News

Barracuda doubles capacity of cloud storage, retains pricing

By Lucas Mearian | 04 August, 2011 20:21

Barracuda Networks Inc. today announced it has doubled the capacity available to customers of its backup service while keeping the price the same.

Amazon boosts identity management, private cloud offerings

By Nancy Gohring | 04 August, 2011 17:07

Amazon Web Services will introduce new capabilities for enterprises on Thursday, including identity federation and support for private network connections to AWS.

15 incredibly useful (and free) Microsoft tools for IT pros

By Sandro Villinger | 04 August, 2011 10:36

We've dug through the jungle that is Microsoft Downloads and found 15 of the best free tools you've probably never heard of.

IEEE to create anti-malware “packer” validation system

By Liam Tung | 04 August, 2011 09:55

Standards body the IEEE has called for proposals to build a catalogue of people using binary “packers”, the software tools often used by malware writers to hide executable files from antivirus products.

McAfee, RSA: the entire Fortune 500 is compromised

By Liam Tung | 04 August, 2011 09:35

Every major corporation harbouring valuable information has been compromised, but only some know it, according to executives at McAfee and RSA.

Metasploit 4.0 sets the stage for mass penetration testing

By Joab Jackson | 04 August, 2011 07:05

Security product provider Rapid7 has updated its widely used open-source Metasploit exploitation framework, expanding the software so it supports enterprise IT security staff as well as its core audience of penetration testers.

Take cyberthreats seriously, says counter-terrorism expert

By Jaikumar Vijayan | 04 August, 2011 06:17

LAS VEGAS --Warnings about emerging cyberthreats shouldn't be treated with the same skepticism that many government officials showed toward the alarms sounded prior to the Sept. 11, 2001, terrorist attacks, warned a leading counter-terrorism at the BlackHat security conference here Wednesday.

Mobile device security: Questions to ask for creating policy

By Joan Goodchild | 04 August, 2011 05:40

While 69 percent of organizations have employees using personal devices to connect to their corporate network, more than one-fifth, or 21 percent, currently have no policy in place to govern the use of personal mobile devices on their network. These new figures, released recently from security-products firm Courion, suggest many security leaders are still ignoring the need to address mobile-device management among their employees.

Mobile malware is on the rise, but there's no need to panic

By Armando Rodriguez | 04 August, 2011 05:24

Using data collected from its Mobile Threat Network, Lookout today released a full report on the state of mobile malware and security. The report covers both Android and iOS, and compares the risks that both platforms face. You can view and download the full report on Lookout's blog, but here are a few of the highlights:

Apple gets serious about iPad security, is it enough?

By Tom Kaneshige | 04 August, 2011 03:54

Soon, SAP hopes to sew up a gaping security hole for its 7,000 iPad-toting employees. The Germany-based tech giant is beta testing a product that will allow it to send PGP-encrypted confidential email to employees. In turn, employees will be able to decrypt them using a Symantec viewer iPad app.

US warns Anonymous, LulzSec could up their game

By Jeremy Kirk | 04 August, 2011 01:29

Hacker groups such as Anonymous and Lulz Security may need to be monitored more closely in the event they are assisted by other hackers with higher skill levels and decide to strike critical infrastructure.

Microsoft incorrectly claims drop in vulnerabilities that allow remote code execution

By Jon Brodkin | 03 August, 2011 23:43

In its latest annual security report, Microsoft claimed some progress in fending off vulnerabilities that allow remote code execution.

Password Management: Idiot-Proof Tips

By Rick Broida | 03 August, 2011 23:27 | 1 Comment

Before the Internet, passwords played only a tiny role in everyday life. Think about it: Except for your ATM PIN, what important codes did you need to remember? Probably none. But now, you can’t click a link without hitting another site that requires a password. Doesn’t matter if it’s a big-name destination like Google Docs or Mint.com, or a smaller, more private site such as your local library or company intranet. You want in? Password, please.

Spike in mobile malware doubles Android users' chances of infection

By Gregg Keizer | 03 August, 2011 21:03

An explosion in mobile malware during the last six months has more than doubled the chance that a user's Android smartphone will become infected, a security researcher said today.

Cloud security 101: Are Cloud providers reliable?

By Hamish Barwick | 03 August, 2011 14:30

Companies relying on Cloud services from Amazon were in April left hanging when the Cloud provider’s EC2 went down. For Gartner research director, Rob McMillan, this outage highlighted the need for airtight service level agreements (SLAs) to ensure their provider’s — and therefore their data’s — reliability.

IIIS: Data governance, risk and compliance

By Hamish Barwick | 03 August, 2011 10:37

Data governance, risk and compliance (GRC) should be viewed by IT managers as a business asset rather than something for the law firm to deal with, according to an IDC US senior analyst.

Automation ups the security ante

By Mark Phillips | 03 August, 2011 10:33

Web applications experience 27 attacks per hour on average — roughly one attack every two minutes — according to findings from a US-based data security provider.

As New Whistleblower Rules Kick In

By Karen M. Kroll | 03 August, 2011 10:27

Section 922 of the Dodd-Frank Wall Street Reform and Consumer Protection Act --- increasing the protection for whistleblowers -- amends the Securities and Exchange Act of 1934 by allowing the Securities and Exchange Commission to offer awards to individuals providing original information about a violation of federal securities regulations. Next Friday, on Aug. 12, these whistleblower provisions go into effect.

LulzSec gets Google+ boot, but returns

By Bob Brown | 03 August, 2011 02:45

Hacker group LulzSec ("the world's leaders in high-quality entertainment at your expense") has had its initial Google+ account nixed this week, though LulzSec has quickly and brashly re-emerged with a new one

Check Point has sights set on 1Tbps firewall

By Tim Greene | 03 August, 2011 02:45

Check Point Software has new, heavy-duty security gateway hardware for data centers and service providers, including one chassis that will grow to support a 1Tbps firewall.

CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Fraud Management Solutions

Reduce fraud losses regardless of channel by preventing cybercrime, identity theft, and other threats targeting your customers.

Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.