NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
Newsfeeds
Network World Security
  • Customers roast Microsoft over security bulletins' demise
    Gregg Keizer

    When Microsoft asked customers last week for feedback on the portal that just replaced the decades-long practice of delivering detailed security bulletins, it got an earful from unhappy users.

    "Hate hate hate the new security bulletin format. HATE," emphasized Janelle 322 in a support forum where Microsoft urged customers to post thoughts on the change. "I now have to manually transcribe this information to my spreadsheet to disseminate to my customers. You have just added 8 hours to my workload. Thanks for nothing."

    To read this article in full or to leave a comment, please click here



    click to view

  • 7 patch management practices guaranteed to help protect your data
    Chris Goettl, Manager of Product Management, Security, Ivanti

    This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

    We’re in an era in which pre-packaged exploit services make it possible for the average Joe, with no technological experience or prowess, to launch intricate attacks on our environments. So, what can be done? Patching operating systems and applications is a surefire way to block some attacks.  But you need to do more than blast out auto updates.

    Here are seven patch management best practices that take your organization’s cybersecurity to the next level:

    #1 Use a proper discovery service

    You can’t secure what you don’t know about. The only way to know if a breach or vulnerability exists is to employ broad discovery capabilities. A proper discovery service entails a combination of active and passive discovery features and the ability to identify physical, virtual and on and off premise systems that access your network. Developing this current inventory of production systems, including everything from IP addresses, OS types and versions and physical locations, helps keep your patch management efforts up to date, and it’s important to inventory your network on a regular basis. If one computer in the environment misses a patch, it can threaten the stability of them all, even curbing normal functionality.

    To read this article in full or to leave a comment, please click here



    click to view

  • More Windows PCs infected with NSA backdoor DoublePulsar
    Ms. Smith

    The number of Windows computers infected with NSA backdoor malware continues to rise since Shadow Brokers leaked the hacking tools on April 14.

    DoublePulsar infection rate climbing

    Two different sets of researchers scanning for the DoublePulsar implant saw a significant bump in the number of infected Windows PCs over the weekend.

    For example, Dan Tentler, CEO of the Phobos Group, suggested that Monday would not be a good day for many people, as his newest scan showed about 25 percent of all vulnerable and publicly exposed SMB machines are infected.

    To read this article in full or to leave a comment, please click here



    click to view

  • Bring Your Own Authentication is upending online security practices
    Geoff Sanders, Product Director of LaunchKey, iovation

    This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

    Seeing the success of the Bring Your Own Device movement, a cadre of leading companies are starting to explore if a similar approach can be used to address the authentication challenge. If BYOD essentially makes the device a proxy for the work environment, can that same device serve as a proxy for customers online?

    This new movement, known as Bring Your Own Authentication (BYOA), holds the same promise of reimagining the way we think of authentication, putting the consumer (and device) front and center in the interaction, and relegating passwords to the background or eliminating them completely. But there are challenges to overcome in order for mass adoption.

    To read this article in full or to leave a comment, please click here



    click to view

  • Fight firewall sprawl with AlgoSec, Tufin, Skybox suites
    John Breeden II

    New and innovative security tools seem to be emerging all the time, but the frontline defense for just about every network in operation today remains the trusty firewall. They aren’t perfect, but if configured correctly and working as intended, firewalls can do a solid job of blocking threats from entering a network, while restricting unauthorized traffic from leaving.

    The problem network administrators face is that as their networks grow, so do the number of firewalls. Large enterprises can find themselves with hundreds or thousands, a mix of old, new and next-gen models, probably from multiple vendors -- sometimes accidentally working against each other. For admins trying to configure firewall rules, the task can quickly become unmanageable.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Review: Canary Flex security camera lives up to its name
    Keith Shaw

    Canary’s initial foray into the networked home security camera space was very impressive – my colleague David Newman touted its high security settings in the wake of revelations about the general insecurity of these types of devices. The Canary camera was also somewhat large – a cylindrical tower that took up some significant space on your desk, cabinet or shelf.

    The latest camera the company sent me is the Canary Flex, a much smaller unit meant to be more flexible (hence the name) in terms of placement, but also in power options. Like the Arlo Pro camera, the Canary Flex is powered by an internal battery (it’s charged via USB cable and power adapter). This means you can move the Flex to a location inside or outside your home where there’s no power outlet. The Flex comes with wall mounting screws and a 360-degree magnetic stand so you can position the camera in different spots. Additional accessories, such as a plant mount or twist mount (pictured below), offer even more location choices.

    To read this article in full or to leave a comment, please click here



    click to view

  • Smackdown: Office 365 vs. G Suite management
    Galen Gruman

    When you choose a productivity platform like Microsoft’s Office 365 or Google’s G Suite, the main focus is on the platform’s functionality: Does it do the job you need?

    That’s of course critical, but once you choose a platform, you have to manage it. That’s why management capabilities should be part of your evaluation of a productivity and collaboration platform, not only its user-facing functionality.

    You’ve come to the right place for that aspect of choosing between Office 365 and Google G Suite.

    Admin console UI. Both the Office 365 and G Suite admin consoles are well designed, providing clean separation of management functions and clear settings labels, so you can quickly move to the settings you want and apply them.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Zix wins 5-vendor email encryption shootout
    David Strom

    Email encryption products have made major strides since we last looked at them nearly two years ago. They have gotten easier to use and deploy, thanks to a combination of user interface and encryption key management improvements, and are at the point where encryption can almost be called effortless on the part of the end user.

    Our biggest criticism in 2015 was that the products couldn’t cover multiple use cases, such as when a user switches from reading emails on their smartphone to moving to a webmailer to composing messages on their Outlook desktop client. Fortunately, the products are all doing a better job handling multi-modal email.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • Review: vArmour flips security on its head
    John Breeden II

    Almost every cybersecurity program these days does some sort of scanning, sandboxing or traffic examination to look for anomalies that might indicate the presence of malware. We’ve even reviewed dedicated threat-hunting tools that ferret out malware that’s already active inside a network.

    However, what if there were a different way to approach security? Instead of searching for behaviors that might indicate a threat, what if you could define everything that is allowed within a network? If every process, application and workflow needed to conduct business could be defined, then by default everything outside of those definitions could be flagged as illegal. At the very least, critical programs could be identified and all interactions with them could be tightly defined and monitored. It’s a different way of looking at security, called segmentation.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • 5 open source security tools too good to ignore
    Fahmida Y. Rashid

    Open source is a wonderful thing. A significant chunk of today’s enterprise IT and personal technology depends on open source software. But even while open source software is widely used in networking, operating systems, and virtualization, enterprise security platforms still tend to be proprietary and vendor-locked. Fortunately, that’s changing. 

    If you haven’t been looking to open source to help address your security needs, it’s a shame—you’re missing out on a growing number of freely available tools for protecting your networks, hosts, and data. The best part is, many of these tools come from active projects backed by well-known sources you can trust, such as leading security companies and major cloud operators. And many have been tested in the biggest and most challenging environments you can imagine. 

    To read this article in full or to leave a comment, please click here



    click to view

  • Review: Samsung SmartCam PT network camera
    Keith Shaw

    The home security camera market has taken a big hit in recent months, becoming the poster child for “bad security behavior” when people talk about the security (or lack thereof) of Internet of Things. Last year’s highly publicized DDoS attack on Dyn highlighted insecure cameras being used as part of a botnet; vulnerabilities were also found in Chinese-based security cameras and at least one Samsung SmartCam product. In the U.S., the FTC filed a complaint against D-Link over claims that their webcams were “secure”.

    To read this article in full or to leave a comment, please click here



    click to view

  • Review: Arlo Pro cameras offer true flexibility for home security
    Keith Shaw

    Netgear’s Arlo brand of home security, network-connected cameras continues to improve, defeating every real or perceived criticism about the devices with an upgrade or improvement. Want to place in an area where there’s no network cable? Bam! Wi-Fi connection. Need to place in an area where there’s no power outlet? Bam! Battery powered! Don’t like replacing batteries? Bam! Rechargeable batteries and a quick-charge battery adapter.

    The latest version of this system is the Arlo Pro – it’s the most flexible camera system I’ve come across so far. After a few weeks of testing, I’ve determined that anyone who has a problem with this system (or think that it can’t do something) is just a cynical old crank.

    To read this article in full or to leave a comment, please click here



    click to view

  • Face-off: Oracle vs. CA for identity management
    CSO staff

    Employees come and go, or switch departments, so IT managers seek an automated way to give (or deny) them access privileges to corporate systems. Two of the top software products for identity and access management (IAM) are Oracle Identity Manager and CA Identity Manager, according to IT Central Station, an online community where IT professionals review enterprise products.

    Both products have their fans who say the sophisticated software helps them handle routine access tasks … without paperwork. But users also note that there are areas where the products have room for improvement — areas such as the user interface, initial setup and vendor tech support, according to reviews at IT Central Station. Plus, several users said the vendors need to migrate these products to the cloud.

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • 7 patch management practices guaranteed to help protect your data
    Chris Goettl, Manager of Product Management, Security, Ivanti

    This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

    We’re in an era in which pre-packaged exploit services make it possible for the average Joe, with no technological experience or prowess, to launch intricate attacks on our environments. So, what can be done? Patching operating systems and applications is a surefire way to block some attacks.  But you need to do more than blast out auto updates.

    Here are seven patch management best practices that take your organization’s cybersecurity to the next level:

    #1 Use a proper discovery service

    You can’t secure what you don’t know about. The only way to know if a breach or vulnerability exists is to employ broad discovery capabilities. A proper discovery service entails a combination of active and passive discovery features and the ability to identify physical, virtual and on and off premise systems that access your network. Developing this current inventory of production systems, including everything from IP addresses, OS types and versions and physical locations, helps keep your patch management efforts up to date, and it’s important to inventory your network on a regular basis. If one computer in the environment misses a patch, it can threaten the stability of them all, even curbing normal functionality.

    To read this article in full or to leave a comment, please click here



    click to view

  • More Windows PCs infected with NSA backdoor DoublePulsar
    Ms. Smith

    The number of Windows computers infected with NSA backdoor malware continues to rise since Shadow Brokers leaked the hacking tools on April 14.

    DoublePulsar infection rate climbing

    Two different sets of researchers scanning for the DoublePulsar implant saw a significant bump in the number of infected Windows PCs over the weekend.

    For example, Dan Tentler, CEO of the Phobos Group, suggested that Monday would not be a good day for many people, as his newest scan showed about 25 percent of all vulnerable and publicly exposed SMB machines are infected.

    To read this article in full or to leave a comment, please click here



    click to view

  • Bring Your Own Authentication is upending online security practices
    Geoff Sanders, Product Director of LaunchKey, iovation

    This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

    Seeing the success of the Bring Your Own Device movement, a cadre of leading companies are starting to explore if a similar approach can be used to address the authentication challenge. If BYOD essentially makes the device a proxy for the work environment, can that same device serve as a proxy for customers online?

    This new movement, known as Bring Your Own Authentication (BYOA), holds the same promise of reimagining the way we think of authentication, putting the consumer (and device) front and center in the interaction, and relegating passwords to the background or eliminating them completely. But there are challenges to overcome in order for mass adoption.

    To read this article in full or to leave a comment, please click here



    click to view

  • Russian man receives longest-ever prison sentence in the US for hacking
    Lucian Constantin

    A 32-year-old Russian hacker was sentenced to 27 years in prison in the U.S. for stealing millions of payment card details from businesses by infecting their point-of-sale systems with malware.

    The sentence is the longest ever handed out in the U.S. for computer crimes, surpassing the 20-year jail term imposed on American hacker and former U.S. Secret Service informant Albert Gonzalez in 2010 for similar credit card theft activities.

    Roman Valeryevich Seleznev, a Russian citizen from Vladivostok, was sentenced Friday in the Western District of Washington after he was found guilty in August of 10 counts of wire fraud, eight counts of intentional damage to a protected computer, nine counts of obtaining information from a protected computer, nine counts of possession of 15 or more unauthorized access devices and two counts of aggravated identity theft.

    To read this article in full or to leave a comment, please click here



    click to view

  • 11 technologies developers should explore now
    Paul Heltzel

    New and evolving technologies are rapidly reshaping how we work—offering creative opportunities for developers who are willing to pivot and adopt new skills. We took a look at 11 tech trends experts say are likely to disrupt current IT approaches and create demand for engineers with an eye on the future.

    It isn’t all about The Next Big Thing. Future opportunities for developers are emerging from a confluence of cutting-edge technologies, such as AI, VR. augmented reality, IoT, and cloud technology ... and, of course, dealing with the security issues that are evolving from these convergences.

    If you're interested in expanding your developer’s toolkit, check out these trending domains—and our tips on how to get ahead by getting started with them.

    To read this article in full or to leave a comment, please click here



    click to view

  • FAQ: What is blockchain and how can it help business?
    Lucas Mearian

    Blockchain sounds like a way to keep boats anchored, which isn't a bad analogy, considering what the technology purports to do.

    While some IT experts herald it as a groundbreaking way of creating a distributed, unchangeable record of transactions, others question the nascent technology's usefulness in the enterprise, which has traditionally relied on centrally-administered databases to secure digital records.

    Even so, companies are moving fast to try and figure out how they can use it to save time and money. And IT vendors are responding to customers calls for info, with some already looking to include it as part of their services.

    To read this article in full or to leave a comment, please click here



    click to view

  • Healthcare records for sale on Dark Web
    Ryan Francis

    Last August a Baltimore substance abuse treatment facility had its database hacked. Patient records subsequently found their way onto the Dark Web, according to DataBreaches.net. The group noticed such things as dates of admission, whether the patients are on methadone, their doctors and counselors, and dosing information.

    In the DataBreaches.net blog, the hacker “Return,” who they think is Russian, described how he compromised the Man Alive clinic: “With the help of the social engineer, applied to one of the employees. Word file with malicious code was downloaded.”

    To read this article in full or to leave a comment, please click here



    click to view

  • Securing risky network ports
    David Geer

    Data packets travel to and from numbered network ports associated with particular IP addresses and endpoints, using the TCP or UDP transport layer protocols. All ports are potentially at risk of attack. No port is natively secure.

    “Each port and underlying service has its risks. The risk comes from the version of the service, whether someone has configured it correctly, and, if there are passwords for the service, whether these are strong? There are many more factors that determine whether a port or service is safe,” explains Kurt Muhl, lead security consultant at RedTeam Security. Other factors include whether the port is simply one that attackers have selected to slip their attacks and malware through and whether you leave the port open.

    To read this article in full or to leave a comment, please click here



    click to view

  • New products of the week 4.24.17
    Ryan Francis


    click to view

  • Trump claimed on Earth Day: 'Rigorous science is critical to my administration'
    Ms. Smith

    If you had been living under a rock, then you might actually believe that President Trump plans to protect the environment and support science.

    Trump’s Earth Day statement began:

    Our Nation is blessed with abundant natural resources and awe-inspiring beauty. Americans are rightly grateful for these God-given gifts and have an obligation to safeguard them for future generations. My Administration is committed to keeping our air and water clean, to preserving our forests, lakes, and open spaces, and to protecting endangered species.

    To read this article in full or to leave a comment, please click here



    click to view

  • There's now a tool to test for NSA spyware
    Michael Kan

    Has your computer been infected with a suspected NSA spying implant? A security researcher has come up with a free tool that can tell.

    Luke Jennings of security firm Countercept wrote a script in response to last week’s high-profile leak of cyberweapons that some researchers believe are from the U.S. National Security Agency. It's designed to detect an implant called Doublepulsar, which is delivered by many of the Windows-based exploits found in the leak and can be used to load other malware.

    To read this article in full or to leave a comment, please click here



    click to view

  • Phishing attacks using internationalized domains are hard to block
    Lucian Constantin

    The latest version of Google Chrome, released earlier this week, restricts how domain names that use non-Latin characters are displayed in the browser. This change is in response to a recently disclosed technique that could allow attackers to create highly credible phishing websites.

    The ability to register domain names made up of characters like those found in the Arabic, Chinese, Cyrillic, Hebrew and other non-Latin alphabets dates back over a decade. Since 2009, the Internet Corporation for Assigned Names and Numbers (ICANN) has also approved a large number of internationalized top-level domains (TLDs) -- domain extensions -- written with such characters.

    To read this article in full or to leave a comment, please click here



    click to view

  • DARPA opens massive “Colosseum” to develop radical wireless applications
    Michael Cooney

    DARPA today said it  opened unique and massive testbed it will use as a battleground for researchers to build and test autonomous, intelligent and collaborative wireless technologies.

    Calling it a “magnificent electronic arena” The Colosseum will be primarily used to host the Defense Advanced Research Projects Agency’s $3.75 million three-year Spectrum Collaboration Challenge (SC2), which will pit researchers against each other to develop what the agency calls radically new technologies for “using and managing access to the electromagnetic spectrum in both military and civilian domains.”

    To read this article in full or to leave a comment, please click here



    click to view

  • Forget signatures for malware detection. SparkCognition says AI is 99% effective  
    Linda Musthaler

    This column is available in a weekly newsletter called IT Best Practices.  Click here to subscribe.  

    The notion of detecting malware by looking for malicious file signatures is obsolete. Depending on which source is cited, anywhere from 300,000 to one million new malware files are identified every day.

    Kaspersky Lab says it finds 323,000 files daily, AV-TEST claims to discover more than 390,000 new malicious programs every day, and Symantec says it uncovers almost a million new threats per day. No matter how you count it, that’s a lot of malicious software being unleased into the wild day after day.

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: Is your company spending on the right security technologies?
    Javvad Malik

    Investing in security technologies is a given for most companies today, and with stories of breaches and hacks making headlines every week, the importance of these tools has risen to prominence.

    While there’s no shortage of security technologies to choose from, the big question that remains is: How does a company choose the right security investments? Many organizations struggle to implement the right tools to manage and mitigate risk, and getting all of these solutions to actually work together often presents an even bigger challenge.

    With that in mind, here are three considerations that can help companies make the right decisions when it comes to investing in security technology:

    To read this article in full or to leave a comment, please click here



    click to view

  • IDG Contributor Network: Why banks should stay well clear of blockchain
    David Richards

    If the financial services industry is banking on blockchain as the basis for new service innovation, it will be sorely disappointed. Blockchain's design principles are completely at odds with those of the industry, and the technology is fraught with flaws that could be catastrophic for financial institutions.

    I’ll come on to why in a moment. Clearly, there is a lot of hype and momentum around blockchain. WANdisco sees this first hand: We’re increasingly being approached by banks that think this is the kind of thing we do (it isn’t). And why are they interested? Because senior directors and investors have heard the buzz and concluded that this is something they need—that if they don’t seize the opportunity, they’ll miss out. They’re wrong. Banks need blockchain like a hole in the head.

    To read this article in full or to leave a comment, please click here



    click to view

  • Cybersecurity skills shortage threatens the mid-market
    Jon Oltsik

    Each year, respondents ESG's annual global survey of IT and cybersecurity professionals are asked to identify the area where their organizations have a problematic shortage of skills. For the sixth year in a row, cybersecurity skills topped the list—this year, 45% of the 641 respondents said their organization has a problematic shortage of cybersecurity skills. 

    Now, the cybersecurity skill shortage isn’t picky; it impacts all organizations across industries, organizational size, geography, etc. Nevertheless, global cybersecurity may be especially problematic for organizations in the mid-market, from 100 to 999 employees.

    Keep in mind that the skills shortage isn’t limited to headcount. Rather, it also includes skills deficiencies—situations where security staff members don’t have the right skills to address the dynamic and sophisticated threat landscape. 

    To read this article in full or to leave a comment, please click here



    click to view

  • What's in the fine print of your disaster recovery vendor agreement?
    Ryan Francis
    Sign on the bottom line
    disaster recovery vendor agreement

    Image by Thinkstock

    Disaster-recovery solutions require several complex, moving parts coordinated between your production site and the recovery site. Service-level agreements are ultimately the most accurate way to determine where responsibility is held for disaster-recovery process and execution. It’s important to have SLA documentation around these critical aspects of recovery so that customers have commitments from their vendor. It’s also important that a service provider’s agreements contain service-credit backed SLAs for additional accountability. When considering DRaaS vendors, ask your potential partner how far they are willing to go in protecting your business and your data, and if these promises will be reimbursable if not met. Bluelock's Brandon Jeffress reviews what is essential to be in an ironclad SLA.

    To read this article in full or to leave a comment, please click here



    click to view

  • Drupal fixes critical access bypass vulnerability
    Lucian Constantin

    The Drupal project has released a patch to fix a critical access bypass vulnerability that could put websites at risk of hacking.

    The vulnerability does not have the highest severity level based on Drupal's rating system, but is serious enough that the platform's developers decided to also release a patch for a version of the content management system that's no longer officially supported.

    Successful exploitation of the vulnerability can lead to a complete compromise of data confidentiality and website integrity, but only Drupal-based websites with certain configurations are affected.

    To be vulnerable, a website needs to have the RESTful Web Services enabled and to allow PATCH requests. Furthermore, the attacker needs to be able to register a new account on the website or to gain access to an existing one, regardless of its privileges.

    To read this article in full or to leave a comment, please click here



    click to view

  • Hackers use old Stuxnet-related bug to carry out attacks
    Michael Kan

    Users that run unpatched software beware. Hackers have been relying on an old software bug tied to the Stuxnet worm to carry out their attacks.

    Microsoft may have initially patched the flaw in 2010, but it's nevertheless become the most widespread software exploit, according to security firm Kaspersky Lab.

    On Thursday, Kaspersky posted research examining the use of exploits, or malicious programs designed to take advantage of certain software flaws. Once an exploit goes to work, it can typically pave the way for other malicious programs to install onto a computer.

    To read this article in full or to leave a comment, please click here



    click to view

  • What's in the fine print of your disaster recovery vendor agreement?
    Ryan Francis
    Sign on the bottom line
    disaster recovery vendor agreement

    Image by Thinkstock

    Disaster-recovery solutions require several complex, moving parts coordinated between your production site and the recovery site. Service-level agreements are ultimately the most accurate way to determine where responsibility is held for disaster-recovery process and execution. It’s important to have SLA documentation around these critical aspects of recovery so that customers have commitments from their vendor. It’s also important that a service provider’s agreements contain service-credit backed SLAs for additional accountability. When considering DRaaS vendors, ask your potential partner how far they are willing to go in protecting your business and your data, and if these promises will be reimbursable if not met. Bluelock's Brandon Jeffress reviews what is essential to be in an ironclad SLA.

    To read this article in full or to leave a comment, please click here



    click to view

  • How to prevent your mobile app from getting hacked
    Ryan Francis
    Trivial matter?
    1 app hacked

    Image by Steve Traynor/IDG

    The average user has around 26 to 55 applications downloaded to his smartphone device. Most likely, you have entertainment and gaming apps, a banking app, a few social media apps, fitness apps, and eCommerce apps to shop at your favorite stores.

    To read this article in full or to leave a comment, please click here



    click to view

  • How to rescue your PC from ransomware
    Eric Geier

    With  nasty malware like Locky making the rounds—encrypting its victims’ files, and then refusing to unlock them unless you pay up—ransomware is a serious headache. But not all ransomware is so difficult.

    You can remove many ransomware viruses without losing your files, but with some variants that isn’t the case. In the past I’ve discussed general steps for removing malware and viruses, but you need to apply some specific tips and tricks for ransomware. The process varies and depends on the type of invader. Some procedures involve a simple virus scan, while others require offline scans and advanced recovery of your files. I categorize ransomware into three varieties: scareware, lock-screen viruses, and the really nasty stuff.

    To read this article in full or to leave a comment, please click here



    click to view

  • How to fend off cyberattacks and data breaches
    Jennifer Lonoff Schiff

    According to research conducted by Symantec, the number of cyberattacks against small businesses (companies with fewer than 250 employees) has been steadily growing over the last six years, with hackers specifically targeting employees (phishing). And while distributed denial of service, or DDoS, attacks are still a leading form of cyber warfare, ransomware and malware attacks, targeting users of smartphones and internet of things (IoT) devices, as well as PCs and systems running on Macs and Linux, are also a big threat to small businesses.

    To read this article in full or to leave a comment, please click here



    click to view

  • 10 things you need to know about the security risks of wearables
    James A. Martin

    The risks from corporate use of activity trackers and other wearables is low, some experts say -- especially in comparison to all the other security and privacy risks CISOs, CIOs and IT folks must worry about.

    That said, as with any connected device, there is risk potential. For example, recent research suggests that devices such as Fitbits can be hacked (when the hacker is within close proximity). By focusing on accelerometers and other motion sensors, researchers at the University of Michigan and the University of South Carolina found that it’s possible to, among other things, use sound waves at different frequencies to add thousands of steps to a Fitbit. (Scroll down to read Fitbit’s response to the research results.)

    To read this article in full or to leave a comment, please click here

    (Insider Story)

    click to view

  • How to set up two-factor authentication for your Apple ID and iCloud account
    Susie Ochs

    If you aren’t using two-factor authentication to protect your Apple ID and iCloud account, you really should do it today. Hackers who claim to have millions of stolen iCloud credentials are demanding Apple pay a ransom or they’ll release them—and ZDNet obtained a sample set of credentials and determined they’re real.

    But guess what? Using two-factor authentication should protect you completely. It’s easy to set up, so take a minute and do it now.

    To read this article in full or to leave a comment, please click here



    click to view

  • How to stop insider threats
    Ryan Francis
    Watch what leaves the office
    1 intro insider threat

    Image by Thinkstock

    Employee turnover is common, as is the practice of employees taking sensitive and confidential data with them when they leave, particularly data that they were involved in generating. This creates a significant risk for employers whose data was misappropriated, resulting in potential data breaches that can trigger regulatory actions or legal actions, as well as a variety of other consequences. Most employers are not adequately prepared to deal with the aftermath of employee data theft and many do not take the steps necessary to mitigate these risks before they occur.

    To read this article in full or to leave a comment, please click here



    click to view

  • What to consider in developing BYOD policy
    Ryan Francis
    Why Have a BYOD Policy?
    BYOD policy

    Image by Thinkstock

    In today’s work environment, employees are increasingly expected to be constantly available and communicating. Regardless of whether the company permits it, employees will use their personal devices for work. Instead of ignoring the inevitable, companies should develop and implement a BYOD policy that protects the company and balances productivity with security. Brandon N. Robinson Partner, Balch & Bingham LLP - Privacy and Data Security Practice, provides some tips.

    To read this article in full or to leave a comment, please click here



    click to view

  • Setting up DLP features for email security.

    Network World contributing editor David Strom provides a roundup of how to enable data leak prevention features on three email security platforms.

    click to view

  • How to protect your privacy with a VPN on Android
    Ryan Whitwam

    Using a VPN on Android can help you access content that’s blocked in your region and help maintain your anonymity around the web. There are plenty of apps that offer VPN services for free and as a paid service, but which of them are worth your time?

    I tested six of the most popular VPN all-in-one apps (with Speedtest and the speedof.me HTML5 test) on Android to see how they stack up. You can also go your own way and use Android’s built-in VPN tool. With a few tweaks, you can make it a little easier to use, too.

    Why use a VPN?

    A VPN (Virtual Private Network) is basically a way to funnel all your web traffic through a remote server. This makes it look like you’re in a different location and obscures your real IP address. VPNs encrypt the traffic passing through them, making it harder for anyone else to listen in on your connection, even if you connect to an unsecured Wi-Fi network.

    To read this article in full or to leave a comment, please click here



    click to view

| Date published: Mon, 24 Apr 2017 16:49:25 -0700
Back to newsfeed list
Translate to: {GOOGLETRANS}
Google Ads




Headlines

»CVE-2007-6761
drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize videobu ...
»CVE-2010-1776
Find My iPhone on iOS 2.0 through 3.1.3 for iPhone 3G and later and iOS 2.1 through 3.1.3 for iPod t ...
»CVE-2010-5321
Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6 ...
»CVE-2010-5329
The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 re ...
»CVE-2011-3428
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary c ...
»CVE-2011-3438
WebKit, as used in Safari 5.0.6, allows remote attackers to cause a denial of service (process crash ...
»CVE-2013-7463
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and ...
»CVE-2014-9654
The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014- ...
»CVE-2014-9680
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo fi ...
»CVE-2014-9907 (imagemagick)
coders/dds.c in ImageMagick allows remote attackers to cause a denial of service via a crafted DDS f ...
»CVE-2015-0104
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration ...
»CVE-2015-0107
IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration ...
»CVE-2015-1521
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet ...
»CVE-2015-1522
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a pack ...
»CVE-2015-7245
Directory traversal vulnerability in DLink DVGN5402SP with firmware W1000CN00, W1000CN03, or W2000EN00 allows remote attackers to read sensitive information via a .. (dot dot) in the errorpage parameter.


Date published: 2017-04-25T00:00:01Z
Details

»Drupal Releases Security Updates
Original release date: April 19, 2017 Drupal has released an advisory to address a vulnerabil ...
»Cisco Releases Security Updates
Original release date: April 19, 2017 Cisco has released updates to address several high-impa ...
»Mozilla Releases Security Updates
Original release date: April 19, 2017 Mozilla has released security updates to address a vuln ...
»Google Releases Security Updates for Chrome
Original release date: April 19, 2017 Google has released Chrome version 58.0.3029.81 for Win ...
»VMware Releases Security Updates
Original release date: April 18, 2017 VMware has released security updates to address vulnera ...
»Oracle Releases Security Bulletin
Original release date: April 18, 2017 Oracle has released its Critical Patch Update for April ...
»Microsoft Addresses Shadow Brokers Exploits
Original release date: April 15, 2017 | Last revised: April 17, 2017 The Microsoft Security R ...
»VMware Releases Security Updates
Original release date: April 14, 2017 VMware has released security updates to address a vulne ...
»ISC Releases Security Updates for BIND
Original release date: April 12, 2017 The Internet Systems Consortium (ISC) has released upda ...
»Apache Software Foundation Releases Security Updates
Original release date: April 12, 2017 | Last revised: April 18, 2017 The Apache Foundation ha ...


Date published: not known
Details

»VB2016 paper: Debugging and monitoring malware network activities with Haka
In their VB2016 paper, Stormshield researchers Benoît Ancel and Meh ...
»VB2017: a wide ranging and international conference programme
We are proud to announce a very broad and very international progra ...
»John Graham-Cumming and Brian Honan to deliver keynote addresses at VB2017
Virus Bulletin is excited to announce John-Graham Cumming and Brian ...
»Virus Bulletin says a fond farewell to John Hawes
As VB's COO John Hawes moves on to new challenges, the team wish hi ...
»VB2016 paper: One-Click Fileless Infection
Symantec researchers Himanshu Anand and Chastine Menrige explain ho ...
»Mostly blocked, but still good enough: Necurs sending pump-and-dump spam
The Necurs botnet has started sending pump-and-dump spam. Almost al ...
»Why the SHA-1 collision means you should stop using the algorithm
Realistically speaking, if your software or system uses the SHA-1 h ...
»VB2017 Call for Papers: frequently asked questions
The call for papers for VB2017, which takes place 4 to 6 October i ...
»Throwback Thursday: Michelangelo - Graffiti Not Art
This week marked the 25th anniversary of the trigger date of the in ...


Date published: not known
Details
Main Menu
· Home
Current Security News
 
US-CERT Current Activity

» Drupal Releases Security Updates
[19 Apr 2017 06:17pm]

» Cisco Releases Security Updates
[19 Apr 2017 06:14pm]

» Mozilla Releases Security Updates
[19 Apr 2017 06:04pm]

» Google Releases Security Updates for Chrome
[19 Apr 2017 06:02pm]

» VMware Releases Security Updates
[18 Apr 2017 02:34pm]

» Oracle Releases Security Bulletin
[18 Apr 2017 02:30pm]

» Microsoft Addresses Shadow Brokers Exploits
[15 Apr 2017 07:09pm]

» VMware Releases Security Updates
[14 Apr 2017 04:13pm]

» ISC Releases Security Updates for BIND
[12 Apr 2017 08:19pm]

» Apache Software Foundation Releases Security Updates
[12 Apr 2017 12:11pm]

***
US-CERT Alerts

» TA17-075A: HTTPS Interception Weakens TLS Security
[16 Mar 2017 06:40am]

» TA16-336A: Avalanche (crimeware-as-a-service infrastructure)
[30 Nov 2016 10:00pm]

» TA16-288A: Heightened DDoS Threat Posed by Mirai and Other Botnets
[14 Oct 2016 05:59pm]

» TA16-250A: The Increasing Threat to Network Infrastructure Devices and Recommended Mitigations
[06 Sep 2016 04:29pm]

» TA16-187A: Symantec and Norton Security Products Contain Critical Vulnerabilities
[05 Jul 2016 08:50am]

» TA16-144A: WPAD Name Collision Vulnerability
[23 May 2016 05:38am]

» TA16-132A: Exploitation of SAP Business Applications
[11 May 2016 05:31am]

» TA16-105A: Apple Ends Support for QuickTime for Windows; New Vulnerabilities Announced
[14 Apr 2016 01:48pm]

» TA16-091A: Ransomware and Recent Variants
[31 Mar 2016 04:00pm]

» TA15-337A: Dorkbot
[03 Dec 2015 04:40pm]

***
Computerworld Security

» Customers roast Microsoft over security bulletins' demise
[24 Apr 2017 12:49pm]

» Researchers remotely kill the engine of a moving car by hacking vulnerable car dongle
[24 Apr 2017 10:54am]

» Russian man receives longest-ever prison sentence in the U.S. for hacking
[24 Apr 2017 09:17am]

» FAQ: What is blockchain and how can it help business?
[24 Apr 2017 04:01am]

» There's now a tool to test for NSA spyware
[22 Apr 2017 05:43am]

» Hackers use old Stuxnet-related bug to carry out attacks
[20 Apr 2017 02:57pm]

» Developer lifts Windows 7's update blockade with unsanctioned patch
[20 Apr 2017 02:28pm]

» DHS's ICS-CERT warns of BrickerBot: IoT malware that will brick vulnerable devices
[19 Apr 2017 09:21am]

» Experts contend Microsoft canceled Feb. updates to patch NSA exploits
[18 Apr 2017 02:06pm]

» How one personal cyber insurance policy stacks up
[18 Apr 2017 05:00am]

» IDG Contributor Network: Most of the Windows zero-day exploits have already been patched
[17 Apr 2017 01:46pm]

» Microsoft confirms it's patched most of the NSA's Windows exploits
[17 Apr 2017 01:05pm]

» 1,175 hotels listed in payment card breach of Holiday Inn parent company
[17 Apr 2017 11:11am]

» Profiling 10 types of hackers
[17 Apr 2017 05:00am]

» An introduction to six types of VPN software
[15 Apr 2017 04:44pm]

***
Microsoft Security Advisories

» 3123479 - SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[14 Mar 2017 11:00am]

» 4010983 - Vulnerability in ASP.NET Core MVC 1.1.0 Could Allow Denial of Service - Version: 1.0
[27 Jan 2017 11:00am]

» 3214296 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege - Version: 1.0
[10 Jan 2017 11:00am]

» 3181759 - Vulnerabilities in ASP.NET Core View Components Could Allow Elevation of Privilege - Version: 1.0
[13 Sep 2016 11:00am]

» 3174644 - Updated Support for Diffie-Hellman Key Exchange - Version: 1.0
[13 Sep 2016 11:00am]

» 3179528 - Update for Kernel Mode Blacklist - Version: 1.0
[09 Aug 2016 11:00am]

» 2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0
[18 May 2016 11:00am]

» 3155527 - Update to Cipher Suites for FalseStart - Version: 1.0
[10 May 2016 11:00am]

» 3152550 - Update to Improve Wireless Mouse Input Filtering - Version: 1.1
[22 Apr 2016 11:00am]

» 3137909 - Vulnerabilities in ASP.NET Templates Could Allow Tampering - Version: 1.1
[10 Feb 2016 11:00am]

» 2871997 - Update to Improve Credentials Protection and Management - Version: 5.0
[09 Feb 2016 11:00am]

» 3118753 - Updates for ActiveX Kill Bits 3118753 - Version: 1.0
[12 Jan 2016 11:00am]

» 3109853 - Update to Improve TLS Session Resumption Interoperability - Version: 1.0
[12 Jan 2016 11:00am]

» 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge - Version: 53.0
[05 Jan 2016 11:00am]

» 3057154 - Update to Harden Use of DES Encryption - Version: 1.1
[08 Dec 2015 11:00am]

***


***
Network World Security

» Customers roast Microsoft over security bulletins' demise
[24 Apr 2017 03:57pm]

» 7 patch management practices guaranteed to help protect your data
[24 Apr 2017 02:59pm]

» More Windows PCs infected with NSA backdoor DoublePulsar
[24 Apr 2017 08:50am]

» Bring Your Own Authentication is upending online security practices
[24 Apr 2017 08:37am]

» Fight firewall sprawl with AlgoSec, Tufin, Skybox suites
[10 Apr 2017 04:32am]

» Review: Canary Flex security camera lives up to its name
[24 Mar 2017 07:01am]

» Smackdown: Office 365 vs. G Suite management
[16 Mar 2017 07:01am]

» Zix wins 5-vendor email encryption shootout
[13 Mar 2017 04:00am]

» Review: vArmour flips security on its head
[06 Mar 2017 03:50am]

» 5 open source security tools too good to ignore
[21 Feb 2017 07:12am]

» Review: Samsung SmartCam PT network camera
[15 Feb 2017 07:00am]

» Review: Arlo Pro cameras offer true flexibility for home security
[09 Feb 2017 07:01am]

» Face-off: Oracle vs. CA for identity management
[26 Jan 2017 10:30am]

» 7 patch management practices guaranteed to help protect your data
[24 Apr 2017 02:59pm]

» More Windows PCs infected with NSA backdoor DoublePulsar
[24 Apr 2017 08:50am]

***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Welcome
Username:

Password:




Remember me

[ ]

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}