Application Security


Today's Approach to Security is Broken

By Anthony Caruana | 17 April, 2014 12:40 | 2 Comments

Over the last month I've attended four international events that have had a focus on security. And there's one data point that ought to have every CSO, CISO and CIO out there worried. Despite more money than ever being spent on security – and the amount is increasing – the amount of money being lost as a result of security breaches is rising at an even greater rate.

Symantec draws new security picture

By Anthony Caruana | 14 April, 2014 08:41

With a background that started at computer store back in the 1990's, Symantec's COO Stephen Gillett has climbed the corporate ladder rapidly. After being spotted by the Chairman of the largest hospital chain in the Pacific northwest of the USA while working at Office Depot, he was appointed as the IT manager of a new hospital. After moving from that to his own start up, he became the CIO of Starbucks at the age of 31. He's now the COO of Symantec.

Heartbleed panic drives flood of enquiries to Symantec's Melbourne CA

By David Braue | 14 April, 2014 08:34

While security vendors weigh their product ranges for vulnerability to the recently discovered 'Heartbleed' bug, Symantec's massive digital certificate infrastructure remains secure – but the company is advising customers to update the vulnerable OpenSSL code and then regenerate their public key infrastructure (PKI) private keys, according to its Melbourne-based senior principal systems engineer Nick Savvides.

Confirmed: hackers can use Heartbleed to steal private SSL keys

By Liam Tung | 14 April, 2014 08:23

Researchers have proven the Heartbleed OpenSSL bug can be used to extract private keys from a vulnerable web server, giving affected services concrete evidence they do need to revoke and reissue private SSL certificates.

Microsoft confirms HTTP Strict Transport Security for IE 12

By Liam Tung | 07 April, 2014 08:22

Microsoft’s next major release of Internet Explorer (IE) will support an internet standard that allows web servers to force browsers to make a secured connection when the site supports encryption.


USB Secure Flash Drive Product Review

By Enex Testlab | 24 August, 2011 12:04 | 3 Comments

A vast majority of today’s workforce use USB memory sticks, they offer unequalled convenience for transferring data. In most situations, if the data is not confidential, a standard USB stick quite acceptable, but what do you use if your data is sensitive?

WatchGuard XCS770R Email Security Appliance Review

By Enex Testlab | 22 June, 2011 20:04

In order to improve productivity and minimise risk, most organisations need a reliable method of protecting their employees from unwanted email (spam) and malicious software (malware). In addition, it is also necessary to protect the corporate network by restricting access to inappropriate content.


Tips and tricks for protecting Android devices

By Eric Geier | 29 August, 2011 13:59

Android doesn't rival BlackBerry when it comes to security and enterprise support. But Android devices can still be reasonably secure. Here are some tips to help you protect your investment, privacy and data.

USB devices: The big hole in network security

By Ellen Messmer | 24 August, 2011 12:42

Ponemon Institute asked 745 information-technology and security managers whether USB drives were important for business use, and if they were secure. What did the survey find?

20 useful IT security Web sites

By Jon Brodkin | 08 April, 2008 09:50

Bookmarking these sites will help you protect your network, comply with government regulations and stay ahead of all the latest threats.


NEWS FOCUS: Cyber-espionage attacks threaten corporate data in new unrelenting ways

By Ellen Messmer | 08 August, 2011 20:26

Stealthy, sometime long-term cyber-espionage attacks to steal sensitive proprietary information -- what some now call "advanced persistent threats" (APT) -- have become a top worry for businesses.

NEWS FEATURE: Debate rages over how to manage personal mobile devices used for work

By Ellen Messmer | 28 July, 2011 06:47

Increasingly, businesses accept the idea that employees should be able to use their personal mobile devices, such as smartphones and tablets, for work. But debate is raging as to whether these employee-owned devices should be managed and secured exactly as corporate-owned devices might be.

5 open source security projects to watch

By Rodney Gedda | 20 January, 2011 11:23 | 1 Comment

Data security is always top of mind for CIOs and CSOs, and there is no shortage of challenges when it comes to picking the right tool for the job. With network and software vulnerabilities growing at a perpetual rate, good security software can help defend against many of the large-scale threats that occur locally and from all over the Internet. In this edition of 5 open source things to watch, we take a look at security products that will guard against threats without robbing your kitty.

5 'Great' Open-source Desktop Security Applications

By Joseph Guarino | 01 April, 2010 05:12

Contributions from free and open software makers can be found throughout the tech world. From your datacenter to the desktop and everywhere in between; there's an open solution to your computing needs. This is no less true in information security. My focus in this article is the several outstanding information security desktop tools that personify the innovation and ingenuity of the FOSS (Free and Open Source Software) world. Please keep in mind that all of these applications (except one) are cross-platform so you can find appropriate versions on whatever you run (BSD, Mac OSX, Linux or Windows). The examples herein, however, will be catered to the largest install base (statistically): Microsoft Windows.

Windows 7 Tips: Best Security Features

By Shane O'Neill | 04 February, 2010 04:52

For both enterprises and consumers, one of the big draws of Windows 7 has been its tighter security features.


Ten tips to secure client VPNs

By Martin Heller | 03 October, 2006 14:31

If you have given your trusted employees and key contractors remote access to your network via a client virtual private network (VPN), congratulations! By now, you have seen the productivity and cost benefits from allowing collaboration that surmounts geographical separation.


The Industrialisation of Hacking

By Chris Wood | 26 October, 2012 16:02

The Industrial Revolution transformed four key aspects of society—innovation, transportation, communication and financial markets—changing the world forever. Although it began more than 200 years ago, there are surprising some parallels between this historically transformative period and IT security. The dynamics of the threat landscape and the increasing complexity of IT environments have given rise to a new era: The ‘Industrialisation of Hacking’.

Winning in the modern threat landscape

By CSO staff | 30 August, 2012 13:45

There are three major attack vectors which must remain secure. Insider threats are related to users who interact with data. Opportunistic attacks deal with understanding the threat scape and global threat intelligence. Targeted attacks are related to internal intelligence; for example, where are my critical assets? What are they vulnerable to? Where are my counter measures? With a strong security connected framework we can begin to address all of these with one centralized security solution that is capable of looking at everything from endpoint, network, to data security. This webcast proposes best practices for: • Understanding and protect against insider, opportunistic and targeted attacks • Integrating the threatscape with one security solution that incorporates all types of attacks • Bringing together endpoint, network and data security into one unified control

Part 1:The business drivers and technology basics of two-factor or multi-factor authentication

By Mike Ryan | 07 May, 2012 13:50 | 2 Comments

The Prime Minister’s Department invited submissions to “Cyber Security White Paper” late in 2011. This is Brass Razoo’s submission that prosecuted the case for Australia to adopt a federated multi-factor authentication that could be deployed nationally. By extending existing identification systems administered by Government and Financial Service providers, the nation could build an identification and security system that would be the envy of the world.

Opinion: The Wild List

By Ian Hyndman | 13 July, 2011 17:27

The WildList is a compilation of sample viruses that have been submitted by security professionals from around the world. It is published each month to a select group of subscribers. Contributors can be any security professional, but the sample must be submitted by at least two respected sources before it will be included in the list.

Opinions: The sorry state of application security

By Matthew Hackling | 11 July, 2011 10:17

Application security is currently one of the major battlegrounds in information security. Compromised web applications are ransacked for credit card numbers, personally identifiable information and is a major vector for spreading crimeware enabling criminals to defraud our banking institutions

CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Identity & Security Management

Identity and Security Management

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).

  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.