DataSec Limited
Forensic computing is now an essential part of the fight against fraud and a vital tool in dealing with internal computer misuse. The use of computer evidence is becoming more prevalent in criminal and civil legal proceedings. Computer forensics is now an essential part of commercial risk management.
Thursday, July 18, 2002
Wireless Security Blackpaper
In 1999 the IEEE completed and approved the standard known as 802.11b, and WLANs were born. Finally, computer networks could achieve connectivity with a useable amount of bandwidth without being networked via a wall socket. Suddenly connecting multiple computers in a house to share an Internet connection or play LAN games no longer required expensive or ugly cabling. Business users could get up out of their chairs and sit in the sunshine while they worked. New generations of handheld devices allowed users access to stored data as they walked down the hall to a meeting. The dawn of networking elegance was upon us. Users could set their laptops down anywhere and instantly be granted access to all networking resources. This was, and is, the vision of wireless networks, and what they are capable of delivering.
Fast forward to today. While wireless networks have seen widespread adoption in the home user markets, widely reported and easily exploited holes in the standard security system have stunted wireless' deployment rate in enterprise environments. While many people don't know exactly what the weaknesses are, most have accepted the prevailing wisdom that wireless networks are inherently insecure and nothing can be done about it. Can wireless networks be deployed securely today? What exactly are the security holes in the current standard, and how do they work? Where is wireless security headed in the future? This article attempts to shed light on these questions and others about wireless networking security in an enterprise environment.
In 1999 the IEEE completed and approved the standard known as 802.11b, and WLANs were born. Finally, computer networks could achieve connectivity with a useable amount of bandwidth without being networked via a wall socket. Suddenly connecting multiple computers in a house to share an Internet connection or play LAN games no longer required expensive or ugly cabling. Business users could get up out of their chairs and sit in the sunshine while they worked. New generations of handheld devices allowed users access to stored data as they walked down the hall to a meeting. The dawn of networking elegance was upon us. Users could set their laptops down anywhere and instantly be granted access to all networking resources. This was, and is, the vision of wireless networks, and what they are capable of delivering.
Fast forward to today. While wireless networks have seen widespread adoption in the home user markets, widely reported and easily exploited holes in the standard security system have stunted wireless' deployment rate in enterprise environments. While many people don't know exactly what the weaknesses are, most have accepted the prevailing wisdom that wireless networks are inherently insecure and nothing can be done about it. Can wireless networks be deployed securely today? What exactly are the security holes in the current standard, and how do they work? Where is wireless security headed in the future? This article attempts to shed light on these questions and others about wireless networking security in an enterprise environment.
Center for Internet Security
The Center for Internet Security (CIS) is a not-for-profit cooperative enterprise that helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate security configurations.
CIS members are developing and propagating the widespread application of Security Benchmarks through a global consensus process that brings together industry, government, academia and consultants. CIS Benchmarks enumerate the "When, Why, and How" aspects of technical security configurations across a wide range of operating system platforms and Internet software applications.
The Center for Internet Security (CIS) is a not-for-profit cooperative enterprise that helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate security configurations.
CIS members are developing and propagating the widespread application of Security Benchmarks through a global consensus process that brings together industry, government, academia and consultants. CIS Benchmarks enumerate the "When, Why, and How" aspects of technical security configurations across a wide range of operating system platforms and Internet software applications.
Security of the Internet
As of 1996, the Internet connected an estimated 13 million computers in 195 countries on every continent, even Antarctica (1). The Internet is not a single network, but a worldwide collection of loosely connected networks that are accessible by individual computer hosts in a variety of ways, including gateways, routers, dial-up connections, and Internet service providers. The Internet is easily accessible to anyone with a computer and a network connection. Individuals and organizations worldwide can reach any point on the network without regard to national or geographic boundaries or time of day.
However, along with the convenience and easy access to information come new risks. Among them are the risks that valuable information will be lost, stolen, corrupted, or misused and that the computer systems will be corrupted. If information is recorded electronically and is available on networked computers, it is more vulnerable than if the same information is printed on paper and locked in a file cabinet. Intruders do not need to enter an office or home, and may not even be in the same country. They can steal or tamper with information without touching a piece of paper or a photocopier. They can create new electronic files, run their own programs, and hide evidence of their unauthorized activity.
As of 1996, the Internet connected an estimated 13 million computers in 195 countries on every continent, even Antarctica (1). The Internet is not a single network, but a worldwide collection of loosely connected networks that are accessible by individual computer hosts in a variety of ways, including gateways, routers, dial-up connections, and Internet service providers. The Internet is easily accessible to anyone with a computer and a network connection. Individuals and organizations worldwide can reach any point on the network without regard to national or geographic boundaries or time of day.
However, along with the convenience and easy access to information come new risks. Among them are the risks that valuable information will be lost, stolen, corrupted, or misused and that the computer systems will be corrupted. If information is recorded electronically and is available on networked computers, it is more vulnerable than if the same information is printed on paper and locked in a file cabinet. Intruders do not need to enter an office or home, and may not even be in the same country. They can steal or tamper with information without touching a piece of paper or a photocopier. They can create new electronic files, run their own programs, and hide evidence of their unauthorized activity.
Group proposes PC protection guarantees
Several U.S. government agencies have teamed with an international Internet security organization to support a set of benchmarks aimed at guaranteeing a minimum security standard for computers.
Several U.S. government agencies have teamed with an international Internet security organization to support a set of benchmarks aimed at guaranteeing a minimum security standard for computers.
HiveCache: Distributed Enterprise Online Backups
HiveCache is a new and innovative backup and data restore solution that eliminates the productivity cost of restoring lost data files for IT users by using the spare disk space on PCs within the corporate intranet to store backup data and keep it available for instant file restores. When a data is lost on a PC the most critical need for your users is restoring a couple of files or folders that were being actively worked on when the system crashed or the files were lost due to "pilot error." With HiveCache your users are up and running again in minutes with data from a version of their file stored in the HiveCache distributed backup mesh, eliminating lost user productivity and the time spent by IT staff tending to such requests.
HiveCache is a new and innovative backup and data restore solution that eliminates the productivity cost of restoring lost data files for IT users by using the spare disk space on PCs within the corporate intranet to store backup data and keep it available for instant file restores. When a data is lost on a PC the most critical need for your users is restoring a couple of files or folders that were being actively worked on when the system crashed or the files were lost due to "pilot error." With HiveCache your users are up and running again in minutes with data from a version of their file stored in the HiveCache distributed backup mesh, eliminating lost user productivity and the time spent by IT staff tending to such requests.
Wednesday, July 17, 2002
Only Mostly Dead
PKI is dead. Mercifully. PKI arrived as a gimpy pony in the first place, and by now we are pretty tired of beating a dead horse.
If you think it seems naive to summarily dismiss an entire platform, I would agree. Writing its obit wasn't my idea. It was inspired by a leading PKI vendor.
PKI is dead. Mercifully. PKI arrived as a gimpy pony in the first place, and by now we are pretty tired of beating a dead horse.
If you think it seems naive to summarily dismiss an entire platform, I would agree. Writing its obit wasn't my idea. It was inspired by a leading PKI vendor.
Computer Policy and Law Policy Collection
Welcome to the Computer Policy and Law Policies List! We've worked hard to make this list a very useful resource for policy-makers of all kinds.
Welcome to the Computer Policy and Law Policies List! We've worked hard to make this list a very useful resource for policy-makers of all kinds.
Security holds back Web services
Security issues are the number one roadblock to the adoption of Web services, according to a ZapThink market analyst.
Last week industry pundits claimed that the submission of the latest version of the Web Services Security (WS-Security) specification to international standards body Organization for the Advancement of Structured Information Standards (OASIS) was a move in the right direction.
But Jason Bloomberg, senior analyst at U.S.-based XML and Web services analyst ZapThink, thinks it's still security concerns that are holding Web services back.
Security issues are the number one roadblock to the adoption of Web services, according to a ZapThink market analyst.
Last week industry pundits claimed that the submission of the latest version of the Web Services Security (WS-Security) specification to international standards body Organization for the Advancement of Structured Information Standards (OASIS) was a move in the right direction.
But Jason Bloomberg, senior analyst at U.S.-based XML and Web services analyst ZapThink, thinks it's still security concerns that are holding Web services back.
Tuesday, July 16, 2002
Creating Secure & Fully Managed Bluetooth Networks
REQUIRES REGISTRATION The Bluetooth standard has reached stability with version 1.1; multiple vendors are now shipping their first Bluetooth products; the first commercial applications for Bluetooth are starting to emerge; and the ultimate goal of wide-scale market adoption by the mass consumer market is on the horizon.
The nature of the technology and its application has also undergone a profound change: what started as a concept for a simple, short-range cable replacement technology has evolved into a local wireless networking technology for the delivery voice, video and data services to a enormous range of handheld and mobile devices. To many, Bluetooth will become the ubiquitous standard for in-building wireless networks which complements the revolution occurring in long-range 3 rd generation cellular networks.
REQUIRES REGISTRATION The Bluetooth standard has reached stability with version 1.1; multiple vendors are now shipping their first Bluetooth products; the first commercial applications for Bluetooth are starting to emerge; and the ultimate goal of wide-scale market adoption by the mass consumer market is on the horizon.
The nature of the technology and its application has also undergone a profound change: what started as a concept for a simple, short-range cable replacement technology has evolved into a local wireless networking technology for the delivery voice, video and data services to a enormous range of handheld and mobile devices. To many, Bluetooth will become the ubiquitous standard for in-building wireless networks which complements the revolution occurring in long-range 3 rd generation cellular networks.
Laptop Theft, Know Before You Go: Why Criminals Steal Laptops
10 years ago when travelers were victimized the object of theft was cameras, five years ago it was camcorders, today it’s laptops. Criminals look at laptops as a good return on their “investment”. A good laptop can be worth up to $5,000 dollars. A criminal can sell a stolen laptop to an unsuspecting used computer store or pawnshop and easily receive up to half it’s value in cash. Not too bad when you compare that to the amount of cash a thief would get by targeting your wallet. How much money would they get from you, $60.00? It easy to understand why your laptop is so desirable to a thief. In addition to the obvious monetary benefit, there is also a legal benefit to stealing property vs. someone’s money. Most career criminals know that the penalties for a crime against property (theft) are less severe than those of a crime against a person ( robbery) like stealing money. So to sum it up, laptops are worth more than cash,, and if you are caught stealing them the penalty is less severe.
10 years ago when travelers were victimized the object of theft was cameras, five years ago it was camcorders, today it’s laptops. Criminals look at laptops as a good return on their “investment”. A good laptop can be worth up to $5,000 dollars. A criminal can sell a stolen laptop to an unsuspecting used computer store or pawnshop and easily receive up to half it’s value in cash. Not too bad when you compare that to the amount of cash a thief would get by targeting your wallet. How much money would they get from you, $60.00? It easy to understand why your laptop is so desirable to a thief. In addition to the obvious monetary benefit, there is also a legal benefit to stealing property vs. someone’s money. Most career criminals know that the penalties for a crime against property (theft) are less severe than those of a crime against a person ( robbery) like stealing money. So to sum it up, laptops are worth more than cash,, and if you are caught stealing them the penalty is less severe.
Developing a Company Policy Against laptop Computer Theft
Firewalls, security scanners, antivirus software and other types of security technology aren't enough to prevent high-tech crime. Real prevention begins by formulating a company security policy that details -- among other matters -- what information is valuable and how to protect it."A lot of companies don't have a policy in place," says Patrice Rapalus of the Computer Security Institute in San Francisco. "It's still an area where there needs to be a lot of awareness. Companies don't believe it's a problem."
Firewalls, security scanners, antivirus software and other types of security technology aren't enough to prevent high-tech crime. Real prevention begins by formulating a company security policy that details -- among other matters -- what information is valuable and how to protect it."A lot of companies don't have a policy in place," says Patrice Rapalus of the Computer Security Institute in San Francisco. "It's still an area where there needs to be a lot of awareness. Companies don't believe it's a problem."
Mailbag: Laptop security conspiracy theories
As expected, I received a range of responses to a previous newsletter about whether laptop security was a real or imagined issue. I heard from several readers who told me their tales of laptop theft. Here are few of your responses.
As expected, I received a range of responses to a previous newsletter about whether laptop security was a real or imagined issue. I heard from several readers who told me their tales of laptop theft. Here are few of your responses.
Where the Hell Is My Laptop?
Unaware that he was about to become a footnote in the history of corporate espionage, Irwin Jacobs shook hands with the people who had flocked to the dais after his speech. It was just before 1 p.m. last Sept. 16, at a meeting of the Society of American Business Editors and Writers in a Hyatt Regency in Irvine, Calif. At one end of a room full of chairs stood Jacobs, a former MIT engineering professor who founded Qualcomm in 1985 and drove the company to revenues of $3.9 billion a year, and himself to billionaire status. A few feet away from him was a lectern with his IBM ThinkPad laptop, which he had used for his presentation. After chatting for a few minutes with the journalists who had approached him, Jacobs noticed something odd about his laptop: It wasn't there. Distraught, he strode over to the lectern, where he confirmed the bad news. The machine had vanished. Reporters asked him what was on it. "Everything," he said. Financial statements, secret corporate data, years of e-mail, digitized pictures of his grandchildren -- all of it was on his machine. "Wherever I go, it goes," he said. "It's been around the world with me a couple of times."
Unaware that he was about to become a footnote in the history of corporate espionage, Irwin Jacobs shook hands with the people who had flocked to the dais after his speech. It was just before 1 p.m. last Sept. 16, at a meeting of the Society of American Business Editors and Writers in a Hyatt Regency in Irvine, Calif. At one end of a room full of chairs stood Jacobs, a former MIT engineering professor who founded Qualcomm in 1985 and drove the company to revenues of $3.9 billion a year, and himself to billionaire status. A few feet away from him was a lectern with his IBM ThinkPad laptop, which he had used for his presentation. After chatting for a few minutes with the journalists who had approached him, Jacobs noticed something odd about his laptop: It wasn't there. Distraught, he strode over to the lectern, where he confirmed the bad news. The machine had vanished. Reporters asked him what was on it. "Everything," he said. Financial statements, secret corporate data, years of e-mail, digitized pictures of his grandchildren -- all of it was on his machine. "Wherever I go, it goes," he said. "It's been around the world with me a couple of times."
Laptop Security: Be Deliberate
Laptops are commonplace today and so is their theft. But losing the computer often doesn't matter as much as losing the data it contains.
Case in point: Qualcomm's chairman and CEO recently gave a speech to the Society of American Business Editors and Writers at the Hyatt Regency Hotel in Irvine, California. After his speech, numerous journalists gathered around to ask questions. During that brief time, he was never more than 30 feet from his laptop, yet someone managed to steal it. The laptop contained some of Qualcomm's most valuable trade secrets (reported to be worth millions), which are now in the thief's hands.
Laptops are commonplace today and so is their theft. But losing the computer often doesn't matter as much as losing the data it contains.
Case in point: Qualcomm's chairman and CEO recently gave a speech to the Society of American Business Editors and Writers at the Hyatt Regency Hotel in Irvine, California. After his speech, numerous journalists gathered around to ask questions. During that brief time, he was never more than 30 feet from his laptop, yet someone managed to steal it. The laptop contained some of Qualcomm's most valuable trade secrets (reported to be worth millions), which are now in the thief's hands.
Laptop Security Guidelines for IT Professionals
Laptops have become thief magnets attracting everything from common thugs and dishonest housekeeping employees to sophisticated conmen, hi-tech crime rings, and industrial spies. In 1999 alone, over 319,000 laptops were reported stolen. Thousands more were simply misplaced or left in hotel rooms, restaurants, airports, cabs or coffee shops by busy employees rushing around. Protect your capital investment and your company's secrets by following these guidelines to better laptop security.
Laptops have become thief magnets attracting everything from common thugs and dishonest housekeeping employees to sophisticated conmen, hi-tech crime rings, and industrial spies. In 1999 alone, over 319,000 laptops were reported stolen. Thousands more were simply misplaced or left in hotel rooms, restaurants, airports, cabs or coffee shops by busy employees rushing around. Protect your capital investment and your company's secrets by following these guidelines to better laptop security.
Netcat 1.10
Netcat is a simple Unix utility which reads and writes data across network connections, using TCP or UDP protocol.It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities. Netcat, or "nc" as the actual program is named, should have been supplied long ago as another one of those cryptic but standard Unix tools.
Netcat is a simple Unix utility which reads and writes data across network connections, using TCP or UDP protocol.It is designed to be a reliable "back-end" tool that can be used directly or easily driven by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need and has several interesting built-in capabilities. Netcat, or "nc" as the actual program is named, should have been supplied long ago as another one of those cryptic but standard Unix tools.
Monday, July 15, 2002
Computer Security Bible Volume 1
Welcome to Computer Security Bible Volume 1. This is the first volume of the many volumes to come that begins in the first steps of hacking. The following is nothing but baby steps into the world of Computer Security. Now, most people hear computer security and think hackers. So I guess you could call this a hacker manual. BUT , at the end of this book I teach you how to defend against every attack presented to you throughout this volume.
Welcome to Computer Security Bible Volume 1. This is the first volume of the many volumes to come that begins in the first steps of hacking. The following is nothing but baby steps into the world of Computer Security. Now, most people hear computer security and think hackers. So I guess you could call this a hacker manual. BUT , at the end of this book I teach you how to defend against every attack presented to you throughout this volume.
Subscribe to:
Posts (Atom)
