Category: Uncategorized

This article shows which strategies and technologies organizations should adopt to manage them securely.

High data capacity and transfer rates, and broad platform support mean that a Universal Serial Bus (USB) or FireWire (IEEE 1394) device has the capacity to quickly download much valuable corporate information, which can be easily leaked to the outside world. This underlying vulnerability has existed since the release of Microsoft Windows 2000, the first widely deployed operating system able to mount a USB storage device automatically.

Intentionally or unintentionally, users can bypass perimeter defenses like firewalls and antivirus at mailserver, and introduce malware such as Trojan Horses or viruses that, if not discovered, can cause serious damage.

This means there is more risk of legal action if personal information – belonging to corporate clients or employees – ends up in the hands of an unauthorized third party. Companies are at risk of losing intellectual property and other critical corporate data. Portable storage devices are also ideal for anyone intending to steal sensitive and valuable data.

What are company requirements and strategies for deploying these devices in the workplace?
Companies should forbid the use of uncontrolled, privately owned devices with corporate PCs. The prohibition should extend to employees, and external contractors with direct access to corporate networks.

What are the best practices in managing these devices?
– Adopt a suitable security policy on using portable storage devices
– Use tools to help manage port access of USBs and FireWire
– Consider using digital rights management technology as part of a wider protection strategy for proprietary information

http://www.csoonline.com/analyst/report2714.html

With firewalls and patch management now being standard practices, the network perimeter has become increasingly secure. Determined to stay a step ahead, hackers have moved up the software stack, focusing on the Web site itself. According to a Gartner analyst, more than 70 percent of cyberattacks occur at the application layer.
1. “The Web site uses SSL, so it’s secure.”
SSL by itself does not secure a Web site. SSL does not protect the information stored on the site once it arrives.
2. “A firewall protects the Web site, so it’s safe.”
Firewalls allow traffic to pass through to a Web site but lack the ability to protect the site itself from malicious activity.
3. “The vulnerability scanner reported no security issues, so the web site is secure.”
Vulnerability scanners have been used since the early ’90s to point out well-known network security flaws. However, they neglect the security of custom Web applications running on the Web server, which usually remain full of holes. Up-to-date vulnerability scanners now achieve more than 90 percent vulnerability coverage on the average network–but they sparsely target the Web-application layer because there are no well-known security issues present in custom-written Web code.
4. “Web application security is a developer problem.”
Sure, developers are part of the problem, but many factors beyond their control contribute to software security. For example, source code can originate from a variety of locations besides in-house. A company might have code developed by an offshore firm to intermingle with existing code.
5. “Security assessments are performed on the Web site every year, so it’s secure.”
The high rate of change in normal Web-site code rapidly decays the accuracy of even the most recent of security reports. As each new revision of a Web application is developed and pushed, the potential for new security issues increases.

http://www.varbusiness.com/sections/news/breakingnews.jhtml%3Bjsessionid=N241AGHB04JH2QSNDBCSKHY?articleId=22104030

Cerf, who co-created the TCP/IP (Transmission Control Protocol/Internet Protocol) of the Internet and now works as chief corporate strategist for MCI, delivered opening remarks Thursday here at the first inaugural Email Technology Conference. The chief topic of debate at the conference was spam.

Cerf said that standardizing methods for authenticating e-mail senders would ultimately lead to successful filtering–technologies that many companies that attended the conference are developing. “Getting to critical mass with those sorts of mechanisms will be really interesting,” Cerf said to an audience of technology executives attending the two-day conference. “Starting from that angle will be more productive than anything,” he added.

Previously, Cerf had jokingly suggested that the industry hold public floggings of spammers as a deterrent.

Spam has skyrocketed to epic proportions since the first e-mail was sent in 1971. Back then, there were just a few geeks sending e-mail, as Cerf put it in his presentation on the history of the Internet, so there was no one to send unsolicited commercial e-mail. Spam has risen to such heights partly because of a fundamental weakness in the Simple Mail Transfer Protocol, or SMTP, the messaging protocol that has defined e-mail for more than two decades.

The Federal Trade Commission in its report on the proposed federal Do Not Email registry said the industry needs to develop a common system for verifying e-mail senders before it could work. Microsoft recently brokered a deal to consolidate Sender Policy Framework and Microsoft’s Caller ID for E-mail–two antispam authentication schemes that look at DNS (Domain Name System) records to determine senders. Others, including Yahoo, are testing key encryption protocols to verify senders.

Cerf touched on digital signatures as a means to encrypt and verify senders, which his company MCI has used effectively. The digital signatures, or unique codes given to each individual, are attached to e-mail and must be authenticated to deliver the message.

Various solutions are in development. Some systems will run into problems in a public forum, he said, because of a lack of a central authority from country to country or state to state to govern the technology.

Another system, called Cloudmark Immunity, builds up a spam “immunity” based on input on what is unwanted e-mail from employees, according to the company. The technology, called Virus Outbreak Filters, is used to detect and quarantine suspicious e-mail or viruses before they can infect the entire network.

For consumers, Cerf suggested that everyone adopt a regimen of “cyberhygiene” to protect themselves from spam, viruses and spyware. Running filters and anti-spyware programs like Ad-aware should be a regular habit, he said, because active HTML (Hypertext Markup Language) and XML (Extensible Markup Language) have made receiving unwanted software to the PC dangerous.

More info: http://zdnet.com.com/2100-1104_2-5238202.html?tag=adnews

For instance, last August, Microsoft issued a patch that fixed a hole that the company described this way: “It could be possible for an attacker who exploited this vulnerability to run arbitrary code on a user’s system. If a user visited an attacker’s Web site, it would be possible for the attacker to exploit this vulnerability without any other user action.”

“IE is a buggy, insecure, dangerous piece of software, and the source of many of the headaches that security pros have to endure…”

A little over a week ago, the SecurityFocus Vulnerability Database reported the “Microsoft Internet Explorer Modal Dialog Zone Bypass Vulnerability,” which “may permit cross-zone access, allowing an attacker to execute malicious script code in the context of the Local Zone.” That was just one of the six reported so far this month – and we’re only halfway through!

In fact, it’s gotten so bad that now spyware creators (AKA, scumbags) are using flaws in IE to surreptitiously install the I-Lookup search bar (or one of several others) into the browser. Again, the user doesn’t need to do anything – just visit a Web site or click on a URL in an email. Your home page is changed, a bunch of new bookmarks show up in your Favorites, and popup windows for porn sites open constantly.

On Monday, the Mozilla Foundation released its latest preview release of Mozilla Firefox, available for download and ready to run.

As most of you probably already know, the Mozilla browser is great, but it’s also a huge software project, encompassing a Web browser, an email program, an address book, a Web page editor, and much, much more. Mozilla Firefox is an effort to pull out the browsing component, resulting in a faster, more focused, and more innovative Web browser. Its feature set is enviable: pop-up blocking, tabs, integrated search, an awesome level of customizability, and excellent support for Web standards.

But it has really shone (as has the Mozilla Project as a whole, actually) in the area of privacy and security. All software has bugs, and none is totally “secure”. As has been said so many times, security is a process, not a product. So I’m quite aware that Firefox has had security issues, and will have more in the future as sure as the sun rises.

In addition to a good track record in the past, Firefox and the Mozilla Foundation are taking a proactive approach to securing the Web browser in the future. The privacy and security settings available in Preferences are intelligent and effective, and the browser itself does not accept ActiveX controls, a key vulnerability in IE. Firefox uses XPI files to install themes, extensions, and other add-ons.

As people who care about security – and who so often work with people who care nothing about security – it’s our responsibility to spread the word about a better Web browser that does not constantly compromise the basic security of our computers and networks.

More info: http://www.securityfocus.com/columnists/249

1. Avoidance of a costly security incident.
2. Avoidance of disruptive downtime.
3. Improved availability.
4. Improved consistency.
5. Improved failure analysis.
6. Improved audit results.

More info: http://www.computerworld.com/securitytopics/security/story/0,,93419,00.html

Exploit code was made publicly available (THCIISLame.c) and rumors of a potential worm that uses the vulnerability as an attack vector are spreading the security news. This is an analysis of the vulnerability and the method of exploitation.

More info: http://security-protocols.com/modules.php?name=News&file=article&sid=1912