Category: News

To measure a company’s ability to deal with security incidents, the group suggested that companies measure the mean time between security incidents and the mean time to recover from security incidents.

As an indicator of a company’s network security readiness, companies should measure the fraction of systems configured to approved standards, the fraction of systems patched as per corporate policy, and the fraction of systems with antivirus software, CIS stated.

Finally, companies should review their software applications for potential security issues by measuring the fraction of business applications that have had a risk assessment, the fraction with a penetration or vulnerability assessment and the fraction of application code that had a threat-model analysis or security code review prior to deployment.

http://www.securityfocus.com/brief/814?ref=rss

Some major hosts have no TTLs or very low TTLs and, for those servers, you gain very little, he said.

“If we can’t override them — can’t override high TTLs — those sites go down for a very long time,” Kaminsky said.

“I never claimed my one-character patch would fix all bugs in bind (sic) — I don’t have that kind of power,” Somlo joked on the mailing list.

http://www.securityfocus.com/brief/808

The technology, known as DNSSEC, promises to secure the domain name system (DNS) against attempts to subvert the infrastructure, such as the cache poisoning attack found by researcher Dan Kaminsky earlier this year.

Because of the technical hurdles — and the political problems in designating companies or governments to hold the keys to the domain-name system — both governments and private sector companies have held off deploying DNSSEC for more than a decade.

The OMB has set a deadline for initial implementation plans of September 5, with mutually agreed on final plans completed by October 24, 2008.

http://www.securityfocus.com/brief/807

“If you look at log files or system events to understand what is going on in your machines or in your network, a lot of people look at their textual logs.” The goal is to take network traffic, intrusion defense system and firewall data and begin visualizing pieces of it to create an overall picture of the company’s security posture. When you start developing the appropriate chart or graph to better flesh out the data, you can begin to see patterns and sometimes certain pieces of information stand out, Marty said.

Firewall log files would be useless with little domain expertise on staff to help generate graphs.

Marty has released a Linux CD called Data Analysis and Visualization Linux (DAVIX).

“With firewall log files, you don’t need to know what specific IP address is connecting to me from the outside,” Marty said. “You can cluster it to get a general idea of what happened and then if you want to drill down you can open up that cluster.” For example, a chart or graph could help visualize violations per Payment Card Industry Data Security Standard (PCI DSS) requirement, helping companies determine where they fall short of the standard. It can be used to audit large database management systems, such as Oracle and Microsoft’s SQL-Server to figure out who accessed a particular table, and whether the database table was altered.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1327341,00.html

ScanSafe detected 34 percent more malware last month than it did in all of 2007, according to the report.

Meanwhile, WhiteHat’s report had some good news: For the first time, most of its customers had fixed Website vulnerabilities that had been spotted — 66 percent of vulnerabilities on those sites had been remediated, according to the report.

There’s an average of five open vulnerabilities in each Website.

Meanwhile, WhiteHat’s top 10 Website vulnerabilities list now officially includes the potentially lethal cross-site request forgery (CSRF), which Grossman and his team long have been predicting would become an attractive method for attackers. The list — which rates Web vulnerabilities by their likelihood of being in a Website — has XSS still holding at No. 1 (67 percent), followed by information leakage (41 percent), content spoofing (21 percent), insufficient authorization (18 percent), SQL injection (17 percent), predictable source location (16 percent), insufficient authentication (12 percent), HTTP response splitting (9 percent), abuse of functionality (8 percent), and CSRF (8 percent).

http://www.darkreading.com/document.asp?doc_id=162515&f_src=darkreading_section_296

Frethog is just a drop in the ocean of malware we’re seeing coming out of China nowadays, many of which are targeting online games. Frethog had proved to be as prevalent as we expected too, with detections on over 200,000 distinct machines.

I know that it is in Microsoft’s interests to carry out Windows Genuine Advantage checks for some downloads to make sure they are not going to pirates, but I think that a periodic scan with the MSRT would be far more beneficial to the wider computing community.

There are a lot of people out there who don’t have the first clue about how to keep their PCs safe, and only some of these people are going to be regularly downloading patches, so it would be good for Microsoft to come up with ways that exposes a greater number of systems to the MSRT.

http://blogs.zdnet.com/hardware/?p=2122