RSA combines SIEM with incident visibility to create Security Analytics

Posted on by admini

With this you get full security visibility of data for log and packet and it gives the user more intelligence and if something is known, if it has been seen before.”

Jon Oltsik, senior principal analyst at Enterprise Strategy Group, said: “The sophistication of advanced attacks and the associated malware is growing every day testing the limitations of existing security analytics tools.”

Marrying intelligence-driven security with Big Data analytics has the potential to help enterprises address the complex problem of advanced threats and thus meet a significant need in the marketplace.”

Link: http://www.scmagazineuk.com/rsa-combines-siem-with-incident-visibility-to-create-security-analytics/article/278162/

Read more

Five eyes push to declassify security vulnerability data – Networks – SC Magazine Australia – Secure

Posted on by admini

Schmidt flagged the need to declassify data during his years at the White House and said progress had been made prior to his resignation from the job in May last year. For Schmidt, the suppression of information denies organisations the ability to defend themselves from attack, noting that it can take months for information to be declassified.

From the time the FBI was notified, DHS (Department of Homeland Security) and the Department of Defense all responded [but] it took 102 days from the time it was reported to the time they went out to industry members. If the declassification effort fails — and it is thought to have stalled amid the recent US Congress reshuffle — then Schmidt said the private sector should take charge and share vulnerability and threat data.

In recent years, security researchers have discovered and extensively detailed malware thought to have been developed by nation-states to launch attacks and conduct espionage against foreign interests.

Schmidt said it is also reckless because such attacks can cause collateral damage against critical private infrastructure, and the malware can be reverse-engineered and re-appropriated for further attacks.

Link: http://www.scmagazine.com.au/News/330685,five-eyes-push-to-declassify-security-vulnerability-data.aspx?utm_source=feed&utm_medium=rss&utm_campaign=SC+Magazine+News+feed

Read more

Cisco has 14k BYOD iPads, says Android malware is not a big threat – BYOD, android malware, cisco, i

Posted on by admini

In 2012, Cisco added 11,000 smartphones and tablets companywide and has nearing an equal ratio of mobile devices to staff. “At the end of 2012, there were nearly 60,000 smartphones and tablets in use in the organisation—including just under 14,000 iPads—and all of them were Bring Your Own (BYO).” Cisco execs have been giving regular updates about its BYOD program in recent times, no doubt because it sells UTM appliances, identity management and other services against the trend.

SAP/Sybase blogger Eric Lai, who has been tracking large iPad deployments, noted from a conference in early May last year that Cisco had 21,000 iPhones, 8,144 iPads and 2,000 Cius tablets (it killed the device later that month). Outside a 5,000 device BYOD program, SAP offers staff a range of 10 smart devices and under that program manages 20,000 iPads, 20,000 iPhones, 4,000 Samsung Android devices, and a smaller number of BlackBerry and Windows Phone devices.

Link: http://www.cso.com.au/article/452398/cisco_has_14k_byod_ipads_says_android_malware_big_threat/

Read more

Governance Must Drive All Security Initiatives… Even Cloud

Posted on by admini

It is up to the CIO or CSO’s due diligence to understand all the implications on how the deployment will affect the holistic enterprise.

“When cloud computing is treated as a governance initiative, with broad stakeholder engagement and well-planned risk management activities, it can bring tremendous value to an enterprise,” said Emil D’Angelo, CISA, CISM, international president of ISACA and founding member of the Cloud Security Alliance.

When due diligence is done, a CIO will have a clear idea of an initiative’s risk versus return and whether a cloud security deployment meets the individual requirements of the company.

For example, seeing who has accessed a certain application gives you historical perspective, but, what if it is a retired account or tries using a decommissioned password? … Or if a partner accesses certain parts of your database to which they are entitled, but quadruples their order in the dead of night to be shipped to Phnom Penh? … There are literally thousands of scenarios by which leveraging the cooperative functionality of IDM, AM, SIEM and Log Management creates not only the holistic visibility to drive governance policies, but offers significant barriers to keep the IT enterprise safer.

The challenge facing most security teams, therefore, is to provide line-of-business users with the access they need while ensuring that the access is appropriate and does not expose the enterprise to unnecessary business risk. But first you must ensure visibility–and when you know where all your data is and all the multiple ways that it is available, then you can best manage the policies, roles, and security functions that best connects your requirements.

Link: http://cloudcomputing.sys-con.com/node/2527026

Read more

Cross-site scripting attacks up 160%

Posted on by admini

Hackers will rapidly go after these high value targets with attacks that are highly automated and, if they are not yielding useful payloads, the attackers are equipped to quickly try a different type of attack. This is why it is important to have an understanding of the kind of traffic that is accessing your hosted infrastructure, so that you can make sure that malicious traffic is diverted and that there is less risk to sensitive data,” he added.

Throughout the whole year, FireHost has blocked over 64 million malicious cyberattacks of all types, with Cross-Site Scripting being the most prolific Superfecta attack type overall, clocking in at 5.4 million blocked attacks.

As in Q3 2012, Europe is still the second most likely origin point for malicious traffic blocked by FireHost after North America, being the source of 13 percent of attacks.

The risks to businesses from the Superfecta varies and depends upon the kind of data that could be stolen in the event of a successful attack, according to Todd Gleason, Director of Technology at FireHost, “Itʼs fairly obvious that, if you are retailer or service provider dealing with private customer data or payment card details, your business will present an attractive target for hackers.

Link: http://www.net-security.org/secworld.php?id=14320

Read more

Report: DDoS attacks harder to detect and defeat

Posted on by admini

DDoS first reared its ugly head in the late 1990s and early 2000s as simple, financially-motivated, brute force attacks in which hackers would attempt to overwhelm network and data center operators with external communication requests, causing system overloads and crashes. Over the years, DDoS attacks have grown in sophistication and efficiency, moving from heavy-handed hardware overloads to application-layer attacks that could look like legitimate network traffic, making it much more difficult to detect and defeat the threat.

“What we’ve seen with the most recent attacks is that it isn’t about how big the attack is – because they weren’t the biggest attacks – it’s about how smart they are,” Moynahan said.

Adding to the challenge is the proliferation of “bring-your-own-device” (BYOD) business models in which companies encourage their employees to use their own smart phones, tablets, and other devices for work, giving hackers more entry points into networks.

To meet the new threats head on, Arbor is going beyond the conventional and increasingly outmoded method of using firewalls and other basic network protection methods that can eventually require too much bandwidth and infrastructure, compromising network availability. To provide its clients with end-to-end traffic visibility to monitor the DDoS threat landscape and minimize risk, Arbor employs a number of solutions, including a new cloud-based active threat level analysis system called ATLAS — a collaborative project in which Arbor clients share anonymous traffic data totaling almost 40 terabytes per second to spot malware and botnet threats across the Internet.

Link: http://www.bizjournals.com/boston/blog/techflash/2013/01/report-ddos-attacks-harder-to-detect.html?ana=RSS&s=article_search&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+bizj_boston+%28Boston+Business+Journal%29&page=all

Read more