IT security

MP3 search site pushes spyware, watchdogs say

A Web site that gives users the ability to search for MP3s contains programs that behave like spyware, according to the Center for Democracy and Technology and StopBadware.org. Continue Reading

By

• Bill Brenner

IBM to acquire compliance software firm

IBM plans to acquire Consul Risk Management Inc., a Delft, Netherlands-based firm whose software tracks non-compliant behavior of employees. Continue Reading

By

• Robert Westervelt, TechTarget

Spam -- stop it at the network edge

Spam has become much more than just a nuisance; it can slow or crash the network. F5 recently added a module to its Big IP platform to stop spam at the network edge. Continue Reading

By

• Susan Fogarty & Andrew R. Hickey

Security Bytes: Phishing worm spreads through MySpace

Round up of security news Continue Reading

By

• SearchSecurity.com Staff

Terrorists may target financial sites

The U.S. government is warning of an al-Qaida call for a cyberattack against online stock trading and banking Web sites Continue Reading

By

• SearchSecurity.com Staff

Symantec blames piracy for Veritas licensing snafu

Weekly compilation of storage news: Symantec says that software counterfeiting is throwing a wrench in tech support ; FRCP rules take effect. Continue Reading

By

• SearchStorage.com Editors

Oracle responds to security critics

Security Blog Log: Oracle takes on researchers who have criticised its security procedures in recent weeks. Meanwhile, Symantec warns of new zombie malware. Continue Reading

Multiple flaws in Adobe Reader, Acrobat

Multiple flaws in Adobe Reader and Acrobat could allow attackers to execute malicious commands on victims' computers. Continue Reading

By

• Bill Brenner

Podcast: Security certifications pay could rebound in '07

Security certifications pay is languishing, according to skill and certifications pay expert David Foote of Foote Research. Foote examines the state of the IT security job market. Continue Reading

By

• SearchSecurity.com Staff

Symantec fixes NetBackup Puredisk flaw

An unauthorised user could launch malicious code by exploiting a flaw in Symantec's Veritas NetBackup PureDisk product. But a fix is available. Continue Reading

By

• Bill Brenner

Adware targets Mac OS X

As F-Secure notes what may be the first example of adware designed for Macs, researcher LMH reports more flaws in the operating system as part of the Month of Kernel Bugs. Continue Reading

By

• Bill Brenner

Study: Some firms balk at mobile security

Companies are failing to safeguard sensitive data on employee mobile devices, according to a survey by the Business Performance Management Forum. Continue Reading

By

• Robert Westervelt, TechTarget

Active Directory security school: Set up and configuration

An Active Directory security lesson. Continue Reading

Active Directory security school: Maintenance and testing

This is lesson three of our Active Directory security school. Continue Reading

Active Directory security school: Management

Lesson two of the Active Directory security school. Continue Reading

Active Directory Security School

An improperly configured Active Directory can render the rest of your security measures useless. So how can you protect yourself from a hacker with their eyes on your AD? How can you recover from such an attack? Find the answers to all of your AD questions Continue Reading

Recordless email: magical or menacing?

A new startup promises recordless email. Is this a stroke of genius that will reward the company with billions of Internet bucks, or is it the end of the world as we know it? Continue Reading

Commentary: We've never met a "thought follower"

A couple of days back, a vendor tried to convince us that their new security consultancy services should be of interest to you, our readers. Continue Reading

By

• Simon Sharwood

Zango defying FTC agreement, researchers say

This week in Security Blog Log: Two researchers accuse Zango of unsavory adware tactics, despite the company's pledge to clean up its act. Continue Reading

New Mac OS X flaw exposed

A Mac OS X flaw was exposed as part of the Month of Kernel Bugs. Also, a new Web site vows to follow the lead of researchers LMH and H.D. Moore with a week of Oracle zero-days. Continue Reading

By

• Bill Brenner

BakBone brushes up replication software

BakBone's NetVault Replicator version 5.0 includes automatic configuration of replication for remote sites, a capacity planning tool and a higher performance data movement engine. Continue Reading

By

• Beth Pariseau, Senior News Writer

Insider security threats come in many forms

Insiders could be the greatest threat to a company's security. The best defense is to let them know Big Brother is watching and a plan to deal with troublemakers. Continue Reading

By

• Bill Brenner

Virtualisation: friend or foe? [Day Two: The virtual appliance]

Virtualisation slashes costs, makes management easier, unshackles software configurations from hardware. And it is being embraced around the world. But is it secure? In this three-part series, Patrick Gray explores the security implications of this important new technology. Continue Reading

By

• Patrick Gray

Trojan poses as Adobe software update

The Trojan keylogger comes in an email that asks users to download the latest version of Adobe Reader. It then tries to steal the user's confidential information. Continue Reading

By

• SearchSecurity.com Staff

Security Blog Log: Sailing a sea of spam

This week, bloggers struggle to purge their bloated inboxes. Their experiences lend weight to recent studies showing a breathtaking spike in spam. Continue Reading

Podcast: Tor peer-to-peer privacy could be hacked

In this edition of Security Wire Weekly, Andrew Christensen of FortConsult explains how the Tor peer-to-peer network can be hacked to track down user identities. Continue Reading

By

• SearchSecurity.com Staff

Storage virtualization acquisitions need careful consideration

Storage virtualization alleviates traditional storage growth problems by implementing a layer of abstraction between applications and physical storage, allowing storage to be combined and treated as a ubiquitous resource, regardless of location. This buying guide helps you understand the most important considerations involved in storage virtualization product selection, identifies specific points of interest for software, hardware and VSAN product categories, and presents a series of basic product specifications that will start you pick the best product for your organization. Continue Reading

Microsoft to patch critical zero-day flaws in Windows

Microsoft plans to repair five critical flaws in Windows and a flaw in XML Core Services as part of its monthly patch update next week. Continue Reading

By

• SearchSecurity.com Staff

Mozilla fixes Firefox flaws

Attackers could exploit multiple flaws in Firefox, SeaMonkey and Thunderbird to crash machines, bypass security restrictions and launch malicious code. Continue Reading

By

• Bill Brenner

How to manage encryption keys

Encryption is an effective way to secure data, but the encryption keys used must be carefully managed to ensure data remains protected and accessible when needed. Continue Reading

Agency improves security grades under CISO's watch

CISO Philip Heneghan has made security a way of life for the U.S. Agency for International Development (USAID). His work earned him a Security 7 award. Continue Reading

By

• Kelley Damore

Sourcefire IPO could fuel Snort, users say

Snort users frowned when Check Point tried to acquire Sourcefire last year. But they are more optimistic about Sourcefire's plans to go public. Continue Reading

By

• Bill Brenner

Microsoft eyes second zero-day threat in a week

This time, attackers are going after a zero-day flaw in Windows, and Microsoft has released some workarounds until a patch is available. Continue Reading

By

• Bill Brenner

Mobile device encryption - a practice not often applied

Encryption is the best way to protect data on mobile devices -- but too few companies are actually deploying this critical technology. Continue Reading

By

• Shamus McGillicuddy, Enterprise Management Associates

Security Blog Log: Dissecting Firefox 2.0

This week, bloggers examine the security features of Firefox 2.0 and come away with mixed reviews. Does it fare better than Internet Explorer 7? Continue Reading

Review: Arbor Networks' Peakflow X 3.6

Hot Pick: Peakflow isn't cheap and requires an intimate understanding of data flows, applications and network infrastructure. But the investment will pay dividends. Continue Reading

By

• Sandra K. Miller, Contributing Writer

Review: Network Intelligence's enVision

enVision offers excellent value and is highly configurable, though typically that means you have to put a lot into it to get the most out of it. Continue Reading

By

• Brent Huston, Contributing Writer

Review: SPI Dynamics' WebInspect 6.1

SPI Dynamics has created a powerful tool for novices as well as advanced users who will appreciate the time and effort it saves. Continue Reading

By

• Phoram Mehta, Contributing Writer

Tor network privacy could be cracked

The Tor network is used by those who want to keep their IP addresses private. But new research shows that it's possible to compromise the system and unmask the user. Continue Reading

By

• Bill Brenner

Download Advanced Storage Guide Chapter 2: Backup/Data protection (PDF)

A printable version of our Advanced Storage All-In-One Guide. Download Chapter 2: Backup/Data protection in .pdf format now. Continue Reading

Flaw found in Firefox 2.0

Attackers could exploit the security flaw to crash versions 1.5.0.7 and 2.0 of the browser, according to various security advisories. Continue Reading

By

• Bill Brenner

Podcast: The state of Oracle security

In this edition of Security Wire Weekly, Oracle DBA Jon Emmons gives his observations about Oracle's new critical patch update format. Continue Reading

By

• SearchSecurity.com Staff

E-vaulting's many faces can confuse IT efforts

E-vaulting is the process that describes how enterprise IT departments ship backup tapes and replicate data to remote disk arrays and VTLs. E-vaulting is not a new concept, but more recently it has grown to mean remote backups and replication for SMBs/SMEs using third-party services. This article examines e-vaulting, highlights the major considerations and roadblocks in implementation, examines the impact of e-vaulting on real-life users and looks ahead at future e-vaulting trends. Continue Reading

Messaging Security School

SearchSecurity.com's Messaging Security School has brought together some of the most knowledgeable experts in the messaging security field to offer you personal instruction on how to secure the information handled by your organization's knowledge workers. Continue Reading

Countermeasures for malicious email code

Today's malware continues to raise the security stakes. Enterprises are now facing numerous evolving threats like targeted and blended attacks, zero-day exploits, botnets and phishing schemes. The attacks aren't the only things evolving; so are today's product sets. In this lesson, attendees will get an overview of the email threat landscape, tips for malware protection success and guidance on the future of email attacks. Continue Reading

By

• Tom Bowers

Survey: Data breach costs surge

A new study by the Ponemon Institute finds a 31% increase in the costs associated with a data breach. Continue Reading

By

• Robert Westervelt, TechTarget

Achieving compliance: a real-world roadmap

A security manager's responsibilities extend beyond the technical aspects of the job. These days, effective governance and compliance are just as essential. Continue Reading

Security Blog Log: The never-ending PatchGuard debate

This week, security vendor fright over the Windows Vista PatchGuard feature permeates the blogosphere. Is Microsoft the boogeyman, or just misunderstood? Continue Reading

Research shows massive botnet growth

Reports from McAfee and Microsoft show bot herders are gaining ground and threatening national infrastructure. Some suppliers hope to strike back by sharing resources. Continue Reading

By

• Bill Brenner

What storage managers are buying and why, page 7

What storage managers are buying and why Continue Reading

What storage managers are buying and why, page 6

What storage managers are buying and why Continue Reading

Security researcher, professor influences students for life

Dorothy Denning, a professor of defense analysis at the Naval Postgraduate School, has contributed to the field of data security. Her work earned her a Security 7 award. Continue Reading

By

• Marcia Savage, Editor

SDL expected to help fulfil Vista security promises

Windows Vista is expected to be the most secure Microsoft product released thanks to the company's implementation of the Security Development Lifecycle (SDL). Continue Reading

By

• Michelle Davidson, TechTarget

Information Security Decisions Session Downloads

Session Downloads from Information Security Decisions 2006 Conference. Continue Reading

Enhanced Identity and Access Management

From consolidating directories to automating provisioning and rolling out single sign-on, these sessions identify how leading organizations are strengthening authorization and enforcing access controls. Continue Reading

Snyder On Security: An insider's guide to the essentials

Joel Snyder, senior partner with consultancy Opus One, provides an in-depth look at information security trends and technologies. Continue Reading

Rural Payments Agency project failed after IT system costs spiralled

Delays in implementing a bespoke IT system led to the Rural Payments Agency (RPA) failing to pay subsidies to farmers on time, according to a National Audit Office report. Continue Reading

By

• Will Hadfield

Nmap Technical Manual

By now, most infosec pros have heard of Nmap, and most would agree that even though the popular freeware tool is invaluable, installing, configuring and running it in the enterprise is no easy task. With that in mind, SearchSecurity.com, in collaboration with security expert Michael Cobb, has produced an Nmap Tutorial, detailing how this free tool can help make your organization more secure. Continue Reading

Security Bytes: Flaws fixed in Bugzilla

Meanwhile, security holes are also plugged in Cisco's Wireless Location Appliance software and Clam AntiVirus. Continue Reading

By

• Bill Brenner

Microsoft caves to pressure over Vista security

To accommodate third-party security vendors and appease antitrust regulators in Europe, Microsoft will make some final tweaks to Windows Vista. Continue Reading

By

• Bill Brenner

Microsoft to fold security into Windows division

The software giant said the move would make future Windows development efforts more efficient. The changes take effect after Microsoft releases Vista. Continue Reading

By

• SearchSecurity.com Staff

Security Blog Log: Taking Google Code Search for a spin

This week, the blogosphere is buzzing about Google Code Search. Despite concerns that the tool will aid attackers, some see it as a boost for security. Continue Reading

What to do when your server goes down

When a server goes down at a particular time every night without the prompt of a virus, our expert, Puneet Mehta, can tell you what the problem is and what you can do to avoid it. Continue Reading

By

• Puneet Mehata

Brief: Malicious Web site poses as Google

A malicious Web site poses as Google's Italian site, but attempts to install malicious ActiveX controls on victim's machines and ultimately redirect them to adult content. Continue Reading

By

• SearchSecurity.com Staff

Inside MSRC: Public vulnerability disclosures on the rise

Even though irresponsible publicly disclosed vulnerabilities seem to be on the rise, Microsoft's Christopher Budd discusses how the software giant was able to quickly release a fix for the recent VML flaw, plus offers best practices on how to make sure all of this month's software updates are installed correctly. Continue Reading

McAfee CEO Samenuk retires in wake of options probe

The investigation into stock option grants is complete and company president Kevin Weiss has been fired, as well. Continue Reading

By

• Dennis Fisher

Google Code Search gives security experts a sinking feeling

The new search tool from Google can help developers find useful code examples. But security experts worry that it also will make attackers' jobs that much easier. Continue Reading

By

• Dennis Fisher

Banking on the future

As the banking landscape changes and global competition takes hold, IT offers banks a way of differentiating themselves from the competition, so how do they balance innovation and imitation in this tough market sector? Continue Reading

Midmarket IT pros have NAC for identity, access management

Midmarket firms may not have the budgets of large companies, but IT pros can build identity and access management programs that are as effective as what the big guys have. Continue Reading

By

• Bill Brenner

Symantec unveils Security 2.0 initiative

As part of Security 2.0, Symantec unveiled new products and partnerships with VeriSign and Accenture to help customers secure their databases, manage risk and fight ID theft. Continue Reading

By

• Bill Brenner

Tiered storage becoming tried and true

Tiered storage matches the value of data with the performance (and expense) of storage. Ideally, tiered storage can save money, while easing the access demands to any single storage tier. While tiered storage has clearly brought storage costs and performance into focus, it has yet to reach its full potential in the enterprise. Continue Reading

School district expels outsourced backup, enrolls CDP

Revere School District dumps tape and outsourced backup, and deploys SonicWall's continuous data protection product. Continue Reading

By

• Alex Barrett, News Director, Data Center Media Group

Test your IQ: Business continuity -- ANSWER

This type of plan specifies a means of maintaining essential services at the crisis location. Continue Reading

DPM's Diary: 3 October 2006

Monday Continue Reading

By

• C P Bound

ZERT rekindles third-party patching debate

This week in Security Blog Log: IT security pros express more reservations about third-party patching, including the CEO of a company that released one a few months ago. Continue Reading

PING with Suzanne Hall

In this exclusive interview with Information Security magazine, Suzanne Hall, AARP director of IT operations and security, examines how security professionals can enable telecommuters and mobile workers while keeping their data secure. Continue Reading

More from SearchSecurity September 2006

This month's round up weighs the pros and cons of security information management systems (SIMs) plus four case studies illustrating the different roadblocks security managers can encounter Continue Reading

On privacy laws, every state is one of confusion

It's getting increasingly difficult for US firms to comply with regulations . David A. Meunier feels that it's time to develop safeguards and processes for this ever-changing regulatory environment. Continue Reading

By

• David A. Meunier

Top 5 free Windows security downloads

The place where you can find free tools that help you crack passwords, remove troublesome spyware and enhance network security. Check out our five most popular tools and find out what you've been missing. Continue Reading

Voice over IP Fundamentals: Chapter 9, 'Billing and Mediation Services'

Voice over IP Fundamentals: Chapter 9, 'Billing and Mediation Services' Continue Reading

Stration worm targets Windows machines

The worm uses several fake email messages, including one claiming to be a security update. Users are advised to avoid unsolicited email attachments. Continue Reading

By

• Bill Brenner

Symantec Dark Vision app monitors underground IRC servers

New research project keeps tabs on the hacker underground, providing new insight on activities like credit card theft and spamming. Continue Reading

By

• Dennis Fisher

IT pros worried about unsecured devices

IT admins keep working to make networks secure even as more unsecured personal gadgets their way into companies. Continue Reading

By

• Eileen Kennedy, News Writer

Hijacked consumer machines target the enterprise

Attackers continue to strike gold by targeting consumers who lack the security savvy to address desktop application flaws, according to Symantec Corp. Enterprises ultimately pay the price. Continue Reading

By

• Bill Brenner

NetApp operations chief talks growth

Tom Georgens, executive vice president and general manager at NetApp -- also rumoured to be in the running as next CEO -- discusses what's driving its growth. Continue Reading

By

• Jo Maitland, TechTarget

Apple fixes Mac Wi-Fi flaws

Updated: Attackers could exploit flaws in Apple's wireless technology to cause a denial of service or run malicious code, resulting in the full takeover of vulnerable Mac machines. Continue Reading

By

• Bill Brenner

Secure network perimeter to result from Symantec-Juniper deal

Juniper and Symantec announced a deal to integrate Symantec's client security software with Juniper's security hardware. The result will allow endpoint compliance and access control platforms to secure the enterprise perimeter. Continue Reading

By

• Amanda Mitchell, News Editor

Three ways to create clustered storage

Clustered storage systems run on storage servers, NAS gateways and hosts. Here's how to determine which clustered file-system architecture is best for your needs and storage environment. Continue Reading

Dell and EMC: Five more years

Dell leans on EMC for support in the face of an SEC investigation and possible delisting from NASDAQ. Continue Reading

By

• Alex Barrett, News Director, Datacenter Media Group

Big security fixes for QuickTime, Flash Player

Apple and Adobe warned that attackers could exploit multiple flaws in QuickTime and Flash Player to run malicious code on targeted machines. Continue Reading

By

• Bill Brenner

Secure network perimeter to result from Symantec-Juniper deal

Juniper and Symantec announced a deal to integrate Symantec's client security software with Juniper's security hardware. The result will allow endpoint compliance and access control platforms to secure the enterprise perimeter. Continue Reading

By

• Amanda Mitchell

Data storage compliance's impact on storage product choices

Data storage compliance is having a tremendous impact on the storage organization, as well as the management practices employed to retain, search, certify and destroy data. It's not just regulations like SOX or HIPAA that influence storage -- there are well over 10,000 regulations that affect data storage, backup and protection across a range of industries. But companies are often left alone in their quest to identify the regulations that relate to them, identify what data should be saved and implement storage to meet those regulations. This article covers the essential goals of data storage compliance, examines implementation considerations and obstacles and reviews the impact of compliance on storage. Continue Reading

Security Bytes: Hackers target the Terminator

In other news, Symantec upgrades its Norton product line and the Anti-Phishing Working Group says phishing activity soared this summer. Continue Reading

By

• SearchSecurity.com Staff

Storage upstarts are tipping the vendor scales

The big storage vendors are always trying to steal a piece of each other's pie. But some small tech upstarts might play big parts in determining who comes out on top. Continue Reading

Fast Guide: VoIP encryption

A guide to encryption within VoIP networks Continue Reading

Security Bytes: New flaw in Cisco IOS

Security news including Cisco, Mozilla hires a former Microsoft strategist to bolster security, a new "pump-and-dump" stock spam campaign is discovered and TippingPoint lists info on new flaws. Continue Reading

By

• SearchSecurity.com Staff

Security Blog Log: Word doc scam evades spam filters

Also this week: A researcher gets a harsh reward after flagging a University of Southern California Web site flaw, and more blogs are keeping an eye on the latest security breaches. Continue Reading

ControlGuard targets rogue devices

ControlGuard Access Manager is an effective tool for controlling what devices users can add to their workstations and how they are used. Continue Reading

By

• Harris Weisman, Contributing Writer

Proofpoint delivers strong messaging security

Proofpoint Messaging Security Gateway is a highly recommended, affordable solution for big enterprises that need protection from email-based attacks. Continue Reading

By

• Phoram Mehta, Contributing Writer

Cisco, Microsoft unveil NAC/NAP interoperability

Nearly two years into their partnership, Cisco and Microsoft yesterday announced a joint architecture combining their network access security solutions. Continue Reading

By

• Andrew R. Hickey