<![CDATA[[SecurityRatty] tag: parody]]> http://securityratty.com/tag/parody Sat, 19 Jan 2008 10:12:06 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA['Paris for President' Parody Strikes Viral Gold]]> http://securityratty.com/article/c1dcff1c78a97408875146e9aad4f22a http://securityratty.com/article/c1dcff1c78a97408875146e9aad4f22a
]]> Sun, 10 Aug 2008 15:30:00 +0000 mock campaign video faux bid million times socialite presidency 'Paris for President' Parody Strikes Viral Gold <![CDATA[Dynamic vulnerability assessment]]> http://securityratty.com/article/309d2a70126b92b32ee6bbcdc8526758 http://securityratty.com/article/309d2a70126b92b32ee6bbcdc8526758

A few weekes ago I wrote about the current state of vulnerability assessment being like a parody of an Obama/Hillary commerical.  Who answers the phone at 3am?  For vulnerability assessment, the results are only as good as who answers the scan.  This has been a problem for security managers and vulnerability assessors for some time.  Balancing scanning during prime time and impacting network performance versus scanning during down times when the devices you need to scan may not be available.

Today StillSecure announced our reponse to ending this problem. We call it Dynamic Vulnerability Assessment (DVA).  With DVA you will have vulnerability and compliance data as of at least the last time a device logged on the network.  This closes the loophole and gives organizations a much more comprehensive and secure assessment of who is on the network and what they look like.

To accomplish this we are using some of our NAC technology from Safe Access. This allows us to detect devices as they come on the network. We can also use the purpose built Safe Access testing engine to deep compliance checks to supplement the tradtional vulnerability checks.  We think this is a big step up in vulnerability assessment and management.  Am interested in what others think.

Zemanta Pixie
]]> Mon, 09 Jun 2008 08:38:11 +0000 vulnerability vulnerability assessment dynamic vulnerability assessment tradtional vulnerability checks network network performance versus safe access prime time time Dynamic vulnerability assessment <![CDATA[Dynamic vulnerability assessment]]> http://securityratty.com/article/bb77e1c8113060b122c368b2e0250f98 http://securityratty.com/article/bb77e1c8113060b122c368b2e0250f98

A few weekes ago I wrote about the current state of vulnerability assessment being like a parody of an Obama/Hillary commerical.  Who answers the phone at 3am?  For vulnerability assessment, the results are only as good as who answers the scan.  This has been a problem for security managers and vulnerability assessors for some time.  Balancing scanning during prime time and impacting network performance versus scanning during down times when the devices you need to scan may not be available.

Today StillSecure announced our reponse to ending this problem. We call it Dynamic Vulnerability Assessment (DVA).  With DVA you will have vulnerability and compliance data as of at least the last time a device logged on the network.  This closes the loophole and gives organizations a much more comprehensive and secure assessment of who is on the network and what they look like.

To accomplish this we are using some of our NAC technology from Safe Access. This allows us to detect devices as they come on the network. We can also use the purpose built Safe Access testing engine to deep compliance checks to supplement the tradtional vulnerability checks.  We think this is a big step up in vulnerability assessment and management.  Am interested in what others think.

Related articles
Zemanta Pixie

]]> Mon, 09 Jun 2008 07:38:11 +0000 vulnerability vulnerability assessment tradtional vulnerability checks dynamic vulnerability assessment vulnerability management network network performance versus safe access prime time Dynamic vulnerability assessment <![CDATA[The Whitehouse.org Serving Malware]]> http://securityratty.com/article/4f895840b6d5da9c0d894880f418e55c http://securityratty.com/article/4f895840b6d5da9c0d894880f418e55c The Whitehouse.org a parody site of the original Whitehouse.gov is serving malware. From TrendMicro's blog :

"According to Trend Micro Advanced Threats Researcher David Sancho, whitehouse.org has been compromised to harbor some malicious, obfuscated JavaScript code which “background downloads” code to unsuspecting visitors of the site, where a malicious file is downloaded (which is detected by Trend Micro as TROJ_DELF.GKP ). Of course, the official White House Web site is whitehouse.gov, and although it has been reported that some people believe whitehouse.org is the real deal, even those looking for this site specifically should be forewarned."

The malicious domain embedded within the site ad.ox88.info/13.htm (67.15.212.150) is using Mal/ObfJS-AP/Exploit:HTML/AdoStream to serve the malware, whereas the domain itself is using DNS servers known to provide service to malicious domains from previous malware embedded attacks that I've been assessing.
]]> Tue, 20 May 2008 22:38:02 +0000 whitehouse malware malicious malicious domains original whitehouse org malicious file parody site site The Whitehouse.org Serving Malware <![CDATA[Proper zoning can help avoid the Cone of Silence problem]]> http://securityratty.com/article/0bd5f9a195bf18946ee43fc93a86c2cb http://securityratty.com/article/0bd5f9a195bf18946ee43fc93a86c2cb Sat, 19 Jan 2008 10:12:06 +0000 useless security measures remember maxwell smart smart parody ridiculous movie dream wait hallway news Proper zoning can help avoid the Cone of Silence problem