US security agency scrutinises secure storage device

Posted on by admini

The TPM is commonly used in enterprise workstations and laptop computers to enable security features and securely store encryption keys. Apple also uses the chip to limit the OS X operating system to Mac hardware, preventing consumers from running it on generic x86 computers.

Privacy advocates have criticised the chips because they could potentially be used to enforce digital rights management technology and prevent users from accessing certain applications or services.

http://www.vnunet.com/2153898

Read more

Man still the weakest link

Posted on by admini

CompTIA also noted that in the last several years, organizations have equipped themselves with sophisticated security infrastructure that better detect and prevent attacks.

The study found that 96 percent of respondents use antivirus software while 91 percent have firewalls and proxy servers, in addition to disaster recovery plans, intrusion detection systems and information security policies.

http://www.zdnetasia.com/news/security/0,39044215,39350700,00.htm

Read more

FDIC – Delivery of Special Alerts – Electronic Distribution to Become Primary Method

Posted on by admini

To guarantee that the SA notification e-mails are received, institutions should ensure that their network spam filters are set to accept all e-mails from fdic.gov.

Institutions without Internet access may request to continue receiving SAs through the mail by completing the attached paper-delivery request form and faxing it to the FDIC at (703) 465-4314. The FDIC also offers electronic distribution of SAs through its online subscription service. Since this service is not secure, confidential SA attachments of fraudulent and genuine instruments are not included.

To decrease the number of unnecessary e-mails, institution users of this on-line subscription service may wish to discontinue receiving SAs through this mechanism.

http://www.bankinfosecurity.com/regulations.php?reg_id=220&PHPSESSID=0c468c65f2007d6227f7a3a2c3db0faf

Read more

VoIP maybe not so secure?

Posted on by admini

They can be eavesdropped on by the people or organizations that own those computers, and they can be eavesdropped on by anyone who has successfully hacked into those computers. Do you want your competitors in on your conference calls?

Ultimately, Schneier concludes that the solution is twofold: encrypted VoIP and secure computers at the endpoints.

My first reaction to Schneier’s conclusions was, “We all want more secure operating systems, and for more than just VoIP.” My second reaction, though, is that the inherent insecurities of VoIP will eventually be addressed by the market once there’s enough demand.

http://arstechnica.com/news.ars/post/20060407-6552.html

Read more

The Web Hacking Incidents Database

Posted on by admini

The web hacking incident database (WHID) is a Web Application Security Consortium project dedicated to maintaining a list of web applications related security incidents. WHID goal is to serve as a tool for raising awareness of the web application security problem and provide the information for statistical analysis of web…

Read more

Web services pose growing security risk

Posted on by admini

During his talk, he described an attack where a user could enter malicious code in a Web form and then get that code to run by calling up the company’s customer service number and tricking a representative into inadvertently executing it. Stamos also showed how Web services requests could be used to conduct denial of service attacks, either by creating malicious XML queries that used massive amounts of memory or by bombarding databases applications with more requests than they can handle.

This trend is of particular concern to smaller companies that may not have the budgets to fully test the security of their software.

http://www.infoworld.com/article/06/04/07/77230_HNwebservicesrisks_1.html

Read more