DoS Attack Reveals Widespread Vulnerabilities
By Anthony M. Freed, Director of Business Development, Infosec Island Network
Infosec Island has once again gained exclusive access to a video demonstration of the XerXeS DoS attack recently developed by the infamous patriot-hacker known only as The Jester. As noted in an analysis of DoS vulnerabilities by security consultant Michael Menefee, more than half of all the websites in the world use Apache, which means this exploit potentially poses a very serious problem should it ever be utilized by nefarious elements…
How Twitter Spam Steals From Google, Yahoo!
From the Infosec Island Network
Scammers have been devising ways to ride on someone else’s coattails since the dawn of time. With every new technology they find another way to make money from nothing. I was innocently monitoring my Twitter feed last night when I saw someone tweet “Sophos acquires anti-spam specialist ActiveState.: An article from: Software Industry Report hxxp://censored”. Interesting… I used to work at ActiveState and know we were acquired in 2003. Something was fishy…
DoD Endorses Certification for Hackers
From the Infosec Island Network
The U.S. Department of Defense (DoD) announces the official approval of the EC-Council Certified Ethical Hacker (CEH) certification program as a new baseline skills requirement for U.S.cyber defenders. Specifically, the new Certified Ethical Hacker program is required for the DoD’s computer network defenders (CND’s), a specialized personnel classification within the DoD’s information assurance workforce.
File-Sharing Software Threat to Health Privacy
From the Infosec Island Network
There is a real risk of inadvertent disclosure of PHI through peer-to-peer file sharing networks, although the risk is not as large as for PFI. Anyone keeping PHI on their computers should avoid installing file sharing applications on their computers, or if they have to use such tools, actively manage the risks of inadvertent disclosure of their, their family’s, their clients’, or patients’ PHI…
Outsourcing Breach Response Lowers Costs
By Doug Pollack, Chief Marketing Officer for ID Experts
The Ponemon Institute last month released their 5th annual 2009 Annual Study: Cost of Data Breach. This year, the report explored several new areas and came up with some interesting and in some cases surprising conclusions…
Social Engineering and Enterprise Security
From the Infosec Island Network
What does our enterprise information have in common with President Obama and Vice President Biden? The need for constant protection. Your enterprise data needs protection from the host of technical and human threats that seem to evolve daily. The President and Vice President require the same protection, albeit amplified due to their position in the world power scheme…
21 More Business Sector Breaches from 2009
From the Infosec Island Network
Some of the breaches described in the notifications were reported in the media at the time, but we spotted a number from the business sector that had not been reported in the media or on this site at the time. So here is a brief roundup on another 21 breaches from the business sector last year…
19 More Financial Sector Breaches from 2009
From the Infosec Island Network
Maryland has updated its web site to provide breach notifications that it has received since its last update. The newly posted notifications are for the period ending December 31, 2009, so there will likely be more to come for 2010…
Building Your Own Malware Lab Part One
From the Infosec Island Network
Malicious software pieces like viruses, worms and bots are currently one of the largest threats to the security of the Internet. Antivirus Labs have invested great Money for analyzing and reversing viruses, but for our case we can perform the analysis using some useful tools on our PC…
Road Map for Software Security Architects
From the Infosec Island Network
If you, as a the security architect involved in the security assessment process, are smart, you would have a security framework to meet these requirements. And if you are “lucky” the application designer will have aligned the requirements to the security framework. But, the reality is that even with an architecture supported by standards and guideline, convincing the application developers to follow it is another story…
