Month: August 2008

Some major hosts have no TTLs or very low TTLs and, for those servers, you gain very little, he said.

“If we can’t override them — can’t override high TTLs — those sites go down for a very long time,” Kaminsky said.

“I never claimed my one-character patch would fix all bugs in bind (sic) — I don’t have that kind of power,” Somlo joked on the mailing list.

http://www.securityfocus.com/brief/808

“If you look at log files or system events to understand what is going on in your machines or in your network, a lot of people look at their textual logs.” The goal is to take network traffic, intrusion defense system and firewall data and begin visualizing pieces of it to create an overall picture of the company’s security posture. When you start developing the appropriate chart or graph to better flesh out the data, you can begin to see patterns and sometimes certain pieces of information stand out, Marty said.

Firewall log files would be useless with little domain expertise on staff to help generate graphs.

Marty has released a Linux CD called Data Analysis and Visualization Linux (DAVIX).

“With firewall log files, you don’t need to know what specific IP address is connecting to me from the outside,” Marty said. “You can cluster it to get a general idea of what happened and then if you want to drill down you can open up that cluster.” For example, a chart or graph could help visualize violations per Payment Card Industry Data Security Standard (PCI DSS) requirement, helping companies determine where they fall short of the standard. It can be used to audit large database management systems, such as Oracle and Microsoft’s SQL-Server to figure out who accessed a particular table, and whether the database table was altered.

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1327341,00.html

The technology, known as DNSSEC, promises to secure the domain name system (DNS) against attempts to subvert the infrastructure, such as the cache poisoning attack found by researcher Dan Kaminsky earlier this year.

Because of the technical hurdles — and the political problems in designating companies or governments to hold the keys to the domain-name system — both governments and private sector companies have held off deploying DNSSEC for more than a decade.

The OMB has set a deadline for initial implementation plans of September 5, with mutually agreed on final plans completed by October 24, 2008.

http://www.securityfocus.com/brief/807