Blogs

Blog Group Links

Tag Cloud

Common Links

Anonymous

To comment on blogs, please Sign in.

If you haven't signed up yet,

please register here.

  • Updated Community Server Web Site

    By now you've noticed that this Web site has undergone a radical facelift starting today (May 23 2012). This redesign has been underway for several months involving many different individuals, long hours of work, and countless meetings. In addition to all of the content from the previous site still being available on this updated Web site, additional security content is being added. And the site is now easier to navigate. In the coming weeks watch for more new security-related material to appear. Thanks to everyone at Cengage who worked on the redesign (to see a partial list of names and photos click OUR TEAM and then "Marketing/Editorial"). Stay secure! http://www.cengagesites.com/Networking-Security/50/information-security/
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 05-23-2012
    Filed under:
  • Another Warning on Medical Devices

    The lack of security on medical devices is continuing to raise concerns. Last year a security researcher, who was himself a diabetic, demonstrated at the Black Hat security conference a wireless attack on an insulin pump that could change the delivery of insulin to the patient. The security vendor McAfee found that they could scan a public space from up to 300 feet away, find vulnerable pumps made by a specific medical device manufacturer, and then force these devices to dispense fatal insulin doses. In 2009 an assistant professor in computer science "hacked" into a defibrillator (used to stabilize a heartbeat) and reprogramed it. He also disabled its power-save mode so the battery ran down in hours instead of years. Last month the national Information Security and Privacy Advisory Board (ISPAB) recommended that one federal government agency like the Food and Drug Administration (FDA) be responsible for ensuring the security of wireless medical devices, and called for the National...
  • Wireless Warning

    The rapid growth of wireless local area networks (WLANs, also called "Wi-Fi") based on the IEEE 802.11a/b/g/n--and soon-to-be-released IEEE 802.11ac standard with theoretical data rates of up to 3.6 Gbps) has been nothing short of phenomenal. According to some estimates by 2014 there will be 1.4 billion devices shipped annually that support wireless data standards, and these devices will transmit the amount of data traffic equal to almost one billion DVDs. By the end of 2011 one quarter of all households around the world, or 439 million households, were using wireless data technology, with South Korea leading the way with over 80 percent of its households using wireless (the U.S. was eighth with 61 percent). It is estimated that by 2016 over 800 million households will have wireless data technology installed. Considering that wireless local area networks were not even available until 2000, this makes their widespread installation that much more amazing. This huge popularity of...
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 05-17-2012
    Filed under: ,
  • Leopard Finally Updated--Sort Of

    In a disturbing trend by some software vendors, older versions of software are being neglected when it comes to security updates. On Monday (May 14 2012) Apple issued its first security-related update to its Leopard operating system (OS X 10.5) in almost one year ago. Yet this update does not even patch any known vulnerabilities but instead only removes older versions of the Adobe Flash Player: any Flash Player older than 10.1.102.64--which was released in November 2010--is now disabled. This update is the same that Apple released last week for Snow Leopard (OS X 10.6) and Lion (OS X 10.7). And although Apple still provides security updates for Java for users running Snow Leopard and Lion, it has not distributed any security patches for Java running on Leopard since June 2011. It's certainly troubling that Apple as well as other security vendors is not keeping older versions of their software updated (see May 15 2012 blog posting). Their patch management {Chapter 5 Security+ 4ed} capabilities...
  • Adobe Retreats on Pay for Patches

    Adobe's track record for creating and maintaining secure protects is less than stellar (see May 7 2012, Dec 8 2011, and Aug 17 2011 blog postings). And to add the proverbial "insult to injury", Adobe recently said that they will no longer patch critical vulnerabilities {Chapter 5 Security+ 4ed} in older versions of their software and that users must purchase the latest software versions to be protected. After a storm of criticism Adobe has now reversed course. There are a total of 8 vulnerabilities in Adobe Illustrator (5 vulnerabilities) and Flash Professional CS5.5 (1 vulnerability)--which have been out for only one year--and two-year old Photoshop CS5 (2 vulnerabilities). Last week Adobe told its users that they must upgrade to the Creative Suite 6 (CS6) editions if they wanted to have this software with the patched vulnerabilities. That cost could be $99 (for Flash Professional), $249 (Illustrator) or $375 (CS6 Design & Web Premium that includes all three). Now Adobe...
  • What is GRC? Why do you care?

    There are really two camps in the information security discipline. You may want to call them managerial and technical. You might call them computer security and information assurance. You can come up with as many terms to explore this division as you like, but it boils down to how we go about establishing a system of controls to reduce risk. One aspect is the implementation of the technical aspects of one of many types of controls that affect limiting the actions a system can be used to take. These are things like firewalls, intrusion detection and prevention, programs that use vulnerability to diagnose and repair vulnerabilities, and so on. Think of these things as ways to make systems able to be more secure, more reliable or more resistant to misuse. The other aspect is that of creating the organization needed to plan and implement secure systems. This is done with establishing and maintaining governance of the IT and security functions (that's the G), Establishing and maintaining...
    Posted to Whitman, Mattord & Green's Blog by Herb Mattord on 05-15-2012
  • Critical Adobe Flash Update

    Adobe sent out a warning today (May 7 2012) that attackers are exploiting a vulnerability {Chapter 1 Security+ 4ed} in the Adobe Flash Player software. Adobe assigned this vulnerability a "1" priority rating, indicating that it's an actively-exploited (or likely soon-to-be exploited) vulnerabilities and should be patched within 72 hours. What should you do to protect yourself? Unfortunately the answer is, "It all depends." The Adobe Flash version 11.2.202.235 contains the necessary patch. If you are running Google Chrome your browser should have automatically been updated last Monday (Apr 30 2012) with Google's Chrome release of 18.0.1025.168. If you are running Microsoft's Internet Explorer (IE), Firefox, Safari or Opera on Windows then Adobe's new silent background update feature--which silently updates Flash in the background--should automatically update the Flash plug-in. This silent background update feature was also released for Apple Mac last week...
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 05-07-2012
    Filed under: ,
  • Blackmail or Idiot Tax?

    Misunderstandings are often the result of a difference in interpretation (aka semantics). However, in this recent computer security attack much more may be at stake. Elantis, a credit provider located in Belgium, was the apparent victim of an attack in which employee login credentials and confidential loan application information on 3,700 customers--name, job description, contact information, annual income, ID card number, etc.--was stolen. Last Friday (Apr 27 2012) the attackers contacted Elantis and threatened to publically publish the information if the bank does not pay 150,000 euros (about $197,000) by tomorrow (May 4 2012). The attackers claimed that the data was stored unencrypted {Chapter 11 Security+ 4ed} on unprotected servers, and parts of what they claimed to be stole data was provided to prove their claims. And to add insult to injury, the attackers also said, "While this could be called 'blackmail,' we prefer to think of it as an 'idiot tax' for leaving...
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 05-03-2012
    Filed under: ,
  • Conficker Still Alive

    A notorious worm {Chapter 2 Security+ 4ed} known as Conficker is still on the loose. And this is after 3 years since its introduction and 4 years since the original patch was distributed to close the vulnerability that it expoits. Conficker first surfaced in November of 2008 and different variants (Conficker.A, .B and .C) later came onto the scene. It targets a known buffer overflow {Chapter 3 Security+ 4ed} vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, and Windows 7 Beta (but not Windows 7); a patch for this vulnerability was released back in October 2007. Conficker is known for its ability to disable a computer's security defenses. It turns off different Windows security system services such as Windows Automatic Update, Windows Security Center, Windows Defender and Windows Error Reporting while also blocking Internet access to security product Web sites, preventing the computer from receiving...
  • If you hated SOPA, you'll just loathe CISPA

    As I'm sure most of you recall, the "Stop Online Piracy Act", or SOPA, was a piece of federal legislation that was winding it's way through the approval process just a few months ago. It was killed, in part, due to public outcry from various sources. Congress saw the writing on the wall, and the bill was tabled in December 2011. SOPA was roundly criticized by many privacy organizations and DNS experts as an ineffective way to combat online piracy, as well as being dangerous to DNS. Recently, the Cyber Intelligence and Sharing and Protection Act, or CISPA, was submitted to the House of Representatives for consideration. This bill would allow the sharing of Internet traffic and associated details between the federal government and certain companies. The stated goal of CISPA is to allow the federal government to investigate potential cyber threats, while protecting against cyber attacks. Sounds great, right? The devil is always in the details, however - and there are really...
    Posted to Whitman, Mattord & Green's Blog by Andy Green on 05-01-2012
    Filed under: , , , ,
  • SSL Websites Vulnerable

    Perhaps the most common transport encryption algorithm is Secure Sockets Layer (SSL), which is a protocol developed by Netscape for securely transmitting documents over the Internet. SSL uses a public key to encrypt data that is transferred over the SSL connection. Transport Layer Security (TLS) is a protocol that guarantees privacy and data integrity between applications communicating over the Internet. TLS is an extension of SSL, and they are often referred to as SSL/TLS {Chapter 12 Security+ 4ed}. One use of SSL is to secure Web Hypertext Transport Protocol (HTTP) communications between a browser and a Web server. This secure version is actually “plain” HTTP sent over SSL/TLS and is called Hypertext Transport Protocol over Secure Sockets Layer (HTTPS). HTTPS uses port 443 instead of HTTP’s port 80. Users must enter URLs with https:// instead of http://. A just-released study shows that 90% of the top 200,000 HTTPS Websites are vulnerable, according to the Trustworthy...
  • Macs With Windows and Mac Malware

    Here's something that few users--particularly Mac users--would have ever expected. The security firm Sophos offers Mac users a free online antivirus scanner (yes, Macs can become infected!). After over 100,000 Mac computers ran that software then Sophos examined what the scanner found. And the results were surprising: almost one out of every five Macs (20%) contained at least one instance of Windows malware. Although this Windows malware cannot function on the Mac, it can be transferred to another Windows computer through USB flash drives and other removeable media, or through network file sharing. Sophos also found 3% of the 100,000 scanned Macs were infected with Mac malware. About 75% of the infected Macs were victims of Flashback (see Apr 11 2012 blog posting). It's estimated that some 600,000 Macs still have this malware while a new version of Flashback has infected another 700,000 Macs. The next most common infection was a fake antivirus "scareware" infection (18...
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 04-26-2012
  • There's Real Money In It

    Just in case there is still someone out there who doesn't think "security" (or a lack thereof) and "money" go hand-in-hand, two recent events may help convince them that these two elements are inseparably linked. First, on the defense side Google has increased the bounties it pays independent researchers who uncover vulnerabilities in its core Web sites, services and online applications. How much of an increase? How about an increase from $3,133 to a whopping $20,000 per vulnerability. Google's Vulnerability Reward Program (VRP) pays for a vulnerability that would allow an attacker to hijack a computer and plant malware on it that is directed against Google.com, Gmail, Youtube.com, and the new Google Play. And a $10,000 bounty will be paid for SQL injection {Chapter 3 Security+ 4ed} vulnerabilities or "significant" authentication bugs and data leak vulnerabilities. Cross-site scripting (XSS) {Chapter 3 Security+ 4ed} flaws will only pay between $100...
  • Just Because You Can... Doesn't Mean You Should

    Just because you can...doesn't mean you should. I'm going to share a story from one of my fellow professors about a student in his information security class. He observed a student using his cell phone in class against course policy. THe student proudly bragged the following: "He acknowledged he was actively scanning a fellow student's system without permission. He had downloaded an Android app used for network scanning and penetration testing, and was playing with it. He scanned the network, found a system with a fellow student's name on it, and claimed he was about to scan it when I called him out on his use of a mobile phone in class." Now realize this is an advanced information security class and the students have already had several classes where they were educated and informed about the legal and ethical responsibilities of an information security professional. In fact in each of these classes, the students sign agreements (White Hat Agreements) that specifically...
  • 259 Attacks in 90 Days

    Breaking into 259 different Web sites and databases in three months is no small feat, considering that's close to 3 successful attacks per day. Yet when the suspect is only a 15-year-old student, that makes it even more amazing. In January 2012 an Austrian student aged 15 was, by his own admission, bored and wanted to prove himself. Craving recognition, praise and affirmation for his limited technology knowledge and skills, he discovered an online forum in which the 2,000 registered members were given points for achieving successful attacks. That launched him into action. Over the next 90 days this script kiddie {Chapter 1 Security+ 4ed}, using attack software that searched for unpatched servers and anonymizing software to hide his tracks, successfully breached the servers belonging to 259 different companies around the world. After defacing Web sites and stealing data, he boasted about it on his Twitter account, where he also posted links to the stolen data. By the end of March he...
    Posted to Mark Ciampa's Blog (Security+ 4ed) by Mark Ciampa on 04-19-2012
    Filed under: ,
1 2 3 4 5 Next > ... Last »