Latest Posts
Common Criteria Evaluation Assurance Level (ISO 15408)
January 30, 2011 Added by:Jamie Adams
Common Criteria is a framework in which computer system users can specify their security and assurance requirements. Vendors then implement and/or make claims about the security attributes of their products, and testing laboratories can evaluate the products to determine if they actually meet the claims...
Comments (0)
Proving HIPAA HITECH Compliance
January 30, 2011 Added by:Jack Anderson
There is no third party authorized by HHS to attest to their compliance such as The Joint Commission or JCAHO can attest to accreditation. Even if they could prove to your satisfaction that they were compliant in January, how would you know that they were compliant in February, or March, etc...
Comments (2)
Intrusion Prevention Systems Getting Better
January 30, 2011 Added by:Bill Gerneglia
Intrusion prevention systems are doing a significantly better job at blocking hackers from corporate networks than a year ago, according to a new study. But some products from major vendors still fare poorly in intrusion tests, and the better security has come at the expense of performance...
Comments (0)
High-Performance Computing in the Enterprise
January 29, 2011 Added by:Rahul Neel Mani
Eng Lin Goh, CTO, SGI in a conversation with Geetaj Channana on the evolution of the company after its takeover by Rackable, and their contribution to cloud computing and high-performance computing in the enterprise...
Comments (0)
Feeling Like Somebody Is Watching You?
January 29, 2011 Added by:Theresa Payton
If you went to the airport, bank, or a store today, you probably expected to be watched. But those are the old school ways of being watched. Now, the smartphone in your pocket could watch you or your laptop webcam can watch you. Having an emotional reaction? There's a wristband monitor for that...
Comments (1)
Did Heartland CEO Make Insider Trades?
January 29, 2011 Added by:Anthony M. Freed
Heartland Payment Systems (HPY) and Federal investigators have released more details about the nature of the massive data breach made public last week, but have refused to pinpoint the exact date that Heartland first became aware there may have been a problem with their network security...
Comments (0)
How Much Longer Does the Magstripe Have?
January 29, 2011 Added by:Robert Siciliano
Every U.S.-based credit card has a magnetic stripe on the back. This stripe can be read and rewritten like a burnable CD. The simplicity of the magstripe’s design, coupled with the availability of card reading and writing technology, results in billions of dollars in theft and fraud...
Comments (0)
Being a Great Compliance Leader
January 28, 2011 Added by:Thomas Fox
If a leader stops growing and improving they run the risk of becoming a terrible boss. Most managers stop working on themselves at some point in their career. Many managers are afraid of failure and this leads to a fear of change. Others do not receive proper training or support from their companies...
Comments (0)
Securing Web Services in the Cloud
January 28, 2011 Added by:Danny Lieberman
Once a security breach is detected, being able to shut down systems and reject traffic from specific sources is important. A DLP system provides real-time detection, forensics recording and the ability to drop traffic from specific IP source addresses in order to properly mitigate the threat...
Comments (0)
Webinar: ISO 27001 Foundations Part One
January 28, 2011 Added by:Dejan Kosutic
If you don't plan information security activities carefully, chances are you will miss something important, and that will cost you. ISO 27001 defines the various steps in the planning phase – the purpose is to set a clear direction and take into account everything that can cause security incidents...
Comments (0)
Q and A with Hacker "srblche srblchez"
January 28, 2011 Added by:Rafal Los
An independent attacker who writes their own scripts and hacks in 'a couple of seconds' is your worst nightmare as a security professional, mostly because the velocity of attack is so great and the likelihood of being caught in a detection system like an IPS is so low...
Comments (1)
Complete PCI DSS Log Review Procedures Part 12
January 28, 2011 Added by:Anton Chuvakin
We have several major pieces that we need to prove for PCI DSS compliance validation. Here is the master-list of all compliance proof we will assemble. Unlike other sections, here we will cover proof of logging and not just proof of log review since the latter is so dependent on the former...
Comments (0)
More On The Cloud And PCI Compliance
January 28, 2011 Added by:PCI Guru
PCI DSS can be applied to “the cloud” in its existing form. Then where is the problem? The first problem with “the cloud” is in defining “the cloud.” If you were to ask every vendor of cloud computing to define “the cloud,” I will guarantee you will get a unique answer from each vendor asked...
Comments (1)
FBI Executes Warrants for Anonymous DDoS Attacks
January 28, 2011 Added by:Headlines
The Anonymous script-kiddie roundup begins in earnest: FBI agents today executed more than 40 search warrants throughout the United States as part of an ongoing investigation into recent coordinated cyber attacks against major companies and organizations...
Comments (1)
Is 2011 the Year of NoSQL Data Breaches?
January 27, 2011 Added by:Daniel Doubrovkine
The buzz about the MongoDB outage at FourSquare got nearly as much attention from the world as the security breaches of traditional RDBMS at Gawker and Silverpop. I believe it’s all going to change soon: TeamSHATTER has seen strong growth in research and hacker activity targeting NoSQL databases...
Comments (2)
Who Protects Your Digital Footprint? It Better Be You
January 27, 2011 Added by:Allan Pratt, MBA
It is critical to reserve your personal brand name and company name – and all other permutations you can think of – across all major social media sites. That way, you won’t have to worry about surprising news about your brand on a site that slightly resembles your official sites...
Comments (2)
Anonymous Calls UK Arrests a "Declaration of War"
January 27, 2011 Added by:Anthony M. Freed
In what is best described as rhetoric befitting a professional wrestling pay-per-view smack-down teaser, the non-entity known as Anonymous has taken offense with the United Kingdom for having the nerve to enforce their nation's laws, calling the arrests a "serious declaration of war"...
Comments (7)
Global GovCloud and the Virtual Environment
January 27, 2011 Added by:Kevin L. Jackson
Recently I had the awesome experience of participating in a global tele-presence conference on government cloud computing. A key takeaway for me was that pre-integrated cloud infrastructure solutions have been credited with reducing the non-recurring engineering cost of private clouds...
Comments (0)
Why the Cloud is a Security Nightmare
January 27, 2011 Added by:Dan Dieterle
Hackers will leverage the power of the cloud themselves to attack government and enterprise encrypted systems. Recently, it was shown that WPA encryption could be cracked using the computing power of the cloud...
Comments (4)
Cross-Site Scripting (XSS) - Some Examples
January 27, 2011 Added by:Ben Keeley
A reflected XSS vulnerability is when ‘code’ is injected into a website in such a way so as to deliver a payload or to produce a result on the end users browser. Reflected XSS vulnerabilities are delivered to a victim via various means such as an email causing the user to click on a malicious URL...