IT security

Metasploit guide 4: Armitage cyber attack management GUI

In part four of our Metasploit guide we look at Armitage, the GUI-based cyber attack management tool. This completes the Metasploit guide series. Continue Reading

By

• Karthik Poojary, Amazon

GlobalSign web certificate authority back online after breach by hacker

Belgian web certificate authority (CA) GlobalSign is back online after investigating claims by the hacker who breached the Dutch DigiNotar CA that its systems had also been breached. Continue Reading

By

• Warwick Ashford, Senior analyst

Web security certificate breach widens

GlobalSign, the fifth largest digital certificate issuer, has suspended the issuing of authentication certificates for websites after the DigiNotar hacker claimed to have breached its systems Continue Reading

By

• Warwick Ashford, Senior analyst

University challenge: using IT to improve services and reduce costs

Universities face a balancing act as they become increasingly expected to improve the experiences of more demanding students while making budgets go further, and IT is a critical tool in finding this balance. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Nike+ problems demonstrate the risk of social media success

The rewards for creating a customer-focused online community are huge. But success comes at a price, as recent issues encountered by Nike's Nike+ running site illustrate. Matt Scott investigates. Continue Reading

By

• Matt Scott, TechTarget

DigiNotar certificate authority breach: Why it matters

There has been much speculation around the identity and motive of the hacker who was able to breach DigiNotar and issue fraudulent digital certificates for hundreds of websites, but putting such speculation aside, what is the broader significance of the incident? Continue Reading

By

• Warwick Ashford, Senior analyst

ICO slams Scottish Children’s Reporter Administration for data breaches

The Information Commissioner's Office has criticised the Scottish Children's Reporter Administration for twice leaking sensitive personal information about young children in breach of the Data Protection Act. Continue Reading

By

• Warwick Ashford, Senior analyst

Orange restores broadband customers' e-mail account access but loses data

A problem with Orange e-mail – which locked out broadband customers – has been partly fixed as access to the accounts is restored, but weeks of e-mails may be lost. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Facebook pays security bug bounty hunters $40,000 in three weeks

Facebook has revealed its security bug bounty initiative has paid out more than $40,000 in just three weeks – but has not revealed how many security vulnerabilities have been reported or how many have been fixed. Continue Reading

By

• Warwick Ashford, Senior analyst

Lack of soft skills training is curbing IT career progression

Employers are failing to provide IT professionals with the business... Continue Reading

By

• Jenny Williams, University of Gloucestershire

Map your data classification policy to controls effectively: How-to

Data classification policy plays an important role in control implementation and effectiveness. We take a look at the involved parameters. Continue Reading

By

• Vishal Gupta

Scholarships aim to encourage women to pursue cybersecurity careers

To boost the percentage of women in IT security careers, (ISC)2 has instituted two new scholarships, each totalling up to $40,000 per year. Continue Reading

By

• Ron Condon

OpenVAS how-to: Creating a vulnerability assessment report

In this OpenVAS how-to, learn how to use the free scanner to create a vulnerability assessment report and assess threat levels. Continue Reading

By

• Mike McLaughlin, Contributor

A handy Nessus tutorial

A powerful vulnerability scanner, Nessus is a utility that infosec pros swear by. If you plan to adopt this tool, our Nessus tutorial has all the details. Continue Reading

By

• SearchSecurity.in Staff

Metasploit tutorial 3 – Database configuration & post exploit affairs

Part three of our Metasploit tutorial covers database configuration in Metasploit and what needs to be done subsequent to exploitation using Metasploit. Continue Reading

By

• Karthik Poojary, Amazon

Why major IT projects are more likely to fail than any others

Major IT projects are 20 times more likely to fail than other business initiatives because project managers are ignoring unpredictable events, says a major research study by Oxford University. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Failed IT projects demolish big businesses and executive careers, say researchers

IT projects spinning out of control in the public and private sector are ending the careers of senior executives and causing entire businesses to collapse. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

Social Engineer Toolkit (SET) tutorial for penetration testers

A social engineering toolkit helps address the human element aspect of penetration testing. Learn how to use Social Engineer Toolkit with this tutorial. Continue Reading

By

• Karthik R, Contributor

IT and marketing: working together for business success

The IT department builds things that scale and last, while marketing wants the next big thing - and needed it yesterday. How can heads of technology work effectively with marketing? Cliff Saran investigates Continue Reading

By

• Cliff Saran, Managing Editor

What does HP's Autonomy acquisition mean for the UK tech sector?

HP's bombshell announcement that it is to acquire Autonomy has left many questioning where this leaves the UK software industry. Computer Weekly asks the experts what the deal means for UK home-grown tech talent and what HP is likely to achieve with the latest addition to its portfolio. Continue Reading

By

• Kathleen Hall, TechTarget

Customers may think twice about HP as PC business looks uncertain

As HP announces a major shake-up of its product range and services, analysts warn customers could think twice about HP contracts as a result of uncertainty surrounding its PC business. Continue Reading

By

• Jenny Williams, University of Gloucestershire

NHS trusts already planning a way out of National Programme contracts

NHS trusts in the National Programme for IT's beleaguered southern region have already begun drafting specifications for systems that may replace those supplied under the controversial project. Continue Reading

By

• Mark Ballard

UK business should educate internally to get the right IT security skills at lower cost

UK businesses should look to internal training to meet future IT security needs rather than paying high prices by competing to recruit scarce skills externally, warn experts. Continue Reading

By

• Warwick Ashford, Senior analyst

IPv6: The security risks to business

IT security professionals say the security holes that will open up in many business organisations as the world moves over to internet protocol version six (IPv6) constitute a substantial security concern Continue Reading

By

• Warwick Ashford, Senior analyst

Information Commissioner calls for more privacy improvements at Google

The Information Commissioner's Office says an audit at Google's London office shows the company has taken reasonable steps to improve its privacy policies, but could do more. Continue Reading

By

• Warwick Ashford, Senior analyst

Government must change the way it stores citizens' personal data, calls the EHRC

The government must bring in changes to better protect personal information, calls the Equality and Human Rights Commission. Continue Reading

By

• Kathleen Hall

Adobe issues security updates for Flash, Shockwave, Photoshop and RoboHelp

Adobe has issued fixes for vulnerabilities in Flash, Shockwave, Photoshop, RoboHelp and Flash Media Server in the latest security update. Continue Reading

By

• Warwick Ashford, Senior analyst

Ten-year-old hacker exposes exploitable flaws in Apple and Android games

A 10-year-old Californian hacker has exposed a new type of security vulnerability in many mobile games at a hacker conference in Las Vegas. Continue Reading

By

• Warwick Ashford, Senior analyst

Blackberry to co-operate with police after youths used BBM to organise riots

Research in Motion has said that it will co-operate with the police after it was revealed that London rioters used Blackberry Messenger rather than Twitter to organise looting sprees across the capital, with violence later spreading to Birmingham, Liverpool, Nottingham and Bristol. Continue Reading

By

• Kathleen Hall, TechTarget

Customer data privacy program poised to roll out at Airtel

Airtel’s customer data privacy program will roll out in phases. With the pilot almost completed, Airtel is confident of meeting data privacy regulations. Continue Reading

By

• Varun Haran, Reporter

Best practices for audit, log review for IT security investigations

Device logs can be one of the most helpful tools infosec pros have, or they can be a huge waste of space. Continue Reading

By

• Michael Cobb

US standards body issues warning to energy suppliers over cyber attacks

A US energy industry standards body has warned suppliers to improve their defences against cyber attacks. Continue Reading

By

• Warwick Ashford, Senior analyst

Toxic National Programme for IT contracts to be housed under one body

Billions of pounds of toxic IT contract exposures at the Department for Health could be housed under one central unit, according to reports. Continue Reading

By

• Kathleen Hall, TechTarget

Microsoft slots 22 patches for August Patch Tuesday

Windows, IE, Visio, .Net, Visual Studio and Report Viewer to get security updates; updated version of Windows Malicious Software Removal Tool on charts. Continue Reading

By

• SearchSecurity.in Staff

NIST SP 800-30 standard for technical risk assessment: An evaluation

Risk assessment with NIST SP 800-30 focuses on securing IT infrastructure. Find out NIST SP 800-30 strengths, and learn how it differs from other standards. Continue Reading

By

• Dharshan Shanthamurthy

Case Study: Data encryption at the Salvation Army

The Salvation Army in the UK supports flexible working from home using laptops owned by the charity, but says finding a good way of protecting data was a challenge. Continue Reading

By

• Warwick Ashford

Missing USB drive, found in pub, contained unencrypted data

The ICO says two housing groups must improve data security after a contractor’s missing USB drive, containing unencrypted data, was found in a pub. Continue Reading

By

• Ron Condon

Hotmail makes sign-in changes, can't please everyone

The Hotmail sign-in page is in the news this week, with subtle changes to browser auto-complete behaviour to provide wider browser compatibility. Continue Reading

By

• Stephen Gillies, editor

NHS trust forced to adopt National Programme patient records system or face £8.8m fine

An NHS trust was forced to buy care records software through the National Programme for IT or face the threat of an £8.8m fine - even though it had a longstanding supplier in place. Continue Reading

By

• Mark Ballard

Former government CIO John Suffolk joins Huawei as head of cybersecurity

Former government CIO John Suffolk has joined China-based IT company Huawei as global head of cybersecurity. Continue Reading

By

• Kathleen Hall, TechTarget

Highlights from 'A recipe for rip-offs' - the Select Committee report on government IT

The Public Administration Select Committee has published a scathingly critical report on government's use of IT. We've chosen a selection of the highlights from the report. Continue Reading

By

• Bryan Glick, Editor in chief

Website secure login: Alternatives to out-of-wallet questions

Learn about alternatives to static knowledge-based authentication and out-of-wallet questions for secure website logins in this tip. Continue Reading

By

• Michael Cobb

Metasploit Pro 4.0 adds support for cloud, SIEM systems

Rapid7 releases Metasploit Pro version 4 with improved automation features and new SIEM and cloud-based pen-testing support. Continue Reading

By

• SearchSecurity.in Staff

Computer glitch halts Post Office card transactions

Customers have been unable to complete card transactions at the Post Office after a computer glitch across all branches... Continue Reading

By

• Jenny Williams, University of Gloucestershire

Metasploit tutorial part 2: Using meterpreter

Part two of our Metasploit tutorial covers usage details of the meterpreter post-exploitation tool in Metasploit to create exploits that evade detection. Continue Reading

By

• Karthik Poojary, Amazon

US House of Representatives committee approves cybersecurity standards bill

The US House of Representatives has passed a bill designed to increase education, research and development to counteract cyberthreats. Continue Reading

By

• Warwick Ashford, Senior analyst

Automated web application attacks are the top security threat, study reveals

Websites are attacked about 27 times an hour or once every two minutes on average, peaking at 25,000 attacks a minute or seven a second, according to research... Continue Reading

By

• Warwick Ashford

UK confirms international cyber rules conference

UK foreign secretary William Hague has confirmed that the government is to host an international conference on cyberspace in London on 1 and 2 November 2011. Continue Reading

By

• Warwick Ashford, Senior analyst

British Computer Society – the case for change

A year on from the BCS extraordinary general meeting (EGM), Amit Bhagwat looks at how BCS has evolved, why the EGM came about and gave the results that it did, what has followed since and, how BCS might consider its future from here. Continue Reading

By

• Amit Bhagwat

Securitytube.net releases WLAN security megaprimer

The Hacker News (THN) has reported that the latest SecurityTube.net release includes a 4.2Gb DVD containing over 40+ HD quality videos of their WLAN Security Megaprimer. Continue Reading

By

• Stephen Gillies, editor

Trend Micro aims to secure consumer mobile devices for enterprises

Security firm Trend Micro has announced an enterprise mobile management product to help organisations integrate consumer devices into an enterprise environment in a secure way. Continue Reading

By

• Warwick Ashford, Senior analyst

Hacking group Anonymous claims to have hacked into NATO servers and stolen data

Hacking group Anonymous has claimed to have hacked into NATO servers, according to the Blottr.com news service. Continue Reading

By

• Warwick Ashford, Senior analyst

(ISC)² publishes official guide to CSSLP

Information security body (ISC)² has published the only official guide to the Certified Secure Software Lifecycle Professional (CSSLP) certification. Continue Reading

By

• Warwick Ashford, Senior analyst

Data breach at York University highlights urgency of security checks, says ICO

The University of York's accidental breach of thousands of students' personal data points to a need for improved security checks, according to the Information Commissioner's Office. Continue Reading

By

• Warwick Ashford, Senior analyst

Nmap tutorial: Nmap scan examples for vulnerability discovery

Learn how to use Nmap, the free network scanner tool, to identify various network devices and interpret network data to uncover possible vulnerabilities. Continue Reading

By

• Mike McLaughlin

Microsoft offers bounty in hunt for Rustock spambot operators

A $250,000 reward is being offered to anyone who provides new information that results in the identification, arrest and criminal conviction of the cybercriminals behind the Rustock botnet. Continue Reading

By

• Robert Westervelt, TechTarget

Managing iPads in enterprise networks

These days users expect to be able to use their iPads inside the business and as thousands of software vendors release applications for the iOS platform which provide data mobility and usability benefits to employees, the prospect of the iPad as a business device is becoming a forced reality. Continue Reading

By

• Stephen Gillies, editor

OCTAVE risk assessment method examined up close

The OCTAVE risk assessment method is unique in that it follows a self-directed approach to risk assessment. Leverage its strengths with this expert tip. Continue Reading

By

• Dharshan Shantamurthy

Central government staff lack skills in IT

A significant proportion of civil servants lack skills in areas such as IT, a National Audit Office report has found. Continue Reading

By

• Kathleen Hall, TechTarget

SAP security tutorial: Top 10 SAP security implementation steps

Implementing SAP software securely isn't only the job of SAP specialists; the entire IT department has a role to play. Learn the top ten steps to a secure SAP implementation. Continue Reading

By

• Richard Hunt, Turnkey Consulting

Metasploit tutorial part 1: Inside the Metasploit framework

In part one of our Metasploit tutorial, learn the framework’s basics, to use it for vulnerability scans and create a simple exploit on a target system. Continue Reading

By

• Karthik Poojary, Amazon

Cyber terrorism set to increase after al-Qaeda calls for more cyber attacks, says government

Cyber terrorism will become an increasing problem as the tools and techniques needed for cyber attacks become more widely available, according to a report on the government's new counter-terrorism strategy. Continue Reading

By

• Kathleen Hall, TechTarget

Microsoft packs a lot into July’s four Patch Tuesday security updates

Microsoft is to release only four security updates in this month's Patch Tuesday security update, but these will cover 22 vulnerabilities in Windows and Office. Continue Reading

By

• Warwick Ashford, Senior analyst

Businesses understand social media risks but fail to take precautions, says survey

Businesses are using social media without taking adequate measures to monitor staff activity, which could open them up to security attacks and create compliance risks. Continue Reading

By

• Karl Flinders, Chief reporter and senior editor EMEA

FireControl project failed because of inadequate EADS contract, MPs told

The failure of the canned £469m FireControl project was due to an inadequate IT contract, MPs were told at a Public Accounts Committee (PAC). Continue Reading

By

• Kathleen Hall, TechTarget

ICO calls on UK businesses to open their doors to audits and reduce data breaches

Private enterprises make up a third of data security breach claims, but despite this, many continue to resist the offer of an audit by the Information Commissioner's Office (ICO), according to the privacy watchdog's latest annual report. Continue Reading

By

• Warwick Ashford, Senior analyst

Network security case study: College’s NAC virtual appliance makes grade

Wellington College’s network security case study explains how a NAC virtualization appliance blocks malware and provides increased capacity on demand. Continue Reading

By

• Ron Condon

ICO issues warning over NHS Data Protection Act breaches

Following five more NHS Data Protection Act violations, the Information Commissioner’s Office will redouble efforts to help NHS improve security. Continue Reading

By

• Ron Condon

Hulu withdraws Facebook Connect feature after software glitch leaked users' data

US online video service Hulu has withdrawn its Facebook Connect integration because of security problems discovered soon after launch. Continue Reading

By

• Warwick Ashford, Senior analyst

Hacker group Anonymous steals user names and passwords in cyber attack on Apple

Hacker group Anonymous claims to have stolen 25 internal user names and passwords from Apple in the latest of a series of attacks on government and corporate websites around the world. Continue Reading

By

• Warwick Ashford, Senior analyst

Cyber criminals deploy TDL-4 virus to create indestructible botnet of 4.5m computers

Over 4.5 million computers around the world have been infected by the TDL-4 virus, creating an indestructible botnet. Continue Reading

By

• Kathleen Hall, TechTarget

Apple fixes 39 bugs in Snow Leopard, preps for Lion release

Releases final non-security update - v10.6.8- for Snow Leopard OS, which fixes 39 flaws. More details inside. Continue Reading

By

• SearchSecurity.in Staff

Japan earthquake and tsunami provides first real test of high-tech disaster recovery, says Microsoft

Japan's earthquake and tsunami that killed at least 15,000 people and left 11,000 missing in March 2011 was the first real test of disaster recovery and business continuity plans on a large scale in a high-tech country, according to Microsoft. Continue Reading

By

• Warwick Ashford, Senior analyst

Update software to reduce risk of cyber attack, top suppliers tell business

Businesses are unnecessarily exposing themselves to cyber attack simply by failing to update to the latest versions of the software they are running, according to Microsoft and Adobe. Continue Reading

By

• Warwick Ashford, Senior analyst

Lulz Security announces it is to disband following 50-day hacking spree 'cruise'

Lulz Security – a group of hackers claiming responsibility for hacking Sony and Nintendo and taking down the websites of the Serious Organised Crime Agency and the US Senate – has announced it is to disband. Continue Reading

By

• Kathleen Hall, TechTarget

Cisco introduces AnyConnect to mobile devices

The benefits of enabling your workforce with mobile access to enterprise applications, regardless of whether those applications are in the cloud or in the corporate data centre, are clearly recognised. The ease of providing secure remote access to employees, and the ability to maintain corporate data security policies is, however, not simple. Continue Reading

By

• Stephen Gillies, editor

Tesco Bank customers remain locked out of accounts following migration glitch

Tesco Bank customers are still unable to log into accounts following a migration glitch. Continue Reading

By

• Jenny Williams, University of Gloucestershire

McAfee releases Android end point security solution

McAfee have announced McAfee Mobile Security software, available for both smartphones and tablets, which according to a recent press release provides a comprehensive mobile security solution by combining three leading McAfee mobile security products: WaveSecure, VirusScan Mobile and SiteAdvisor® for Android. Continue Reading

By

• Stephen Gillies, editor

European Commission gives green light to CSC acquisition of beleaguered iSoft

The European Commission (EC) has approved CSC's acquisition of healthcare software maker iSoft. Continue Reading

By

• Kathleen Hall, TechTarget

Mozilla releases final version of Firefox 5 for download

Mozilla has released a fifth version of its web browser, Firefox, available to download for Windows, Mac, Linux and Android. Continue Reading

By

• Jenny Williams, University of Gloucestershire

Security awareness tips: Making programmes more effective

Several information security pros, via LinkedIn, share their best security awareness tips with SearchSecurity.co.UK. Continue Reading

By

• Ron Condon

Top incident response steps: Incident response team responsibilities

Do you know the proper incident response steps to handle a breach? Expert Davy Winder covers how to manage incident response team responsibilities. Continue Reading

By

• Davey Winder

How to combat advanced persistent threats: APT strategies to protect your organisation

Simple defence strategies will go a long way to preparing businesses for APTs Continue Reading

By

• Warwick Ashford, Senior analyst

Demystifying IT Rules 2011: What it means for you

The first of a two-part series on the IT Rules 2011 notification under IT Act 2000, looking into its stipulations and their implications for businesses. Continue Reading

By

• Varun Haran, Reporter

Chinese software flaw makes infrastructure vulnerable, warns report

China's public infrastructure is vulnerable to cyber attack because of vulnerabilities in software used to run weapons systems, utilities and chemical plants, according to Reuters. Continue Reading

By

• Warwick Ashford

NHS pays £200m advance to CSC as contract renegotiation nears conclusion

The NHS has paid £200m to troubled supplier CSC as an advance while awaiting the conclusion of discussions on amendments to the controversial deal. Continue Reading

By

• Bryan Glick, Editor in chief

Leveraging ISO 27005 standard’s risk assessment capabilities

In this first of a series of articles on risk assessment standards, we look at the latest in the ISO stable; ISO 27005’s risk assessment capabilities. Continue Reading

By

• Dharshan Shanthamurthy

Government to create market for personal identity data

The government is preparing to create a marketplace for citizens' personal data to be used for accessing online public services, according to documents that were issued to industry in preparation for the coalition's next-generation identity scheme. Continue Reading

By

• Mark Ballard

Busy Patch Tuesday sees 16 Microsoft fixes coincide with Adobe security update release

IT administrators will find their hands full this month with Microsoft planning 16 security updates to fix 34 vulnerabilities on the same day as security updates from Adobe. Continue Reading

By

• Warwick Ashford, Senior analyst

Former T-Mobile employees ordered to pay nearly £80,000 for data theft

The Chester Crown Court has ordered two former employees of UK mobile operator T-Mobile to pay a total of £73,700 after stealing and selling customer data from the company in 2008. Continue Reading

By

• Warwick Ashford, Senior analyst

Nessus Android application extends vulnerability scanner’s mobile reach

Free Android app for Nessus Vulnerability scanner released by developers, Tenable Network Security Inc; extends Nessus’s existing support for iOS devices. Continue Reading

By

• SearchSecurity.in Staff

Adobe patches Flash to fix zero-day XSS vulnerability

‘Important’ cross-site scripting vulnerability in Flash Player on all platforms mitigated to combat zero-day attacks in the wild. Continue Reading

By

• SearchSecurity.IN Staff

UK government to propose national website blocking list

The UK government is considering setting up a national blocking list of violent and unlawful websites in plans to tackle radicalisation to be unveiled by Home Secretary Theresa May. Continue Reading

By

• Warwick Ashford, Senior analyst

Hacker group Anonymous steals 10,000 Iranian government e-mails

Hacking group Anonymous has hacked into Iranian government servers and stolen more than 10,000 e-mail messages from the Ministry of Foreign Affairs, say US reports. Continue Reading

By

• Warwick Ashford, Senior analyst

E-mail accounts of senior US officials targeted in Chinese hack attack

Chinese hackers have accessed the accounts of hundreds of Gmail users, including senior US officials, Chinese political activists, military personnel, journalists and officials in several Asian countries, Google has said. Continue Reading

By

• Kathleen Hall, TechTarget

World IPv6 Day coming June 8 - what should you be doing?

On 8 June, 2011, a number of large networks will offer their content over IPv6 for a 24-hour “test flight”. Continue Reading

By

• Stephen Gillies, Editor

Four handy botnet detection techniques and tools: A tutorial

This tutorial will help you determine the right techniques and tools for effective botnet detection. Continue Reading

By

• Karthik R, Contributor

Case study: Invensys saves £546,000 with SMS tokens for 150,000 users

Engineering firm Invensys is embarking on a global roll-out of software-based tokens from SecurEnvoy to replace physical token-based authentication. Continue Reading

By

• Cliff Saran, Managing Editor

DWP prepares alternative to identity cards for Universal Credit

The Department for Work and Pensions (DWP) is grooming a British tech start-up to play a key role in its £2bn Universal Credit benefits system. Continue Reading

By

• Mark Ballard

Cross-site scripting attack on Hotmail highlights personal e-mail risk to business

A vulnerability in the Hotmail site has enabled hackers to steal an unknown number of messages from users' accounts, according to security firm Trend Micro. Continue Reading

By

• Warwick Ashford, Senior analyst