NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Newsfeeds
Network World Security
  • IDG Contributor Network: Can the U.S. Senate secure the Internet of Things?
    Gary Eastwood

    As a free and open internet continues to come under assault by the FCC’s proposal to effectively end net neutrality, investors, programmers, and internet users of all stripes have vociferously voiced their support of the Internet of Things (IoT) and the open web that enables it. It appears those voices have been heard, as the U.S. Senate may be taking steps to secure the IoT's future.

    So, what exactly is the U.S. Senate up to, and how might its actions impact the health of the IoT? What are the specifics of the bill in question, and how might its text impact American’s everyday lives as they make use of the IoT?

    A hopeful IoT security bill

    A new bipartisan bill published Tuesday by Sen. Mark Warner (D-Va.) and Sen. Cory Gardner (R-Colo.), the Internet of Things Cybersecurity Improvement Act of 2017, hopes to beef up America’s internet security. The bill highlights the enormous complexity of the IoT and the huge benefits it provides to the American economy, but it also notes the fragility and vulnerability of the system to outside attacks.

    To read this article in full or to leave a comment, please click here



    click to view

  • 31% off WD 4TB My Passport Portable External USB 3.0 Hard Drive - Deal Alert
    DealPost Team

    Safely store massive amounts of photos, videos and music with this 4TB external drive from WD. It comes equipped with WD Backup software so you can automatically back up photos, videos, music and documents on your preferred schedule. And built-in 256-bit AES hardware encryption with WD Security software helps keep your content private and safe. The 4TB My Passport model is currently priced just $10 higher than its 3TB counterpart with this 31% off deal. See it now on Amazon.

    To read this article in full or to leave a comment, please click here



    click to view

  • 7 free tools every network needs
    Paul Venezia

    In the real estate world, the mantra is location, location, location. In the network and server administration world, the mantra is visibility, visibility, visibility. If you don't know what your network and servers are doing at every second of the day, you're flying blind. Sooner or later, you're going to meet with disaster.

    Fortunately, many good tools, both commercial and open source, are available to shine much-needed light into your environment. Because good and free always beat good and costly, I've compiled a list of my favorite open source tools that prove their worth day in and day out in networks of any size. From network and server monitoring to trending, graphing, and even switch and router configuration backups, these utilities will see you through.

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: SDN and a life beyond the death of the internet
    Jay Turner

    For decades, enterprises have relied on the public internet for business-critical SaaS applications and data traffic. The reason why is pretty simple: it’s cost-efficient, it’s easy to use and it’s already there. Compare that to the logistical, financial and implementation challenges of installing an alternative private network, and it’s clear why enterprises have been pretty content with the internet for their entire digital lives.

    But, it’s 2017. And, if there’s one thing clear about the public internet today, it’s that it no longer cuts it. Rampant DDoS attacks and other cyber threats posed by hackers, rogue employees and nation-states have not just revealed the security, reliability and transparency cracks in the public internet — they’ve blown them wide open.

    To read this article in full or to leave a comment, please click here



    click to view

  • 7 free tools every network needs
    Paul Venezia

    In the real estate world, the mantra is location, location, location. In the network and server administration world, the mantra is visibility, visibility, visibility. If you don't know what your network and servers are doing at every second of the day, you're flying blind. Sooner or later, you're going to meet with disaster.

    Fortunately, many good tools, both commercial and open source, are available to shine much-needed light into your environment. Because good and free always beat good and costly, I've compiled a list of my favorite open source tools that prove their worth day in and day out in networks of any size. From network and server monitoring to trending, graphing, and even switch and router configuration backups, these utilities will see you through.

    To read this article in full or to leave a comment, please click here



    click to view

  • Gravityscan, keeping WordPress sites safe
    Mark Gibbs

    If your website, in common with roughly 25% of all websites, is running WordPress then it's pretty much certain that it's being constantly attacked. WordPress is to hackers what raw meat is to jackals because unless sites are assiduously maintained, they quickly become vulnerable to a huge number of exploits.

    The root cause of this vulnerability is WordPress' ecosystem of complex core software augmented by thousands of third party developers whose themes and plugins are often buggy and not quickly (or often, never) updated to fend off known security problems. Add to that many site owners being slow to update their core WordPress installation and you have an enormous and easily discovered collection of irresistible hacking targets.

    To read this article in full or to leave a comment, please click here



    click to view

  • Network monitoring tools: Features users love and hate
    IT Central Station

    Managing the health of the corporate network will directly affect the productivity of every user of that network. So network administrators need a robust network monitoring tool that helps them manage the network, identify problems before they cause downtime, and quickly resolve issues when something goes wrong.

    Five of the top network monitoring products on the market, according to users in the IT Central Station community, are CA Unified Infrastructure Management, SevOne, Microsoft System Center Operations Manager (SCOM), SolarWinds Network Performance Monitor (NPM), and CA Spectrum.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Book Review: Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
    Sandra Henry-Stocker

    The overall equation is pretty simple: If you want to understand network traffic, you really should install Wireshark. And, if you really want to use Wireshark effectively, you should consider this book. Already in its third edition, Practical Packet Analysis both explains how Wireshark works and provides expert guidance on how you can use the tool to solve real-world network problems.

    Yes, there are other packet analyzers, but Wireshark is one of the best, works on Windows, Mac, and Linux, and is free and open source. And, yes, there are other books, but this one focuses both on understanding the tool and using it to address the kind of problems that you're likely to encounter.

    To read this article in full or to leave a comment, please click here



    click to view

  • Fight firewall sprawl with AlgoSec, Tufin, Skybox suites
    John Breeden II

    New and innovative security tools seem to be emerging all the time, but the frontline defense for just about every network in operation today remains the trusty firewall. They aren’t perfect, but if configured correctly and working as intended, firewalls can do a solid job of blocking threats from entering a network, while restricting unauthorized traffic from leaving.

    The problem network administrators face is that as their networks grow, so do the number of firewalls. Large enterprises can find themselves with hundreds or thousands, a mix of old, new and next-gen models, probably from multiple vendors -- sometimes accidentally working against each other. For admins trying to configure firewall rules, the task can quickly become unmanageable.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Review: Canary Flex security camera lives up to its name
    Keith Shaw

    Canary’s initial foray into the networked home security camera space was very impressive – my colleague David Newman touted its high security settings in the wake of revelations about the general insecurity of these types of devices. The Canary camera was also somewhat large – a cylindrical tower that took up some significant space on your desk, cabinet or shelf.

    The latest camera the company sent me is the Canary Flex, a much smaller unit meant to be more flexible (hence the name) in terms of placement, but also in power options. Like the Arlo Pro camera, the Canary Flex is powered by an internal battery (it’s charged via USB cable and power adapter). This means you can move the Flex to a location inside or outside your home where there’s no power outlet. The Flex comes with wall mounting screws and a 360-degree magnetic stand so you can position the camera in different spots. Additional accessories, such as a plant mount or twist mount (pictured below), offer even more location choices.

    To read this article in full or to leave a comment, please click here



    click to view

  • Zix wins 5-vendor email encryption shootout
    David Strom

    Email encryption products have made major strides since we last looked at them nearly two years ago. They have gotten easier to use and deploy, thanks to a combination of user interface and encryption key management improvements, and are at the point where encryption can almost be called effortless on the part of the end user.

    Our biggest criticism in 2015 was that the products couldn’t cover multiple use cases, such as when a user switches from reading emails on their smartphone to moving to a webmailer to composing messages on their Outlook desktop client. Fortunately, the products are all doing a better job handling multi-modal email.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Review: vArmour flips security on its head
    John Breeden II

    Almost every cybersecurity program these days does some sort of scanning, sandboxing or traffic examination to look for anomalies that might indicate the presence of malware. We’ve even reviewed dedicated threat-hunting tools that ferret out malware that’s already active inside a network.

    However, what if there were a different way to approach security? Instead of searching for behaviors that might indicate a threat, what if you could define everything that is allowed within a network? If every process, application and workflow needed to conduct business could be defined, then by default everything outside of those definitions could be flagged as illegal. At the very least, critical programs could be identified and all interactions with them could be tightly defined and monitored. It’s a different way of looking at security, called segmentation.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • 5 open source security tools too good to ignore
    Fahmida Y. Rashid

    Open source is a wonderful thing. A significant chunk of today’s enterprise IT and personal technology depends on open source software. But even while open source software is widely used in networking, operating systems, and virtualization, enterprise security platforms still tend to be proprietary and vendor-locked. Fortunately, that’s changing. 

    If you haven’t been looking to open source to help address your security needs, it’s a shame—you’re missing out on a growing number of freely available tools for protecting your networks, hosts, and data. The best part is, many of these tools come from active projects backed by well-known sources you can trust, such as leading security companies and major cloud operators. And many have been tested in the biggest and most challenging environments you can imagine. 

    To read this article in full or to leave a comment, please click here



    click to view

  • 31% off WD 4TB My Passport Portable External USB 3.0 Hard Drive - Deal Alert
    DealPost Team

    Safely store massive amounts of photos, videos and music with this 4TB external drive from WD. It comes equipped with WD Backup software so you can automatically back up photos, videos, music and documents on your preferred schedule. And built-in 256-bit AES hardware encryption with WD Security software helps keep your content private and safe. The 4TB My Passport model is currently priced just $10 higher than its 3TB counterpart with this 31% off deal. See it now on Amazon.

    To read this article in full or to leave a comment, please click here



    click to view

  • 7 free tools every network needs
    Paul Venezia

    In the real estate world, the mantra is location, location, location. In the network and server administration world, the mantra is visibility, visibility, visibility. If you don't know what your network and servers are doing at every second of the day, you're flying blind. Sooner or later, you're going to meet with disaster.

    Fortunately, many good tools, both commercial and open source, are available to shine much-needed light into your environment. Because good and free always beat good and costly, I've compiled a list of my favorite open source tools that prove their worth day in and day out in networks of any size. From network and server monitoring to trending, graphing, and even switch and router configuration backups, these utilities will see you through.

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: SDN and a life beyond the death of the internet
    Jay Turner

    For decades, enterprises have relied on the public internet for business-critical SaaS applications and data traffic. The reason why is pretty simple: it’s cost-efficient, it’s easy to use and it’s already there. Compare that to the logistical, financial and implementation challenges of installing an alternative private network, and it’s clear why enterprises have been pretty content with the internet for their entire digital lives.

    But, it’s 2017. And, if there’s one thing clear about the public internet today, it’s that it no longer cuts it. Rampant DDoS attacks and other cyber threats posed by hackers, rogue employees and nation-states have not just revealed the security, reliability and transparency cracks in the public internet — they’ve blown them wide open.

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: Can U.S. lawmakers fix IoT security for good?
    Majid Ahmed

    While the Internet of Things (IoT) has carved out a comfortable place for itself in today’s society and markets, many still fear that the interconnectivity-driven phenomenon is extraordinarily vulnerable to outside attacks. A number of U.S. Senators believe they may have a solution to the problem, and have put forward the Internet of Things Cybersecurity Improvement Act of 2017.

    What are the exact details of the text of the bill, and how does it intend to secure one of the most diverse and unregulated assets of the economy? What potential pitfalls stand in the bills way, and how much of a chance does it have of becoming law? An analysis of the IoT Act reveals that it’s a healthy step in the right direction, but it may not be enough.

    To read this article in full or to leave a comment, please click here



    click to view

  • Mingis on Tech: Android vs iOS – Which is more secure?

    Apple's iOS has long had the reputation of being more secure than Android, but that may not necessarily be the case. Here's how to evaluate each side's claims about mobile security.

    click to view

  • IDG Contributor Network: The new branch office SD-WAN model
    Ciaran Roche

    Wrapping up an SD-WAN workshop session with a client last week, I reflected on how rapidly the branch office WAN connectivity and management model is changing. Some great opportunities are emerging for enterprise IT teams that can materially impact how the network is designed, paid for and managed. Here are some thoughts:

    1. Public cloud is driving a lightweight edge security model

    Most people agree that SD-WAN can facilitate service chaining, and a selective backhaul model is interesting to many enterprises that want to concentrate next-generation firewall services in larger locations. But with the rapid growth of distributed content in public cloud applications (even from Microsoft and Salesforce, who long resisted this trend that Google pioneered) it’s increasingly counterproductive to backhaul browsing traffic long distances from the end users. It reduces performance, and adds significant load at hubs on the network — not ideal when this can represent 80 percent or more of the traffic.

    To read this article in full or to leave a comment, please click here



    click to view

  • The GDPR deadline is fast approaching; how enterprises are preparing
    Rand Morimoto

    The deadline for compliance with the European Union General Data Protection Regulation (GDPR) is May 25, 2018. Many organizations have spent countless hours already in their preparation for the deadline, while other organizations are just getting around to reading up on it.

    GDPR, like Y2K of a couple decades ago, has international implications that for some organizations HAS to be addressed as GDPR will impact the lifeblood of their operations, whereas for most organizations, some due diligence needs to be done to ensure they are within the compliance of the regulation.

    GDPR is today’s Y2K

    I reference Y2K because I was one of the advisors to the United States White House on Y2K and spent the latter part of the decade before the millennium switchover traveling around the globe helping organizations prepare for 1/1/2000. Today with GDPR, as I did then with Y2K, believe there are fundamental things every organization needs to do to be prepared for the deadline, but to NOT get caught up in the hype and over speculation to the Nth degree detail that’ll drive you crazy. 

    To read this article in full or to leave a comment, please click here



    click to view

  • 22% off Aukey Dash Cam, Full HD Wide Angle With Night Vision - Deal Alert
    DealPost Team

    This 1080p Dash Camera captures video or stills, and is equipped with a motion detector and continuous loop recording. An emergency recording mode can be activated by sharp turns or sudden stops, and automatically captures unexpected driving incidents. The Dash Camera can also record whenever it sees motion in front or create a time-lapse video of your trip. Features Full HD 1080P, 170° Wide Angle Lens, 2“ LCD and Night Vision. Its typical list price has been reduced 22% to just $69.99. See this deal on Amazon.

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: AMP and ThreatGrid Integration into Meraki UTMs
    Aaron Woland

    Lately, I have been spending a lot of time on integrating security systems together, and specifically focusing a lot of my energy on Cisco’s Advanced Threat Security product family. (Disclosure: I am employed by Cisco.)

    Which is what brings me to Cisco’s Advanced Malware Protection (AMP), which is a solution to enable malware detection, blocking, continuous analysis and retrospective actions and alerting.

    In fact, when the Talos cyber-vigilantes parachute into an environment and performs their forensics analysis and active defense against attacks—AMP is one of the primary tools that they use.

    To read this article in full or to leave a comment, please click here



    click to view

  • Chasing down leakers fast with ThinAir's asset tracking

    Tony Gauda, CEO of ThinAir, talks with CSO senior writer Steve Ragan about how the ThinAir system tracks which users within an organization have seen each piece of data, spotting anomalous information and quickly finding the source of a leak.

    click to view

  • Do developers care about security?

    They certainly do, according to Sarah Gibson, application security consultant at Veracode, who talks with CSO senior writer Fahmida Rashid about the issues around application security, and how having a collaborative security team is key to writing good code.

    click to view

  • True random numbers are here — what that means for data centers
    Sandra Henry-Stocker

    For many decades, the term “random numbers” meant “pseudo-random numbers” to anyone who thought much about the issue and understood that computers simply were not equipped to produce anything that was truly random.

    Manufacturers did what they could, grabbing some signals from the likes of mouse movement, keyboard activity, system interrupts, and packet collisions just to get a modest sampling of random data to improve the security of their cryptographic processes.

    And the bad guys worked at breaking the encryption.

    We used longer keys and better algorithms.

    And the bad guys kept at it. And life went on.

    But something recently changed all that. No, not yesterday or last week. But it was only back in November of last year that something called the Entropy Engine won an Oscar of Innovation award for collaborators Los Alamos National Laboratory and Whitewood Security. This Entropy Engine is capable of delivering as much as 350 Mbps of true random numbers—sufficient to feed an entire data center with enough random data to dramatically improve all cryptographic processes.

    To read this article in full or to leave a comment, please click here



    click to view

  • Safeguarding power grids and other critical infrastructure from data leaks

    CSO senior writer Steve Ragan talks with cybersecurity experts Krypt3ia and Kodor about how the pair seek out passwords, schematics and other sensitive documents on SCADA control system architectures that shouldn't be available online, passing along tips to federal authorities to combat real-world threats.

    click to view

  • Bringing behavioral game theory to security defenses

    Kelly Shortridge and CSO senior writer Fahmida Y Rashid talk about using behavioral game theory to take advantage of hackers’ mistakes and manipulate the data they think they're receiving. People generally make decisions by either thinking ahead to figure out how people may act in a given situation, or by learning over time by observing what people are doing. Since attackers learn over time by collecting feedback, obfuscating what they get can really mess up what the attackers are able to learn.

    click to view

  • IDG Contributor Network: Can SD-WANs meet standards requirements?
    Steve Garson

    Any innovative technology faces a battle of doubt. When Amazon first rolled out AWS, few could imagine servers running in the cloud. Before Salesforce, many thought CRM to be too critical to run as SaaS. I find SD-WANs to be facing a similar battle. It’s inconceivable to many that an SD-WAN could replace MPLS. This is particularly true for security teams.

    At one recent client, a chemical company, the team was looking to transition from MPLS to SD-WAN. The security group, though, could not accept the fact that SD-WANs met the requirements stipulated by CFATS (Chemical Facility Anti-Terrorism Standards) guiding the chemical industry.

    It was a classic example of professionals getting hooked into the implementation and failing to consider alternative approaches to addressing the same need. CFATS professionals assume MPLS and firewalls to be mandated by the standard. MPLS being the de facto transport. As for firewalls, “Organizations understand and feel safe with firewalls,” says Nirvik Nandy, my partner and the president and CEO, of Red Lantern, a security and compliance consultancy.

    To read this article in full or to leave a comment, please click here



    click to view

  • Simple tips to keep your devices secure when you travel

    CSO security reporters Fahmida Rashid and Steve Ragan share some easy ways to keep your data and devices secure while traveling, even at the Black Hat conference, where active scanning is the norm. (And check out the built-in Faraday cage in Fahmida's jacket).

    click to view

  • How DevOps and cloud will speed up security

    Zane Lackey, CSO and co-founder of Signal Sciences, talks with CSO senior writer Fahmida Rashid about how DevOps and cloud can help organizations embed security into their technology structures, enabling business to move faster.

    click to view

  • Stop blaming users for security misses

    Does the message to users about security need to change? Or does IT need to rebuild infrastructure so users can worry less about security? Wendy Nather, principal security strategist at Duo Security, talks with CSO senior writer Fahmida Rashid about how organizations can learn to do security right.

    click to view

  • Tech Talk: The latest on Azure Stack, cyberattacks, the next iPhone and ... keyboards

    Get the details on Microsoft's new Azure Stack, why cyberattacks never seem to end, the fate of Apple's Touch ID and why QWERTY keyboards are now tech relics.

    click to view

  • Unix: How random is random?
    Sandra Henry-Stocker

    On Unix systems, random numbers are generated in a number of ways and random data can serve many purposes. From simple commands to fairly complex processes, the question “How random is random?” is worth asking.

    EZ random numbers

    If all you need is a casual list of random numbers, the RANDOM variable is an easy choice. Type "echo $RANDOM" and you'll get a number between 0 and 32,767 (the largest number that two bytes can hold).

    $ echo $RANDOM
    29366

    Of course, this process is actually providing a "pseudo-random" number. As anyone who thinks about random numbers very often might tell you, numbers generated by a program have a limitation. Programs follow carefully crafted steps, and those steps aren’t even close to being truly random. You can increase the randomness of RANDOM's value by seeding it (i.e., setting the variable to some initial value). Some just use the current process ID (via $$) for that. Note that for any particular starting point, the subsequent values that $RANDOM provides are quite predictable.

    To read this article in full or to leave a comment, please click here



    click to view

  • IBM touts full data encryption in new Z series mainframes
    Andy Patrizio

    IBM has introduced the 14th generation of its Z series mainframes, which still sell respectably despite repeated predictions of their demise. One of the major features being touted is the simple ability to encrypt all of the data on the mainframe in one shot. 

    The mainframe, called IBM Z or z14, introduces a new encryption engine that for the first time will allow users to encrypt all of their data with one click—in databases, applications or cloud services—with virtually no impact on performance.

    The new encryption engine is capable of running more than 12 billion encrypted transactions every day. The mainframe comes with four times more silicon for processing cryptographic algorithms over the previous generation mainframe along with encryption-oriented upgrades to the operating system, middleware and databases.  

    To read this article in full or to leave a comment, please click here



    click to view

  • IBM wants you to encrypt everything with its new mainframe
    Peter Sayer

    IBM wants businesses to use its new z14 mainframe to encrypt pretty much everything -- an approach to security it calls pervasive encryption.

    Encrypting everything, and restricting access to the keys, is one way to reduce the risk and impact of data breaches. It can reduce the threat surface by 92 percent, according to research commissioned by IBM.

    To make such pervasive encryption viable, the z14 has four times as much silicon devoted to cryptographic accelerators as its predecessor, the z13, giving it seven times the cryptographic performance.

    To read this article in full or to leave a comment, please click here



    click to view

  • What is IoT?
    Jon Gold

    The Internet of Things, at its simplest level, is smart devices - from refrigerators that warn you when you’re out of milk to industrial sensors – that are connected to the Internet so they can share data, but IoT is far from a simple challenge for IT departments.

    For many companies, it represents a vast influx of new devices, many of which are difficult to secure and manage. It’s comparable to the advent of BYOD, except the new gizmos are potentially more difficult to secure, aren’t all running one of three or four basic operating systems, and there are already more of them.

    A lot more, in fact – IDC research says that there are around 13 billion connected devices in use worldwide already, and that that number could expand to 30 billion within the next three years. (There were less than 4 billion smartphone subscriptions active around the world in Ericsson’s most recent Mobility Report.) 

    To read this article in full or to leave a comment, please click here



    click to view

  • Cisco continues its network-based security strategy by moving to acquire Observable Networks
    Zeus Kerravala

    Over the past few years Cisco has changed the face of its security business. What was once a struggling concern is now the fastest-growing part of Cisco. How did the company do this? Part of the rebirth of Cisco security can be traced to a change in focus, away from point products to a more data-driven model. Big data, analytics and machine learning have been hot topics in IT, and Cisco has gotten religion in this area and applied it masterfully to its security business.

    Today, Cisco added to that when it announced its intent to acquire privately held Observable Networks. The St. Louis-based company provides dynamic network behavior monitoring to help security teams find anomalies that could indicate a breach. The product captures data and analyzes it to gain situational awareness of all users, devices and traffic, not only on a company’s network, but also out to the cloud, with support for both Amazon Web Services and Microsoft Azure.

    To read this article in full or to leave a comment, please click here



    click to view

  • Mingis on Tech: How linguistics can help catch cyberattackers

    When it comes to tracking down the bad actors behind malware and ransomware, cybersecurity firms are turning to linguists.

    click to view

  • Get 72% off NordVPN Virtual Private Network Service For a Limited Time - Deal Alert
    DealPost Team

    NordVPN gives you a private and fast path through the public Internet. All of your data is protected every step of the way using revolutionary 2048-bit SSL encryption even a supercomputer can’t crack. Access Hulu, Netflix, BBC, ITV, Sky, RaiTV and much more from anywhere in the world. Unmetered access for 6 simultaneous devices. You're sure to find dozens of good uses for a VPN. Take advantage of the current 72% off deal that makes all of this available to you for just $3.29/month (access deal here). This is a special deal available for a limited time.

    To read this article in full or to leave a comment, please click here



    click to view

  • Choosing Windows for your organization should get you fired
    Bryan Lunduke

    In the wake of yet another ransomware attack—this time named NotPetya—I have a special message specifically for those of you working in organizations that continue to run Microsoft Windows as the operating system on either your servers or your desktops:

    You are doing a terrible job and should probably be fired. 

    I know. That’s harsh. 

    But it’s true. If you haven’t yet replaced Windows, across the board, you absolutely stink at your job. 

    For years, we’ve had one trojan, worm and virus after another. And almost every single one is specifically targeting Microsoft Windows. Not MacOS. Not Linux. Not DOS. Not Unix. Windows. 

    To read this article in full or to leave a comment, please click here



    click to view

  • How to secure your CMS without patching
    Peter Sayer

    In as little as four hours, the bad guys can reverse engineer a software patch for an open-source content management system (CMS) and build an exploit capable of turning millions of websites into spammers, malware hosts or DDoS attackers. 

    "There's just not enough time for normal site owners to apply the updates," said David Jardin, a member of the German association CMS Garden, which promotes the use of open source CMS software including Drupal, Joomla, WordPress and others.

    To help ordinary users patch more quickly, CMS Garden is participating in a government-funded project, Secure Websites and Content Management Systems (Siwecos), to make the websites of SMEs more secure. 

    To read this article in full or to leave a comment, please click here



    click to view

  • It's time to upgrade to TLS 1.3 already, says CDN engineer
    Peter Sayer

    Businesses dragging their heels over rolling out TLS 1.2 on their website might have an excuse to delay a little longer: Version 1.3 of the TLS (Transport Layer Security) encryption protocol will be finalized later this year, and early deployments of it are already under way.

    TLS, the successor to SSL, is used to negotiate secure connections to web or mail servers, encrypting data on the move.

    Six years in the making, TLS 1.2 added new, stronger encryption options -- but retained all the older, weaker encryption schemes that had gone before in the name of backward compatibility. Unfortunately, this meant that someone able to perform a man-in-the-middle attack could often downgrade connections to a weaker encryption system without the user being aware.

    To read this article in full or to leave a comment, please click here



    click to view

  • 6 things you need to know about virtual private networks
    Lucian Constantin

    A virtual private network is a secure tunnel between two or more computers on the internet, allowing them to access each other as if on a local network. In the past, VPNs were mainly used by companies to securely link remote branches together or connect roaming employees to the office network, but today they're an important service for consumers too, protecting them from attacks when they connect to public wireless networks. Given their importance, here's what you need to know about VPNs:

    VPNs are good for your privacy and security

    Open wireless networks pose a serious risk to users, because attackers sitting on the same networks can use various techniques to sniff web traffic and even hijack accounts on websites that don't use the HTTPS security protocol. In addition, some Wi-Fi network operators intentionally inject ads into web traffic, and these could lead to unwanted tracking.

    To read this article in full or to leave a comment, please click here



    click to view

  • Unix: How random is random?
    Sandra Henry-Stocker

    On Unix systems, random numbers are generated in a number of ways and random data can serve many purposes. From simple commands to fairly complex processes, the question “How random is random?” is worth asking.

    EZ random numbers

    If all you need is a casual list of random numbers, the RANDOM variable is an easy choice. Type "echo $RANDOM" and you'll get a number between 0 and 32,767 (the largest number that two bytes can hold).

    $ echo $RANDOM
    29366

    Of course, this process is actually providing a "pseudo-random" number. As anyone who thinks about random numbers very often might tell you, numbers generated by a program have a limitation. Programs follow carefully crafted steps, and those steps aren’t even close to being truly random. You can increase the randomness of RANDOM's value by seeding it (i.e., setting the variable to some initial value). Some just use the current process ID (via $$) for that. Note that for any particular starting point, the subsequent values that $RANDOM provides are quite predictable.

    To read this article in full or to leave a comment, please click here



    click to view

  • The complexity of password complexity
    Sandra Henry-Stocker

    Deploying password quality checking on your Debian-base Linux servers can help to ensure that your users assign reasonable passwords on their accounts, but the settings themselves can be a bit misleading. For example, setting a minimum password length of 12 characters does not mean that your users' passwords will all have twelve or more characters. Let's stroll down Complexity Boulevard and see how the settings work and examine some settings worth considering.

    First, if you haven't done this already, install the password quality checking library with this command:

    apt-get -y install libpam-pwquality

    The files that contain most of the settings we're going to look at will be:

    To read this article in full or to leave a comment, please click here



    click to view

  • 8 ways to manage an internet or security crisis
    Jennifer Lonoff Schiff

    Your business is hit with a ransomware attack. Or your ecommerce site crashes. Your legacy system stops working. Or maybe your latest software release has a major bug. These are just some of the problems that ecommerce, technology and other companies experience at one time or another.

    The issue is not if a problem – or crisis – occurs, but how your company handles it when it does. Manage the problem poorly, you risk losing customers, or worse. Handle a crisis promptly and professionally, you can fend off a public relations disaster and might even gain new customers.

    So what steps can businesses take to mitigate and effectively manage an IT-related crisis? Here are eight suggestions.

    To read this article in full or to leave a comment, please click here



    click to view

  • Incident response is like tracking down a perpetrator
    Ryan Francis
    What is incident response?
    1 incident response police tape crime death

    Image by Thinkstock

    Incident response is like investigating a real burglary. You look for evidence of the intruder at the crime scene, find his targets and his getaway car, and repair any holes. Discover any cuts in your chain link fence. Take a few steps back for more perspective. Find the intruder’s targets. What assets are near the compromised fence? Investigate in both directions to find the intruder's target and getaway car. Fix the fence. Resolve any issues and patch vulnerabilities.

    To read this article in full or to leave a comment, please click here



    click to view

  • 6 things you need to know about IoT security
    Ryan Francis
    Security, trust and data integrity
    IoT security

    Image by Thinkstock

    The emergence of IoT is altering our personal technology security paradigm and is a game-changer in customer/business interaction, in part due to the wide scope of available data and sheer number of devices collecting this data. McKinsey & Company estimates the IoT ecosystem will generate $6 trillion in value by 2025. Successful IoT offerings rely on the perception of benefit they can deliver to businesses and consumers while creating a proportionate foundation of security, trust, and data integrity. There are important ways that IoT technology can reduce data security risk while improving customer experience in a connected world.

    To read this article in full or to leave a comment, please click here



    click to view

  • Pitfalls of identity access management
    Ryan Francis
    Tracking
    identity access management

    Image by Thinkstock

    It is easy to overlook identity access management as static infrastructure in the background, and that's the chief problem: Too few organizations treat IAM as the crucial, secure connective tissue between businesses' multiplying employees, contractors, apps, business partners and service providers. Aaron Perry, president at Focal Point Data Risk, runs through some of IAM’s pitfalls.

    To read this article in full or to leave a comment, please click here



    click to view

  • How to strike ransomware out
    Ryan Francis
    Swing and a miss
    ransomware

    Image by Victor Grigas

    Most businesses are ill prepared to handle a ransomware attack. In fact, according to a new study released by Carbonite, 68 percent of survey respondents believe their company is “very vulnerable” or “vulnerable” to a ransomware attack. Respondents stated that if their company didn’t pay ransom, it was because they had a full and accurate backup. Without backup, they have no other way to get their most valuable asset back.

    To read this article in full or to leave a comment, please click here



    click to view

  • 10 ways to achieve ROI on a network solution
    Ryan Francis
    Measuring ROI
    1 measure roi

    Image by Thinkstock

    With the advent of Bring Your Own Device (BYOD), WLAN network access to customers and visitors and virtualized systems, the demand for IP addresses has exploded. Small companies might have to manage more than 1,000 IP addresses and it is not unusual for larger companies to have 10,000 or more spread across many locations. Setting up and protecting the network infrastructure is a major challenge and needs to be even more sophisticated and dynamic than ever before.

    To read this article in full or to leave a comment, please click here



    click to view

  • What to ask when selecting application security solutions
    Ryan Francis
    Buying decisions
    application security solutions

    Image by Thinkstock

    There are many factors to consider when making an application security purchasing decision, and the pressure is on organizations now more than ever to improve their security risk management preparedness. In fact, more than 80 percent of security attacks target software applications, with application vulnerabilities as the No.1 cyber-attack target. Organizations need a comprehensive application security toolkit to stay secure throughout the product lifecycle, and need to address key questions that can help them determine the right tools to address security risks.

    To read this article in full or to leave a comment, please click here



    click to view

| Date published: Sat, 19 Aug 2017 11:28:49 -0700
Back to newsfeed list
Translate to: {GOOGLETRANS}
Google Ads




Headlines

»CVE-2006-3635 (linux_kernel)
The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service ...
»CVE-2007-5199
A single byte overflow in catalogue.c in X.Org libXfont 1.3.1 allows remote attackers to have unspec ...
»CVE-2007-5341
Remote code execution in the Venkman script debugger in Mozilla Firefox before 2.0.0.8.
»CVE-2009-5145 (zope)
Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11. ...
»CVE-2010-2245 (wink)
XML External Entity (XXE) vulnerability in Apache Wink 1.1.1 and earlier allows remote attackers to ...
»CVE-2010-3845 (apache_authenhook)
libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log ...
»CVE-2011-0469
Code injection in openSUSE when running some source services used in the open build service 2.1 befo ...
»CVE-2011-4343 (myfaces)
Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2 ...
»CVE-2011-5325 (busybox)
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remot ...
»CVE-2012-0880 (xerces-c++)
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a craft ...
»CVE-2012-2771 (ffmpeg)
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different ...
»CVE-2012-2773 (ffmpeg)
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different ...
»CVE-2012-2778 (ffmpeg)
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different ...
»CVE-2012-2780 (ffmpeg)
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different ...
»CVE-2012-2781 (ffmpeg)
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different ...


Date published: 2017-08-19T16:01:09Z
Details

»Drupal Releases Security Updates
Original release date: August 16, 2017 Drupal has released an advisory to address several vul ...
»Cisco Releases Security Updates
Original release date: August 16, 2017 Cisco has released updates to address vulnerabilities ...
»Symantec Releases Security Update
Original release date: August 11, 2017 Symantec has released an update to address vulnerabili ...
»Juniper Networks Releases Junos OS Security Advisory
Original release date: August 09, 2017 | Last revised: August 10, 2017 Juniper Networks has r ...
»FTC Releases Alert on Government Grant Scams
Original release date: August 08, 2017 The Federal Trade Commission (FTC) has released an ale ...
»Microsoft Releases August 2017 Security Updates
Original release date: August 08, 2017 Microsoft has released updates to address vulnerabilit ...
»Mozilla Releases Security Updates
Original release date: August 08, 2017 Mozilla has released security updates to address multi ...
»Adobe Releases Security Updates
Original release date: August 08, 2017 Adobe has released security updates to address vulnera ...
»IRS Warns Tax Professionals of New Scam to Steal Passwords
Original release date: August 07, 2017 The Internal Revenue Service (IRS), acting in concert ...
»Google Releases Security Updates for Chrome OS
Original release date: August 03, 2017 Google has released Chrome OS version 60.0.3112.80 for ...


Date published: not known
Details

»Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 2
In the second part of this two-part blog series, we look at five mo ...
»Five tips for submitting to Calls for Papers
With the VB2017 Call for Papers out, here are five tips to increase ...
»The WannaCry kill switch wasn't inserted to make someone a hero
Following the arrest of WannaCry hero Marcus Hutchings, suggestions ...
»Throwback Thursday: Ten memorable Virus Bulletin conference presentations - part 1
In a two-part blog post series, we look back at ten memorable VB co ...
»Worms wiggling inside your networks are a lot harder to stop
The authors of the Trickbot banking trojan seem to have taken note ...
»VB2017 drinks reception to be hosted in Madrid's unique Geographic Club
To give those attending VB2017 Madrid a chance to experience a litt ...
»By removing VPNs from its Chinese App Store, Apple turns its biggest security asset against its users
To comply with Chinese laws, Apple has removed all iOS VPN apps fro ...
»VB2017 Small Talks and reserve papers announced
Today we announce the first two Small Talks for the VB2017 programm ...
»NoMoreRansom's first birthday demonstrates importance of collaboration
This week the NoMoreRansom project celebrated its first birthday. I ...


Date published: not known
Details
Main Menu
· Home
Current Security News
 
US-CERT Current Activity

» Drupal Releases Security Updates
[16 Aug 2017 05:08pm]

» Cisco Releases Security Updates
[16 Aug 2017 04:36pm]

» Symantec Releases Security Update
[11 Aug 2017 06:40am]

» Juniper Networks Releases Junos OS Security Advisory
[09 Aug 2017 09:08pm]

» FTC Releases Alert on Government Grant Scams
[08 Aug 2017 06:30pm]

» Microsoft Releases August 2017 Security Updates
[08 Aug 2017 03:31pm]

» Mozilla Releases Security Updates
[08 Aug 2017 11:11am]

» Adobe Releases Security Updates
[08 Aug 2017 10:41am]

» IRS Warns Tax Professionals of New Scam to Steal Passwords
[07 Aug 2017 01:30pm]

» Google Releases Security Updates for Chrome OS
[03 Aug 2017 12:25pm]

***
US-CERT Alerts

» TA17-181A: Petya Ransomware
[30 Jun 2017 11:41pm]

» TA17-164A: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
[13 Jun 2017 09:45am]

» TA17-163A: CrashOverride Malware
[12 Jun 2017 03:44pm]

» TA17-156A: Reducing the Risk of SNMP Abuse
[05 Jun 2017 06:11pm]

» TA17-132A: Indicators Associated With WannaCry Ransomware
[12 May 2017 07:36pm]

» TA17-117A: Intrusions Affecting Multiple Victims Across Multiple Sectors
[27 Apr 2017 04:50pm]

» TA17-075A: HTTPS Interception Weakens TLS Security
[16 Mar 2017 06:40am]

» TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
[30 Nov 2016 10:00pm]

» TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets
[14 Oct 2016 05:59pm]

» TA16-250A: The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations
[06 Sep 2016 04:29pm]

***
Computerworld Security

» iCloud security: How (and why) to enable two-factor authentication
[18 Aug 2017 04:11am]

» Find My Device: How Android's security service can manage your missing phone
[17 Aug 2017 10:27am]

» Where’s the KB 4034661 jumbo bug fix for Win10 Anniversary Update?
[17 Aug 2017 05:33am]

» 8 steps to install Windows 10 patches like a pro
[16 Aug 2017 01:07pm]

» 31% off WD 4TB My Passport Portable External USB 3.0 Hard Drive - Deal Alert
[16 Aug 2017 07:26am]

» Where we stand with this month’s Windows and Office security patches
[15 Aug 2017 08:18am]

» Another undocumented Surface Pro update — Dynamic Platform and Thermal Framework
[14 Aug 2017 09:47am]

» Mingis on Tech: Android vs iOS – Which is more secure?
[10 Aug 2017 04:00am]

» New in Windows security: Automatically log off suspicious users
[10 Aug 2017 03:59am]

» Windows 10 1607 cumulative update KB 4034658 wipes out Update History
[09 Aug 2017 07:40am]

» How Windows to Go can protect data for business travelers
[08 Aug 2017 04:00am]

» It’s time to check your Windows machines and temporarily turn off Automatic Update
[07 Aug 2017 10:10am]

» The case against Windows Automatic Update
[07 Aug 2017 06:19am]

» New Surface Pro 4 driver restores Windows Hello — and this time it’s documented
[04 Aug 2017 04:43am]

» 22% off Aukey Dash Cam, Full HD Wide Angle With Night Vision - Deal Alert
[03 Aug 2017 07:54am]

***
Microsoft Security Advisories

» 4038556 - Guidance for securing applications that host the WebBrowser Control - Version: 1.0
[08 Aug 2017 11:00am]

» 4033453 - Vulnerability in Azure AD Connect Could Allow Elevation of Privilege - Version: 1.0
[27 Jun 2017 11:00am]

» 4025685 - Guidance related to June 2017 security update release - Version: 1.0
[13 Jun 2017 11:00am]

» 4022344 - Security Update for Microsoft Malware Protection Engine - Version: 1.2
[12 May 2017 11:00am]

» 4022345 - Identifying and correcting failure of Windows Update client to receive updates - Version: 1.3
[12 May 2017 11:00am]

» 4021279 - Vulnerabilities in .NET Core, ASP.NET Core Could Allow Elevation of Privilege - Version: 1.1
[10 May 2017 11:00am]

» 4010323 - Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11 - Version: 1.0
[09 May 2017 11:00am]

» 3123479 - SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[14 Mar 2017 11:00am]

» 4010983 - Vulnerability in ASP.NET Core MVC 1.1.0 Could Allow Denial of Service - Version: 1.0
[27 Jan 2017 11:00am]

» 3214296 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege - Version: 1.0
[10 Jan 2017 11:00am]

» 3174644 - Updated Support for Diffie-Hellman Key Exchange - Version: 1.0
[13 Sep 2016 11:00am]

» 3181759 - Vulnerabilities in ASP.NET Core View Components Could Allow Elevation of Privilege - Version: 1.0
[13 Sep 2016 11:00am]

» 3179528 - Update for Kernel Mode Blacklist - Version: 1.0
[09 Aug 2016 11:00am]

» 2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[18 May 2016 11:00am]

» 3155527 - Update to Cipher Suites for FalseStart - Version: 1.0
[10 May 2016 11:00am]

***
Security Latest

» Charlottesville, HBO Hacks, and More Security News This Week
[19 Aug 2017 07:00am]

» Breaking Down the HBO Hacks: From Game of Thrones To a Twitter Takeover
[18 Aug 2017 09:46am]

» Cloudflare Pulls Support For The Daily Stormer, a White Supremacist Site
[16 Aug 2017 05:47pm]

» A Deep Flaw in Your Car Lets Hackers Shut Down Safety Features
[16 Aug 2017 02:55pm]

» Verizon Takes Fourth Amendment Stand in Carpenter V. United States
[16 Aug 2017 08:00am]

» Donald Trump's Charlottesville Press Conference Has Roots in Fox News and Twitter
[15 Aug 2017 07:47pm]

» Tech Companies Have the Tools to Confront White Supremacy
[14 Aug 2017 04:24pm]

» Free Stingray-Detector Apps Could Be Outsmarted
[14 Aug 2017 05:00am]

» The Alt-Right Can't Disown Charlottesville
[13 Aug 2017 06:10pm]

» A Guide to Russia’s High Tech Tool Box for Subverting US Democracy
[13 Aug 2017 05:00am]

» The Guy Who Made Up All Those Password Rules Is Sorry
[12 Aug 2017 06:00am]

» Russia's 'Fancy Bear' Hackers Used Leaked NSA Tool 'Eternal Blue" to Target Hotel Guests
[11 Aug 2017 07:00am]

» Trump's North Korea Nuclear Riffing Creates a Real Danger
[10 Aug 2017 05:00am]

» Biohackers Encoded Malware in a Strand of DNA
[09 Aug 2017 10:00pm]

» North Korea's Miniature Nuke Spells Big Trouble For the World
[08 Aug 2017 04:28pm]

***
Network World Security

» IDG Contributor Network: Can the U.S. Senate secure the Internet of Things?
[18 Aug 2017 05:26am]

» 31% off WD 4TB My Passport Portable External USB 3.0 Hard Drive - Deal Alert
[16 Aug 2017 07:26am]

» 7 free tools every network needs
[15 Aug 2017 01:52pm]

» IDG Contributor Network: SDN and a life beyond the death of the internet
[15 Aug 2017 12:00pm]

» 7 free tools every network needs
[15 Aug 2017 01:52pm]

» Gravityscan, keeping WordPress sites safe
[24 May 2017 02:34pm]

» Network monitoring tools: Features users love and hate
[01 May 2017 04:51am]

» Book Review: Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems
[27 Apr 2017 12:45pm]

» Fight firewall sprawl with AlgoSec, Tufin, Skybox suites
[10 Apr 2017 04:32am]

» Review: Canary Flex security camera lives up to its name
[24 Mar 2017 07:01am]

» Zix wins 5-vendor email encryption shootout
[13 Mar 2017 04:00am]

» Review: vArmour flips security on its head
[06 Mar 2017 03:50am]

» 5 open source security tools too good to ignore
[21 Feb 2017 07:12am]

» 31% off WD 4TB My Passport Portable External USB 3.0 Hard Drive - Deal Alert
[16 Aug 2017 07:26am]

» 7 free tools every network needs
[15 Aug 2017 01:52pm]

***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Welcome
Username:

Password:




Remember me

[ ]

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}