<![CDATA[[SecurityRatty] tag: verisign]]> http://securityratty.com/tag/verisign Tue, 20 May 2008 17:04:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Data Mining to Detect Pump-and-Dump Scams]]> http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411 http://securityratty.com/article/a5878a5dbedbdb06b13ea9db23d0e411 I don't know any of the details, but this seems like a good use of data mining:

Mr Tancredi said Verisign's fraud detection kit would help "decrease the time between the attack being launched and the brokerage being able to respond".

Before now, he said, brokerages relied on counter measures such as restrictive stock trading or analysis packages that only spotted a problem when money had gone.

Verisign's software is a module that brokers can add to their in-house trading system that alerts anti-fraud teams to look more closely at trades that exhibit certain behaviour patterns.

"What this self-learning behavioural engine does is look at the different attributes of the event, not necessarily about the computer or where you are logging on from but about the actual transaction, the trade, the amount of the trade," said Mr Tancredi.

"For example have you liquidated all of your assets in stock that you own in order to buy one penny stock?" he said. "Another example is when a customer who normally trades tech stock on Nasdaq all of a sudden trades a penny stock that has to do with health care and is placing a trade four times more than normal."

This is a good use of data mining because, as I said previously:

Data mining works best when there's a well-defined profile you're searching for, a reasonable number of attacks per year, and a low cost of false alarms.

Another news article here.

]]> Thu, 14 Aug 2008 02:10:34 +0000 stock penny stock restrictive stock data trades tech stock trades fraud detection kit alerts anti-fraud teams trade Data Mining to Detect Pump-and-Dump Scams <![CDATA[US Government Won't Cede Control Over DNS Root Zone]]> http://securityratty.com/article/921395ec15b9d9c6bc5244b23e58a028 http://securityratty.com/article/921395ec15b9d9c6bc5244b23e58a028 a letter to ICANN Board chairman Peter Dengate-Thrush Meredith A. Baker, Acting Assistant Secretary for Communications and Information in the Commerce Department's NTIA (National Telecommunications and Information Administration) has declared that the US government has no plans to yield the control it now has over changes to the Internet's DNS root zone file. ICANN manages the DNS root zone, but according to terms of an agreement between it and the NTIA. The distribution of changes in the zone file to the various root servers across the world is performed by VeriSign. ICANN's authority to administer various aspects of the Internet DNS derives from agreements with the Commerce Department. The current agreement for that authority, the JPA or Joint Project Agreement, is set to expire in September 2009. ICANN has been gearing up for what comes next with preparations for taking more complete control. The Baker letter pulls the rug out from under some of those plans. I'm not surprised at the letter and it wouldn't surprise me if even an Obama administration were to retain such control, but observers in Europe and Asia will probably be disappointed.
]]> Fri, 01 Aug 2008 06:54:13 +0000 control dns root zone baker joint project agreement agreement baker letter pulls letter internet dns derives internet US Government Won't Cede Control Over DNS Root Zone <![CDATA[U.S. Government Won't Cede Control Over DNS Root Zone]]> http://securityratty.com/article/acdeee9347364bcb941d4fd5080bf4ed http://securityratty.com/article/acdeee9347364bcb941d4fd5080bf4ed a letter to ICANN Board Chairman Peter Dengate Thrush, Meredith A. Baker, acting assistant secretary for communications and information in the Commerce Department's National Telecommunications and Information Administration, has declared that the U.S. government has no plans to yield the control it now has over changes to the Internet's DNS root zone file. ICANN manages the DNS root zone, but according to terms of an agreement between it and the NTIA. The distribution of changes in the zone file to the various root servers around the world is performed by VeriSign. The authority of the Internet Corporation for Assigned Names and Numbers to administer various aspects of the Internet Domain Name System derives from agreements with the Commerce Department. The current agreement for that authority, the Joint Project Agreement, is set to expire in September 2009. ICANN has been gearing up for what comes next with preparations for taking more complete control. The Baker letter pulls the rug out from under some of those plans. I'm not surprised at the letter, and it wouldn't surprise me if even an Obama administration were to retain such control, but observers in Europe and Asia will probably be disappointed.]]> Fri, 01 Aug 2008 06:54:13 +0000 control dns root zone baker joint project agreement agreement baker letter pulls internet letter internet domain U.S. Government Won't Cede Control Over DNS Root Zone <![CDATA[Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology]]> http://securityratty.com/article/89b9d7e5cf356a247b7fdf2bfb5372f9 http://securityratty.com/article/89b9d7e5cf356a247b7fdf2bfb5372f9 (Source: VeriSign) Get a broad understanding of important regulations and how you can make sure your site is in adherence.

]]> Mon, 07 Jul 2008 09:00:00 +0000 regulations source site verisign broad adherence Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology <![CDATA[Not All QSAs Are Created Equal: What You Should Know Before You Buy]]> http://securityratty.com/article/42390700480e76d344d6c2375101f64b http://securityratty.com/article/42390700480e76d344d6c2375101f64b (Source: VeriSign) The Payment Card Industry Data Security Standard (PCI DSS) requires an annual assessment of security systems and procedures, which must be performed by a QSA and is designed to verify that an entity is complying with all requirements of the PCI DSS. Many companies equate passing the assessment with actually being in compliance. However, recent security breaches highlight the danger of this assumption. True compliance and sound security are part of an ongoing commitment best serviced by QSAs with expertise in security as a whole. This whitepaper helps choose the best QSA for the annual assessment by highlighting key differentiators among QSAs and QSA vendors.

]]> Thu, 26 Jun 2008 09:00:00 +0000 annual assessment assessment security systems security qsa qsas qsa vendors pci dss compliance Not All QSAs Are Created Equal: What You Should Know Before You Buy <![CDATA[Spear-phishing attacks have hooked 15,000, says Verisign]]> http://securityratty.com/article/05ed51de039fb3c9712bf9a03334e73e http://securityratty.com/article/05ed51de039fb3c9712bf9a03334e73e

]]> Fri, 06 Jun 2008 09:00:00 +0000 attacks verisign victims past months Spear-phishing attacks have hooked 15,000, says Verisign <![CDATA[Securiy Briefing: June 6th]]> http://securityratty.com/article/dd0c564dca2422cfc43519ef1455de5f http://securityratty.com/article/dd0c564dca2422cfc43519ef1455de5f
newspapera.jpg

Working form the home office this morning. The best kind of commute. Now, back to my research.

Click here to subscribe to Liquidmatrix Security Digest!

And now, the news…

  1. Google to allow third party code in Gmail? | Builder AU
  2. Skype patches security policy bypassing vulnerability | ZDNet
  3. Experts warn of security-dodging Trojans | vnunet
  4. Microsoft Patch Tuesday promises seven fixes | The Register
  5. 6 burning questions about network security | Network World
  6. ArcSight and VeriSign Enterprise Security Services Launch Global Business Relationship | Compliance Home
  7. EU gives mixed response to new U.S. travel laws | Reuters
  8. Conroy launches service to warn of e-crimes | Australian IT
  9. Are you a computer security professional? | InfoWorld

Tags: , , , ,

]]> Fri, 06 Jun 2008 08:56:35 +0000 security news news experts warn computer security professional conroy launches service warn network security travel laws mixed response Securiy Briefing: June 6th <![CDATA[Spear-phishing attacks have hooked 15,000, says Verisign]]> http://securityratty.com/article/c7f63957a4faad9f412be4970a5dc92c http://securityratty.com/article/c7f63957a4faad9f412be4970a5dc92c Thu, 05 Jun 2008 20:00:00 +0000 e-mail attacks verisign victims researchers data criminals past months Spear-phishing attacks have hooked 15,000, says Verisign <![CDATA[Free SSL Certs for Debian Bug Victims from Comodo]]> http://securityratty.com/article/207f0d3a674587378bb04e27c97189e6 http://securityratty.com/article/207f0d3a674587378bb04e27c97189e6 VeriSign's response to the Debian OpenSSL bug, certificate authority Comodo is offering free replacement SSL certificates to anyone affected, including customers of other CAs. Comodo customers can just go into their accounts and replace their certificates with a new Certificate Signing Request. Customers of other CAs can get their free certificate at this site. Comodo says that the term of the new certificate will be comparable to the old one it is replacing.
]]> Thu, 22 May 2008 06:12:19 +0000 comodo free comodo customers customers free replacement ssl authority comodo debian openssl bug cas outdo verisign Free SSL Certs for Debian Bug Victims from Comodo <![CDATA[McAfee Partner isn't McAfee Secure either]]> http://securityratty.com/article/51b396ff6d9541ffa1a5939d9e429101 http://securityratty.com/article/51b396ff6d9541ffa1a5939d9e429101 Winferno.com is an authorized distributor of McAfee Software. OK.
They use Verisign 128-bit SSL to secure your transaction. Can't take issue with that.
All good so far...but wait!
Shouldn't a McAfee Partner be McAfee Secure?
Apparently not, and being one wouldn't have cured the XSS blues anyway.
Next in our video series, a supposedly secure shopping cart that is far from.

Here's an IFRAME.
Here's the cookie.
As well we know, coughing up the cookie counts as a really bad thing for any shopping cart, let alone an SSL protected shopping cart that happens to be a McAfee Partner and authorized distributor of McAfee Software. But lest we forget, McAfee doesn't count XSS as concerning.
Here's the video.
Huge props to Ronald van den Heetkamp for starting this whole debate years ago, and for exposing Brett Oliphant for the fraud that he is.
Fraud is the key word here. Hacker Safe was fraudulent, McAfee Secure is fraudulent, and buying from Winferno puts consumers at risk for being defrauded, not only due to horrendous site code, but perhaps bad business practices as well.
I won't even ask if McAfee has any standards, we already know the answer.
Their standards have left the building.

del.icio.us | digg]]> Tue, 20 May 2008 17:04:00 +0000 mcafee mcafee secure mcafee partner secure mcafee software verisign 128-bit ssl bad bad business practices ssl McAfee Partner isn't McAfee Secure either