DirSec Security

Webmail in the educational market appears to be a three horse race between Zimbra, Gmail and Outlook/Microsoft Exchange. And today, Yahoo's Zimbra won out against the other two in a bid to provide for Stanford University.

VMware and partner Tripwire have a tool that they say could make the job easier. Called Tripwire ConfigCheck, the free tool assesses ESX Servers against VMware's configuration rules. ConfigCheck is available for download on Tripwire's site, with a link on VMware's security site as well. Users can scan individual ESX Servers, presenting remediation instructions for non-compliant systems.

VMware and Sun Microsystems are working together to deliver a high-performance virtual desktop solution across wide area networks with a new integrated solution that includes the VMware Virtual Desktop Infrastructure (VDI) platform and Sun Microsystems' Sun Ray™ software and virtual display clients. The solution utilizes Sun's Appliance Link Protocol™ (ALP), which outperforms other display protocols when used to deliver virtual desktops over networks with high latency. Customer tests show dramatic increases in performance when using VMware VDI with Sun ALP to deliver complete desktop environments in a WAN deployment.

It may not be possible after all to conceal the existence of a sensitive file on a machine. BT security expert Bruce Schneier and a group of researchers have hacked an ultra-paranoid feature in the TrueCrypt open-source disk encryption tool that lets users hide secret files from detection by attackers or others. This "deniability" feature is a sort of extreme file-protection function that first encrypts the file and then hides it within an encrypted area on the disk drive like an invisibility cloak. But Schneier, chief security technology officer with British Telecom and researchers from the University of Washington found that Microsoft Vista, Word, and Google Desktop each can blow the cover of files using this so-called "deniable file system" (DFS) feature. The researchers were able to get around DFS in versions 5.0 and below of TrueCrypt's encryption-on-the-fly tool, and will present their findings on the hack at the Usenix HotSec '08 summit next week in San Jose, Calif.

How can you identify and locate your organization's most sensitive data? Many vendors are offering data loss prevention (DLP) tools and other discovery tools, and many of them offer a lot of promise. But they aren't cheap or trivial to deploy. Does your data discovery process have to wait until you get the time and budget to deploy DLP? Thankfully, no. It's possible to get a jump-start on discovering sensitive data using freely available and open source tools -- provided that you understand what your company needs to identify and protect. The tools range in functionality from simple searching of files on desktops and laptops to spidering and searching Website content.

[T]here are assumptions, myths and even urban legends surrounding encryption. We'll debunk conventional wisdom and explain what is true, what is almost true and what is completely false.

I don't mean to pick on Nissan by any means but I am quite curious to know exactly what it takes to make an IT organization (or more explicitly, IT management) choose a blatantly inferior product over far more capable competing products for use in such a critical environment no matter how sweet the deal may seem.