Category: Statistics

Abramson said it hasn’t been unusual for him to stumble across views of sensitive data while fulfilling consulting contracts. More and more, companies are pulling their production data forward into unsecure areas where business partners, outside contractors, consultants, or even customers can see it.

Encryption features generally may be applied to database tables as data is stored in them, and Secure Backup guarantees that only encrypted data flows out to the backup tapes. “If used fully, these measures reduce serious risks,” said Abramson, but he also acknowledged that Oracle alone can’t cover all areas of security exposure.

Both Oracle and several third parties are making products available that monitor database activity, watching for suspicious activity and alerting managers when someone seems to be attempting unauthorized activity.

http://www.informationweek.com/news/security/app_security/showArticle.jhtml;jsessionid=NHV10EELD1SC4QSNDLPSKH0CJUNN2JVN?articleID=210602800

Shoer called health-care costs one of the largest issues facing the U.S. Rising health-care costs have become a worker-recruiting issue, added Shiv Kumar, executive vice president at ZSL, a VAR in Edison, New Jersey. Considering our business size, we can’t attract or retain good workforce without offering a good benefits package which could be offered easily by large organizations because of their size,” he said.

In focus groups in late 2007 and early this year, health-care costs came up several times as a top concerns of VAR members of CompTIA, said Michael Wendy, a CompTIA spokesman.

While Shoer and Kumar focused on health-care costs as their top policy concern, they both acknowledged that cybersecurity is a major concern as well. It can be difficult to talk some customers into buying more cybersecurity products or services, they said. “We finally had the client sign off on a document that acknowledged our disapproval of this practice and basically absolved us of any responsibility for any problems resulting from this partner’s unwillingness to conform to the firm’s password policy,” he said.

For most small businesses, cybersecurity comes down to a convenience issue, Shoer added.

IT workers need training in technologies such as Web 2.0, unified communication and virtualization, Kumar said.

http://www.pcworld.com/article/150658/.html?tk=rss_news

Shadowserver figures suggest the number of command and control servers has actually decreased over the last month, following a spike in activity back in July.

Not much by way of email malware activity has been monitored, so if the latter explanation is true, then drive-by download attacks are playing a bigger role in spreading botnet client infestation.

http://www.theregister.co.uk/2008/09/02/zombie_surge/

The target information included CEO passwords, customer database, research and development plans, financial reports, M&A plans and the company’s list of privileged passwords.

Identity management firm Cyber-Ark conducted the survey of 300 IT professionals in its annual review ‘Trust, Security & Passwords’.

The survey also found that one third of IT staff admitted to snooping around the network, looking at highly confidential information, such as salary details and people’s personal emails.

http://www.computerworlduk.com/management/security/cybercrime/news/index.cfm?newsid=10734

While the company reported that overall vulnerability counts have started to decline, the most common vulnerabilities listed in the report will seem familiar to those who follow Web security.

A new entry to the top 10 was cross-site request forgery, which allows an attacker to force a victim’s browser to make an authorized Web request.

WhiteHat CTO Jeremiah Grossman also recommended that developers practice input validation and output filtering properly.

http://www.eweek.com/c/a/Security/WhiteHat-Report-Finds-Web-Site-Security-Vulnerabilities-Persist/?kc=rss

— Vulnerabilities affecting Web server applications are climbing and so are the attacks, both evidenced by newcomers to the most vulnerable vendor list and this year’s automated SQL injection attacks.

— Although standard Web browsers are becoming more secure, attackers continue to rely on automated toolkits, obfuscation, and the prevalence of unpatched browsers and plug-ins to successfully gain hold of new endpoint victims.

— In the first half of 2008, 94 percent of public exploits affecting Web browserrelated vulnerabilities were released on the same day as the disclosure.

· Independent researchers are almost twice as likely to have exploit code published on the same day as their vulnerability disclosure in comparison to research organizations.

· Although virtual machine breakout vulnerabilities tend to get a lot of attention from the press, they are rare and predominantly target x86 platforms and Type II (virtualization solutions that require a host operating system).

· “Complex” spam (spam that uses images, PDFs, or complex text/HTML) is on the decline and a simpler type of spam is taking its place.

· This simpler spam relies on Web links and short text messages inside spam e-mails, which may be more difficult for some antispam technologies to detect.

· For the first half of 2008, a password stealer family that targets online games is in first place on the top ten malware list, and, in the password stealer category, gamerelated malware takes 50 percent of the top ten spots overall.

http://www-935.ibm.com/services/us/iss/xforce/midyearreport/xforce-midyear-report-2008.pdf