Application Security

Stealthy, sometime long-term cyber-espionage attacks to steal sensitive proprietary information -- what some now call "advanced persistent threats" (APT) -- have become a top worry for businesses.

Increasingly, businesses accept the idea that employees should be able to use their personal mobile devices, such as smartphones and tablets, for work. But debate is raging as to whether these employee-owned devices should be managed and secured exactly as corporate-owned devices might be.

Data security is always top of mind for CIOs and CSOs, and there is no shortage of challenges when it comes to picking the right tool for the job. With network and software vulnerabilities growing at a perpetual rate, good security software can help defend against many of the large-scale threats that occur locally and from all over the Internet. In this edition of 5 open source things to watch, we take a look at security products that will guard against threats without robbing your kitty.

Contributions from free and open software makers can be found throughout the tech world. From your datacenter to the desktop and everywhere in between; there's an open solution to your computing needs. This is no less true in information security. My focus in this article is the several outstanding information security desktop tools that personify the innovation and ingenuity of the FOSS (Free and Open Source Software) world. Please keep in mind that all of these applications (except one) are cross-platform so you can find appropriate versions on whatever you run (BSD, Mac OSX, Linux or Windows). The examples herein, however, will be catered to the largest install base (statistically): Microsoft Windows.

For both enterprises and consumers, one of the big draws of Windows 7 has been its tighter security features.

If you have given your trusted employees and key contractors remote access to your network via a client virtual private network (VPN), congratulations! By now, you have seen the productivity and cost benefits from allowing collaboration that surmounts geographical separation.

The Industrial Revolution transformed four key aspects of society—innovation, transportation, communication and financial markets—changing the world forever. Although it began more than 200 years ago, there are surprising some parallels between this historically transformative period and IT security. The dynamics of the threat landscape and the increasing complexity of IT environments have given rise to a new era: The ‘Industrialisation of Hacking’.

There are three major attack vectors which must remain secure. Insider threats are related to users who interact with data. Opportunistic attacks deal with understanding the threat scape and global threat intelligence. Targeted attacks are related to internal intelligence; for example, where are my critical assets? What are they vulnerable to? Where are my counter measures? With a strong security connected framework we can begin to address all of these with one centralized security solution that is capable of looking at everything from endpoint, network, to data security. This webcast proposes best practices for: • Understanding and protect against insider, opportunistic and targeted attacks • Integrating the threatscape with one security solution that incorporates all types of attacks • Bringing together endpoint, network and data security into one unified control

The Prime Minister’s Department invited submissions to “Cyber Security White Paper” late in 2011. This is Brass Razoo’s submission that prosecuted the case for Australia to adopt a federated multi-factor authentication that could be deployed nationally. By extending existing identification systems administered by Government and Financial Service providers, the nation could build an identification and security system that would be the envy of the world.

The WildList is a compilation of sample viruses that have been submitted by security professionals from around the world. It is published each month to a select group of subscribers. Contributors can be any security professional, but the sample must be submitted by at least two respected sources before it will be included in the list.

Application security is currently one of the major battlegrounds in information security. Compromised web applications are ransacked for credit card numbers, personally identifiable information and is a major vector for spreading crimeware enabling criminals to defraud our banking institutions