<![CDATA[[SecurityRatty] tag: zdnet]]> http://securityratty.com/tag/zdnet Tue, 08 Jul 2008 05:38:15 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Links for 2008-09-17 [del.icio.us]]]> http://securityratty.com/article/751d0368ea56272a400c201b0c4cf5bc http://securityratty.com/article/751d0368ea56272a400c201b0c4cf5bc
  • Why “better” often doesn’t sell | Paul Murphy | ZDNet.com
    • ]]>     Wed, 17 Sep 2008 20:00:00 +0000 paul murphy zdnet Links for 2008-09-17 [del.icio.us]     <![CDATA[Links for 2008-09-15 [del.icio.us]]]> http://securityratty.com/article/76641371b3a7f5060624cdd792c7e9cb http://securityratty.com/article/76641371b3a7f5060624cdd792c7e9cb
  • Quest grabs NetPro to strengthen Windows management wares - Network World
    NetPro’s lineup includes tools focused on security/compliance, infrastructure administration and identity/access. Those tools include auditing, backup/recovery, policy enforcement, event log management, Exchange migration, group policy management, health/performance and user self-service password management
  • Are common logging and audit standards emerging? :: SearchSecurity.com.au
  • SaaS market will 'collapse' in two years | Tech News on ZDNet
    Q: Won't people avoid the mistakes of "previous" SaaS incarnations, as you mentioned? A: People are stupid. History has shown it repeats itself, and people make the same mistakes.
  • CRM Outsiders » Blog Archive » Lawson CEO: SaaS Will “Collapse” In Two Years
    I couldn’t disagree more, but than again it was also Harry Debes that predicted that many of today’s Web 2.0, cell phone gadgets would never catch on either. SaaS is certainly here to say. I
  • Nerd News: Eventlog to Syslog
  • (ISC)2 Blog: Event Correlation
  • Speaking of Security... | Blog Entry: Paul Stamp | Correlation is no silver bullet: 1301
    So, when deploying SIEM to improve your security operations, remember that correlation only really works when backed up by real data about what is the biggest problem in your environment, and how that problem manifests itself in the event logs. I call it "working out what type of needles you'll find in your haystack."
  • Systems log analytics offers operators performance insights that set stage for IT transformation | Dana Gardner’s BriefingsDirect | ZDNet.com
  • Sharpening Stones and Walking on Coals | Nemertes Research
    When hunting for a needle in a haystack, after all, making the haystack larger is not an obviously productive course; getting a tool that can assist in the hunt - a magnet, or a metal detector - makes more sense!
  • Search or Destroy | Nemertes Research
    It's not all about security, it's not all about events, it's not all about compliance. All those things are critically important to IT, of course, but even more fundamental is the task of keeping things running.
  • jdm's Blog: How worthwhile is logging?
    Logs are like a warm blanket; verbose logging means you can know what's happening on your systems if you keep up with the logs. At the same time, logs become a burden very very easily, and they are easy to ignore.
  • Rainer's Blog: What is an Event? And what an Event Log?
  • Enterprise Architecture: From Incite comes Insight...: Taming the Documentum Audit Trail
    First and foremost, it is a good security principle to separate log data from the system.
  • Log management is a pain | Thomas Nicholson
    So for an administrator to not care about logs was a shock.
  • thebaumblog » Blog Archive » Life after SIEM. Situational Awareness is next.
    Life after SIEM. Situational Awareness is next.
    • ]]>     Mon, 15 Sep 2008 20:00:00 +0000 logs event logs event log management event log management event log security saas market saas Links for 2008-09-15 [del.icio.us]     <![CDATA[Simple Method Allows iPhone Passcode Lock To Be Bypassed]]> http://securityratty.com/article/df9c8e492352dce3154e1a0eb42c5ae2 http://securityratty.com/article/df9c8e492352dce3154e1a0eb42c5ae2 Thu, 28 Aug 2008 13:12:24 +0000 access limit access intruder access requires physical access iphone device four-digit pincode sensitive information finger taps Simple Method Allows iPhone Passcode Lock To Be Bypassed <![CDATA[In space, Malware can make you scream!]]> http://securityratty.com/article/a6dafd7065c57b1fcbe7b5df26613b15 http://securityratty.com/article/a6dafd7065c57b1fcbe7b5df26613b15 So, does Malware infect faster in zero gravity?
    clipped from blogs.zdnet.com

    Malware is reaching new heights, and going into Space through a removable media carrying the W32.Gammima.AGISS Malware password stealing malware to the International Space Station. According to SpaceRef.com :
      blog it
    ]]>     Tue, 26 Aug 2008 19:57:50 +0000 space malware international space station malware infect faster removable media blogs heights gammima w32 In space, Malware can make you scream!     <![CDATA[Summarizing Zero Day's Posts for July]]> http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d http://securityratty.com/article/8dcef74e51c669037abd743dd3beb89d
    Different audience provokes different approach for communicating a particular event. In case you aren't reading ZDNet's Zero Day, where I blog next to Ryan Naraine and Nathan McFeters - join us.

    Also, consider subscribing yourself to my personal RSS feed, or Zero Day's main feed in order to read all the posts. Here's a quick summary of my posts for last month :

    01. Blizzard introducing two-factor authentication for WoW gamers
    02. Sony PlayStation's site SQL injected, redirecting to rogue security software
    03. 300 Lithuanian sites hacked by Russian hackers
    04. Antivirus vendor introducing virtual keyboard for secure Ebanking
    05. Gmail, Yahoo and Hotmail's CAPTCHA broken by spammers
    06. Storm Worm's Independence Day campaign
    07. Approximately 800 vulnerabilities discovered in antivirus products
    08. $1 Million prize offered for cracking an encryption algorithm
    09. U.K's most spammed person receives 44,000 spam emails daily
    10. Storm Worm says the U.S have invaded Iran
    11. Gmail, PayPal and Ebay embrace DomainKeys to fight phishing emails
    12. Verizon, Telecom Italia, and Brasil Telecom top the botnet charts in Q2 of 2008
    13. XSS worm at Justin.tv infects 2,525 profiles
    14. Remote code execution through Intel CPU bugs
    15. Ringleader of cybercrime group to be offered a job as cybercrime fighter
    16. Spam coming from free email providers increasing
    17. Kaspersky's Malaysian site hacked by Turkish hacker
    18. Georgia President's web site under DDoS attack from Russian hackers
    19. 75% of online banking sites found vulnerable to security design flaws
    20. McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position
    21. Click fraud in 2nd quarter of 2008 more sophisticated, botnets to blame
    22. How OpenDNS, PowerDNS and MaraDNS remained unaffected by the DNS cache poisoning vulnerability
    23. DNS cache poisoning attacks exploited in the wild
    24. The Neosploit cybercrime group abandons its web malware exploitation kit
    25. OS fingerprinting Apple's iPhone 2.0 software - a "trivial joke"
    26. HD Moore pwned with his own DNS exploit, vulnerable AT&T DNS servers to blame
    ]]>     Fri, 08 Aug 2008 10:35:52 +0000 day software rogue security software spam emails daily cybercrime cybercrime fighter independence day campaign emails posts Summarizing Zero Day's Posts for July     <![CDATA[Links for 2008-07-31 [del.icio.us]]]> http://securityratty.com/article/5623363e9fc4342cd38866267f83d656 http://securityratty.com/article/5623363e9fc4342cd38866267f83d656
  • Too Many GRC Systems? | The IT-Finance Connection
    In many ways, GRC today is at a stage similar to CRM 10 or 15 years ago. Then, each department maintained its own customer relations management tools, resulting in inefficiency and customer frustration, as well as duplication of effort and redundancy of i
  • Five signs that your career is about to get vapid » Brazen Careerist by Penelope Trunk
    You can tell if you are avoiding personal growth in your career because you are not feeling challenged. You can tell if you are not feeling challenged if you are not scared. Being scared is what makes life interesting. You should be scared that you are go
  • McAfee acquires Reconnex, inks distribution pacts | Between the Lines | ZDNet.com
    The company said it acquired Reconnex, which makes technology that automates data protection, for $46 million.
    • ]]>     Thu, 31 Jul 2008 20:00:00 +0000 reconnex mcafee acquires reconnex inks distribution pacts grc grc systems it-finance connection stage similar penelope trunk customer frustration Links for 2008-07-31 [del.icio.us]     <![CDATA[Vulnerabilities in Antivirus Software - Conflict of Interest]]> http://securityratty.com/article/99630b84f67151661d9187260dcf552f http://securityratty.com/article/99630b84f67151661d9187260dcf552f Vulnerabilities within security solutions -- antivirus software in this case -- are a natural event, however, the conflict of interests and failure of communication between those finding them and those failing to acknowledge them as vulnerabilities in general, harms the customer. How they get count, and how is their severity measured in a situation where a vulnerability bypassing the scanning method of an antivirus software allowing malware to sneak in, is less important than a remote code execution through the antivirus software, is a good example of short sightedness. Here's a related development regarding a recent study regarding vulnerabilities in antivirus software - "McAfee debunks recent vulnerabilities in AV software research, n.runs restates its position" :

    "Several days after blogging about a research conduced by n.runs AG that managed to discover approximately 800 vulnerabilities in antivirus products, McAfee issued a statement basically debunking the number of vulnerabilities found, and providing its own account into the number of vulnerabilities affecting its own products :

    “A recent ZDnet blog discusses a large number of vulnerabilities German research team N.Runs says it found in antimalware products from nearly every vendor. The ZDNet posting includes scary graphs to frighten users of security products. We researched the N.Runs claims by analyzing the raw data and found their claims to be somewhat exaggerated. We will discuss our findings (and make available our source data) in the attached document. We have also provided our source data for anyone who wishes to examine it.”

    Today, n.runs AG has issued a response to McAfee’s statement, providing even more insights into the vulnerabilities they’ve managed to find, how they found them, and why are the affected antivirus vendors questioning the number of flaws in general."

    Consider going through the interview with Thierry Zoller as well.

    Related posts:
    0bay - how realistic is the market for security vulnerabilities?
    Was the WMF vulnerability purchased for $4000?!
    Where's my 0day, please?
    Scientifically Predicting Software Vulnerabilities
    Zero Day Initiative "Upcoming Zero Day Vulnerabilities"
    Delaying Yesterday's "0day" Security Vulnerability
    Shaping the Market for Security Vulnerabilities Through Exploit Derivatives
    Zero Day Vulnerabilities Market Model Gone Wrong
    Zero Day Vulnerabilities Auction
    The Zero Day Vulnerabilities Cash Bubble
    ]]>     Thu, 24 Jul 2008 00:38:07 +0000 vulnerabilities day vulnerabilities security vulnerabilities antivirus software day vulnerabilities auction software vulnerabilities products runs claims security products Vulnerabilities in Antivirus Software - Conflict of Interest     <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146 http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146

    Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

    Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on April 17, 2008.

    You may also listen to this podcast right now:

    Show Content:

    Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]>     Tue, 15 Jul 2008 13:20:45 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...     <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b

    Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

    Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on April 17, 2008.

    You may also listen to this podcast right now:

    Show Content:

    Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]>     Tue, 15 Jul 2008 12:22:35 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...     <![CDATA[Have you googled, HR security breaches lately?]]> http://securityratty.com/article/891bb72b417d85643a8bd1df738baf4f http://securityratty.com/article/891bb72b417d85643a8bd1df738baf4f

    Blogger: Randall Gamby

    As briefly mentioned in a Burton Group IdPS blog and a ZDNet Australia published article on July 3, 2008, HR data from Google was stolen from one of their previous HR outsource partners.  It seems that the partner, Colt Express Outsource Partners, had equipment stolen that contained HR data from some of its clients, including Google.  The data was unencrypted and stored on systems that were apparently portable.

    So what does this mean for all of us? 

    First, it shows that even large SaaS companies like Google can be bitten by a lack of security at their partners, just like many of us can.  Burton Group has been warning clients for a long time about the dangers of sending confidential information to outsource partners without proper security and audit processes in place. Of course this should also be backed by strong contractual language. 

    Second, be prepared to pay.  Even if Google had breach mitigation terms in their contract, Colt Express announced that it was in financial difficulty. So Google has had to pay for financial reporting and other compensation to its own employees, even though Google did nothing wrong. 

    Third, a Google representative stated "We take the security of our employees very seriously and require outside vendors to meet appropriate security standards. We review and update these standards on an on-going basis.”  Does this mean that Google doesn’t require encryption of its confidential information since encryption of the data was not deployed at Colt Express?  When working with third parties, whether it’s financial data or confidential personal data, this information needs to be protected from unauthorized access. One of the simplest ways is encrypting the data while at rest, regardless of where it’s located. 

    Final, the Colt Express breach brings to mind a question Burton Group is always asking: “What is your exit strategy if the contract is terminated with your outsourcing partner?”  A lot of effort is expended in creating an outsourcing agreement around use and protection of data, but what happens when the contract is ended?  Do you obtain and retain the information the outsource partner maintained?  Do you have the outsource partner destroy the information and any archives of it (and verify this was done)?  Do you create a custodial contract with the outsourcing partner for them to maintain the information and archives on your behalf (ensuring the data is properly protected)?  As was found in this incident, after their contract with Google was terminated the outsourcing partner apparently retained the employee data unencrypted on their servers. This was the fatal mistake that allowed the breach to occur.

    So as you work with your outsourcing and SaaS vendors, you should not only consider how day-to-day operations should be secured to maintain the confidentiality of your data. You should also think about how that data is being maintained over time, and what are your procedures should the unthinkable happen if your partner allows your data to be compromised.

    ]]>     Tue, 08 Jul 2008 05:38:15 +0000 data employee data outsource partner destroy outsource partner confidential personal data security financial data partner partner apparently Have you googled, HR security breaches lately?