Security

How to Get Full Value in a Flash Upgrade

Sun, 03 Mar 2013 11:00:00 EST

Companies that need to improve application performance, for example, in server virtualization or VDI environments, frequently come to the conclusion that flash is the best strategy. SSD technology is becoming the "go to" solution for enhancing the performance of these kinds of critical production applications. After realizing that a flash-based solution is warranted, the next question involves implementation. What is the most cost-effective way to add solid state flash technology into an existing production environment? For IT organizations that have multiple primary servers needing this performance boost, most find themselves looking at network based storage appliances as they can be easily shared across all servers and applications.

What Are DDoS Attacks and How Can You Prevent Them?

Thu, 07 Feb 2013 12:44:00 EST

Internet Security is a vital measure for any business to implement. Due to the Internet's global reach, it is becoming increasingly more important to protect sensitive company data and networks. For multinational corporations and smaller businesses alike, the possibility of attack on a system or network is a daily concern. Over the past few years Distribution Denial of Service (DDoS) attacks have become more frequent, diversified and on a larger scale. Unlike access attacks that enter security perimeters to gain information, DDoS attacks paralyze Internet systems by flooding it with useless traffic. Websites can be seized and crashed by hackers, which cause severe implications and damage to a business's reputation. These DDoS attacks are an unfortunate inevitability of online business and are a huge threat to organizations. Even high profile companies are having to reconsider their security protocols following vicious attacks. As technology becomes more sophisticated and widespread, so do DDoS attacks, making the preventative measures so critical. Most typically, DDoS attacks are intended to cause widespread damage, especially those carried out by activists and international cybercriminals.

Victim-nomics: Estimating the “Costs” of Compromise

Mon, 14 Jan 2013 06:15:00 EST

While recently researching a known threat group within ThreatConnect.com, we identified several interesting observables associated with targets of a single Chinese-based Advanced Persistent Threat (APT) group. Over the course of seven days, we watched the adversary tailor their command and control infrastructure toward the specific target companies and industries. Ten suspected targets were readily identified; they consisted of U.S. based, publicly and privately held companies across the following industries: • Mining & Metals • Aerospace & Defense • Manufacturing & Fabrication • Construction & Engineering

Taking a Holistic Approach to IT Security

Mon, 03 Dec 2012 06:45:00 EST

Lake Health's Information Security Officer has been expanding the breadth and depth of risk management there to a more holistic level -- far more than just a series of security products. Many people are practicing IT security and they're employing products and technologies. They're putting in best practices and methods, of course. But you have a different take. You've almost abstracted this up to information assurance -- even quality assurance -- for knowledge, information, and privacy. Tell me how that higher abstraction works, and why you think it's more important or more successful than just IT security?

Encryption of Data-in-Use to Harness the Power of the Cloud

Mon, 19 Nov 2012 08:00:00 EST

Cloud computing has dramatically altered how IT infrastructure is delivered and managed, as well as how IT functionality is consumed. However, security and privacy concerns continue to be major inhibitors for risk-conscious organizations to adoption of cloud computing – whether infrastructure as a service, software as a service applications or email as a service. Cloud service providers, in response, have made strategic decisions on the investment they make in directly addressing these concerns in order to encourage broader adoption of cloud-based services. By implementing controls and processes to further improve security, cloud service providers are increasingly aiming to deliver more safeguards for the cloud environment than individual customer could within on-premise environments. However, a significant consideration for many organizations as they look to best exploit the benefits of the cloud is whether they can retain ownership and control of data processed by third party services.

What Is the Future of Security Incident Response?

Thu, 15 Nov 2012 12:00:00 EST

With the common theme in today’s security management conversations being “your security will fail” and “expect to be breached,” it’s no question that there has been increased interest in the area of incident response. The industry is realizing that the addition of regulations, people, or even product features, is not going to cut it – a next generation incident response offering is needed. To get a view of what the next-generation incident response solution might look like, Web Security Journal sat down with entrepreneur and life-long incident response veteran, Joseph Loomis, a cooperative member with the FBI and DEA’s divisions on Cybercrime and founder and CEO of Phoenix-based CyberSponse.

The Penetration of Application Complexity and Interdependency

Wed, 24 Oct 2012 08:00:00 EDT

The smart investment money in software application development is in the management layer. Actually that’s not true, the smart money is probably on almost every level of the application development lifecycle; but the deployment, release automation, testing, governance and release management layer is now developing to a level of fabulously penetrating enrichment never quite seen before. As firms now view a total IT stack populated with complex interdependent applications, the simultaneous deployment of multiple pieces of interlocking software has to be performed with an eye on both the code itself and the infrastructure that supports them.

Security Automation Connects Silos

Thu, 18 Oct 2012 14:00:00 EDT

A wealth of security information exists in our networks from a variety of sources – policy servers, firewalls, switches, networking infrastructure, defensive components, and more. Unfortunately, most of that information is locked away in separate silos due to differences in products and technologies, as well as by companies’ organizational boundaries. Further complicating the issue, information is stored in different formats and communicated over different protocols. An open standard from the Trusted Computing Group (TCG) offers the capability to centralize communication and coordination of information to enable security automation. The Interface for Metadata Access Points – IF-MAP for short – is like Facebook for network and security technology, allowing real-time sharing of information across a heterogeneous environment.

Security and Control in the Cloud

Thu, 18 Oct 2012 07:30:00 EDT

Cloud computing is so alluring. The public cloud economizes infrastructure resources and creates a scalable, on-demand source for compute capacity. Additionally, the cloud can be a strategic asset for enterprises that know how to migrate, integrate and govern deployments securely. Apple co-founder, Steve Wozniak recently said, "A lot of people feel 'Oh, everything is really on my computer,' but I say the more we transfer everything onto the web, onto the cloud, the less we're going to have control over it." In fact, over 70% of IT professionals worry about security according to an IDG Enterprise Cloud Computing Study. Boiled down, security, access and connectivity are really issues of control. As any prudent cloud user, the application has its own unique security features, such as disk encryption and port filtering. But do these layers of security features overlap or conflict? What happens to ownership after migration? Do solutions really have to be architected before and after deployment?

What Are the Basics of PCI DSS?

Thu, 20 Sep 2012 13:00:00 EDT

PCI DSS is the industry standard for the safe and secure processing of payment card transactions. In order for a business to effectively process card payments, PCI DSS needs to be used and maintained. As more firms head online, the internet offering a great many business opportunities (as well as intelligent web hosting options), the issue of secure payment processing is an important one. While each program was unique and came from different (in some cases, competing) brands, the overall aim was the same throughout: to ensure merchants meet minimum levels of security in storing, processing and transmitting cardholder data in order to better protect card issuers. The five separate but similar policies were eventually collated in 2004 when the PCI DSS was created. Soon afterward, each company aligned their own policies to correlate with that of the new industry standard.

Twenty-Thousand Men Pregnant Because of Bad Data

Fri, 20 Apr 2012 06:30:00 EDT

Millions or even billions have been spent caring for tens of thousands of pregnant men in the U.K. For UK’s chronically underfunded National Health System, a few hundred million or a few billion is a very big deal. Especially given how easily this problem could have been prevented with properly designed applications, integration software, and diagnosis codes. Using manual data or application integration techniques; poorly designed codes that are easy to mis-enter; badly written applications that don't check for basic things like "If you're a guy, you're probably not pregnant" - all a recipe for expensive disaster. And all common place. Bad Data and Sick Applications. And simply unacceptable.

The Hidden Business CoST: Consumerization of Sharing Tools

Sat, 07 Apr 2012 16:00:00 EDT

Sharing files with friends has never been easier. Whether it is via old-school hard copy methods like CDs, DVDs and USB drives, nefarious peer-to-peer torrents like BitTorrent or new shared, private cloud storage services like Dropbox, getting a photo or music file from one person to another takes mere seconds. The problem is that people inside businesses aren’t using these services just to share personal files. They are circumventing secured content management systems like SharePoint in favor of consumer-friendly services in order to share files with third parties. For businesses, Consumerization of Sharing Tools (CoST) can encourage insecure file sharing and the impact can be startling. WikiLeaks was the result of a failed SharePoint deployment. The user simply circumvented the SharePoint system, downloaded extremely sensitive data and made it available to the world. Of course, not all file share abuse is intended to be destructive and the majority of businesses aren’t dealing with classified government cables or sensitive personal information. Most businesses, however, do want full visibility of some files, particularly who is accessing them and what they are doing with them.

Bulletproofing the WebSocket Wire Protocol

Sun, 12 Dec 2010 02:30:00 EST

There's been a flurry of discussion this week among Internet and Web standards heavy-hitters around WebSocket, the new communications protocol supported in Chrome 4 and Safari 5. What was the main issue? Is there some kind of fundamental security vulnerability with the WS protocol? Web Security Journal turned to a domain expert in such issues, namely the CTO of Kaazing Corporation, John R. Fallows.

The Good Thing About Standards

Thu, 10 Jun 2010 10:36:00 EDT

“The good thing about standards is that there are so many to choose from.” – Dr. Tanenbaum And so we picked SMIL, an open web standard developed by the W3C (the fellows that brought us HTML, CSS and all the other things that make the internet work) for our new light-weight digital signage player which, thanks to Microsoft Silverlight, runs on a variety of platforms such as Windows, OS X, Linux, Symbian and Windows CE. As some of you may remember, we released SMIL support for our Oxygen media platform a few months ago. Since then a lot has happened! Our partner IAdea has rolled out a few hundred units of their XDS-100 players that are managed by our platform. Furthermore we are working with many partners and customers to roll out more SMIL-based digital signage installations.

Amazon Makes Sharing Data Easier with Shared EBS

Thu, 24 Sep 2009 11:00:00 EDT

Amazon releases the ability to share EBS snapshots so others can utilize and consume your data, irrespective of format. But EBS is more than just persisted data. It is a whole mechanism to allow for quickly taking snapshots of your data partition and then mounting that partition elsewhere. Take for example, having your database running on an EBS partition. You can snapshot that partition and mount that new clone on another machine. Quick and easy. Amazon were quick to exploit this feature and offer publicly blessed pre-configured datasets. For example, ever fancied having the WikiPedia dataset available to your application? Or maybe you would prefer to have all the US Addresses mapping information?

Antivirus Software Is Not Dead – It's Evolving

Fri, 21 Nov 2008 09:15:00 EST

Contrary to some industry observers, antivirus software is not dead. It is, however, undergoing a game-changing transformation. It has to. After all, the current model of detecting viruses through blacklisting simply cannot keep pace with the unprecedented volume of malware released every day. To continue to be effective, antivirus must transition from the current signature-based model to a new hybrid model that uses whitelisting to allow trustworthy applications, blacklisting to block prevalent known malware, and reputation-based ratings to automatically categorize the "long tail" of unknown malware and legitimate software.