|
Virtual Private Networks (VPN) the Insecure Solution
Many organisations have deployed VPN’s as a quick win solution and have suffered as a result of not implementing a full solution. Trinity Security Services’ Consultants have worked with a wide array of customers to solve security issues as a result of hastily rolled out VPN solutions.
http://www.securitypronews.com/2003/1218.html
|
12.18.03 |
|
A White Hat's Penetration Test
This tutorial is more of a “case study”, in which I describe a recent penetration test I performed. Due to the success of the penetration test (in a relatively very short time) I decided to share this experience with you.
http://www.securitypronews.com/2003/1216.html
|
12.16.03 |
|
Securing
Network Resources
Network
attacks are the biggest risk for Windows 2000 servers. Since
the release of the old Windows NT 3.1, hackers have been actively
looking for bugs in Microsoft Windows operating systems. Tools
like SecHole, IISInjector, NAT (NetBIOS Auditing Tool), SMBRelay
and L0pthcrack have been developed to reveal passwords, execute
actions on a server, forge network connections and degrade system
performance. In addition, several critical security vulnerabilities
have been recently released for Windows 2000 that can completely
expose a network to an intruder.
http://www.securitypronews.com/2003/1211.html
|
12.11.03 |
|
Economic
Report: The ROI of Network Integrity
It
has become more difficult to control network security investments,
including escalating labor costs that are growing at the rate
of 31.7% annually. Combine these investments with the surge
in personnel time allocated to security tasks versus network
provisioning responsibilities - at a steep ratio of 3:1 - and
the result is clear: businesses are losing the battle to balance
security with network availability.
http://www.securitypronews.com/2003/1202.html
|
12.02.03 |
|
The
Database Security Checklist
Database
security can jeopardize your network security. The security
administration of your RDBMS (Relational Database Management
System), needs to be focused on preventing the unauthorized
use of your company or business information by criminals.
http://www.securitypronews.com/2003/1120.html
|
11.20.03 |
|
The
Principles of RDBMSs Security
Databases
are a goldmine for criminals. Successfully tracking an intrusion
can depend 100% on administering database accesses and permissions.
Unauthorized user actions, as well as possible intruder actions,
need to be tracked and audited in order to maintain the integrity
of the information stored in the database.
http://www.securitypronews.com/2003/1118.html
|
11.18.03 |
|
Looking
for Trouble: ICMP and IP Statistics to Watch
| During
the US/Canada road show this past two years, I’ve had
the opportunity to share many of my favorite tools, tricks and
techniques for network troubleshooting and cybercrime detection
and testing.
One area that I spend a bit of time on is the Summary Statistics
window provided by EtherPeek – it’s hot! Using
the information provided in the summary statistics window,
I can identify a network that is experiencing the following
traffic behavior:
http://www.securitypronews.com/2003/1028.html
|
10.28.03 |
|
PGP:
The Next Generation
Avoid
the complexities of key management and replace your API driven
PGP implementation with the Presidio Gateway Appliance. Click
below for details on how Forum Systems Presidio can help you
save time and money while better securing your business-to-business
communications.
http://www.securitypronews.com/2003/1022.html
|
10.22.03 |
|
Restricting
Access by Time of Day
Problem
You want a service to be available only at certain times of
day.
Solution
For xinetd, use its access_times attribute. For example, to
make telnetd accessible from 8:00 a.m. until 5:00 p.m. (17:00)
each day:
http://www.securitypronews.com/2003/1016.html
|
10.16.03 |
|
Encrypting
Backups
| Method
1 produces a backup that may be considered fragile: one big
encrypted file. If part of the backup gets corrupted, you might
be unable to decrypt any of it.
Method 2 avoids this problem. The cp -l option creates hard
links, which can only be used within a single filesystem.
http://www.securitypronews.com/2003/1013.html
|
10.13.03 |
|
OS
Fingerprinting with ICMP
Operating
System (OS) fingerprinting is the process of learning what operating
system is running on a device. This can be used by the curious
network administrator when they see a new device on the network.
Most likely, however, OS fingerprinting is done by an unwarranted
party on your network.
http://www.securitypronews.com/2003/0930.html
|
09.30.03 |
|
The
Distributed Denial of Service
Distributed
Denial of Service (DDOS) attacks are a significant threat to
the availability of any company’s networks and systems. In the
last 18 months, the press has reported many high profile DDOS
attacks costing the victims many hundreds of thousands of pounds.
http://www.securitypronews.com/2003/0925.html
|
09.25.03 |
|
ICMP:
The Good, the Bad and the Ugly
The
Internet Control Message Protocol (ICMP) was developed along
side the entire TCP/IP protocol suite as tool for exchanging
simple messages between devices. The messages can indicate that
services or hosts are unavailable or the messages can be used
to test connectivity between devices.
http://www.securitypronews.com/2003/0918.html
|
09.18.03 |
|
Are
you missing these tools to prevent DDoS Attacks & Worms?
The
Captus IPS 4000, continuously monitors and manages the network,
dynamically shaping, throttling, denying and allowing traffic
in response to live traffic conditions. It provides network
administrators with the ability to precisely define and implement
network security and performance policies that align with their
business goals.
http://www.securitypronews.com/2003/0916.html
|
09.16.03 |
|
SNMP
Enumeration and Hacking
SNMP
(Simple Network Management Protocol) is a protocol that never
seems to get the attention it deserves. As a "security expert"
I am quite ashamed to say, that I was not fully aware of all
the intricate possibilities that lie within SNMP, until quite
recently.
http://www.securitypronews.com/2003/0911.html
|
09.11.03 |
|
Secure
Your Online Business Today!
Figuring
out the nuts and bolts of setting up your e-commerce site and
accepting online payments can be time-consuming and complex.
Now let VeriSign help you understand this process—with our FREE
TECHNICAL White Paper.
http://www.securitypronews.com/2003/0909.html
|
09.09.03 |
|
Securing A Wireless Network
Most people know that your wireless/cordless phone is, by itself, pretty insecure. A phone of the same model or a receiver set to the right frequency can easily pick up the transmission – utilizing your phone or listening to your conversation. Luckily, the limited range of these devices and the sheer numbers of them are good limiting factors to this type of privacy breech. Still, a phone with a cord connected to the wall is much more secure than a phone with an antenna.
http://www.securitypronews.com/2003/0827.html
|
08.27.03 |
|
Are
DDoS Attacks, Worms & Port Scans Stoppable?
The Captus
IPS 4000, continuously monitors and manages the network, dynamically shaping,
throttling, denying and allowing traffic in response to live traffic conditions.
It provides network administrators with the ability to precisely define and implement
network security and performance policies that align with their business goals.
http://www.securitypronews.com/2003/0819.html
|
08.19.03 |
|
Windows
DCOM RPC Exploit
Microsoft
originally released this bulletin and patch on July 16, 2003 to correct a security
vulnerability in a Windows Distributed Component Object Model (DCOM) Remote Procedure
Call (RPC) interface. The patch was and still is effective in eliminating the
security vulnerability.
http://www.securitypronews.com/2003/0814.html
|
08.14.03 |
|
Risk
Metrics Needed For IT Security
Business
leaders worldwide are becoming more aware of the importance of assuring the security
of information assets. Information-security issues are among the hottest topics
being addressed in trade media for organizational governance, executive, financial,
audit, and IT leaders. Conferences covering the latest information-security issues,
tools, and problems abound in both the public and private sectors.
http://www.securitypronews.com/2003/0807.html
|
08.07.03 |
|
3 Tips For Securing Your Windows Network Properly
One of the wonderful things about Windows 2000 and Windows server 2003 is that you can delegate administrative tasks in your domains. You no longer have to give full administrative privileges to help desk employees, for example, when you just want them to be able to reset passwords.
http://www.securitypronews.com/2003/0805.html
|
08.05.03 |
|
An
Introduction to Network Firewalls
On this
article series we will review the concept of firewalls, gateways and routers.
Specifically, we will explore the installation, migration and administration secrets
of Microsoft Internet Security and Acceleration Server (ISA) to provide an easy
and hands-on approach for firewall implementers and security managers.
http://www.securitypronews.com/2003/0803.html
|
08.03.03 |
|
Security
Trends
You set
up firewalls, e-mail filtering, Intrusion Detection Systems (IDS), personal firewalls,
Censor Software (both on network and personal level) and they still get in. What
I'm referring to are those pesky VBSes, similar worms inhibiting the Windows platform
right now and maybe a few real life crackers here and there. For the network administrator,
this can be a real problem. Even when he has secured his network with the latest
tools and patches, there is still a big chance of his kingdom getting infected,
especially if it's made up of MS Windows machines, and its trusting users.
http://www.securitypronews.com/2003/0717.html
|
07.17.03 |
|
EtterCap
- ARP Spoofing And Beyond
When it
comes to Network Security, my philosophy is – "You can't afford to know less than
the Hacker." This means that in order to protect ourselves effectively, we need
to understand and experience the same tools and techniques that are used against
us.
http://www.securitypronews.com/2003/0624.html
|
06.24.03 |
|
IDS-Can
You Afford Not To Have One?
Everyone
has an opinion as to the longevity of this type of technology, its validity and
its capabilities as a security tool. Most security professionals will agree that
an IDS cannot be used as your only form of defence. If an IDS is deployed in the
correct manner, that is as part of an overall security program, with the correct
processes and procedures in place governing operation maintenance and incident
handling, can an organisation afford to be without one?
http://www.securitypronews.com/2003/0605.html
|
06.05.03 |
|
Mask
Your Web Server For Enhanced Security
Masking or anonymizing a Web server involves removing identifying details that intruders could use to detect your OS and Web server vendor and version. This information, while providing little or no utility to legitimate users, is often the starting place for crackers, blackhat hackers and "script kiddies".
http://www.securitypronews.com/2003/0508.html
|
05.08.03 |
|
Help
Protect Your On-line Business. Focus on Security. Free Guide.
There's
so much at stake, you can't afford security that's less than the best. As the
value of on-line business increases, so does the risk that a security breach could
seriously damage your company. Passwords can provide weak security, while tokens
and smart cards are expensive and don't scale well.
http://www.securitypronews.com/2003/0430.html
|
04.30.03 |
|
What
Would You Do If Your Company Lost All Of Its Data Tomorrow?
That’s
the nightmare scenario that no one likes to think about. But the fact is that
those nightmares can and do happen to businesess like yours. A whopping 82% of
companies lack adequate data protection – most likely because internal security
management is so costly, time-consuming, and complicated.
http://www.securitypronews.com/2003/0429.html
|
04.29.03 |
|
Windows
2003 leaves security gaps
Although
high speed internet access may not have reached you yet, it probably will soon.
The advantages are obvious, but there's a dark side: security. I'm not going to
talk about the more general aspects of securing your system here (I've done that
in General Security), but only specifically about the issue of clear text passwords
with telnet, pop, and ftp.
http://www.securitypronews.com/2003/0423.html
|
04.23.03 |
|
Remote
User Security: Your IT's Achilles Heel?
According
to a recent survey by the American Business Collaborative, a majority (51%) of
employees work off-site or from remote locations. No wonder the Yankee Group cites
that supporting mobile network connections is the third largest problem facing
enterprises today.
http://www.securitypronews.com/2003/0417.html
|
04.17.03 |
|
Smarter
Security and a FREE iPAQ
In theory,
it’s smart. Make sure your IT and Facilities teams always know what each other
is doing. So users aren’t left with multiple passwords and tokens to access PCs,
networks, VPNs and Web apps – plus a pocketful of ID badges to gain entry into
buildings.
http://www.securitypronews.com/2003/0327.html
|
03.27.03 |
|
Netgear
Takes The Worry out of Wireless Networks
Wireless
connectivity has dramatically improved the way telecommuters, traveling workers,
small companies and branches of large organizations exchange information. Yet
a recent report assembled by wireless network hackers exposed an alarming statistic
- 72% of wireless networks lack even the most basic security measures.
http://www.securitypronews.com/2003/0325.html
|
03.25.03 |
|
How
to Get Rid of Denial-of-Service Attacks
There's
nothing like buying all your fab new networking equipment, setting it up in your
home and having it work perfectly from that moment until the day you move or upgrade.
I say there's nothing like it because that's exactly what I mean. Nothing like
that ever happens.
http://www.securitypronews.com/2003/0320.html
|
03.20.03 |
|
How
One Hosting Company Successfully Weathered Slammer
At approximately
12:30 am EST on January 25, the Sapphire worm – also known as Slammer and SQLExp
– infected more than 120,000 computers, overwhelming many corporate and service
provider networks and disrupting hundreds of thousands of systems worldwide.
http://www.securitypronews.com/2003/0317.html
|
03.17.03 |
|
Defense
In Depth + Review of Alchemy Eye
External
information access from partners and employees is a very important aspect in the
design of security. Corporations need to be assured that their critical servers
are safe from different internet threats. Additionally, because the Web is worldwide,
it is impossible to create a global agreement on what traffic is inappropriate
and how that traffic should be regulated.
http://www.securitypronews.com/2003/0226.html
|
02.26.03 |
|
Free
t-shirt & Free trial-- Fast, friendly backup that's always there for you!
Want a
backup and restore that you can depend on – that you know will always keep your
data there for you? You need BACKUP EXPRESS: Enterprise-wide backup that is fast,
reliable, user-friendly and supports a broad range of technologies.
http://www.securitypronews.com/2003/0224.html
|
02.24.03 |
|
| Anti
Virus Software: Norton, McAfee, Trend Micro, or Hauri?
|
Optimize
Email Security and Usage
Mail Warden,
the anti-spam/anti-virus complete solution provides proactive, multi-tiered content
security for mail servers, protecting your entire company from malicious code,
inappropriate and nonproductive material, harassment, spam and viruses.
http://www.securitypronews.com/2003/0121.html
|
01.21.03 |
|
|
