admini – Page 125 – CyberSecurity Institute

Database Security Suffers From Leadership Gap

Posted on April 2, 2010December 30, 2021 by admini

“We asked who owns database security, and what we found is that a lot of companies have multiple people involved,” Oltsik says.

According to ESG, the most common stakeholders listed by survey respondents were security administrators, DBAs, and system administrators. But some organizations could have as many as 10 different individuals or functional groups burdened with responsibility for regulatory compliance when it comes to the sensitive information within their databases.

Approximately nine different corporate roles were listed by at least a quarter of respondents as having a say in database security, including the usual suspects along with auditors, compliance departments, and legal staffers.

Unfortunately, with so many stakeholders responsible for securing valuable database information, Oltsik suspects that too many of them believe someone else is taking care of database security — thus leaving no one at the tiller.

“Instead of investing in hardware or software, I would start with the people first,” says Kornbrust, CEO of Red-Database-Security GmbH, a consultancy that specializes in securing Oracle databases.

This could start by testing out cooperation with the hardening of just a few databases.

http://www.darkreading.com/database_security/security/app-security/showArticle.jhtml?articleID=224201189&cid=RSSfeed

FAA Launches Real-Time Security Pilot With IBM

Posted on March 30, 2010December 30, 2021 by admini

In addition to the FAA’s own cybersecurity efforts, the FAA’s security operations center manages cybersecurity for the rest of the Department of Transporation as well as for parts of the Department of Energy and the Department of Commerce, and Brown expects the amount of cybersecurity information being fed to the FAA’s analysts only to grow with time.

According to IBM, the effort will work by first establishing certain baselines in order to be able to identify anomalous traffic, and then use those baselines to detect the presence of possible attackers in real-time and even to perform predictive analytics to anticipate what hackers who have infiltrated a system might do next in order to cut them off at the pass before they’re able to do real damage.

InfoSphere Streams is able to digest heavy streams of low-level data in multiple formats simultaneously, analyze them with pre-processing, and adjust to tweaks in algorithms and analytical models on the fly.

http://www.darkreading.com/vulnerability_management/security/perimeter/showArticle.jhtml?articleID=224200806&cid=RSSfeed

A Security Checklist for Deploying Software-as-a-Service

Posted on March 26, 2010December 30, 2021 by admini

When you convert to SaaS, your data will be transported across the Internet to the SaaS vendor site. If their application is not secure, your critical business information will potentially be exposed to anyone who can take advantage of such a vulnerability.

– Review the vendor’s service history
– Application and infrastructure security requirements
– Solid Service Level Agreements
– No silent fixing
– Data recovery
– Encryption standards and key management
– No weak links in the security access chain
– Ownership

Finally, you need to remember that software is secure only when it’s built that way, so when choosing a sound SaaS solution, be sure that the security has been checked for all vulnerabilities so that it’s secure for all of today’s distributed software portfolios.

http://www.ctoedge.com/content/security-checklist-deploying-software-service

Senate Committee OKs Cybersecurity Act

Posted on March 24, 2010December 30, 2021 by admini

Olympia Snowe (R-Maine), was introduced last April and then re-introduced last week with some key changes. Notably, it no longer gives the president unilateral power to disconnect networks from the Internet in the event of a major cyberattack. The bill also includes amendments for how the president and private sector can work together to help secure critical infrastructure.

During the hearing, senators expressed how important it is that the Senate passes the legislation quickly, as it’s long overdue. “The government hasn’t gotten its act together; the private sector has had problems getting its act together,” he said. Bill Nelson (D-Florida) said that might even be too much time in light of potential cyber threats.

The House last month passed its own cybersecurity bill, the Cybersecurity Enhancement Act of 2009 (HR 4061), first introduced by Rep. Daniel Lipinski (D-IL) last year.

http://www.darkreading.com/security/government/showArticle.jhtml?articleID=224200245&cid=RSSfeed

Forensics for GPS Unit

Posted on March 17, 2010December 30, 2021 by admini

Cross Product
Blackthorn2
For forensics acquisition, examination and analysis platform for various platforms including Garmin, TomTom, and Magellan:
I like this product since it provides forensic quality data (including hashes).
Pricing: Being requested.

Device Seizure
• GPS Waypoints, Tracks, Routes…
Price: USD 199 per license

TomTom Specific

TomTology
Decoding of live data providing:
Home Location
Favourites
Recent Destinations
Last Journey Start and End Point (where available)
Stored Phonebook
Called Phone Numbers
Received Phone Numbers
Sent SMS Messages
Received SMS Messages
Location where TomTom was turned off

• Retrieving of deleted journeys from unallocated space proving same details as above for all recovered.

• Locating deleted phone numbers

• Locating deleted SMS Messages

Price: USD 250 per license

XACT
Retrieves location data.

Pricing: Being requested.

Not tools but useful pages of info:
Tom Tom GPS Forensics
Pinpointing TomTom location records: A forensic analysis

Database Security Lacking at Financial Services Firms

Posted on March 4, 2010December 30, 2021 by admini

“One of the most important things a company can do to assure their future success is to plug the holes in their security policies that were demonstrated in this study,” Larry Ponemon, head of the Ponemon Institute, said in a statement.

For instance, the survey of top security officials at 80 large financial firms found that 83 percent use real data, such as credit card or account numbers, when developing and testing applications.

For instance, 88 percent of the companies surveyed said they still use Social Security numbers as their primary identifier.

http://www.esecurityplanet.com/features/article.php/3868381/Database-Security-Lacking-at-Financial-Services-Firms.htm