A Security Checklist for Deploying Software-as-a-Service

Posted on by admini

When you convert to SaaS, your data will be transported across the Internet to the SaaS vendor site. If their application is not secure, your critical business information will potentially be exposed to anyone who can take advantage of such a vulnerability.

– Review the vendor’s service history
– Application and infrastructure security requirements
– Solid Service Level Agreements
– No silent fixing
– Data recovery
– Encryption standards and key management
– No weak links in the security access chain
– Ownership

Finally, you need to remember that software is secure only when it’s built that way, so when choosing a sound SaaS solution, be sure that the security has been checked for all vulnerabilities so that it’s secure for all of today’s distributed software portfolios.

http://www.ctoedge.com/content/security-checklist-deploying-software-service

Read more

Senate Committee OKs Cybersecurity Act

Posted on by admini

Olympia Snowe (R-Maine), was introduced last April and then re-introduced last week with some key changes. Notably, it no longer gives the president unilateral power to disconnect networks from the Internet in the event of a major cyberattack. The bill also includes amendments for how the president and private sector can work together to help secure critical infrastructure.

During the hearing, senators expressed how important it is that the Senate passes the legislation quickly, as it’s long overdue. “The government hasn’t gotten its act together; the private sector has had problems getting its act together,” he said. Bill Nelson (D-Florida) said that might even be too much time in light of potential cyber threats.

The House last month passed its own cybersecurity bill, the Cybersecurity Enhancement Act of 2009 (HR 4061), first introduced by Rep. Daniel Lipinski (D-IL) last year.

http://www.darkreading.com/security/government/showArticle.jhtml?articleID=224200245&cid=RSSfeed

Read more

Forensics for GPS Unit

Posted on by admini

Cross Product
Blackthorn2
For forensics acquisition, examination and analysis platform for various platforms including Garmin, TomTom, and Magellan:
I like this product since it provides forensic quality data (including hashes).
Pricing: Being requested.

Device Seizure
• GPS Waypoints, Tracks, Routes…
Price: USD 199 per license

TomTom Specific

TomTology
Decoding of live data providing:
  Home Location
  Favourites
  Recent Destinations
  Last Journey Start and End Point (where available)
  Stored Phonebook
  Called Phone Numbers
  Received Phone Numbers
  Sent SMS Messages
  Received SMS Messages
  Location where TomTom was turned off

• Retrieving of deleted journeys from unallocated space proving same details as above for all recovered.

• Locating deleted phone numbers

• Locating deleted SMS Messages

Price: USD 250 per license

XACT
Retrieves location data.

Pricing: Being requested.

Not tools but useful pages of info:
Tom Tom GPS Forensics
Pinpointing TomTom location records: A forensic analysis

Read more

Database Security Lacking at Financial Services Firms

Posted on by admini

“One of the most important things a company can do to assure their future success is to plug the holes in their security policies that were demonstrated in this study,” Larry Ponemon, head of the Ponemon Institute, said in a statement.

For instance, the survey of top security officials at 80 large financial firms found that 83 percent use real data, such as credit card or account numbers, when developing and testing applications.

For instance, 88 percent of the companies surveyed said they still use Social Security numbers as their primary identifier.

http://www.esecurityplanet.com/features/article.php/3868381/Database-Security-Lacking-at-Financial-Services-Firms.htm

Read more

Symantec Chief Says Cloud Security the Next Step

Posted on by admini

Cyber attacks are shifting from being broad-based to being very targeted, Salem said.

Symantec’s 2010 State of Enterprise Security survey spoke with 2,100 CIOs and IT/security executives, and found 75 percent had been attacked in the last six months — and all of those had suffered some kind of data loss; it may have been intellectual property, financial or credit card data or the personal information of a customer.

Salem said that in 2008, Symantec added 1.6 million signatures to its antimalware software, more than it had in the prior 16 years combined.

Instead of efforts, such as signature-based malware detection, he talked up the concept of reputation-based security, an approach that leverages the knowledge of users around the world. Since adding reputation-based security to Norton 2009, Symantec has collected one billion reputation ratings and taken 177 billion reputation queries in the last six months.

http://www.esecurityplanet.com/features/article.php/3868161/Symantec-Chief-Says-Cloud-Security-the-Next-Step.htm

Read more

Crackdown on Mariposa: Botnet Infected 13 Million PCs

Posted on by admini

Though security experts described the hacking trio as “relatively unskilled cyber criminals,” they managed to use Mariposa — the Spanish word for butterfly — to steal account login information for social media sites, online e-mail services, user names and passwords to banking accounts and credit card data by infiltrating more than 12.7 million compromised personal, corporate and government IP addresses in more than 190 countries.

Email Article Print Article Comment on this article Share Articles Digg del.icio.us Newsvine Facebook Google LinkedIn MySpace Reddit Slashdot StumbleUpon Technorati Twitter Windows Live YahooBuzz FriendFeed “Our preliminary analysis indicates that the botmasters did not have advanced hacking skills,” Pedro Bustamante, Panda Security’s senior research advisor, said in a blog posting detailing the attacks and subsequent investigation.

Related Articles Database Security Lacking at Financial Services Firms McAfee Fingers Microsoft IE Flaw in Google Attack Kneber Botnet Pierces 2,500 Organizations McAfee Finds Spike In Malware From China Investigators said the hackers attacked vulnerabilities in Microsoft’s Internet Explorer browser software to infect machines with the Mariposa bot client.

http://www.esecurityplanet.com/features/article.php/3868436/Crackdown-on-Mariposa-Botnet-Infected-13-Million-PCs.htm

Read more