DirSec Security

jared T was at

ZZZzzz....

As such, I've frequently advised small business owners to avoid banking on Windows systems, since all of the malicious software currently being used by these criminals to steal e-banking credentials simply fails to run on anything other than Windows. What's more, the tools these crooks are using - mainly the Zeus Trojan - almost always outpace anti-virus detection at least by a few days, and by then it's usually too late.

[A]ddressing Stuxnet goes beyond using quality security controls, said Mark Weatherford, vice president and chief security officer at NERC. The industry, he said, needs to demand higher quality software that is free from defects. "This is not an indictment on [the] control system industry; it's an indictment on the IT business in general," Weatherford said. "We're still seeing products that come out that are susceptible to vulnerabilities that quite frankly have been in the wild for quite some time."

In addition to security and PCI compliance, WAF systems are also very useful for obtaining visibility of web applications and data flows in a network.

A new lawsuit alleges their influential conclusions are biased to those who pay. It may be time for financial-industry-style disclosure rules

Rapid7 has acquired Metasploit to bring the open-source project's database of reliable exploits to bear in Rapid7's vulnerability management and penetration testing offerings.

Such software, often referred to as "scareware," has gotten more attention in the past year as scammers continue to enjoy success tricking users into shelling out big bucks. In a report titled "Report on Rogue Security Software," Symantec officials uncovered that sales affiliates were pulling in staggering amounts of money.

Or: Disk encryption is only useful if the underlying system doing the encryption is trusted.

"New breed of products calculates risk ratings of PCs based on what files they contain"

Cool pitch from Demo Fall..

An interesting take on a "netbook" device.

Between insider threats and malware attacks, the idea of trust-but-verify is dead as a security model, according to a new report by Forrester Research. In its place, Forrester analyst John Kindervag contends enterprises should embrace the concept of zero trust, a model where insiders and outsiders are equally untrustworthy, and security administrators stop trusting packets as if they are people. The change, he said, is necessary due in part to the "innumerable instances" of trusted users going rogue on enterprise networks.

Upcoming 802.11n draft standards promise improvements like more consistent access, better signal quality, improved security, and smarter management

lou@dirsec.com password 8e6VAR.

I'm also an advocate of third-party software that helps companies manage elevated accounts. I often run into Cyber-Ark's privilege identity manager solutions. It's pretty cool stuff and perfect for managing elevated accounts. Admin accounts can be locked into a digital vault, then protected by granular policies that enforce rules and checkout procedures in order for an elevated account to be used. One of my favorite features is the one-time-use passwords, where the password is changed for each user and occasion. You can also easily enable auditing of who used what accounts when.

Emerging as the sentinels of this modern scourge are companies like WatchGuard, the Seattle-based manufacturer of appliances dedicated to inoculating computer networks from the spread of viruses. The company in November unveiled three new models in its XCS series of 1U appliances to provide small and midsize businesses with always-on protection from spam, viruses, spyware, phishing and other threats borne by e-mail.

The decade-old software provider, based in Pasadena, Calif., on Jan. 19 announced Version 4 of its EnCase eDiscovery platform. EnCase provides legal and IT teams with an integrated software package that includes all the necessary functions for in-house electronic discovery, such as legal hold, precollection analytics, and identification, preservation and collection. The latest news is that Guidance, in its Version 4, has added a couple of other important features: processing, analysis and early case assessment, and first-pass review.

Cloud Based WLAN