admini – Page 79 – CyberSecurity Institute

Group of Security Experts Across Multiple Industries Discuss Practical Ways to Leverage Simulated At

Posted on April 14, 2013December 30, 2021 by admini

“Phishing, and the more targeted and sophisticated spear-phishing, is the weapon of choice for the modern cyber-criminal and is used by the more organized hacker for data and intellectual property theft,” said Perry Carpenter, former security awareness analyst from Gartner who is now working as a security expert in the financial sector. More than anything else, the report shows how simulated attack training can introduce measurement into training — not only is it effective, its effectiveness can be measured and monitored to allow the most cost-efficient training for the highest risk people and topics.

Link: http://mw.newsblaze.com/story/2013040906001900009.mwir/topstory.html

U.S. On Brink Of Major Cyber Attack From Another Nation – Perhaps North Korea

Posted on April 13, 2013December 30, 2021 by admini

Away from the ongoing tensions with North Korea, Lieberman says the threat of nation state attacks on the US is ever-present and could come from a number of other sources. “In my daily interaction with government bodies, police and other public sector authorities, we are seeing a huge rise in attacks which are state sponsored and targeted at the critical national infrastructure.

While more plainly destructive DDoS and malware attacks grab most of the security headlines, Lieberman says the greatest threat currently lies in the covert infiltration of networks, where the perpetrators hop from one machine to another collecting as much data as possible – something the New York Times detected in its system, with the Chinese government suspected of being responsible.

“The point to be made is simple: there is little to no real security found in the commercial tools for anti-virus and anti-malware from the major software providers and the continued purchase of these products is a waste of money and time when the foe is more than a petty criminal.”

Link: http://mitechnews.com/articles.asp?id=15566&sec=24

Wide-scale attack against WordPress blogs reported

Posted on April 12, 2013December 30, 2021 by admini

“As I type these words, there is an on-going and highly-distributed, global attack on WordPress installations across virtually every web host in existence,” HostGator said in a post. “This attack is well organized and again very, very distributed; we have seen over 90,000 IP addresses involved in this attack,” it said.

Link: http://www.computerworld.com/s/article/9238377/Wide_scale_attack_against_WordPress_blogs_reported?source=CTWNLE_nlt_dailyam_2013-04-15

Small Banks: Prepping for DDoS Attacks

Posted on April 12, 2013December 30, 2021 by admini

Small banking institutions have to depend on third parties to keep them abreast of emerging fraud schemes and attack trends, such as DDoS. First Landmark, however, knew from its founding in 2008 that it had to outsource most of its information technology and security management, says Leigh Pharr, the bank’s senior vice president.

“We are very fortunate in that senior management here and our president are very in-tune with DDoS attacks, and we keep all of our employees well-educated on what might happen, what can happen,” Pharr says. “While we do rely on our core processor to provide us with all of the technical, online banking products, we are not satisfied that is all we need to ensure we are secure and that our accounts are protected,” Pharr says. “That’s why we have hired other third party providers [such as CSI] to come in and test our systems – try to break us. “

As the managers of online-banking platforms for the majority of small and mid-tier banking institutions throughout the U.S., core processors have a responsibility to ensure their institution customers are protected and are investing in up-to-date solutions.

Link: http://www.bankinfosecurity.com/blogs/small-banks-prepping-for-ddos-attacks-p-1449?rf=2013-04-11-eb&elq=1a992929888647e29512fd7c7911f434&elqCampaignId=6408

Detection, response key to effective security

Posted on April 11, 2013December 30, 2021 by admini

With corporate security measures becoming increasingly more effective, often the only point of entry to a company’s network for a cyber criminal is via an employee.

“Research found that the negative impact of mobile devices on security was not only the result of the mobility of devices, but because of a number of assumptions IT departments make around the data they carry. In today’s mobile business environment, securing mobile devices has become a priority, but many IT departments neglect to think about the fact that the data carried on these devices isn’t contained as it would be in a centralised office environment. By working with the assumption that this is the same situation as when the data is in the data centre, IT becomes an unwitting accomplice of cyber criminals, according to Kaspersky’s research,” Myburgh points out.

“IDC data also shows that mobility is the number one factor driving new security spending, suggesting that more organisations are taking heed and beefing up security measures beyond their data centre perimeters.”

Link: http://www.itweb.co.za/index.php?option=com_content&view=article&id=63127

Security updates likely to keep admins busy in April

Posted on April 9, 2013December 30, 2021 by admini

According to the Security Bulletin Advance Notification for April 2013, the first critical update is for all versions of Internet Explorer (IE), including the newest IE 10, on Windows 8 and RT. This vulnerability should be at the top of patching priority lists as it allows remote code execution through users visiting a compromised website, which is of the most popular attack methods, said Wolfgang Kandek, chief technology officer at security firm Qualys.

Andrew Storms, director of security operations at nCircle, said it is almost certain that this month’s IE patch fixes the Pwn2Own bug from CanSec West.

The second Microsoft security update is aimed at a “critical” vulnerability that affects the Windows Operating System, except the newest versions – Windows 8, Server 2012 and Windows RT for tablets. “The vulnerabilities addressed in these bulletins typically allow the attacker an escalation of privilege from a normal user to an admin-level user once they are already on the machine or can trick the user to open a specifically crafted file,” said Kandek.

Ziv Mador, director of security research at Trustwave, said it would be interesting to find out how the vulnerability in Windows Defender was discovered and disclosed.

There is also an out-of-cycle update for Java from Oracle this month.

Link: http://www.computerweekly.com/news/2240181030/Security-updates-likely-to-keep-admins-busy-this-month?utm_medium=EM&asrc=EM_ERU_21243939&utm_campaign=20130408_ERU%20Transmission%20for%2004/08/2013%20(UserUniverse:%20626713)_myka-reports@techtarget.com&utm_source=ERU&src=5119914