Linux Security Week: March 7th 2005

The Internet front door to almost every bank and financial services company in the world is guarded by two sets of firewalls defining a DMZ. Nearly every e-commerce site sits in a similar DMZ in what has become the de facto standard in Web security architecture. According to Sun Microsystems, "In today's tumultuous times, having a sound firewall/DMZ environment is your first line of defense against external threats." But I would argue that guarding the perimeter is lulling organizations into a false sense of security that results in ignoring the implementation of other security mechanisms in their applications and databases.

news/firewall/firewalls-false-sense-of-security

Specialist distributor, Firewall Systems, is warning resellers to start thinking of security as a managed service or risk losing market share to physical security providers. Firewall marketing director, Nick Verykios, said physical security players such as Chubb were already providing IP-based services, adding data to their stack as the markets continued to converge.

news/firewall/firewall-warns-dealers-of-physical-security-threat

This year's RSA Conference was another opportunity for the security glitterati to shine. The event, which attracted a record 13,000 visitors, also was a testament to how hot the security market is.

news/firewall/wheres-the-security-leadership

StillSecure attached six computers - loaded with different versions of the Windows, Linux and Apple's Macintosh operating systems - earlier this month to the Internet without anti-virus software. The results show the Internet is a very rough place. Over the course of a week, the machines were scanned a total of 46,255 times by computers around the world that crawl the Web looking for vulnerabilities in operating systems.

For Linux the RealPlayer 10 and the Helix Player are affected. No fixed versions are available for this. The Player for Symbian and PalmOS are not concerned by the weak spots.RealNetworks classifies the security gaps as critical and recommends all users to install the available updates. Under Windows and Mac OS the update functionÊof the Player can be used.

There are two approaches to network vulnerability scanning, active and passive. The active approach encompasses everything an organization does to foil system breaches, while the passive (or monitoring) approach entails all the ways the organization oversees system security. When making buying decisions for your organization, it's a mistake to think that you have to choose between the two types of protection.

news/network-security/two-sides-of-vulnerability-scanning

SElinux is an impressively designed but notoriously hard-to-configure set of kernel hooks that enforce Orange Book-style security on Linux. Full support for SELinux takes effort, but when I first heard about Fedora's new targeted policies for SELinux, I was willing to tell the Red Hat folks "thanks, but no thanks." A conversation with their Dan Walsh changed my mind.

This document describes a method for generating automatic rotating "snapshot"-style backups on a Unix-based system, with specific examples drawn from the author's GNU/Linux experience. Snapshot backups are a feature of some high-end industrial file servers; they create the illusion of multiple, full backups per day without the space or processing overhead. All of the snapshots are read-only, and are accessible directly by users as special system directories.

news/server-security/mikerubelorg

The National Security Agency built a version of Linux with more security tools that its technologists believe could help make the country's computing infrastructure less vulnerable. They won over the Linux developer community with the changes. But its success depends on the adoption by U.S. companies and government agencies, something that remains very much in doubt.

news/server-security/linux-security-rough-around-the-edges-but-improving

Taking a cue from Firefox and others, software developer Opera is updating the latest iteration of its Web browser to combat phishing attacks that take advantage of a domain name vulnerability. To address the emerging Internationalized Domain Names (IDN) issue, the second Beta version of the Opera browser displays localized domain names from certain top level domains (TLD). It selects TLDs that have stringent policies on the domain names they register. The Norwegian firm said it will update its list of trusted TLDs on a regular basis to further protect users.

news/vendors-products/opera-targets-browser-vulnerability

Mandrakelinux products cover needs from the desktop (with the PowerPack) to critical infrastructure functions (with the Multi Network Firewall). The Multi Network Firewall operating system is able to control access to both an organisation's private intranet and the public internet. Mandrakesoft products are part of the software library which has been selected to modernize the infrastructure of France's education system. As well as the applications themselves, Mandrakesoft will deliver technical support and training to staff.

news/vendors-products/french-ministry-of-education-and-research-and-mandrakesoft

This sort of basic firewall has some issues that can be exploited by hackers and malicious programmers to sneak through which is why there are more advanced firewall systems. I mentioned that with this sort of port blocking, communications in response to connections initiated by your computer would be allowed through even on ports you were blocking. Using this knowledge, a hacker can forge the packet to make it look like it is a reply rather than an initiation of a connection and the firewall will allow it through.

Want more advice for locking down your network? Stay on top of the latest security issues and industry trends by automatically signing up for our free Internet Security Focus newsletter, delivered each Monday! In less than a decade, Internet security has evolved from an almost esoteric topic to become one of the more important facets of modern computing. And yet it's a rarity to find companies that actually consider information security to be an important job function for all workers--and not just the IT department's problem.

"It's as deep as it will get for us. It's what we're betting the data center on," said Jon Fraley, a Linux administrator at Glen Raven. In December, the Glen Raven, North Carolina-based textile manufacturer finished moving mission-critical Oracle databases from an aging 24-CPU Hewlett-Packard server running Unix to four-way HP servers that are based on Intel Xeon processors and run Red Hat's Linux distribution.

The security software and appliance market rose by 30 per cent last year and is predicted to be worth $5.5billion worldwide by 2008 according to a new report. The figures, by analysts Infonetics Research, show growth in all security categories except the Firewall/VPN market. Last year revenue topped $3.7billion for the whole market.

"RES" Information Security and Threat Management solution provides a perfect blend of best practices and industry standards that our enterprise customers need to comply with growing regulatory requirements," said Douglas Adams, RESÕ vice president of sales and marketing. "RES is committed to providing the most innovative managed services designed to meet the quality-of-service demands of our Fortune 500 and Fortune 1000 enterprise customers."

news/government/managed-security-service-expands-compliance-capabilities

I finally settled on a strategy for wireless security. As wireless access points began appearing on our company's network, we configured them with Cisco's Lightweight Extensible Access Protocol (read my previous article, Migrate WLANs away from Cisco's LEAP). LEAP forces users to authenticate to the access point with their enterprise credentials - the same credentials used for virtual private network access, as well as services such as payroll and Microsoft Exchange e-mail. That's because we use a centralised directory that ties into most of our core applications and lets employees use a single password to sign on.