Skip to main content

Home/ Information Security/ Group items tagged information security

Rss Feed Group items tagged

Filter: All | Bookmarks | Topics Simple Middle
Skeptical Debunker

The Comprehensive National Cybersecurity Initiative | The White House - 0 views

www.whitehouse.gov/...ional-cybersecurity-initiative

President Obama cybersecurity initiative

shared by Skeptical Debunker on 03 Mar 10 - Cached
  • The CNCI consists of a number of mutually reinforcing initiatives with the following major goals designed to help secure the United States in cyberspace: To establish a front line of defense against today’s immediate threats by creating or enhancing shared situational awareness of network vulnerabilities, threats, and events within the Federal Government—and ultimately with state, local, and tribal governments and private sector partners—and the ability to act quickly to reduce our current vulnerabilities and prevent intrusions. To defend against the full spectrum of threats by enhancing U.S. counterintelligence capabilities and increasing the security of the supply chain for key information technologies. To strengthen the future cybersecurity environment by expanding cyber education; coordinating and redirecting research and development efforts across the Federal Government; and working to define and develop strategies to deter hostile or malicious activity in cyberspace.
  • Skeptical Debunker on 03 Mar 10
     
    President Obama has identified cybersecurity as one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter. Shortly after taking office, the President therefore ordered a thorough review of federal efforts to defend the U.S. information and communications infrastructure and the development of a comprehensive approach to securing America's digital infrastructure. In May 2009, the President accepted the recommendations of the resulting Cyberspace Policy Review, including the selection of an Executive Branch Cybersecurity Coordinator who will have regular access to the President. The Executive Branch was also directed to work closely with all key players in U.S. cybersecurity, including state and local governments and the private sector, to ensure an organized and unified response to future cyber incidents; strengthen public/private partnerships to find technology solutions that ensure U.S. security and prosperity; invest in the cutting-edge research and development necessary for the innovation and discovery to meet the digital challenges of our time; and begin a campaign to promote cybersecurity awareness and digital literacy from our boardrooms to our classrooms and begin to build the digital workforce of the 21st century. Finally, the President directed that these activities be conducted in a way that is consistent with ensuring the privacy rights and civil liberties guaranteed in the Constitution and cherished by all Americans.
Skeptical Debunker

Browser history hijack + social networks = lost anonymity - 0 views

arstechnica.com/...al-networks-lost-anonymity.ars

social networking phishing identity exposure research

shared by Skeptical Debunker on 25 Feb 10 - Cached
  • Skeptical Debunker on 25 Feb 10
     
    Simply joining a few groups at social networking sites may reveal enough information for hackers to personally identify you, according to some recent computer science research. In a paper that will be presented at a security conference later this year, an international team of academics describes how they were able to build membership sets using information that social networking sites make available to the public, and then leverage an existing attack on browsing history to check for personal identity. That information, they argue, can then be combined with other data to create further security risks, such as a personalized phishing attack.
anonymous

Bruce Schneier: More on the Broad View of Security - CSO Online - Security and Risk - 0 views

www.csoonline.com/..._on_the_Broad_View_of_Security

security Schneier broad view multidisciplinary

shared by anonymous on 08 Jan 09 - Cached
  • anonymous on 08 Jan 09
     
    Bruce Schneier's comments on the first Workshop in Security and Human Behavior. Examples of the New School of Information Security.
anonymous

Identity and Access Management: Explained in Detail - 0 views

goo.gl/ZcF3Qn

information informaion security information technology tech technology IAM Access Management Identity Management

shared by anonymous on 05 Jan 17 - No Cached
  • anonymous on 05 Jan 17
     
    Identity and Access Management is an information security framework which focuses on the security of the digital identities in a workplace and enables an administrator to maintain control over the access to the company resources, both physical and digital
Skeptical Debunker

FTC warns firms, organizations of widespread data breach - 0 views

www.physorg.com/news186082629.html

FTC warning personal information compromised

shared by Skeptical Debunker on 23 Feb 10 - Cached
  • The FTC declined to identify the companies or organizations involved, but said they were both "private and public entities, including schools and local governments." The companies and organizations ranged in size from "businesses with as few as eight employees to publicly held corporations employing tens of thousands," the FTC said in a statement. It said sensitive data about customers and employees had been shared from the computer networks of the companies and organizations and made available on Internet peer-to-peer (P2P) file-sharing networks. The information was accessible to "any users of those networks, who could use it to commit identity theft or fraud," the FTC said. "Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers' sensitive information at risk," FTC chairman Jon Leibowitz said. "For example, we found health-related information, financial records, and drivers' license and social security numbers -- the kind of information that could lead to identity theft," Leibowitz said.
  • Skeptical Debunker on 23 Feb 10
     
    The US Federal Trade Commission (FTC) said Monday it has notified nearly 100 companies and organizations of data breaches involving personal information about customers or employees.
Travis Post

Practical Computer and Information Security Tips - 0 views

www.onguardonline.gov

security FTC Internet fraud identity theft

shared by Travis Post on 26 May 11 - Cached
  • Travis Post on 26 May 11
     
    OnGuardOnline.gov provides practical tips from the federal government and the technology industry to help you be on guard against internet fraud, secure your computer, and protect your personal information.
anonymous

Why should Penetration Testing be conducted frequently - 0 views

goo.gl/lS5mdf

information informaion security infosec information technology penetration testing pen testing technology tech internet

shared by anonymous on 13 Jan 17 - No Cached
  • anonymous on 13 Jan 17
     
    The popularity of cloud computing and BYOD really brought information security to the forefront. The intruders also got smarter and more intelligent in finding new ways and new loopholes to attack. In order to deal with the future attacks, what a business…
loadperformance

Application Security in the Software Development Lifecycle Issues, Challenges and Solut... - 0 views

www.quotium.com/...ation_Security_in_the_SDLC.php

security software development SDLC application

shared by loadperformance on 30 Oct 13 - No Cached
  • loadperformance on 30 Oct 13
     
    This white paper will discuss in detail why application security throughout the entire software development lifecycle is necessary for businesses of all shapes and sizes to prevent web security breaches and how it helps cut down business cost and increase the level of organizational information security.
peerlyst

WannaCry no more: ransomware worm IOC's, Tor C2 and technical analysis + SIEM rules, by... - 0 views

www.peerlyst.com/...s-siem-rules-andrii-bezverkhyi

SIEM WannaCry Ransomware IOC Network Malware Vulnerability Exploit Security Infosec Information

shared by peerlyst on 20 May 17 - No Cached
  • peerlyst on 20 May 17
     
    After a rather long day, night and morning of studying the news, researching and hunting the #WannaCry ransomware worm there are some discoveries to be shared.. This includes Host and Network IOCs, their analysis obtained with help of fellow security researchers and practitioners, review of C2 infrastructure and its interactions with Tor. Last but not least are some free SIEM use cases. What else should a security practitioner know for their handling of WannaCry?
Devid Thomas

Learn how Eliot from Mr.robot hacked into to his therapist's new boyfriend's email and ... - 0 views

www.securitynewspaper.com/...boyfriends-email-bank-accounts

Bank+Account+Passwords Mr.robot

shared by Devid Thomas on 09 Dec 15 - No Cached
  • Devid Thomas on 09 Dec 15
     
    SOURCE: Information Security Newspaper http://www.securitynewspaper.com/2015/12/08/learn-eliot-mr-robot-hacked-therapists-new-boyfriends-email-bank-accounts/ TAGS: Bank Account Passwords, Mr.robot text-align: ...
  • Devid Thomas on 09 Dec 15
     
    SOURCE: Information Security Newspaper http://www.securitynewspaper.com/2015/12/08/learn-eliot-mr-robot-hacked-therapists-new-boyfriends-email-bank-accounts/ TAGS: Bank Account Passwords, Mr.robot text-align: ...
netsec

Amazon.com: A New Host-Based Hybrid IDS Architecture - A Mind Of Its Own: The Know-how ... - 0 views

www.amazon.com/...ref=sr_1_1

ids intrusion detection system intrusion detection host-based intrusion detection hybrid intrusion detection host-based hybrid intrusion detection network security internet security computer security information security

shared by netsec on 04 Sep 09 - No Cached
  • netsec on 04 Sep 09
     
    Amazon.com: A New Host-Based Hybrid IDS Architecture - A Mind Of Its Own: The Know-how Of Host-Based Hybrid Intrusion Detection System Architecture Using Machine Learning Algorithms With Feature Selection (9783639172881): Murat Topallar: Books
valuementor

NESA Compliance Service | SIA | Security Standards & Audit | UAE - 0 views

valuementor.com/...nesa-compliance

nesa nesauae nesa_compliance nesa_standards

shared by valuementor on 10 Mar 22 - No Cached
  • valuementor on 10 Mar 22
     
    NESA / SIA PCI Compliance is the cyber security standard for critical information infrastructure protection in UAE. Our Nessa Assessment Audit Team has executed more than 20 NESA compliance projects in UAE
Rich Hintz

ISO27k infosec management standards - 0 views

www.iso27001security.com

businesscontinuity businessresilience disasterrecovery security

shared by Rich Hintz on 27 Oct 08 - Cached
  • ISO27k standards provide generally accepted good practice guidance on Information Security Management Systems to protect the confidentiality, integrity and availability of the information content and information systems
  • Rich Hintz on 27 Oct 08
     
    iso27k iso27000
Kiran Kuppa

"TrustyCon" security counter-convention planned for RSA refusniks - 0 views

arstechnica.com/...tion-planned-for-rsa-refusniks

privacy security rsa ecc elliptic curve cryptography pki backdoor

shared by Kiran Kuppa on 22 Jan 14 - No Cached
  • Kiran Kuppa on 22 Jan 14
     
    The RSA concerns started with documents leaked by Edward Snowden and published by the New York Times in December. These indicated that the NSA had worked with the National Institute of Standards and Technology to create a "backdoor" in the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), a pseudorandom number generator designated as a standard for encryption. According to the documents, in 2004-even before NIST approved it as a standard-the NSA paid RSA $10 million to use Dual EC DRGB as part of its RSA BSAFE cryptographic library. This meant that much of the encryption software sold by RSA would allow the NSA to break the encryption using the known backdoor
  • Kiran Kuppa on 22 Jan 14
     
    The RSA concerns started with documents leaked by Edward Snowden and published by the New York Times in December. These indicated that the NSA had worked with the National Institute of Standards and Technology to create a "backdoor" in the Dual Elliptic Curve Deterministic Random Bit Generator (Dual_EC_DRBG), a pseudorandom number generator designated as a standard for encryption. According to the documents, in 2004-even before NIST approved it as a standard-the NSA paid RSA $10 million to use Dual EC DRGB as part of its RSA BSAFE cryptographic library. This meant that much of the encryption software sold by RSA would allow the NSA to break the encryption using the known backdoor
Carlos Gomes

Welcome to CAcert.org - 1 views

www.cacert.org/index.php

assurance cryptography msia pki security

shared by Carlos Gomes on 13 Mar 07 - Cached
  • CAcert.org is a community driven, Certificate Authority that issues certificates to the public at large for free. CAcert's goal is to promote awareness and education on computer security through the use of encryption, specifically with the X.509 family of standards. We have compiled a document base that has helpful hints and tips on setting up encryption with common software, and general information about Public Key Infrastructures (PKI). For the enthusiast looking to dip their toe in the water, we have an easy way of obtaining certificates you can use with your email program. You can use these not only to encrypt, but to prove to your friends and family that your email really does come from you. For administrators looking to protect the services they offer, we provide host and wild card certificates which you can issue almost immediately. Not only can you use these to protect websites, but also POP3, SMTP and IMAP connections, to list but a few. Unlike other certificate authorities, we don't limit the strength of the certificates, or the use of wild card certificates. Everyone should have the right to security and to protect their privacy, not just those looking to run ecommerce sites. If you're extremely serious about encryption, you can join CAcert's Assurance Programme and Web of Trust. This allows you to have your identity verified to obtain added benefits, including longer length certificates and the ability to include your name on email certificates. CAcert Inc. is a non-profit association, incorporated in New South Wales Australia.
Rich Hintz

SP-800-66-Revision1.pdf (application/pdf Object) - 0 views

csrc.nist.gov/...SP-800-66-Revision1.pdf

security health information regulations

shared by Rich Hintz on 23 Dec 08 - No Cached
wolf hesse liked it
  • Rich Hintz on 23 Dec 08
     
    Introductory Resource Guide for Implementing HIPPA Security Rule
Seçkin Anıl Ünlü

Plugging the CSS History Leak at Mozilla Security Blog - 0 views

blog.mozilla.com/...plugging-the-css-history-leak

security web history mozilla online browsers privacy bugfix

shared by Seçkin Anıl Ünlü on 17 Apr 10 - Cached
  • History Sniffing
  • Links can look different on web sites based on whether or not you’ve visited the page they reference.
  • The problem is that appearance can be detected by the page showing you links, cluing the page into which of the presented pages you’ve been to. The result: not only can you see where you’ve been, but so can the web site!
  • ...18 more annotations...
  • The most obvious fix is to disable different styles for visited versus unvisted links, but this would be employed at the expense of utility: while sites can no longer figure out which links you’ve clicked, neither can you.
  • David Baron has implemented a way to help keep users’ data private while minimizing the effect on the web, and we are deploying it to protect our users.
  • The biggest threats here are the high-bandwidth techniques, or those that extract lots of information from users’ browsers quickly.
  • The JavaScript function getComputedStyle() and its related functions are fast and can be used to guess visitedness at hundreds of thousands of links per minute.
  • we’re approaching the way we style links in three fairly subtle ways:
  • Change 1: Layout-Based Attacks
  • First of all, we’re limiting what types of styling can be done to visited links to differentiate them from unvisited links.
  • can only be different in color
  • the CSS 2.1 specification takes into consideration how visited links can be abused:
  • implement other measures to preserve the user’s privacy while rendering visited and unvisited links differently
  • Change 2: Some Timing Attacks
  • we are changing some of the guts of our layout engine to provide a fairly uniform flow of execution to minimize differences in layout time for visited and unvisited links.
  • when the link is styled, the appropriate set of styles is chosen making the code paths for visited and unvisited links essentially the same length.
  • Change 3: Computed Style Attacks
  • JavaScript is not going to have access to the same style data it used to.
  • Firefox will give it unvisited style values.
  • it’s the right trade-off to be sure we protect our users’ privacy.
  • fixing CSS history sniffing will not block all of these leaks. But we believe it’s important to stop the scariest, most effective history attacks any way we can since it will be a big win for users’ privacy.
Carlos Gomes

The SwitchWare Project - 0 views

www.cis.upenn.edu/...index.html

assurance msia security security.toresearch

shared by Carlos Gomes on 13 Mar 07 - Cached
  • The SwitchWare Project Active Network Research at Penn and Bellcore Active networks explore the idea of allowing routing elements to be extensively programmed by the packets passing through them. This allows computation previously possible only at endpoints to be carried out within the network itself, thus enabling optimizations and extensions of current protocols as well as the development of fundamentally new protocols. Welcome to the SwitchWare home page, describing the Active Networks research effort underway in the Penn Department of Computer and Information Science and Bellcore as well as pointers to related material.
1 - 20 of 29 Next ›
Showing 20▼ items per page