legally recognizing the Dangers of Surveillance US House…

  • Network Security Podcast, Episode 309

    netsecpodcast@mckeay.net (Martin McKeay)
    9 Apr 2013 | 4:13 pm
    Due to a last minute work engagement, Rich is not present on tonight’s show. Martin and Zach attempt to compensate for Rich’s absence by being snark but also half-asleep.  We’ll leave it to you to figure out which half of that we feel is most like Rich. Network Security Podcast, Episode 309, April 9, 2013 Time: 41:04 Show notes: Apple’s iMessage encryption trips up feds’ surveillance Google will fight secretive national security letters in court Privacy group calls for changes in CISPA cyberthreat sharing bill Unlocking the Motorola Bootloader Key Lulzsec…

  • Network Security Podcast, Episode 308

    netsecpodcast@mckeay.net (Martin McKeay)
    2 Apr 2013 | 3:51 pm
    Getting three security professionals to slow down long enough to record a podcast together is always a challenge and tonight was harder than usual.  Part of the problem is that there are so many interesting stories going on right now.  But the fact that we all have jobs and families is a much bigger part of it.  This week we talk about HSM in the cloud, DDoS attacks, and of course, our government spying on us.  Such unfamiliar territory. Network Security Podcast, Episode 308, April 2, 2013 Time: 40:17 Show notes: AWS CloudHSM – Secure Key Storage and Cryptographic Operations Killing…
 
  • add this feed to my.Alltop

    Crave: gorgeous gadgets and other crushworthy stuff. - CNET

  • A look back at NASA's planet-pinpointing space 'scope

    19 May 2013 | 12:01 am
    (Credit: NASA/Ames/JPL-Caltech) NASA announced this week that a key piece of gear on its Kepler space telescope has run into trouble. And though the space agency hasn't given up on a jump-start, the mission may well be at risk. It's already gone well beyond its planned duration, however, and presented us with many fascinating discoveries. In this gallery, we take a look back at that mission -- at Kepler's intriguing quest to find Earth-like, life-friendly planets among the Milky Way's many stars. Requiem for Kepler? NASA's pioneering planet-finder (pictures) 1-2 of 30 Scroll Left Scroll Right…

  • Verizon Galaxy S4 starts shipping early

    18 May 2013 | 8:09 pm
    Forwarded from a reader who goes by "Delons." (Credit: Screenshot by Eric Mack/CNET) Big Red looks to be feeling the heat to get its take on Samsung's new Galaxy S4 into the hands of customers. Verizon customers have begun to report receiving notifications from the carrier that their new Android superphones have shipped earlier than expected. Related storiesSamsung Galaxy S4 (review)Where and when to buy the Samsung Galaxy S4Samsung plans a hard-core Galaxy S4, says report While I've yet to see video footage, I can only assume that many happy dances have followed receipt of these…

  • Teen dies trying to hold onto iPad during theft, police say

    18 May 2013 | 12:30 pm
    (Credit: CNET) It's a natural instinct to resist if someone tries to steal something out of your hand. In Las Vegas on Thursday afternoon, that instinct might have cost a 15-year-old boy his life. As the Las Vegas Sun reports, Marcos Vincente Arenas was walking down the street, holding an iPad. Police say an SUV pulled up alongside him. A man allegedly got out of the passenger seat and tried to wrest the iPad from Arenas. The teen wouldn't let go of the device, so, investigators say, he was dragged along by the alleged thief toward the vehicle. He was still near the passenger door when the…

  • Previously, on 'Arrested Development': NPR's epic guide to the show's running gags

    18 May 2013 | 10:58 am
    Good grief! A wealth of "Arrested Development" references, including all references to Peanuts. (Credit: Screenshot by Eric Mack/CNET) Watch out for that stair car... and any of the other numerous running jokes from resurrected cult hit "Arrested Development." In honor of the show's triumphant return to Netflix, with 15 new episodes set to start streaming May 26, NPR has compiled, logged, and cross-referenced all the recurring gags from the show's original three seasons to make sure you don't miss a beat. Related stories'Arrested Development' trailer peeks at new Netflix…

  • How to really, really make your naked Snapchat photos disappear

    18 May 2013 | 10:21 am
    To erase or not to erase? That is the question. (Credit: Screenshot by Chris Matyszczyk/CNET) The attractions of Snapchat are essentially intellectual. In creating the conditions for a spontaneous "now you see me, now you don't" aspect to your life, it allows for a greater and more nuanced level of excitement to permeate human relationships. Recently, however, there have been concerns that the topless, bottomless, or merely hapless shots sent by Snapchat users might not truly disappear. They remain stored in the nether regions of your phone, able to be retrieved by a nosy policeman, parent,…
 
  • add this feed to my.Alltop

    Network Security Podcast

  • Network Security Podcast, Episode 312

    quine
    14 May 2013 | 4:37 pm
    Rich is dealing with some sick babies, so Martin and Zach inadvertently make the show about corporate and government (not just the U.S. this time!) surveillance. Network Security Podcast, Episode 312, May14, 2013 Time: 38:26 Show notes: How the Syrian Electronic Army Hacked The Onion U.S. Weighs Wide Overhaul of Wiretap Laws FBI’s Latest Proposal for a Wiretap-Ready Internet Should Be Trashed Bloomberg reporters allegedly used financial terminals to spy on Wall Street A Saudi Arabia Telecom’s Surveillance Pitch Tonight’s Music: London Girl by Lato What didn’t make the show:…

  • Network Security Podcast, Episode 311

    rmogull
    1 May 2013 | 6:07 pm
    Long show with short notes this week as Wade Baker of Verizon and Josh Corman of Akamai join us to talk about the Verizon Data Breach Investigations Report. This is a must-read report and our short podcast can’t possibly do it justice, but we made our best effort.  Listen to the end, we have some big news! Network Security Podcast, Episode 311, May 1, 2013 Time: 48:49 Show notes: The 2013 Verizon DBIR Tonight’s Music: Tipping – Marucci – Dube  with I’m Confused

  • Network Security Podcast, Episode 310

    quine
    23 Apr 2013 | 3:34 pm
    After a hectic couple of weeks — conferences, travel, and city-wide lockdowns – recovery is sorely needed, but we push through a relatively lively show with a teaser for a bigger debate^Wdiscussion slated for next week.  And somehow the podcast just keeps getting a little longer every week. Network Security Podcast, Episode 310, April 23, 2013 Time: 43:06 Show notes: Japanese police ask ISPs to start blocking Tor Post Boston: Privacy advocates warn about coming tsunami of surveillance cameras Law professor makes a case for legally recognizing the Dangers of Surveillance US House…

  • Network Security Podcast, Episode 309

    quine
    9 Apr 2013 | 4:12 pm
    Due to a last minute work engagement, Rich is not present on tonight’s show. Martin and Zach attempt to compensate for Rich’s absence by being snark but also half-asleep.  We’ll leave it to you to figure out which half of that we feel is most like Rich. Network Security Podcast, Episode 309, April 9, 2013 Time: 41:04 Show notes: Apple’s iMessage encryption trips up feds’ surveillance Google will fight secretive national security letters in court Privacy group calls for changes in CISPA cyberthreat sharing bill Unlocking the Motorola Bootloader Key Lulzsec…

  • Network Security Podcast, Episode 308

    quine
    2 Apr 2013 | 3:50 pm
    Getting three security professionals to slow down long enough to record a podcast together is always a challenge and tonight was harder than usual.  Part of the problem is that there are so many interesting stories going on right now.  But the fact that we all have jobs and families is a much bigger part of it.  This week we talk about HSM in the cloud, DDoS attacks, and of course, our government spying on us.  Such unfamiliar territory. Network Security Podcast, Episode 308, April 2, 2013 Time: 40:17 Show notes: AWS CloudHSM – Secure Key Storage and Cryptographic Operations Killing…
  • add this feed to my.Alltop

    About.com Internet / Network Security

  • Tips For Hiding From Google

    12 May 2013 | 12:30 pm
    Do you feel like Google has too much information about you in its massive databases? Wouldn't it be nice if you could shut your virtual blinds and hide from Google? In this week's featured article: How to Hide From Google...Read Full Post

  • Stealth Yourself Online

    30 Apr 2013 | 4:06 pm
    Do you ever feel like you wish you could use Harry Potter's cloak of invisibility while you're online? Whether it's Spammers, hackers, or scammers that you are trying to avoid, in this week's featured article:  5 Ways to Stealth Yourself Online, we'll help you in your quest to try and drop off the Internet radar screen for awhile....Read Full Post

  • How to Keep Track of Your Kids with Geofences

    30 Apr 2013 | 3:15 pm
    Do you worry about where your kids are and what they're doing when you're not around? Every parent does. GPS-enabled smartphone technology has come a long way over the past few years and now your child's worst parental control-related nightmare has been realized? Welcome to the wonderful world of Geofences....Read Full Post

  • Small Business Network Security Tips

    28 Apr 2013 | 6:29 am
    You may be a small business but you could also be a big target for hackers, cybercriminals, and perhaps even disgruntled employees. In this week's featured article, we'll discuss Network Security Tips for Small Businesses. We'll go over some cost-conscious strategies for getting the most out of your limited security budget and we'll help you focus on what's most important: protecting your resources and your data....Read Full Post

  • Taming Your Firewall - Best Practices for Firewall Management

    17 Apr 2013 | 1:18 pm
    Are you the person who has to manage your organization's network firewall? Firewall management can be a challenge, especially if you inherit poorly documented firewall rules and ACLs from the previous firewall administrator....Read Full Post
 
  • add this feed to my.Alltop

    Feed: Blogs

  • Week 7 Link Dump

    George Chetcuti
    17 May 2013 | 7:12 am
    Weekly link dump topics – Prison sentences hacking & unauthorised acts, who was Avunit?, cyber-attacks, safeguard critical businesses, Botnet, Google Wallet, Stuxnet, APT, Linux vulnerability and more…

  • Domain Generation Algorithms (DGA)

    George Chetcuti
    16 May 2013 | 7:33 am
    Why are threat actors increasingly turning to malware with DGA capabilities?

  • Samsung Knox on S4 gets approval from DoD

    Debra Shinder
    15 May 2013 | 9:02 am
    The recently released Galaxy S4 is one of the hottest smart phones of the year. It includes plenty new features, one of which is the Knox security software.

  • Passwords most commonly tried by crackers

    Debra Shinder
    15 May 2013 | 8:57 am
    One of the most basic ways to gain unauthorized access to a system is to simply guess the password. Ever wonder what password crackers are most likely to try?

  • Solutions vs. Problems

    Debra Shinder
    14 May 2013 | 8:47 am
    If you're asking management to invest company dollars into new security technologies, be sure that investment will result in solutions - not create more problems.
 
  • add this feed to my.Alltop

    TaoSecurity

  • Practice of Network Security Monitoring Table of Contents

    29 Apr 2013 | 3:38 pm
    Since many of you have asked, I wanted to provide an updated Table of Contents for my upcoming book, The Practice of Network Security Monitoring. The TOC has only solidified in the last day or so. I delayed responding until I completed all of the text, which I did this weekend. You can preorder the book through No Starch. Please consider using the discount code NSM101 to save 30%. I'm still on track to publish by July 22, 2013, in time to teach two sessions of my new course, Network Security Monitoring 101, in Las Vegas. I'll be using the new book's themes for inspiration but will likely have…

  • Bejtlich Teaching New Class at Black Hat in July

    21 Apr 2013 | 7:57 am
    I'm pleased to announce I will teach two sessions of a brand-new two day class at Black Hat USA 2013 this summer. The new class is Network Security Monitoring 101. From the overview: Is your network safe from intruders? Do you know how to find out? Do you know what to do when you learn the truth? If you are a beginner, and need answers to these questions, Network Security Monitoring 101 (NSM101) is the newest Black Hat course for you. This vendor-neutral, open source software-friendly, reality-driven two-day event will teach students the investigative mindset not found in classes that focus…

  • Mandiant APT1 Report: 25 Best Commentaries of the Last 12 Days

    2 Mar 2013 | 5:51 pm
    Two weeks ago today our team at Mandiant was feverishly preparing the release of our APT1 report. In the twelve days that followed publication on the evening of Monday the 18th, I've been very pleased by the amount of constructive commentary and related research published online. In this post I'd like to list those contributions that I believe merit attention, in the event you missed them the first time around. These sorts of posts are examples of what the security community can do to advance our collective capability to counter digital threats. Please note I avoided mass media accounts,…

  • Recovering from Suricata Gone Wild

    24 Feb 2013 | 8:43 am
    Recently I tried interacting with one of my lab Security Onion sensors running the Suricata IDS. I found the Sguil server was taking a really long time to offer services on port 7734 TCP. Since I hadn't worked with this lab system in a while, I guessed that there might be too many uncategorized events in the Sguil database. I dusted off an old blog post titled More Snort and Sguil Tuning from 2006 and took a look at the system. First I stopped the NSM applications on the server. sudo service nsm stopStopping: securityonion * stopping: sguil server [ OK ]Stopping: HIDS * stopping: ossec_agent…

  • Using Bro to Log SSL Certificates

    22 Feb 2013 | 6:21 pm
    I remember using an older version of Bro to log SSL certificates extracted from the wire. The version shipped with Security Onion is new and that functionality doesn't appear to be enabled by default. I asked Seth Hall about this capability, and he told me how to get Bro to log all SSL certs that it sees. Edit /opt/bro/share/bro/site/local.bro to contain the changes as shown below. diff -u /opt/bro/share/bro/site/local.bro.orig /opt/bro/share/bro/site/local.bro--- /opt/bro/share/bro/site/local.bro.orig 2013-02-23 01:54:53.291457193 +0000+++ /opt/bro/share/bro/site/local.bro 2013-02-23…
  • add this feed to my.Alltop

    Roger's Security Blog

  • Is there a future for Product Certifications?

    rhalbheer
    17 May 2013 | 2:09 am
    Often, when I talk to customers, product certification is one of the key themes they want to address. Especially they want to know about our commitment to Common Criteria and whether our products are certified. Typically we certify an operating system on Common Criteria EAL 4+ - the highest level, which seems achievable for multi-purpose operating systems. However, personally I do not think that product certifications are the future for different reasons: The certification is static. In other words, there is a configuration at a given time, with a given product build, which is certified. The…

  • Will the user define security policies in the future?

    rhalbheer
    14 May 2013 | 12:39 am
    I think, I blogged about this event already earlier: Years ago I was meeting a customer and was talking about the future of IT. I was telling the audience (about 10 people including the Security Officer) that there is a good chance that IT will not define a set of hardware anymore but that the user will buy their own and use it for business. Additionally, different people have different needs and my notebook is setup differently than a lot of others within Microsoft's internal network – just because I have different needs and I use one piece of hardware for private and business. Actually in…

  • Some Windows XP Users Can't Afford To Upgrade

    rhalbheer
    23 Apr 2013 | 8:18 am
    I just read a post on slashdot: During a recent trip to an eye doctor, I noticed that she was still using Windows XP. After I suggested that she might need to upgrade soon, she said she couldn't because she couldn't afford the $10,000 fee involved with the specialty medical software that has been upgraded for Windows 7. Software written for medical professionals is not like mass market software. They have a limited market and can't make back their money in volume because there isn't the volume for an eye doctor's database product like there is for Office or Quicken. With many expecting…

  • Microsoft Account: Enable Two-Step Verification

    rhalbheer
    19 Apr 2013 | 2:06 am
    We could even talk about two-factor authentication in my opinion. The idea is, that whenever you logon from an untrusted PC, you will be asked to use a second factor (or step). In my case, which I show below, I use the Authenticator app on my phone, which is similar to an RSA SecureID. How to set it up? Fairly easy: Logon to your Microsoft Account (formerly LiveID) on https://account.live.com . There you have all your account settings. Go to your Security Info: And choose Set up two-step verification, which will guide you through the wizard: Once you are done, get back to your Security Info…

  • Internet Accessible SCADA Systems

    rhalbheer
    25 Mar 2013 | 12:21 am
    This is a fairly scary view of the world…. Freie Universität Freiburg mapped the Internet accessible SCADA systems. Have a look on your own: https://www.scadacs.org/projects.html Roger
  • add this feed to my.Alltop

    Spyware news

  • Scammers use fake telephone support for extorting money

    2-spyware.com Support
    19 May 2013 | 5:10 am
    Day by day, scammers use smarter methods for swindling the money from PC users. After relying on alerts that report about invented threats and then offer to purchase useless program, now they are starting a new era of tricking their victims. It is based on a misleading telephone support, which promises to fix the PC remotely. Of course, it is done NOT for free and it is useless. You must have encountered or heard about those fake pop up ads that interrupt user’s browsing session and offer installing a free scanner in order to check the system for potential security risks. After getting…

  • Fake Amazon emails spread malware

    2-spyware.com Support
    18 May 2013 | 6:04 am
    2spyware security center announces about the widespread attack, which works under the name of Amazon. It seems that it is set to attack United Kingdom in the first place because this virus spreads via emails presented as the message from its UK branch. If you happen to receive an email, which has the attachment about an order for an unnamed item, you should firstly think twice and make sure that you have ordered something from Amazon recently. If you have been tricked to download the malicious attachment on your computer, please run a full system scan with updated anti-spyware. If you receive…

  • How to start Safe Mode on Windows 8

    2-spyware.com Support
    11 May 2013 | 6:34 am
    Windows 8 has been available for more than half a year, so its normal that scammers have modified their viruses to get ability to attack this operating system easily. According to our security experts, such ransomwares as FBI virus, FBI PayPal virus or White Screen virus are now capable to invade Windows 8 without any sign. In addition, we won’t have to wait for ages until rogue anti-spywares and other threats will start infecting machines running this operating system as well. Since it’s still a relatively new system, we have decided to write a tutorial on how you can boot your…

  • Avoid wasvideo.com because it may hack your Facebook account!

    2-spyware.com Support
    30 Mar 2013 | 5:05 am
    Have you heard about Scambook? This is a site, which has been created to protect Facebook users and their accounts. Here you can find all the latest information about most of the Facebook scams and also announce one if you notice anything suspicious on this social network. The latest trickery, which was reported on the Scambook some days ago, includes the phishing site wasvideo.com. You must stay away from this website because it has been noticed for stealing Facebook login data and other sensitive information. Of course, scammers apply misleading methods for making people visit this site…

  • A couple of new facts about FBI virus and its prevention

    2-spyware.com Support
    14 Mar 2013 | 7:06 am
    No matter that FBI virus can no longer be called a new or freshly-released virus, security researchers still fight against it. In order to make sure that you are not among those Internet users on the planet who haven’t heard about this dangerous ransomware, we’ll keep writing the posts explaining how to remove this infection and, most importantly, how to prevent it. The newest fact that should be known by all PC owners is that you don’t need to enter illegal site or download freeware in order to get infected with FBI virus. Now it can attack your PC while watching…
 
  • add this feed to my.Alltop

    Uncommon Sense Security

  • You know stuff. Share it. We’ll help.

    2 May 2013 | 5:00 am
    You know stuff, you’ve seen interesting things, done interesting research, have a unique perspective.  You also know that the ability to communicate effectively deliver your message to an audience is critical to professional success.  But you haven’t spoken at a major event, and you need some advice and encouragement.  Maybe you are intimidated by public speaking- that’s very common (there’s even a word for this common fear, glossophobia).  Well, we’re here for you.  By “we”, I mean the BSides community in general, and in this case BSides Las Vegas in…

  • The envelopes please…

    1 May 2013 | 10:11 am
    I had a great time in London last week, I finally got to BSides London, had a good show at InfoSecurity Europe, and talked to partners and customers- and I got to co-host the second annual (we can call it that after only two, right?) Security Bloggers Meetup and first European Security Bloggers awards.  The blogger gathering was great, I got to meet and catch up with a lot of folks I don’t often see, and there were a lot of great conversations throughout the evening. About those awards- the winners were: The Best Corporate Security Blog Sophos Naked Security Blog Best Security Podcast…

  • European Security Bloggers’ Awards

    12 Apr 2013 | 5:04 pm
    The European Security Bloggers’ Meetup is getting closer, and the nominations are in for the first European Security Blogger Awards.  Voting is now open at https://www.surveymonkey.com/s/EUSecurityBloggerAwards.  The rules are simple: Only one vote per person. How many votes per person? One We reserve the right to validate any of the votes by using the contact details given. Judges' decision is final. The purpose of the awards is to provide a fun platform to recognise those who share with the community. Please respect the spirit of the awards. The Meetup will be on Tuesday the…

  • Digital Natives, Digital Savages, and immigration

    3 Apr 2013 | 8:24 pm
    It has been a while since I’ve written about “Digital Natives”, but Krypt3ia’s recent post Digital Natives, Digital Immigrants, Exo-Nationals and The Digital Lord of The Flies has me thinking about it again.  He raises some great points in that post, and I would like to add a few thoughts of my own.  If you haven’t seen it already, take a few minutes to read Krypt3ia’s post, and I’ll meet you back here. I think about the generational issues in technology and security, and only partly because I’m old.  Generational anomalies have intrigued me since I was a…

  • European Security Bloggers Meetup and Awards

    19 Mar 2013 | 5:59 pm
    This year will be the second annual European Security Bloggers’ Meetup, and will include the first European Blogger Awards.  The meetup will be Tuesday evening, the 23rd of April, from 18:00-21:00, in Kensington (London) near the Earls Court conference center (the site of InfoSecurity Europe). BSides London is the following day, so it will be a busy week- join us for a relaxing and conversational evening before the madness gets overwhelming. If you are a security blogger or podcaster, please sign up at the event’s Eventbrite page to get all the details. Also, if you are a European…
  • add this feed to my.Alltop

    cissp CISSP training Certified Information Systems Security Professional

  • FBI IC3 2012 Internet Crime Report

    Posted by cdupuis
    19 May 2013 | 12:38 am
    As seen on the excellenthttp://www.stefanomele.it web site: The FBI Internet Crime Complaint Center (IC3) has released the 2012 Internet Crime Report — a summary of reported fraudulent activity, including data and statistics. In 2012, the IC3 received and processed 289,874 complaints, averaging more than 24,000 complaints per month. Unverified losses reported to IC3 rose 8.3 percent over the previous year.A new section in this year’s report includes charts for each of the 50 states detailing demographic, complaint, and dollar-loss data. The section allows for easy comparisons and…

  • The Holistic CISSP Exam Preparation and Overview Tutorial

    Posted by cdupuis
    15 May 2013 | 2:19 pm
    Good news! Today I have updated my holistic presentation on How to become a CISSP. This presentation will tell you ALL that you need to know from step A to Z. You can find it at: https://www.cccure.org/flash/intro/player.html This is a MUST watch for anyone interested in completing the CISSP certification. Enjoy! Clement  

  • Webinar: CompTIA Advanced Security Professional (CASP)

    Posted by cdupuis
    13 May 2013 | 6:51 am
    Here is a webcast you don't want to miss.My friend Eric Conrad will be doing a webcast tomorrow on the new CASP Certification from CompTIA. Visit the link below to register: https://www.sans.org/webcasts/prepare-comptia-casp-exam-96525 On the exciting side, The CASP was added to DoD 8570 for the following roles: IAT level IIIIAM II, and IASAE level I and II. You can see the updated 8570 list of approved certifications at: http://iase.disa.mil/eta/iawip/content_pages/iabaseline.html  Here is the latest list of approved certs on the graphic below: DoD Approved 8570 Baseline Certifications

  • NIST Announces the Final Release of SP 800-53 Revision 4

    Posted by cdupuis
    2 May 2013 | 9:16 pm
    NIST Announces the Final Release of SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations To view the full announcement of this document and the updates made to improve this document, please visit the Computer Security Resource Center (CSRC) News/Announcement page:  http://csrc.nist.gov/news_events/#apr30 Here is the link to the Special Publications page on CSRC to view/download the document:http://csrc.nist.gov/publications/PubsSPs.html#800-53 **Please note** When clicking link to the PDF file, you will notice the link as…

  • Official (ISC)2 Guide to the CISSP CBK, Third Edition is available

    Posted by cdupuis
    1 May 2013 | 1:32 am
    Good news to all, Finally it was announced today that the Official (ISC)2 Guide to the CISSP CBK, Third Edition will be available in Ibook format and also in Kindle format as a single file for the whole book.   This is a very welcome move from ISC2. IBOOK FORMAT (also called "i"-dittion or I-Dittion) Purchase the complete book in IBook format with all ten domains for only  US$69.99 or you can buy individual domains for US$12.99 each.  I am still disappointed to see that single domains are still costing twice as much per domain as buying the whole book.   Buying…
  • add this feed to my.Alltop

    Hackers For Charity

  • May 16 2013

    Johnny
    17 May 2013 | 4:39 am
    Some of you remember Loko village. After that rebuild, we tried to start a work program there to help people that didn’t have jobs or skills. Nobody showed up to the free training, and that’s when I pulled away. Pastor Jesse and I couldn’t really see pushing hard into an area where there was no effort on the part of the residents. Since some of the residents were renting their rooms to others, we gave the tenants six months of free rent, then had the landlords agree to let the tenants stay at the previous rate for another six months. We were told that the “squatter…

  • Tuesday May 14 2013

    Johnny
    14 May 2013 | 9:14 am
    Snuck off to Kenya Saturday night to surprise my daughter for her birthday. Jen had arrived two nights before to surprise her and I surprised them both. I rode for twelve hours on a bus packed full of Sudanese families, their chickens, farm implements and what seemed like all their belongings. There were people two to a seat and wedged in every imaginable space including sprawled out in the aisles. Oh, and the Rastafari-Kenyan driver cranked reggae the whole night on the BANGING sound system and rolled and smoked a joint twenty minutes into the trip. At a police check, he pulled out his log…

  • Thursday May 9, 2013

    Johnny
    11 May 2013 | 7:30 am
    I still haven’t gotten used to blogging every day. So I’m missing days. Sorry about that. It’s just too easy to get heads down into work and forget. Lots of things going in the last few days and when I look at it all it does seem like quite the hodgepodge but that’s what life is like here. I can’t easily answer the question, “So what do you do?” There was a time when that was a straightforward thing to answer. Not anymore. The past few days reflect that. We had visitors from YWAM that we met at the Keep who took an interest in our leather project.

  • Tuesday May 7, 2013

    Johnny
    8 May 2013 | 12:16 am
    There are times when I just scratch my head and confused, wonder what I’m supposed to do. Do I belong here? Is it time to move on, scale back, do something different? I’d like to say I have these deep contemplative moments often as they would likely help me keep on course but most often I have these thoughts when I’m broke. And last week, I had those thoughts because we were broke. We weren’t just running low on cash, we were completely out of money. We paid our staff, and that was the end of it. It was so bad that we didn’t have money to buy cooking gas or…

  • Saturday May 4, 2013

    Johnny
    7 May 2013 | 3:41 am
    A busy few days and I’m too tired to write a lot, and besides my posts have been running pretty long, so I’ll summarize. Stuff worked on: More iPhones. Some really odd-looking and quite old Macs for repair (G3′s!). More iPhones. iPhones. Sheesh. Lots and lots of writing as I prepare to pre-release the Volunteer Network to some trusted friends. Work on the Volunteer Network with Vito Leather work – began work on some new watch bands and helped with some “special-order” belts Hosting the Busoga Traditional Dance Troupe Performing at The Keep.   Ancient…
 
  • add this feed to my.Alltop

    Schneier on Security

  • Friday Squid Blogging: Striped Pyjama Squid Pet Sculpture

    schneier
    17 May 2013 | 2:57 pm
    Technically, it's a cuttlefish and not a squid. But it's still nice art. I posted a photo of a real striped pyjama squid way back in 2006. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

  • Applied Cryptography on Elementary

    schneier
    17 May 2013 | 12:59 pm
    In the episode that aired on May 9th, about eight or nine minutes in, there's a scene with a copy of Applied Cryptography prominently displayed on the coffee table. This isn't the first time that my books have appeared on that TV show.

  • Bluetooth-Controlled Door Lock

    schneier
    16 May 2013 | 6:45 am
    Here is a new lock that you can control via Bluetooth and an iPhone app. That's pretty cool, and I can imagine all sorts of reasons to get one of those. But I'm sure there are all sorts of unforeseen security vulnerabilities in this system. And even worse, a single vulnerability can affect all the locks. Remember that vulnerability found last year in hotel electronic locks? Anyone care to guess how long before some researcher finds a way to hack this one? And how well the maker anticipated the need to update the firmware to fix the vulnerability once someone finds it? I'm not saying that you…
  • add this feed to my.Alltop

    Zeroday 01100100011010010

  • Wireless Mic Research

    zeroday
    22 Apr 2013 | 9:21 pm
    During Source Boston I became fascinated by the idea of using SDR to listen in on wireless mics. It occurred to me that corporate meetings in hotels with lots of sensitive information are probably vulnerable to that type of eavesdropping. I looked into encrypted wireless mics but they are very expensive and I can’t imagine a lot of people outside of the Fortune 10, military, and some parts of the government can afford them. My first find was a page of wireless mics that were in the 700Mhz range and now banned by the FCC for intruding upon emergency communications. [1] @0xabad1dea…

  • Is Korean Law Driving Policy at Blizzard?

    zeroday
    6 Jul 2010 | 9:13 pm
    US customers of game maker Blizzard are up in arms tonight as news of a new policy is set to require all posts on the Blizzard forum to use their Real ID system. That means that every post is accompanied by the real first and last name of the user. People are unsure what to make of this and I haven’t seen any communication from Blizzard stating why they are making this change. I’m going to make the suggestion that South Korea’s Real Name System [is a driving force behind this decision]*. In 2009 South Korea’s government created a law that was meant to curb online…

  • Pax Musicana

    zeroday
    21 Feb 2010 | 1:59 pm
    Over the years friends have asked what I have against music services like iTunes. A week or two ago the term Pax Musicana crept into my subconscious and it captures the issue perfectly. My general disdain for digital services like iTunes, Amazon Kindle, and the like is that I am locked into a service and should I decide to wander to the next big thing I would have to rebuild my collection from scratch. I would have to abandon all the value I stored in that service because they refuse to let me take my purchases with me. The term Pax Musicana came to me as a concept of what these services…

  • My speech at the Works in Progress of Intellectual Property Conference

    zeroday
    2 Oct 2009 | 8:08 pm
    My notes for the talk I gave to a group of distinguished law professors at the Seventh Annual Works in Progress Intellectual Property (WIPIP) I am not a law professor i am and am not a hacker. the term hacker has undergone significant change in the last two decades so the meaning is ambiguous these days. let me give you this definition and for the sake of the next 4 mins of my talk consider it to the the authoritative one hackers are computer users who are adept enough to bend the function of a program to their will. security researchers are much like the hackers of the 1990′s but…

  • Repercussions of bad German laws on security research

    zeroday
    20 Sep 2009 | 11:43 am
    This month I’m conducting some research into web hosting security issues and ran into the aftermath of the German law passed in 2007 banning security research publication. The policy has had the effect of silencing security researchers from that country. While investigating issues in PHP security I came upon the Month of PHP Bugs website and when I attempted to download a proof of concept to illustrate what type of security issues PHP had back in 2007 I got an explanation from security researcher Stefan Esser explaining why he no longer feels comfortable publishing results to the…
  • add this feed to my.Alltop

    Infosec Events

  • Week 19 in Review – 2013

    Roxanne
    13 May 2013 | 8:53 am
    Event RelatedSyScan 2013SyScan13: Revisiting Mac OS X Rootkits presentation – reverse.put.as SyScan 2013, 10th anniversary edition is over! It is a great conference and I hope it does not end here. I had lots of fun and met new interesting people. Thomas is an awesome host! It helps that I really like Singapore and Asia in general.SyScan :: Download Section – syscan.org SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and experience…

  • Week 18 in Review – 2013

    Roxanne
    6 May 2013 | 5:31 am
    Event RelatedSyscan 2013SyScan 2013, Bochspwn paper and slides – gynvael.coldwind.pl In our SyScan presentation, we explained the concept of kernel race conditions in interacting with user-mode memory, gave a brief rundown on how they can be identified by using CPU-level instrumentation of an operating system session, and later focused on how they can be successfully exploited with the help of several generic techniques (on the example of three Windows vulnerabilities discovered by the Bochspwn project).Syscan 2013 – antid0te.com Index of /syscan_2013/ Keynote Address on Cyber…

  • Information Security Events For May

    sheila
    1 May 2013 | 6:27 am
    Here are information security events in North America this month:   Bsides San Antonio : May 4 in San Antonio, TX USA   Secure360 : May 13 to 15 in Minnesota USA  GovSec : May 13 to 15 in Washington DC USA   HackMiami 2013 : May 17 to 19 in Miami, Florida USA   BSides Boston : May 18 in Boston, MA USA   BSides Memphis : May 18 in Memphis, TN USA   IEEE Symposium on Security and Privacy : May 19 to 22 in San Francisco, California USA   CEIC : May 22 in Orlando, FL USA  BSides Denver 2013 : May 25…

  • Week 17 in Review – 2013

    Roxanne
    29 Apr 2013 | 6:41 am
    Event RelatedNotacon 10 (2013) Videos – irongeek.com These are the videos from the 10th Notacon conference held April 18th-21st, 2013. Not all of them are security related, but I hope my viewers will enjoy them anyway. Thanks to Froggy and Tyger for having me up, and to the video team: SatNights, Widget, Securi-D, Purge, Bunsen, Fry Steve and myself (at least that is who it was last year, if you got he names for 2013 let me know).AIDE 2013 – irongeek.com Recorded at AIDE 2013. Big thanks to Bill Gardner (@oncee) for having me out to record.Serial Offenders: Widespread Flaws in…

  • Week 16 in Review – 2013

    Roxanne
    21 Apr 2013 | 11:29 pm
    Event RelatedGreat Scott Gadgets Infiltrate 2013 – greatscottgadgets.com Michael Ossmann and Kyle Osborn presented Two-Timing Data Connectors at Infiltrate 2013. ResourcesNessusUsing Posh-SecMod PowerShell Module to Automate Nessus(Part1) – darkoperator.com One showed me some of the scripts they use and then it came to me why not automate Nessus from with in PowerShell.Security and Networking – Blog – Using Posh-SecMod PowerShell Module to Automate Nessus (Part3) – darkoperator.com We can retrieve a list of the reports available on the Nessus Server and the…
 
  • add this feed to my.Alltop

    Security Catalyst

  • Does practicing progress over perfection require lower standards?

    Michael Santarcangelo
    14 May 2013 | 6:23 am
    Sitting in the back of a dimly lit conference room for a client team meeting, I listened as each team member introduced themselves. I watched the reactions of their colleagues. Standing at the front of the room, the leader smiled and offered encouragement to everyone. As the line snaked to the front corner, he called for attention. It was time, he explained, to introduce a new face. An  industry powerhouse. Brought in to consult. To solve some challenging problems. The leader ran down a list of his impressive history. Then he pointed and asked the slender man to stand and introduce himself.

  • Understanding awareness, training, and development

    Michael Santarcangelo
    16 Apr 2013 | 6:25 am
    The key to learning and teaching new skills lies in a three-step advancement: awareness, training, and development. These steps guide learning new skills, including effective communication, how to build better passwords, and even activities like archery and yoga. Understanding this advancement allows us to build better communication. To ease the process of change. It’s a construct to build on, to model specific concepts. Each step plays a role in guiding the journey from where we are to where we need to be. By focusing on the needs of individuals, the entire organization advances. Getting…

  • When good intentions lead to bad password advice

    Michael Santarcangelo
    10 Apr 2013 | 5:31 am
    Ever ask someone “How does a password work?” I’m curious what the response is. I’ve spent the last decade working with companies to successfully change the way people build, use, and maintain passwords. I ask that question all the time. Seldom do I get the right answer. And even then, it takes some work to get the pieces right. Authentication is complex. Explaining the role of passwords in a meaningful way to influence and measure behavior change has eluded us for over 20 years. Done right, it requires an understanding of identification, authentication, assurance and privileges. Dry…

  • The Perfect Message Fallacy is a barrier to effective communication

    Michael Santarcangelo
    9 Apr 2013 | 6:42 am
    A barrier to effective communication, the Perfect Message Fallacy is the misguided attempt to create one message that offers something to everyone. Despite the best effort put into the messaging, it results in no value for anyone. A message easily ignored. The gap between expectation and experience, much like the illusion of communication, leaves people confused, frustrated, and disconnected. It happens as much with internal communication as with external marketing and sales. It afflicts a lot of communicators regardless of their experience or the medium of delivery. The attempt to craft the…

  • Three steps to liberate and share stories

    Michael Santarcangelo
    3 Apr 2013 | 7:22 am
    This is a continuation into the exploration of business stories. Check out “Why we need better business storytellingHow to build better business stories,” and “Why stories need to be liberated” for additional insights.  As a catalyst, I listen to and learn from the stories of others. Engaging individuals in comfortable and safe situations to allow their story to emerge and take shape yields valuable insight into the individual, and often into the organization. As explained in “Why stories need to be liberated,” too many people are disconnected from the definition of story and…
  • add this feed to my.Alltop

    Dr Anton Chuvakin Blog PERSONAL Blog

  • Monthly Blog Round-Up – April 2013

    1 May 2013 | 7:07 am
    Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “Simple Log Review Checklist Released!” is often at the top of this list – the checklist is still a very useful tool for many people. “On Free Log Management Tools” is a companion to the checklist (updated version) “Top 10 Criteria for a SIEM?” came from one of my last projects I did when running my SIEM consulting firm in 2009-2011. “On Choosing SIEM” is another old classic (from 2010) that often shows up on my top list; it covers some tips on choosing SIEM tools. “SIEM…

  • Monthly Blog Round-Up – March 2013

    1 Apr 2013 | 9:35 am
    Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “Simple Log Review Checklist Released!” is often at the top of this list – the checklist is still a very useful tool for many people. “On Free Log Management Tools” is a companion to the checklist (updated version, and, yes, I know it really needs another update) My classic PCI DSS Log Review series is popular as well. The outlined log review approach is useful for building other types of log review processes and procedures, whether regulatory or not. “Top 10 Criteria for a SIEM?”…

  • Monthly Blog Round-Up – February 2013

    4 Mar 2013 | 7:21 am
    Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “Simple Log Review Checklist Released!” is often at the top of this list – the checklist is still a very useful tool for many people. “On Free Log Management Tools” is a companion to the checklist (updated version, and, yes, I know it really needs another update) My classic PCI DSS Log Review series is popular as well. The outlined log review approach is useful for building other types of log review processes and procedures, whether regulatory or not. “Top 10 Criteria for a SIEM?”…

  • Monthly Blog Round-Up – December 2012

    1 Feb 2013 | 8:47 am
    Here is my next monthly "Security Warrior" blog round-up of top 5 popular posts/topics this month: “Simple Log Review Checklist Released!” is often at the top of this list – the checklist is still a very useful tool for many people. “On Free Log Management Tools” is a companion to the checklist (updated version, and, yes, I know it really needs another update) “Top 10 Criteria for a SIEM?” came from one of my last projects I did when running my SIEM consulting firm in 2009-2011. “On Choosing SIEM” is another old classic (from 2010) that shows up on my top list; it covers…

  • Annual Blog Round-Up – 2012

    1 Feb 2013 | 8:47 am
    Here is my annual "Security Warrior" blog round-up of top 10 popular posts/topics in 2012. “Simple Log Review Checklist Released!” was again the most popular this year. The checklist, a list of critical things to look for while reviewing  system, network and security logs when responding to a security incident PCI DSS Log Review series of posts take the #2 spot; they are about planning and executing PCI DSS-driven log review at an organization “On Choosing SIEM” is about the least wrong way of choosing a SIEM tool – as well as why the right way is so unpopular. “On Free Log…
 
  • add this feed to my.Alltop

    symantec.com

  • Symantec Protection for Trojan.FakeSafe

    Symantec Security Response
    17 May 2013 | 4:30 am
    Today, Trend Micro published a report about a targeted attack campaign they’re calling SafeNet (the campaign’s name is unrelated to the security company of the same name). read more

  • Symantec Protection for Targeted Attacks in South Asia

    Symantec Security Response
    16 May 2013 | 7:22 pm
    ESET recently blogged about a targeted cyber/espionage attack that appears to be originating from India. Multiple security vendors have been tracking this campaign. The attack appears to be no more than four years old and very broad in scope. read more

  • Spam Campaigns Take to Tumblr

    Ben Nahorney
    16 May 2013 | 6:15 am
    As the urban legend goes, the bank robber Willie Sutton was asked why he robbed banks. “Because that’s where the money is,” he is attributed as saying. read more

  • Japanese One-Click Fraud on Google Play Leads to Data Stealing App

    Joji Hamada
    16 May 2013 | 3:07 am
    Since the beginning of the year, a Japanese one-click fraud campaign has continued to wreak havoc on Google Play. The scammers have published approximately 700 apps in total since the end of January. read more

  • Phishers Offer Rita Ora’s Video

    Mathew Maniyara
    15 May 2013 | 7:10 pm
    Contributor: Avdhoot Patil Celebrity scandals are always popular and phishers are keen on incorporating them into their phishing sites. Recently, we observed a phishing site featuring British singer and actress Rita Ora. The phishing site was hosted on a free Web hosting site. read more
  • add this feed to my.Alltop

    Optimal Security

  • Hiding Under the Covers

    Daniel M. Teal
    15 May 2013 | 9:24 am
    “All warfare is based on deception” – Sun Tzu, The Art of War Attackers like stealth.  Once they have compromised a system, one of their primary goals is to remain undetected. Initially, attackers used malware with pseudo Windows service names such as svchosts.exe, winlogin.exe, lsasss.exe, and others. Although these names appear to be innocuous, power users have learned to notice these processes by using the task manager or tools like Process Explorer or Process Hacker. Something is not right here – “winlogin.exe”? The next step in the evolution of evasion occurred when…

  • Ten Bulletins This May Patch Tuesday; But Don’t Get Excited

    Paul Henry
    14 May 2013 | 10:53 am
    While 10 patches covering 33 vulnerabilities may seem like a high number, it isn’t all bad news for IT professionals this May Patch Tuesday. Only two of the 10 patches released today are critical and both impact Microsoft Windows and Internet Explorer. The two critical-rated patches address the IE 8 zero-day that made news after attacking a website belonging to the U.S. Department of Labor last week, Security Advisory 2847140. This is being actively exploited now, and because so many choose to switch on WSUS and call it a day, Microsoft took the responsible approach and issued a hot…

  • Market Impact of a Data Breach

    Chris Merritt
    13 May 2013 | 10:24 am
    In my Changeup post the other day, I mentioned that my colleague Paul Henry had saved an organization an estimated $10M (or roughly 15%) in market cap by showing that an intrusion had no material impact. That got me to thinking: what *is* the typical market impact of a breach? And furthermore, how good are these data breach cost numbers we read about? Data Breach Cost Estimates There are several studies out there looking at the costs associated with a data breach. Of course, the annual Cost of a Data Breach surveys by our friends at the Ponemon Institute is perhaps the most cited, and for…

  • BYOD or BYOT (Bring Your Own Threat)…The Case for Mobile Devices as Endpoints

    Paul Zimski
    7 May 2013 | 9:53 am
    Lumension recently conducted a survey of more than 1,600 IT professionals on Linkedin regarding their thoughts on BYOD and mobile security. You can check it out here. There is a lot of interesting information in this survey, with one of the main takeaways was for these respondents’ organizations, BYOD is really all about end-user satisfaction and productivity. Ken Hess of ZDNet stated in a recent article that he concludes the same. Ken said, “I’ve said before companies want employees to be happy, and BYOD is part of that movement. The numbers tell the story with 55 percent of the…

  • Changeup Information Sharing

    Chris Merritt
    6 May 2013 | 2:22 pm
    We were talking with the CIO of a major healthcare company the other day who told us that his day had gone sideways because of the re-emergence of the ChangeUp worm / Trojan. This was news to me. I mean, yes, I’m a little behind in my reading, but I’d not heard much about ChangeUp since it flared up again at the end of 2012. It turns out there was brief mention made in mid-April about  an outbreak. But since then … Nada. Niente. Rien. Garnichts. In short … Crickets. And that’s a problem. Changeup Background Just to catch everyone up a bit. The ChangeUp worm / Trojan –…
 
  • add this feed to my.Alltop

    TRUSTe Blog

  • Tune In: Sprint Discusses Consumer Privacy Concerns

    Ievgeniia
    9 May 2013 | 5:04 pm
    Join us for an informative webinar with special guest Sprint – global provider of voice, data and Internet services – and get insight into how a leading brand takes into account and incorporates consumer privacy concerns into their marketing strategies. Register for the “Are Your Audience-Building Efforts Suffering Due to Consumer Privacy Concerns?” webinar today! … Continue reading »

  • Track TRUSTe Around the Globe

    Ievgeniia
    2 May 2013 | 10:36 am
    ———May 9 Join TRUSTe’s first May event at an interactive discussion – “How Website Monitoring Can Boost Marketing ROI and Reduce Corporate Risk.” With our Product Manager Calvin Lam and TRUSTe Managing Director Mikhail Nikitin, learn about current website monitoring and reporting services that help some of the web’s largest websites manage privacy related risks, … Continue reading »

  • The State of Privacy on Social Networks

    Ievgeniia
    29 Apr 2013 | 12:34 pm
    MDG Advertising recently released a comprehensive infographic on “The Sad State of Social Media Privacy” providing an overview of privacy and social media based upon research from American Consumer Institute Center for Citizen Research, Anonymizer, Harris Interactive, MSNBC and The Ponemon Institute. This infographic outlines data related to the issue of Trust/Distrust online amongst social … Continue reading »

  • 2012 TRUSTe Transparency Report

    Ievgeniia
    22 Apr 2013 | 5:00 am
    Melissa Pereira Director of Corporate Communications | TRUSTe @melissadpereira Today we’re releasing our 2012 TRUSTe Transparency Report.  It details how TRUSTe helps companies conduct business in a privacy-safe manner while also building trust, driving engagement and ensuring compliance.  The report provides an overview of TRUSTe technology developments and privacy certifications over the past year.  We … Continue reading »

  • Data Anonymization

    Ievgeniia
    16 Apr 2013 | 4:11 pm
    Jim Rennie Sr Product Counsel | TRUSTe Recently, talk of “anonymizing” or “pseudo-anonymizing” data has been picking up, both publicly online and in private conversations with our clients. There have been questions on what these terms mean, what they mean for user privacy, and the pitfalls around the practice. Currently, “anonymizing” is not defined or … Continue reading »
 
  • add this feed to my.Alltop

    SecurityWeek RSS Feed

  • Yahoo Japan Suspects 22 Million IDs Stolen

    AFP
    17 May 2013 | 9:51 pm
    TOKYO - Yahoo Japan Corp. has said it suspects up to 22 million user IDs may have been stolen during an unauthorised attempt to access the administrative system of its Yahoo! Japan portal. read more

  • US Authorities Seize Bitcoin Operator Accounts

    AFP
    17 May 2013 | 7:43 am
    WASHINGTON - US authorities seized the accounts of a Bitcoin digital currency exchange operator, claiming it was functioning as an "unlicensed money service business," court documents showed Friday. read more

  • Saudi Reports Attacks on Government Websites

    AFP
    17 May 2013 | 7:17 am
    RIYADH - Several government Internet sites have come under "coordinated and simultaneous" cyber attack, an information security spokesman in the oil-rich kingdom reported on Friday. read more

  • Italian Police Raid Hackers Who Took on Vatican

    AFP
    17 May 2013 | 7:09 am
    ROME - Italian police on Friday arrested four alleged hackers believed to belong to the activist group Anonymous for attacking websites, including those of the Vatican and the parliament in Rome. The four have been placed under house arrest and communications police carried out a dozen raids. read more

  • Britain's Financial Times 'Hacked by Syrians'

    AFP
    17 May 2013 | 2:21 am
    LONDON - The website of Britain's Financial Times appeared to have been hacked on Friday by the Syrian Electronic Army, a mysterious group seemingly aligned with the regime of President Bashar al-Assad. read more
  • add this feed to my.Alltop

    Free IT - Security Magazines and Downloads from alltop.tradepub.com

  • The Essentials of Information Security Kit: Includes a Free PC Security Handbook - 2nd Edition eBook

    15 May 2013 | 2:50 pm
    The Essentials of Information Security brings together the latest in information, coverage of important developments, and expert commentary to help with your Information Security related decisions.The following kit contents will help you get the most out of your Information Security research:PC Security Handbook - 2nd EditionTop 5 Myths of Website SecurityThe Forrester Wave: Endpoint Security, Q1 2013How to Pass an IT AuditRequest Free!

  • Mapping Security for Your Virtual Environment

    13 May 2013 | 12:00 am
    With the gaining popularity of virtualization in today's enterprise data centers, you need a virtual security solution that allows you to confidently adopt virtualization throughout your data center without compromising on your existing security postures.Sponsored by: HP and Intel®Intel and the Intel logo are trademarks or registered trademarks of Intel Corporation in the U.S. and/or other countries.Request Free!

  • My Patch Compliance Rates are WHAT?

    13 May 2013 | 12:00 am
    Watch this Demo to learn how organizations are: Automatically managing patches for multiple operating systems and applicationsSupporting thousands of endpoints—regardless of location, connection type or statusReducing security and compliance risk by slashing remediation cycles from weeks to hoursGaining visibility into patch compliance with flexible, real-time monitoring and reporting Patching online and offline virtual machines to improve security in virtual environmentsRequest Free!

  • Security Explorer Trial Download

    8 May 2013 | 4:50 pm
    Take Security Explorer for a test drive, and see how it can:Give you complete access control and security management capabilitiesProvide you with a powerful, yet intuitive solution across your entire Window networkSimplify security managementYour free trial is a Web-based, self-contained virtual test environment, so you can effectively evaluate Security Explorer. Start your virtual trial now.Request Free!

  • Active Administrator Trial

    8 May 2013 | 4:50 pm
    Take Active Administrator for a spin and see how this powerful, all-in-one solution allows you to: Control auditing, security, recovery and health for Active DirectoryCentralize management of AD and Group PolicySave time and take control over your AD environment Your free trial is a Web-based, self-contained virtual test environment, so you can effectively evaluate Active Administrator.Request Free!
  • add this feed to my.Alltop

    IT-Security

  • HIPAA Audit Tips – Key Points from OCR Head 12-13-2012 Talk in Boston

    bchaput
    17 May 2013 | 11:00 am
    This entry is part 17 of 20 in the series HIPAA Audit Tips Healthcare IT News and HIMSS Media joined forces to create and hold The Privacy & Security Forum on December 12-13, in Boston.  Among other speakers, Leon Rodriguez, head of the Office for Civil Rights (OCR), spoke and was interviews by Healthcare IT News in a brief 7 1/2 minute segment that’s well worth the listen.   The event and interview provided great insight into next enforcement activities and plans by the OCR.   Here’s today’s big tip– Listen to Leon’s comments about risk analysis! HIPAA Audit Tips – Good…

  • HIPAA Audit Tips – Know What De-Identification of PHI Really Means

    bchaput
    15 May 2013 | 11:00 am
    This entry is part 18 of 20 in the series HIPAA Audit Tips On Monday, November 26 HHS / OCR issued what some call long-overdue “Guidance Regarding Methods for De-identification of Protected Health Information (PHI) in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule”.  I found the guidance not only a deep-dive into what might be considered arcane subject matter,  but also a great review of some foundational concepts about Privacy and PHI always helpful in preparing for audits or investigations.  Here’s today’s big tip– Have at least a…

  • HIPAA Audit Tips – Do a Privacy Assessment!

    bchaput
    13 May 2013 | 11:00 am
    This entry is part 15 of 20 in the series HIPAA Audit Tips Preliminary OCR observations on the first proactive audits highlighted weaknesses in Privacy training, safeguards, policies & procedures, sanctions, training and mitigation.  Make no mistake about it, the HIPAA Privacy Rule is well within scope of the HITECH-mandated audits and the findings are interesting, but certainly not surprising.  Learn more!  Here’s today’s big tip– Do a Privacy Assessment! Do a Privacy Assessment to Prepare for OCR HIPAA Audits and Investigations Although most healthcare covered entities think…

  • HIPAA Texas Style HB 300 is Here

    bchaput
    10 May 2013 | 11:00 am
    HIPAA is considered a non-preemptive Federal Statute and, therefore, only sets a “floor” for privacy, security and breach notification requirements. That is, individual states may pass–and have passed–their own legislation and regulations that exceed HIPAA requirements. At this writing, 46 states, the US Virgin Islands, the District of Columbia and Puerto Rico have passed such laws. On September 1, 2012 Texas law House Bill 300 (HB 300) took effect and new health information disclosure rules and penalties apply to HIPAA Covered Entities and Business Associates as well as “any person…

  • HIPAA Contingency Planning

    phesse
    10 May 2013 | 8:59 am
    This article describes the HIPAA contingency planning and security incident response requirements. The relevant subsections of the HIPAA law are §164.308(a)(6) and §164.308(a)(7).  HIPAA contingency planning is a term used broadly to cover security incident response procedures and contingency planning for emergency situations that may compromise protected health information. HIPAA contingency planning is one of the administrative safeguards that a covered entity must employ. The audit requirements for HIPAA contingency planning is covered in a separate post. HIPAA Security Incident…
 
  • add this feed to my.Alltop

    Infosec Communicator

  • Visualizing Your Professional Network

    bwadmin
    16 May 2013 | 12:48 pm
    Did you know that LinkedIn Labs provides a graphical representation of your professional network? It’s similar to a hyperbolic browser I saw demonstrated several years ago in a research facility in Silicon Valley. The map allows you to hover over … Continue reading →

  • Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter

    bwadmin
    26 Apr 2013 | 7:21 am
    Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter. I was truly humbled and honored to receive the Society for Technical Communication‘s Distinguished Chapter Service Award (DCSA) for my work over the last few years with the … Continue reading →

  • Get On Board! Entraining Volunteers

    bwadmin
    25 Apr 2013 | 10:14 am
    I’m delivering the presentation below as part of a progression at Summit 2013 Leadership Day in Atlanta. Summit Leadership Day provides STC community leaders with the knowledge and guidance they need to lead successful communities, both geographic chapters and SIGs. … Continue reading →

  • Empowering the Introvert Within | Bulletproofing Your Career Online

    bwadmin
    20 Mar 2013 | 8:48 pm
    Empowering the Introvert Within | Bulletproofing Your Career Online. Preview Hannah (Careersherpa.net) and Ben’s newest presentation, Empowering the Introvert Within: Becoming an Outstanding Leader. Presentations are currently scheduled in Rochester at Spectrum, March 22, 2013 and in Atlanta at the STC … Continue reading →

  • More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com

    bwadmin
    19 Mar 2013 | 8:55 am
    More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com. Ed Marsh’s review of our Bulletproofing Your Career Online Keynote and Workshop at the STC Philly Metro’s Mid Atlantic Technical Communication Conference in March … Continue reading →
  • add this feed to my.Alltop

    Infosec Communicator

  • Visualizing Your Professional Network

    bwadmin
    16 May 2013 | 12:48 pm
    Did you know that LinkedIn Labs provides a graphical representation of your professional network? It’s similar to a hyperbolic browser I saw demonstrated several years ago in a research facility in Silicon Valley. The map allows you to hover over … Continue reading →

  • Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter

    bwadmin
    26 Apr 2013 | 7:21 am
    Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter. I was truly humbled and honored to receive the Society for Technical Communication‘s Distinguished Chapter Service Award (DCSA) for my work over the last few years with the … Continue reading →

  • Get On Board! Entraining Volunteers

    bwadmin
    25 Apr 2013 | 10:14 am
    I’m delivering the presentation below as part of a progression at Summit 2013 Leadership Day in Atlanta. Summit Leadership Day provides STC community leaders with the knowledge and guidance they need to lead successful communities, both geographic chapters and SIGs. … Continue reading →

  • Empowering the Introvert Within | Bulletproofing Your Career Online

    bwadmin
    20 Mar 2013 | 8:48 pm
    Empowering the Introvert Within | Bulletproofing Your Career Online. Preview Hannah (Careersherpa.net) and Ben’s newest presentation, Empowering the Introvert Within: Becoming an Outstanding Leader. Presentations are currently scheduled in Rochester at Spectrum, March 22, 2013 and in Atlanta at the STC … Continue reading →

  • More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com

    bwadmin
    19 Mar 2013 | 8:55 am
    More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com. Ed Marsh’s review of our Bulletproofing Your Career Online Keynote and Workshop at the STC Philly Metro’s Mid Atlantic Technical Communication Conference in March … Continue reading →
  • add this feed to my.Alltop

    AT&T Networking Exchange Blog » Security

  • 3 Tips To Avoid Being Hacked On Social Media

    Mario Armstrong
    8 May 2013 | 4:10 am
    A couple of weeks ago, a major news service’s Twitter account was hacked, and several fake tweets not only sent ripples through the media, they impacted stocks globally. While there’s a key lesson here about the importance of social media, this event underscores just how vital it is to keep social media accounts safe. Social media is often the lifeblood of a small business or brand, sometimes as the only direct line to customers or clients available. So if your social media accounts were to get hacked, it isn’t just your business that’s in danger, it’s your reputation and your…

  • Are You In Business To Make Money Or Lose It?

    Bindu Sundaresan
    26 Apr 2013 | 7:10 am
    Are you in business to make money or lose it? For most people, the answer to this question is a no brainer! As a security professional, I truly believe that security can impact your bottom line. It is key to protecting your most vulnerable business asset – your data. If your business has anything worth protecting, whether it’s money, intellectual property, or a trusted reputation, you need to be concerned about the security embedded in your organization. No company wants to experience a data breach – that much is obvious. As it is well-known by now, a data breach can have a major impact…

  • Security’s Evolutionary Theory

    Steve Hurst
    25 Apr 2013 | 7:10 am
    Security and risk awareness have been part of the lives of humans from the very earliest days. At its core, security focuses on keeping things safe.  In a business environment, complete safety can restrict access and availability, and is therefore impractical.  Focusing solely on security, without balancing associated risk, is unrealistic, as businesses need to take certain risks to grow and be profitable. Let’s look at the history of security and risk to see how we can bring the focus back to business risks and away from simply protecting, or securing, assets. A long time ago in a place…

  • Cyber Attacks And Security Breaches In Healthcare

    Barb White
    24 Apr 2013 | 7:10 am
    I read almost daily in the news about cyber attacks on U.S. banks, infrastructure, government agencies, and businesses. In fact, government agencies saw a more than 650% increase in cyber security incidents from 2006 to 2010, according to the Government Accountability Office (GAO). The GAO reports that a main reason for the increase is the failure of agencies to fully implement their IT security programs. To me, this means that many of the incidents could be preventable. Although healthcare organizations are not often a primary target of hackers, electronic data in the healthcare sector is…

  • IT Risk And Security Reward Webinar

    19 Apr 2013 | 7:10 am
    Every day corporate networks are faced with increasingly complex threats to IT security. But there’s an entirely new approach that can help you minimize risks. It’s called “Orbital Security”—and it just might save your company’s data. Orbital Security allows you to create an IT security strategy based on the relationships your company has with clients, competitors, employees and suppliers, and enables you to prioritize risks and build policies that define various levels of access to your applications. Join Steven Hurst, CISSP, Director of Security Services and Technology for…
 
  • add this feed to my.Alltop

    Email management, storage and security for business email admins

  • InetOrgPerson Object Causing Sync Issues in Exchange Server 2010

    Jacob Rede
    16 May 2013 | 7:00 am
    The ability to sync a mailbox with Microsoft Exchange Server is a key element in your systems design. If this ability is non-existent then your system may as well be broken.  It’s important to remember that users will be relying on getting their mail, and if they can’t, then you’re going to have a problem.  Companies and organizations rely on System Administrators to maintain business continuity; letting something like a synchronization error slip through is just not an option. In order to prepare for issues like this, be sure that your system is updated to the proper service pack as…

  • Inside Exchange 2013, Part 12 – Sizing Does Matter

    Casper Manes
    13 May 2013 | 7:00 am
    The Exchange Team at Microsoft has long maintained one of the best and most active blogs of any Microsoft product group. “You Had Me At Ehlo” is not only a regular read for me, it is often the inspiration for my posts here at TheEmailAdmin. Recently, Jeff Mealiffe, the Senior Program Manager Lead for the Exchange Customer Experience posted an article on sizing Exchange 2013 that should be a must read for anyone currently considering an Exchange 2013 upgrade or new deployment. Ask the Perf Guy: Sizing Exchange 2013 Deployments is one of the longer posts to make it onto the Exchange Team…

  • Common Fixes for iOS and Exchange Server

    Jacob Rede
    9 May 2013 | 7:00 am
    While every mobile operating system is different from another, it’s important to make sure you know how to fix some common problems on iOS. Most of these problems revolve around one simple issue: syncing. iOS has been having problems with Exchange Server ever since it came out. To give its manufacturer credit, they are usually always on top of releasing software updates to correct problems as soon as they become known. And although most of these fixes are successful, there are always a couple fixes that still need workarounds. Unfortunately these issues don’t become known until after an…

  • Troubleshooting Headers with the Remote Connectivity Analyzer

    Casper Manes
    8 May 2013 | 7:00 am
    The Exchange team at Microsoft must not sleep, because once again they have taken one of my favourite tools, and made it better. The Remote Connectivity Analyzer, which by now we all know and love, has a new feature added into it for analyzing SMTP headers called the Message Analyzer, and while it is branded as being in beta, and you might think it’s only useful for Exchange or Office 365, it’s a great tool you can use today whether or not you use Exchange or live in Microsoft’s cloud. To use the tool, you first need to go to https://www.testexchangeconnectivity.com and click on the…

  • Email Security by the Numbers

    Jeff Orloff
    6 May 2013 | 7:00 am
    Any organizations spend a considerable amount of time, resources and dollars to secure the perimeter of their organization’s network. When it comes to email, however, the same fervor that came with ordering firewalls, intrusion detection and prevention systems, web application firewalls, penetration tests, end point security and even data encryption comes up short when email security is concerned. From the network security expert’s point of view the mail servers exist behind the firewall or in the DMZ so they are secured as much as they need be. The operating systems are patched and the…
  • add this feed to my.Alltop

    Anti spam and general email security in a business environment

  • Syria’s State-Sponsored Phishing Attack Nets an Onion

    Sue Walsh
    16 May 2013 | 7:00 am
      Earlier this month, popular website and newspaper The Onion, which offers a satirical look at the news and current events, had their Twitter account hacked by a Syrian group calling themselves the Syrian Electronic Army. The account was then used to send series of anti-Israel posts and posts attacking the US and United Nations. The Onion has revealed that the hack happened courtesy of a phishing attack and that one foolish employee and some sloppy security are to blame. In a post on their website they explained in detail: Once the attackers had access to one Onion employee’s…

  • ‘Spam: A Shadow History of the Internet’ Takes a Hard Look at the Dark Art of Spam

    Malcolm James
    14 May 2013 | 6:30 am
    “Spam” is a word with remarkable properties. As this history has demonstrated, the meaning of this word has remained surprisingly consistent through enormous shifts in technology and scale. - from Spam: A Shadow History of the Internet, by Finn Brunton It’s difficult not to hate spam, but ironically, it’s hard not to love it, too. It gives us something to discuss around coffee machines, it’s often laughable, and when it isn’t threatening to tear down our firewalls, it’s just plain entertaining. In his book Spam: A Shadow History of the Internet (MIT Press, ISBN…

  • Pump and Dump Spam is Back

    Sue Walsh
    13 May 2013 | 7:00 am
    Malicious spam levels continued to rise in Q1 of 2013, with overall spam levels rising by 98% and malicious spam by a whopping 157%. In the first quarter, 97.4 billion spam messages a day were sent with 973 million of them being malicious spam. Pump and dump spam, once a thriving scam, roared back to life in Q1 years after it had quietly died out. Back in the early 2000s it was a one of the most popular types of spam, and it gave many a scammer a nice fat payday. It works by sending messages made to look like hot stock tips that urge the recipient to invest quickly before word gets out and…

  • Give Your Mother a Spam-Free Mother’s Day

    Casper Manes
    12 May 2013 | 7:00 am
    According to Wikipedia, Mother’s Day is a celebration honoring mothers and motherhood, maternal bonds, and the influence of mothers in society. It is celebrated on various days in many parts of the world, most commonly in March or May. It complements Father’s Day, a similar celebration honoring fathers. When US President Woodrow Wilson made the second Sunday in May an officially recognized national holiday, he probably wasn’t thinking of email, but considering what my mother asked me today, and that a huge number of other countries have Mother’s Day observances that happen…

  • Do You Know What to Do When You Get Spammed?

    Jeff
    10 May 2013 | 7:00 am
    Just a day after we recognized the 35th anniversary of that first mass marketing email that Gary Thuerk sent to about 400 users of ARPANET news spread of the Commtouch Internet Threats Trend Report for the first quarter of 2013 was released that claimed around the world an average of 97.4 billion spam emails were sent each day. That is quite a bit of junk mail. Now any organization with a good anti-spam solution in place, notice I said good, will see a great deal of these messages filtered out because their technological controls will spot these illicit messages and sent them directly to the…
  • add this feed to my.Alltop

    AT&T Networking Exchange Blog » Security

  • 3 Tips To Avoid Being Hacked On Social Media

    Mario Armstrong
    8 May 2013 | 4:10 am
    A couple of weeks ago, a major news service’s Twitter account was hacked, and several fake tweets not only sent ripples through the media, they impacted stocks globally. While there’s a key lesson here about the importance of social media, this event underscores just how vital it is to keep social media accounts safe. Social media is often the lifeblood of a small business or brand, sometimes as the only direct line to customers or clients available. So if your social media accounts were to get hacked, it isn’t just your business that’s in danger, it’s your reputation and your…

  • Are You In Business To Make Money Or Lose It?

    Bindu Sundaresan
    26 Apr 2013 | 7:10 am
    Are you in business to make money or lose it? For most people, the answer to this question is a no brainer! As a security professional, I truly believe that security can impact your bottom line. It is key to protecting your most vulnerable business asset – your data. If your business has anything worth protecting, whether it’s money, intellectual property, or a trusted reputation, you need to be concerned about the security embedded in your organization. No company wants to experience a data breach – that much is obvious. As it is well-known by now, a data breach can have a major impact…

  • Security’s Evolutionary Theory

    Steve Hurst
    25 Apr 2013 | 7:10 am
    Security and risk awareness have been part of the lives of humans from the very earliest days. At its core, security focuses on keeping things safe.  In a business environment, complete safety can restrict access and availability, and is therefore impractical.  Focusing solely on security, without balancing associated risk, is unrealistic, as businesses need to take certain risks to grow and be profitable. Let’s look at the history of security and risk to see how we can bring the focus back to business risks and away from simply protecting, or securing, assets. A long time ago in a place…

  • Cyber Attacks And Security Breaches In Healthcare

    Barb White
    24 Apr 2013 | 7:10 am
    I read almost daily in the news about cyber attacks on U.S. banks, infrastructure, government agencies, and businesses. In fact, government agencies saw a more than 650% increase in cyber security incidents from 2006 to 2010, according to the Government Accountability Office (GAO). The GAO reports that a main reason for the increase is the failure of agencies to fully implement their IT security programs. To me, this means that many of the incidents could be preventable. Although healthcare organizations are not often a primary target of hackers, electronic data in the healthcare sector is…

  • IT Risk And Security Reward Webinar

    19 Apr 2013 | 7:10 am
    Every day corporate networks are faced with increasingly complex threats to IT security. But there’s an entirely new approach that can help you minimize risks. It’s called “Orbital Security”—and it just might save your company’s data. Orbital Security allows you to create an IT security strategy based on the relationships your company has with clients, competitors, employees and suppliers, and enables you to prioritize risks and build policies that define various levels of access to your applications. Join Steven Hurst, CISSP, Director of Security Services and Technology for…
 
  • add this feed to my.Alltop

    F-Secure Antivirus Research Weblog

  • BBC News: LulzSec Hacker Interview

    17 May 2013 | 2:56 am
    BBC News has a 13 minute report that's worth a view.LulzSec hacker: 'Internet is a world devoid of empathy' On 17/05/13 At 12:54 PM

  • Another Document Targeting Uyghur Mac Users

    17 May 2013 | 2:56 am
    We spotted a new variant of the documents used in the cyber attacks against Uyghur back in February.This variant was first submitted to VirusTotal on April 11 from China. This time it uses IUHRDF, which may be a reference to International Uyghur Human Rights & Democracy Foundation, instead of Captain as the author:The payload is still the same besides using different filenames and command and control server.It uses "alma.apple.cloudns.org" as the command and control server:It creates the following copy of itself and launch point:~/Library/Application…

  • LulzSec Sentencing in UK

    17 May 2013 | 2:56 am
    LulzSec – the rockband of hacker groups – had three of their six members sentenced today in London.LulzSec made headlines during their "50 days of Lulz" in May-June 2011, during which they attacked Fox, PBS, Sony, Nintendo, Sega, Minecraft, Infragard, NHS, US Senate, SOCA and CIA. They also recorded and published a conference call between US and European law enforcement officials, discussing police tactics against LulzSec.LulzSec was different from most other attackers, as they weren't doing their attacks to make money or to protest. They did it for Teh Lulz. Also, they had no…

  • Facebook is Testing Tags For "What"

    17 May 2013 | 2:56 am
    Facebook has gradually added different tags to its "Status" updates.Currently, most users have the ability to tag: who, when and where.Those options could soon include: what. (Roll out is limited at the moment.)And not just what you are doing — but what you're feeling.As long as everybody you're friends with gets the joke……you should be safe.But let's say your boss mistakes "a pan galactic gargle blaster" for a real drink and reprimands you for drinking alcohol on the job.That could leave you feeling quite annoyed.How do I share my feelings or what I'm doing in a status…

  • Mac Spyware Found at Oslo Freedom Forum

    17 May 2013 | 2:56 am
    The Oslo Freedom Forum is an annual event "exploring how best to challenge authoritarianism and promote free and open societies." This year's conference (which took place May 13-15) had a workshop for freedom of speech activists on how to secure their devices against government monitoring. During the workshop, Jacob Appelbaum actually discovered a new and previously unknown backdoor on an African activist's Mac.Our Mac analyst (Brod) is currently investigating the sample.It's signed with an Apple Developer ID.The launch point:It dumps screenshots into a folder called MacApp:Functions:There…
  • add this feed to my.Alltop

    Constantly Learning - Brett Hardin

  • Successful Marketers are Creative

    Brett Hardin
    15 May 2013 | 12:00 am
    If you can't be the leader in your category, create a new category you can be the leader in. Rule 2 in the The 22 Immutable Laws of Marketing Every successful person you know has differentiated themselves from others in their field. They are unique in their niche. I stumbled upon this advertisement for Forever 21, a woman's clothing store, a while ago and realized that marketing and marketers fit this same mold. Great marketing is an invention game. Old methodologies can work, but new ways of marketing to users can be more affective. Forever 21 wanted to have an advertisement in Times Square,…

  • Mobile Devices Aren't Phones

    Brett Hardin
    8 May 2013 | 12:00 am
    I love my mobile device. I have an Apple iPhone 4S and I am sure I will continue to use smart phones even if I shy away from Apple. I will continually use a smart phone because I use every app on the phone, except one. I don't use the phone. My mobile device is essentially a text message device. It is not a phone. I hate having phone conversations on my mobile device. The delay between a person talking and my ear receiving it is too long. I remember thinking the same thing when mobile phones started becoming popular in 1999. However, I assumed, like other technologies it would become better…

  • Limiting Code Damage

    Brett Hardin
    1 May 2013 | 12:00 am
    When choosing a character in any role-playing game there are only two archetypes. Strong and Slow or Fast and Weak. All other classes are iterations of these basic attributes. Rouges, wizards, thieves, and rangers are just variations of the Rouge and Barbarian. These two traits are a sliding scale. The stronger the player is the slower they are. The faster they are the weaker they are. You are unable to get the best of both worlds. You can't create a buffed out warrior who is lightning fast. Muscle is slow. Software design has similar limitations with a similar sliding scale. Software can…

  • Startup Lessons Learned From an Auction

    Brett Hardin
    23 Apr 2013 | 12:00 am
    This past weekend was Endgame's annual auction. Endgame - a board game store in Oakland, California - has an Auction once a year, that is an anticipated event for bay area gamers. They can get rid of the games they don't play while acquiring new items which they want to play. As I was bidding on items I wanted, I thought about what made Endgame's Auction so great in comparison to other board game auctions. Since I've been playing games, I've been to many different auctions, but the Endgame auction always stands out as being the best. Although, I try to make other auctions occasionally, It…

  • Rentership and Usership

    Brett Hardin
    15 Apr 2013 | 12:00 am
    I have a huge collection of board games. No, not like Monopoly. If you have ever played Settlers of Catan, you know the type of boardgames I own and like to play. Strategy games. Games that reduce or completely remove luck elements, like dice rolls from the game. I have always kept the number of games I own below 250. This seems like a lot, but many of the games are card games which don't take up a lot of shelf space. The problem with owning this amount of games is the frequency at which they are played. One game may sit, untouched, on the shelf for two years before it is ever played. The…
  • add this feed to my.Alltop

    Threatpost

  • Q&A: Microsoft’s TJ Campana

    Dennis Fisher
    17 May 2013 | 9:48 am
    REDMOND, Wash.–The Microsoft Digital Crimes Unit has been spearheading botnet takedowns and other anti-cybercrime operations for many years, and it has had remarkable success. But the cybercrime problem isn’t going away anytime soon, so the DCU is in the process of building a new cybercrime center here, and soon will roll out a new threat intelligence service to help ISPs and CERT teams get better data about ongoing attacks. Dennis Fisher sat down with TJ Campana, director of security at the DCU to discuss the unit’s work and what threats could be next on the target list.

  • PushDo Attackers Adjust Algorithm to Generate .KZ Domains

    Michael Mimoso
    17 May 2013 | 9:25 am
    For every punch a hacker throws, there is a counter from a security company, and then, inevitably, the hacker adjusts again. That’s what’s happening right now with the PushDo malware. This week, Dell SecureWorks, Damballa Lab and Georgia Tech University combined on a research report exposing the fact that PushDo, a Trojan dropper largely responsible for Cutwail, one of the largest spam-producing botnets on record, was back. PushDo had returned en force with a domain generation algorithm that is capable of spinning up 1,380 .com domains every day in the event its two built-in command and…

  • New Mac Malware Discovered on Attendee Computer at Anti-Surveillance Workshop

    Brian Donohue
    17 May 2013 | 9:04 am
    In an Oslo Freedom Forum workshop offering advice to free speech advocates on how to better secure their devices against government surveillance, security researcher Jacob Appelbaum uncovered a new strain of malware with backdoor capabilities on the Mac machine of an Angolan activist attending the event. Appelbaum is probably best known for his work with the online anonymity enabling Tor Project and for his affiliation with and various legal battles regarding the 2010 and 2011 publications of U.S. State Department cables by the online whistle-blower, Wikileaks. Appelbaum was also the first…

  • Mozilla Refining Third-Party Cookie Patch in Firefox

    Michael Mimoso
    17 May 2013 | 7:48 am
    Mozilla has tapped the brakes on its plans to block third-party cookies by default in the Firefox browser. Test versions of Firefox 22, scheduled for a June release, were supposed to include a patch that blocked third-party cookie drops by default. However, Mozilla CTO Brendan Eich said yesterday those plans have been temporarily put on hold for more testing. Mozilla has been promoting this privacy-conscious decision for months, most publicly at the RSA Conference in February. Chief privacy officer Alex Fowler commented during a panel discussion about the practices of advertisers, data…

  • At Microsoft, a Sharpened Focus on Cybercrime

    Dennis Fisher
    16 May 2013 | 1:57 pm
    REDMOND, Wash.–Cybercrime has developed in the last few years into a major concern, not just for the consumers and businesses that are victims, but also for governments around the world. Obama administration officials have called it one of the larger threats to the United States economy. While law enforcement agencies handle the investigative and prosecutorial piece of things, they are increasingly being aided by experts at companies such as Microsoft, Google and others that have unique insights into attackers’ activities and the capability to make life more difficult for them.
 
  • add this feed to my.Alltop

    VRT

  • Microsoft Update Tuesday: Update for IE8 0-day and More

    Yves Younan, Ph.D.
    14 May 2013 | 12:13 pm
    Today is Update Tuesday and Microsoft is releasing updates for 33 CVEs across 10 bulletins. We'll be discussing some of the highlights here.One of the most important updates (MS13-038) that is being released is for the recent 0-day in Internet Explorer, which was used in a watering hole attack on a Department of Labor internal website targeting Department of Energy employees. This vulnerability, CVE-2013-1347, affects IE8 and can allow an attacker to perform remote code execution via a use-after-free vulnerability. While it's currently not being exploited in any of the exploit kits that we…

  • Changing the IMEI, Provider, Model, and Phone Number in the Android emulator

    dgoddard
    23 Apr 2013 | 10:22 am
    PincerI was having a look at the Pincer family of Android malware and came across some code designed to hinder analysis.From the decompilation of com/security/cert/a/a/c.class:    String str1 = com.security.cert.b.b.b(paramContext);    String str2 = com.security.cert.b.b.c(paramContext);    String str3 = com.security.cert.b.b.d(paramContext);    if(str3.toLowerCase().equals("android") ||        str1.equals("000000000000000") ||        str1.equals("012345678912345")…

  • 25 years of vulnerabilities: 1988-2012, the report

    Yves Younan, Ph.D.
    4 Mar 2013 | 8:50 am
    We here at the VRT are all about backing up opinions with facts, and there are a lot of opinions about the nature of the vulnerability landscape out there. That in mind, we decided recently to study the numbers, and put conventional wisdom to the test. At a high level, the numbers show that while vendors are putting increasing amounts of effort into security, critical vulnerabilities such as the recent Java, PDF, and Internet Explorer 0-days are on the upswing again of late. Combined with the clear upward trend in the amount of malware being dropped via these vulnerabilities - the Sourcefire…

  • Life Cycle and Detection of an Exploit Kit

    Alex Kirk
    25 Feb 2013 | 9:00 am
    Exploit kits may not be as hot a topic as the recently released Mandiant Report, but they're still an important part of today's threat landscape. As the success of the Cool Exploit Kit lets its author buy vulnerabilities, for example, these kits are not only one of the more prevalent ways of dropping malware on end-users, they're actually pushing defenders towards a time with more and more 0-days to worry about. Those of you who would like to understand more about how these kits work, check out my recent presentation on the subject. The presentation assumes no prior knowledge, so it's a…

  • 25 years of vulnerabilities: 1988-2012

    Yves Younan, Ph.D.
    20 Feb 2013 | 9:03 am
    We at the VRT are always interested in vulnerabilities and information about vulnerabilities. To this end we recently dug into the NVD database and examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software.Some of the questions we asked ourselves were:What are the most popular vulnerabilities?Which had the most impact?Which vendors and products suffered from the most issues?Which browser is the best in terms of vulnerabilities found?How many 0-days are found in products?While the answers to some of these questions are predictable,…
  • add this feed to my.Alltop

    NSS Labs

  • Blue Coat Acquires Netronome SSL Technology: Is this the beginning of a much larger play?

    17 May 2013 | 12:00 am
    Last week, Blue Coat Systems, Inc. acquired the SSL appliance product line from the fabless semiconductor and flow processing company, Netronome. The acquisition is yet another indication that HTTPS is the de facto industry standard for encryption, and it is time for the security industry to recognize this — so HTTP sit down and HTTPS suit up!

  • SDN a hot topic at Interop

    15 May 2013 | 12:00 am
    Last week’s Interop conference in Las Vegas may have lacked an overriding theme, but the most prominent topic for discussion as we sat down with both vendors and enterprise customers was software-defined networking (SDN). Security vendors have been slow to consider how SDN will impact their businesses, and there is still considerable confusion among customers as to the impact of SDN on enterprise infrastructure in general. This is starting to change, however.

  • McAfee Acquires Stonesoft: Deal Of The Decade?

    10 May 2013 | 12:00 am
    Unless you have been hiding under a rock somewhere you cannot fail to have noticed that on May 6, 2013, security vendor McAfee, Inc. entered into a combination agreement with the intent to acquire Finnish security firm Stonesoft Corporation for $389 million in cash. On the face of it, this might seem to be an awful lot to pay for a small, relatively unknown company based in Europe, representing as it does a multiple of around 7.5 times revenue. But that kind of thinking overlooks the tremendous potential for McAfee to seriously disrupt the market once this acquisition is complete.

  • 2013 Huawei Global Analyst Summit Wrap Up

    6 May 2013 | 12:00 am
    Huawei made a good bit of news at its annual analyst conference recently. The China-headquartered $35B USD information and communications technology company, which has been slowly devouring the world for the last decade, gave its first indication that it may be suffering a bit of indigestion.

  • The Emperor Would Like His Clothes Back Please!

    15 Apr 2013 | 12:00 am
    There has been some discussion over on LinkedIn about the difference between NGFW and UTM and whether or not those terms are interchangeable. It seems the opinions vary depending on whether you are a) a confused customer, b) a vendor, or c) an analyst firm with a vested interest in perpetuating a distinction that no longer exists – if indeed it ever did. Well you know what they say about opinions… so here is mine: NGFW was always nothing more than UTM for the enterprise.
 
  • add this feed to my.Alltop

    VRT

  • Microsoft Update Tuesday: Update for IE8 0-day and More

    Yves Younan, Ph.D.
    14 May 2013 | 12:13 pm
    Today is Update Tuesday and Microsoft is releasing updates for 33 CVEs across 10 bulletins. We'll be discussing some of the highlights here.One of the most important updates (MS13-038) that is being released is for the recent 0-day in Internet Explorer, which was used in a watering hole attack on a Department of Labor internal website targeting Department of Energy employees. This vulnerability, CVE-2013-1347, affects IE8 and can allow an attacker to perform remote code execution via a use-after-free vulnerability. While it's currently not being exploited in any of the exploit kits that we…

  • Changing the IMEI, Provider, Model, and Phone Number in the Android emulator

    dgoddard
    23 Apr 2013 | 10:22 am
    PincerI was having a look at the Pincer family of Android malware and came across some code designed to hinder analysis.From the decompilation of com/security/cert/a/a/c.class:    String str1 = com.security.cert.b.b.b(paramContext);    String str2 = com.security.cert.b.b.c(paramContext);    String str3 = com.security.cert.b.b.d(paramContext);    if(str3.toLowerCase().equals("android") ||        str1.equals("000000000000000") ||        str1.equals("012345678912345")…

  • 25 years of vulnerabilities: 1988-2012, the report

    Yves Younan, Ph.D.
    4 Mar 2013 | 8:50 am
    We here at the VRT are all about backing up opinions with facts, and there are a lot of opinions about the nature of the vulnerability landscape out there. That in mind, we decided recently to study the numbers, and put conventional wisdom to the test. At a high level, the numbers show that while vendors are putting increasing amounts of effort into security, critical vulnerabilities such as the recent Java, PDF, and Internet Explorer 0-days are on the upswing again of late. Combined with the clear upward trend in the amount of malware being dropped via these vulnerabilities - the Sourcefire…

  • Life Cycle and Detection of an Exploit Kit

    Alex Kirk
    25 Feb 2013 | 9:00 am
    Exploit kits may not be as hot a topic as the recently released Mandiant Report, but they're still an important part of today's threat landscape. As the success of the Cool Exploit Kit lets its author buy vulnerabilities, for example, these kits are not only one of the more prevalent ways of dropping malware on end-users, they're actually pushing defenders towards a time with more and more 0-days to worry about. Those of you who would like to understand more about how these kits work, check out my recent presentation on the subject. The presentation assumes no prior knowledge, so it's a…

  • 25 years of vulnerabilities: 1988-2012

    Yves Younan, Ph.D.
    20 Feb 2013 | 9:03 am
    We at the VRT are always interested in vulnerabilities and information about vulnerabilities. To this end we recently dug into the NVD database and examined data for the last 25 years and used it to map out trends and general information on vulnerabilities in software.Some of the questions we asked ourselves were:What are the most popular vulnerabilities?Which had the most impact?Which vendors and products suffered from the most issues?Which browser is the best in terms of vulnerabilities found?How many 0-days are found in products?While the answers to some of these questions are predictable,…
  • add this feed to my.Alltop

    Private WiFi

  • Stop WiFI Snoopers with a VPN: PRIVATE WiFi on WPIX NY

    Jillian Ryan
    16 May 2013 | 12:28 pm
    As WPIX NY reporter James Ford explains, “Public WIFi is a great and helpful tool and coverage is expanding… but also expanding is its potential danger to you.” Most people don’t realize that public WiFi are just radio waves, similar to the type that you can listen to in your car. And just as easy as it is to find your favorite station, a hacker can use public WiFi to listen in on you! In the middle of Times Square, Ford visited with PRIVATE WiFi team members, Raj Devjani and Lane Liston. In this demonstration Devjani and Liston set up a rogue, or fake, hotspot in Times Square.

  • Health Data Breaches Multiply; Canadian Hospital, Department of Veterans Affairs Both Hit With Lawsuits

    Elaine Rigoli
    15 May 2013 | 11:00 pm
    Just when you think it’s safe to provide your Social Security number on your doctor’s intake forms, another wave of medical data breaches crashes over our hopeful heads and reminds us that less (personal detail) is more. That’s because medical data breaches at large, major medical centers are all over the place again this month. Will a $40 million lawsuit in Canada — or the lawsuit by two United States veterans against the Department of Veterans Affairs — make people pay attention to such security gaffes and finally demand tighter security? Several Canadian…

  • Twitter Chat Sponsored by ITRC and PRIVATE WiFi Raises Awareness of Public WiFi Dangers

    Nikki Junker
    15 May 2013 | 9:21 am
    Earlier this month, PRIVATE WiFi and The Identity Theft Resource Center (ITRC) co-hosted the monthly ID Theft Twitter Chat. The ITRC hosts these monthly events in an effort to engage consumers in discussion about the issues surrounding identity theft. As the ITRC believes that cyber security is an important part of protecting from identity theft, the issue of public WiFi is of of utmost importance. Many of the participants felt as strongly about the risks of WiFi usage and there was a lot of great input. Joining the chat, among others, were Stop.Think.Connect., Clarity for Consumers, CSID and…

  • Hacked in the Subway: PRIVATE WiFi Featured on WNBC

    Jillian Ryan
    14 May 2013 | 10:07 am
    “Turns out free WiFi has a price,” explained WNBC New York’s Andrew Siff in a recent segment. As public WiFi connections expand in New York City’s subway system, Siff recognized the security implications. To get a better understanding, he spent some time underground with PRIVATE WiFi’s CEO Kent Lawson and Product Growth Manager Raj Devjani. Using simple, readily available software, Devjani was able to sniff the data of commuters accessing the WiFI network. He explained to Siff, “I can get into your e-mail so I know a lot.” Lawson continued, “All you have to do is put…

  • The FBI and SOeC Endorse VPNs for Securing Mobile Devices

    Jillian Ryan
    9 May 2013 | 8:11 am
    Securing Our eCity Foundation (SOeC), in conjunction with the Federal Bureau of Investigation, has developed a Public Service Announcement featuring five tips for keeping yourself safe on your mobile device. In this PSA, airing on San Diego’s NBC 7, FBI Special Agent Darell Foxworth states, “Securing your mobile device is essential to keep your data out of the hands of crooks.” Agent Foxworth provides the following steps for protecting yourself: Lock your device with a passcode. When using public WiFi, limit using e-mail, social networking, shopping, and banking, unless you have a…
  • add this feed to my.Alltop

    BullGuard’s Blog – Your Online Security Hub

  • Cheat Sheet: Keep Your Online Identity Safe In 3 Easy Steps

    Kirsten Dunlaevy
    16 May 2013 | 2:35 am
    Are you stressed about your online identity being at risk? You’re not alone – with over 15 million identities stolen each year in the U.S. alone, identity protection is an understandable concern. There’s really no need to be afraid – BullGuard is here to protect you, not just with award-winning products, but also with easy-to-follow tips to make sure your online identity stays safe. Try BullGuard Internet Security 2013, free for 60 days, here! With any online interaction, it’s important to be vigilant. You could unwittingly be giving away parts of your key identity information…

  • 4 Ways Cybercrooks Are Stealing From You

    Kirsten Dunlaevy
    15 May 2013 | 5:01 am
    Identity theft is on the increase globally. Nothing is safe. They’re after your Facebook account, your medical identity and your financial assets. Typically, most, if not all of this information, exists in some shape or form on the World Wide Web, which means it can be hacked. You’re especially at risk if you use the same passwords, variations of the same password or personal information such as your birth date, to access this information. Aside from being a massive inconvenience, identity theft is also expensive! While you’re not liable to false expenses, it does take time to legally…

  • Identity Theft Gains Popularity Among Cybercriminals

    Elena Ionică
    14 May 2013 | 5:46 am
    Online crime nowadays comes in various shapes, and identity theft is already a major concern for many consumers worldwide. While users are being thoroughly educated regarding their online behaviour, researchers admit that online identity theft is on the rise. Try BullGuard Internet Security 2013, free for 60 days, here! Although it is not a new type of threat, identity theft is equally dangerous for both consumers and financial institutions. Recovery from identity theft requires huge amounts of effort, time and money to restore stolen identities and peace of mind. What is identity theft?

  • Watch Out For Bad News, The Mobile Virus! 6 Tips To Stay Virus-Free

    Kirsten Dunlaevy
    13 May 2013 | 7:59 am
    It’s no joke the latest in mobile viruses is called ‘Bad News.’ To date, this virus has infected approximately 9 million Android based devices. And its attack method is unique. This Trojan is terrorizing Android mobile phone consumers by hiding amongst existing apps on the device, and has been associated with 32 different Android apps. Malware hidden in legitimate apps only becomes live upon post-launch updates. Once active, it sends up a false notification asking users to download an app – this is the Bad News malware piece. When dormant, Bad News is able to register the user for…

  • Tell Your Friends About BullGuard And Get Rewarded

    BullGuard
    10 May 2013 | 3:28 am
    We’ve got exciting news for you! We’ve just rolled up our new Tell a friend programme, to show our appreciation for all BullGuard users, friends and followers that make up our BullGuard community. If you’re one of them, this programme is dedicated to you! Tell a friend was designed to help you gain rewards for spreading the word about BullGuard’s award-winning Internet Security 2013. What rewards? Well, those would be hefty discounts and FREE subscription extensions for your BullGuard products, even trial versions. Get as many friends as you can to use BullGuard’s award-winning…
 
  • add this feed to my.Alltop

    Pivot Point Security

  • Assessing the Security of Legal Practice Management Software in the Cloud

    John
    16 May 2013 | 4:00 am
    Recently I had an interesting conversation with a client about the pros and cons of moving from an in-house enterprise Practice Management System (PMS) to a cloud-based (SaaS) solution.  Needless to say, our conversation centered on the information security implications of the potential move.  I was intrigued when he indicated that the PMS vendor was both SOC 2 and ISO 27001 certified.  While we were chatting I pulled up the vendor in question’s website and found that the vendor’s “marketing” touted the security of the data center where their application ran — rather than…

  • Hey, Is This Application Secure?

    Marc
    14 May 2013 | 5:00 am
    Lately a lot of clients have been asking me to provide what I refer to as “security on demand.” The client basically asks: “My users want me to give them this (commercial off the shelf software) application — is it secure?” That’s a very simple question, but often the answer is a lot more complex. At a minimum, it might take me considerable time to research the issue. I need to check the Microsoft Security Research & Defense blog, I have to check the vendor’s website, I have to see if there’s any notices of vulnerability in CVE or anyplace…

  • Disaster & Recovery

    Scott
    8 May 2013 | 1:18 pm
    As a result of the devastation from Hurricane Sandy, the possibility of another similar—or worse—weather incident and our ever-increasing reliance on the cloud, we have to ask ourselves two questions: How can we ensure that NJ businesses survive future events like Sandy? How can we ensure the resilience of information technologies that support New Jersey businesses? In this 2-Part Special Report, we will uncover the answers to those questions, and shed light on the things that need to be done today. Read the article by downloading the PDF from NJTC. The post Disaster & Recovery…

  • Why Outsourced or Co-Sourced Vulnerability and Configuration Management is Becoming More Popular

    John
    7 May 2013 | 4:00 am
    We conduct hundreds of vulnerability assessments and penetration tests per year at Pivot Point Security. While the overall security postures of most organizations is notably better today than it was ten years ago, I think that vulnerability and configuration management practices specifically are not much better today than they were then. The improvement in security posture as a whole is largely attributable to Microsoft getting more serious about security in the middle of the last decade, and moving to a secure-by-default approach. But, since a majority of information security risk stems from…

  • How OWASP Can Prevent Your Business From Getting Stung By Hackers

    Bob
    30 Apr 2013 | 4:00 am
    In a recent blog post, one of my colleagues at Pivot Point Security wrote about a client firm that was hacked due to a vulnerability in one of its web applications. While they regularly ran network vulnerability tests against their web server, they had overlooked their applications, which were not coded with security in mind and had never been properly tested for vulnerabilities. You don’t want to find out the hard way about security vulnerabilities in your web applications — and you don’t have to. Finding and fixing holes proactively, ideally before the application reaches…
  • add this feed to my.Alltop

    My RSS Feed 1

  • BackLinks2rss

    19 May 2013 | 1:44 pm
    Get your links indexed

  • Keyword 1

    19 May 2013 | 11:21 am
    In Part 10, we cover Keyword 1 in details, also covering checking hard on a search engine. Remember that Keyword 1 is all about .....
 
  • add this feed to my.Alltop

    HOTforSecurity

  • OSX Backdoor Found on Angolan Activist’s Mac, Apparently Downloaded from Romania

    Bogdan Botezatu
    18 May 2013 | 12:00 am
    The Bitdefender labs are currently working on an analysis of a Mac OS X backdoor that has been discovered by independent security researcher Jacob Applebaum on an Angolan activist. The victim, who had fallen victim to a phishing scam, ended up installing a malicious piece of code that acts as a backdoor, taking screenshots, and [...]

  • Internet criminals outstrip hacktivists to take back dominance of the internet underworld

    Erik Grueter
    17 May 2013 | 5:39 am
    Organized crime, data theft, and other “old school” methods for stealing information have re-gained control over the internet underworld  in the past year, shoving aside the hacktivists who had dominated the virtual landscape from 2011. Verizon’s Data Breach Report is the best place to explore the reasons behind such a change. This report comprises millions [...]

  • Bitdefender Antivirus Free Adds Quarantine Ability

    Liviu Arsene
    17 May 2013 | 1:56 am
    Bitdefender Antivirus Free for desktop computers is designed to minimize both the performance footprint on computers and user interactions. Using the same award-winning technology proven to fend off even the most intrusive malware, Antivirus Free not only offers 24/7 protection, but is also fully compatible with Windows 7 and Windows 8. Since we’re always trying [...]

  • Cyber-Criminals Grabbed Over $500 Million Last Year, FBI Complaints Show

    Bianca Stanescu
    16 May 2013 | 8:02 am
    Cyber criminals stole more than $500 million last year, according to the latest IC3 study based on reported incidents. In 2012, the organization received almost 300,000 complaints, an average of more than 24,000 a month. Compared to the previous year, losses by users tricked over the Internet increased by 8.3 percent. Almost half of the complaints [...]

  • SysAdmin Hoax Goes International; Spanish Passwords Go Straight to Scammer Database

    Bianca Stanescu
    16 May 2013 | 5:17 am
    The SysAdmin scam that makes people believe they need to restore their account because of hacking attempts went international. The Spanish are now sending their passwords straight to the cyber-criminals’ database. The e-mail targeting the Spanish in their language claims the user’s email account needs to be urgently restored. “Several incorrect login attempts on your [...]
  • add this feed to my.Alltop

    ETech 7's Managed IT and Internet Marketing Blog

  • Server Data Backup Saves You Money

    Emil Isanov
    3 May 2013 | 3:00 am
    When you want to learn about backing up your data, a great place to read more is "What Are the Real Advantages of Backing Up?" You can back up your data in a number of different ways, but they are all going to have the impact of saving you money over time. While you might initially think that server data backup is merely an expense, there are a lot of different ways you can preserve your company's capital by using professional, automated backup systems. The fact that every company isn't backing up their data effectively in the modern world is unfortunate. The world of onsite data backup is…

  • The IT Support Company in Your Network

    Emil Isanov
    2 May 2013 | 3:00 am
    Much like with every other company that starts to outsource IT support functions, your world begins to change the moment you outsource your tech functions. Just as with any kind of change, there are going to be some bumpy moments where you wonder if you made the right decision. But just like with most other kinds of changes you make during the early formative years of your business or during a period where your company evolves a lot, the growing pains are worthwhile because they can reveal a lot of great things. To learn about outsourcing in general, read more in "One Good Reason Small…

  • Has Anyone Not Gotten Website Content Development Yet?

    mark kandinov
    1 May 2013 | 3:00 am
    The world is a much different place than it used to be. Since the Internet is the most rapidly changing development environment in the world, Internet business development is one of the most dynamic fields of intellectual discourse going on right now. With so many different kinds of content being developed on so many diverse kinds of platforms, it makes sense that the upward limit of what this means to business owners is a hot topic of discussion. To learn more about the SEO process and how it works alongside content, read more in "When Web Marketing and SEO Consulting Go Hand in Hand." The…

  • Moving Beyond Onsite Data Backup

    Chris Hodge
    30 Apr 2013 | 3:00 am
    The qualities that have made onsite data backup a major factor in the backup plans of most businesses are not limited to this kind of operation. In the same vein, the onsite form of backing up your data should not be the only method you use to keep what you have and maintain your operation if something negative happens to your data stream. While this is a major step and more than some businesses do, which already puts you ahead of the curve if you are practicing backup effectively.   To learn about this process, read more about it with "What are the Real Advantages of Backing Up?" The…

  • Life When You're Outsourcing IT Isn't So Bad

    Chris Hodge
    28 Apr 2013 | 6:45 pm
    The world out outsourcing IT operations is one where you have to be careful. Any kind of outsourcing operation has the potential to be a pain in the lower back, so you have to pick your company carefully and stay reasonable about the process. Assuming that any company holds a magic wand or that your operation can only be successful is a sure recipe for disaster, and thus you do not want to be unprepared for the beginning of your outsourcing. Fortunately, once you get some experience with it, outsourcing is a very cool operation. To learn more about outsourcing just about all of your IT…
  • add this feed to my.Alltop

    Data In Motion - a Managed File Transfer blog

  • Is Your Enterprise Losing Control of File Transfers

    Tom Scearce
    29 Apr 2013 | 1:01 pm
    It seems like every day there is news buzzing about the newest file sharing service in the cloud. You may have heard about the recent acquisition of Mailbox, the mobile mailbox in the cloud, by Dropbox, a file sharing service in the cloud. But what does this emerging trend mean for the file transfer landscape? It means trouble. The allure of a free, quick and easy system to exchange files is appealing to many consumers and businesses. It seems like a logical alternative to sending files through email, which is unreliable and can clog inboxes, or FTP, which can put data at risk. However,…

  • Reflection for Secure IT Web Edition 8.0 and FileShot 1.9 to the Rescue

    Tom Scearce
    25 Mar 2013 | 4:25 pm
    When we last left John, he was bracing for an awkward conversation with his boss. It started when he tried to email a proposal to a very important client at deadline time. Unfortunately, the proposal’s file size exceeded the limit set by John’s IT department. A predictable chain of events ensued: proposal not received… …client unhappy… …account lost to competition… …John’s perspiration level rising. As we shared in our last post, streamlining user-driven file transfers can increase your peace of mind. With the right file transfer solution, you’ll know your files are secure…

  • User-driven file transfers and you

    Tom Scearce
    5 Mar 2013 | 1:46 pm
    Email is the most common way that users transfer files to other users. That makes sense, doesn’t it? Email is fast and easy. We rely on it to communicate with employers, colleagues, vendors, family and friends. It makes sense that we default to sending a file through email. However, with fast and easy, we often sacrifice security and reliability. Consider the story of John. John works in a professional services organization and has promised to deliver a large proposal to an important client by end of day. John typically relies on email to send his files, so he simply drafts an email and…

  • The Top 3 MFT Benefits for 2013

    Tom Scearce
    28 Jan 2013 | 2:05 pm
    When you send an important package through the postal service, you want to ensure it safely reaches the intended recipient. So you buy insurance, or you request a tracking number, or a receipt notification. You don’t want to risk your item getting lost or stolen. And you want peace of mind that the package arrived undamaged. The same is true for transferring files. When you send photos, music, documents and other files, you want to know that it arrived safely and securely. This is how a managed file transfer solution can help. Whether or not you’ve made New Year’s resolutions for 2013,…

  • Top FTP Risks of 2012

    Sam Morris
    26 Dec 2012 | 11:14 am
    Picture this scenario: Your organization has a signed contractual obligation to provide a set of services  to a business partner.  As a part of those services, you must deliver a file to your business partner no later than  4 a.m. on Monday morning. The file is produced by a batch process that is generated over the weekend and then copied to your partner using a file transfer script. Monday morning arrives and you receive an angry phone call that the file never made it to your business partner, and now they are threatening to apply the penalties section of your service level agreement.
 
  • add this feed to my.Alltop

    Secure Connexion

  • What is Multifactor Authentication & Why YOU Need it?

    Jay Pfoutz
    6 May 2013 | 11:16 am
    Lately, there’s been a lot of buzz about multifactor authentication, especially with Twitter. Multifactor Authentication refers to the requirement of two or more pieces of information needed before allowing access to a specific account. Adding another step to authentication, it’s requiring the user to not only enter a password, but also input another piece or more of information. Many example include inputting a username and password, plus maybe a code or other piece of pertinent information each time at logon. Although this is a good security method, by providing another barrier…

  • With the Rise of Coding, Comes the Rise of Malware

    Jay Pfoutz
    1 May 2013 | 1:43 pm
    I’m sure you might have read recent articles about how coding is going to be the ultimate skill in the coming years. Seems like this might as well be true, so it’s being pushed with the various online schools being developed (the list is getting exhaustive). With this huge rise of training comes a huge rise of smarter hackers and malware writers. What is it about malware that seems so attractive? Money, fun, damage, etc.? We can get a glimpse of reality when we see the statistics on antivirus vendor websites, some say a million new samples are added weekly. Many of these issues…

  • Added Security for Twitter Users to Come Soon!

    Jay Pfoutz
    26 Apr 2013 | 1:02 pm
    From spam to ham, Twitter deals with a lot of security issues on a daily basis. What about viruses/malware? I’m sure, yes. But, more importantly: account security. What do Twitter users need? Security assurance! Therefore, Twitter is developing and perfecting a two-factor authentication method that will allow Twitter to not only ask for a password, but also a different credential to be sure of who is accessing your account. From recent issues with Twitter accounts being hacked, it is best to have this in place, before it happens to other high profile organizations. Some of the recent…

  • CISPA Bill Passed by Representatives Again – Trouble on the Horizon!

    Jay Pfoutz
    22 Apr 2013 | 11:49 am
    The Cyber Information Sharing and Protection Act, AKA CISPA, has once again passed in the US House of Representatives. Reminder that this bill gives government agencies and their other agencies access to personal, private user data to help monitor for the presence of hackers. Now, when CISPA was first passed, Senate said NO! Also, President Barack Obama has said that he’d veto the bill if it came through his office. Because of the different privacy issues, many advocates against this bill will fight it to the end. This bill has been backed by bigwig business for a long period of time,…

  • Updated Details: Gozi Malware Back with More Money Stealing & Sophistication

    Jay Pfoutz
    20 Apr 2013 | 2:48 pm
    It seems as if security firm, Trusteer, has identified a new variant of the Gozi financial malware. This one is more sophisticated and requires your attention. This new variant infects the Master Boot Record (MBR) on your computer — which is a boot sector software device that resides at the beginning of your hard drive that tells your computer how to boot up. Just like TDL4, another MBR infector, this malware is hard to detect and remove. The main idea behind Gozi, though, is to wait for Internet Explorer to be launched on the victim’s machine, and malicious code is injected into…
  • add this feed to my.Alltop

    Video Surveillance

  • 45% of US Employers Increased Security Budget in 2012

    16 May 2013 | 12:21 pm
    Businesses are catching up with America’s growing concern for tighter security; in 2012, 45% of U.S. employers reported that their annual security equipment budgets increased during 2012 according to a survey conducted by market research firm IMS Research in late April 2013.

  • CommunityCam featured on OregonLive.com

    9 May 2013 | 12:00 pm
    CommunityCam, a security camera mapping tool in Portland, OR that aims to help local citizens and law enforcement squelch crime, was recently featured in the Oregonian and on OregonLive.com in an article titled "Map by Portland's VideoSurveillance.com Reveals Cameras Pointed at public."

  • New Case Study on Golf Course Surveillance

    7 May 2013 | 10:21 am
    Mattawang Golf Club, a public golf course located in Bell Mead, New Jersey, reached out to VideoSurveillance.com to design an HD security camera system for their 9,000 square foot clubhouse facility and pro shop. The aim of the new IP surveillance system was to protect the golf club’s staff, patrons, and grounds, as well as deter sneak-on golfers and vandals.

  • New York Times/CBS Poll Shows 78% of Americans Favor Public Surveillance

    2 May 2013 | 11:42 am
    According to a poll conducted by New York Times/CBS News majority of Americans believe that public surveillance is a good idea – 78% to be exact. The poll of Americans on Terrorism Threats, published on May 1, 2013, asked survey respondents their opinions on a variety of hot-button issues such as the risk of terrorism in the United States, civil liberties, and domestic preparedness for preventing a terrorist attack. What’s even more noteworthy is that these results come from a reputable, dependable, and unbiased news agency. What follows is a demographic breakdown of those who believe…

  • CommunityCam Crowd-Sourced Map Gains Momentum in the Northwest

    30 Apr 2013 | 12:36 pm
    Spearheaded by VideoSurveillance.com, CommunityCam is a free crowd-sourced camera mapping tool that allows users to upload and view surveillance camera locations across the U.S. Since its release a few months ago, CommunityCam has acquired thousands of cameras in Philadelphia and the Pacific Northwest, with visible growth every day from new users around the country.
  • add this feed to my.Alltop

    InternetCyberCrime.com

  • WestPark Capital Supporting Ukrainian Ponzi Scheme “Uinvest”

    Bernd
    19 May 2013 | 1:12 pm
    The guys over at Realscam have just recently started to uncover some Ukrainian Ponzi scheme that claims to be the biggest crowdfunding company in the world. This seems funny, as most of the industries big names has never heard about them and also they do not seem to care much about any securities laws anywhere in the world, not even in their own country. But this is not the topic today. What is even more interesting is, that we can see again WestPark Capital doing shady business. WestPark has created some headlines in the past by conducting shady business activities and working with…

  • Kansas Issued Cease And Desist Order Against Profitable Sunrise Including Name Of Nancy Jo Frazer

    Bernd
    18 May 2013 | 1:55 am
    The state of Kansas has recently issued a cease and desist order against the Profitable Sunrise HYIP Ponzi scam. In this cease and desist order they are saying that the program offered gaudy returns of 1.6% to 2.7% on a daily basis. This cease and desist order comes a bit late, it is still important though. The most interesting part of this new cease and desist order is that two of the biggest pitchmen for the Profitable Sunrise Ponzi scheme have been called by name. In his statement, the Kansas securities officials stated that Florida resident P. Cozzocrea and Nancy Jo Frazer of NJF Global…

  • Zeek Rewards Claims Portal Is Open

    Bernd
    16 May 2013 | 5:03 am
    Five days ago I reported that the Zeek Rewards claims portal is scheduled to open soon. This has now happened. The portal is accessible through the website of the court appointed receiver and also through a separate website. All claims must be filed by 11:59 p.m. (prevailing Eastern time) on September 5, 2013. Graham C. Mullen, Senior U.S. District Judge of the Western District of North Carolina has approved the Zeek Rewards claims process on May 8. Kenneth D. Bell said in a letter to Zeek participants last week, that there are potentially more than 1 million claimants. Before you are…

  • Hindustan Times: 13 Deaths Related To West Bengal Ponzi Schemes

    Bernd
    16 May 2013 | 1:39 am
    According to the “Hindustan Times”, a newspaper in India, 13 deaths have been linked to Ponzi schemes operating in the West Bengal region. Just recently a man has been found dead hanging in a tree, the newspaper reported. At least 12 people have been commited suicide and a director of the Ponzi scheme “Saradha” has been killed since the scheme started to fail. The Saradha Ponzi scheme  may have stolen billions of dollars from Indian investors, Jordan D. Maglich, attorney and publisher of PonziTracker.com reported. This is what has been published on PonziTracker.com:…

  • Advice: Banners Broker HYIP Ponzi Scam Victims Should Not Stay Silent

    Bernd
    15 May 2013 | 12:05 am
    If you have invested into the Banners Broker Ponzi scheme and have lost your money you should act at all cost and report them to your local police as well as the financial services authority in your country. There is really no need to be ashamed or something. Why is it so important? Read this article to know more. I have recently red an article from Eddie O Driscoll who was invited to the Banners Broker Ponzi scam quite a while ago. He had the luck to know all necessary things in order to identify Banners Broker as a fraud within minutes. His article is really a great example for why it is…
 
  • add this feed to my.Alltop

    Infosec Communicator

  • Visualizing Your Professional Network

    bwadmin
    16 May 2013 | 12:48 pm
    Did you know that LinkedIn Labs provides a graphical representation of your professional network? It’s similar to a hyperbolic browser I saw demonstrated several years ago in a research facility in Silicon Valley. The map allows you to hover over … Continue reading →

  • Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter

    bwadmin
    26 Apr 2013 | 7:21 am
    Ben Woelk Receives STC Distinguished Chapter Service Award | STC Rochester Chapter. I was truly humbled and honored to receive the Society for Technical Communication‘s Distinguished Chapter Service Award (DCSA) for my work over the last few years with the … Continue reading →

  • Get On Board! Entraining Volunteers

    bwadmin
    25 Apr 2013 | 10:14 am
    I’m delivering the presentation below as part of a progression at Summit 2013 Leadership Day in Atlanta. Summit Leadership Day provides STC community leaders with the knowledge and guidance they need to lead successful communities, both geographic chapters and SIGs. … Continue reading →

  • Empowering the Introvert Within | Bulletproofing Your Career Online

    bwadmin
    20 Mar 2013 | 8:48 pm
    Empowering the Introvert Within | Bulletproofing Your Career Online. Preview Hannah (Careersherpa.net) and Ben’s newest presentation, Empowering the Introvert Within: Becoming an Outstanding Leader. Presentations are currently scheduled in Rochester at Spectrum, March 22, 2013 and in Atlanta at the STC … Continue reading →

  • More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com

    bwadmin
    19 Mar 2013 | 8:55 am
    More on Security and Google Tips from @benwoelk and @careersherpa #stcpmc13 | ed marsh dot com. Ed Marsh’s review of our Bulletproofing Your Career Online Keynote and Workshop at the STC Philly Metro’s Mid Atlantic Technical Communication Conference in March … Continue reading →
  • add this feed to my.Alltop

    Dice News » Security

  • Using Big Data to Save the Planet

    nick kolakowski
    2 May 2013 | 2:54 pm
    Using Big Data to Save the Planet (via slashdot) Big Data: tool of international diplomacy? The U.S. State Department’s Conflict and Stabilization Operations (CSO) office is reportedly using an analytical toolset to drill deep into the reasons behind conflicts around the world. “We are about breaking and interrupting, stopping and preventing… The post Using Big Data to Save the Planet appeared first on Dice News.

  • Mandatory Data Breach Reporting Appears Dead

    nick kolakowski
    29 Apr 2013 | 11:41 am
    Mandatory Data Breach Reporting Appears Dead (via slashdot) A plan by the Obama Administration to set up a framework for exchanging cybersecurity information could be dead—at least as a mandatory requirement. But that doesn’t mean such an information-sharing framework is off the table. The Washington Post reported April 26 that, while a national plan that… The post Mandatory Data Breach Reporting Appears Dead appeared first on Dice News.

  • Ways AP Could Have Avoided Its Twitter Hack

    David Strom
    25 Apr 2013 | 7:00 am
    A single tweet with a phony bit of news sent the stock market into a brief dive Tuesday, pushing the Dow Jones Industrial Average down more than 140 points in the three minutes from 1:07 to 1:10 p.m. ET. When the “news” — that two bombs had exploded in the White House, injuring the president — was debunked, the market regained its footing.   Of course, phony information blasts out through Twitter all the time. The difference here is that the tweet came from a reliable source — @AP, the account of the Associated Press. A group called the Syrian Electronic…

  • The Security Implications of Fake Twitter Followers

    David Strom
    19 Apr 2013 | 8:00 am
    A recent New York Times story about the fake Twitter follower community got me thinking. The newspaper claims that this is a $1 million industry, with followers being purchased in bulk for about a penny a head. Why does Twitter tolerate this? Certainly, the company could easily fix this problem with some clever software engineering. Instead, they’re turning a blind eye. But on further reflection, it’s not something that’s easy to fix. I have a Twitter account that I set up with some automated feed software, and I haven’t looked at it in a while. Yet it has 18,000…

  • What Are Your 5 Biggest Online Privacy Worries?

    David Strom
    16 Apr 2013 | 8:00 am
    Let’s talk about this. An article posted on ITWorld earlier this month got me thinking about how small businesses have to deal with online privacy issues. According to ITWorld, their top five concerns include: The proliferation of cookies. Theft of cloud-based data through weak password controls. Being betrayed by the stored location data on cell phones and other mobile devices. Photo tags on social networks. Federal and police agencies scanning online services. Notice: None of these items include the words “hacker,” “rogue employee” or “security…
  • add this feed to my.Alltop

    Seculert Blog on Advanced Persistent Threats and Malware

  • PushDo Malware Domain Generation Adaptation

    Aviv Raff
    16 May 2013 | 2:08 pm
    The advanced malware world is amazingly dynamic. Attackers adapt to the security vendors findings incredibly fast, so much so that sometimes they manage to make adaptations to the malware even before the malware report is public. Yesterday, Dell SecureWorks and Damballa reported [PDF] that a variant of the PushDo malware added a new feature – [...] The post PushDo Malware Domain Generation Adaptation appeared first on Seculert Blog on Advanced Persistent Threats and Malware. [[Read more...]]

  • Dorkbot Rears its Malicious Head on Facebook

    Debbie Cohen-Abravanel
    16 May 2013 | 12:01 am
    If your enterprise and/or employees use Facebook, then watch out: Dorkbot is back in town. Thanks to the researchers at Bitdefender for spotting this one, and the reporters at CSO for helping sound the alarm. Dorkbot – which the folks at Facebook have since worked to remove from their site – spreads via a botnet [...] The post Dorkbot Rears its Malicious Head on Facebook appeared first on Seculert Blog on Advanced Persistent Threats and Malware. [[Read more...]]

  • New Android Malware: Android.TechnoReaper Found on Google Play

    Debbie Cohen-Abravanel
    13 May 2013 | 6:27 am
    It hasn’t been a great week for the folks in charge of Google Play’s malware prevention department. One expects that there’s been plenty of overtime, lots of coffee – and more than a few headaches.  That’s because, after finding that four (now removed) apps had been covertly installing the BadNews malware on up to 9 [...] The post New Android Malware: Android.TechnoReaper Found on Google Play appeared first on Seculert Blog on Advanced Persistent Threats and Malware. [[Read more...]]

  • Linux/Cdorked Malware Attacking Some of the World’s Top Web Servers

    Debbie Cohen-Abravanel
    9 May 2013 | 9:24 am
    As reported by the IDG News Service, a strain of covert malware called Linux/Cdorked is attacking some of the world’s highest-profile web servers – and to make things even more alarming, nobody’s quite sure yet how it got there…or where it may head next. The malware alarm bell was set off last week by two [...] The post Linux/Cdorked Malware Attacking Some of the World’s Top Web Servers appeared first on Seculert Blog on Advanced Persistent Threats and Malware. [[Read more...]]

  • 19 Hours of Malware Blackout

    Aviv Raff
    8 May 2013 | 3:00 pm
    For over 19 hours the internet in Syria was inaccessible. There was no access to internet resources from within and throughout the country. This internet blackout was a really bad news for most Syrian citizens, but it was also a malware blackout for some of the cyber criminals, hacktivists, and other adversaries that were not [...] The post 19 Hours of Malware Blackout appeared first on Seculert Blog on Advanced Persistent Threats and Malware. [[Read more...]]
 
Log in