Master of Science in Information
Security - Earn your Master of Science in Information Security online
from Norwich University. Designated a "Center of Excellence", the program offers
a solid education in the management of information assurance, and the unique case
study method melds theory into practice. Using today's e-Learning technology,
you can earn this esteemed degree, without disrupting your career or home life.
LINUX ADVISORY
WATCH - This week, advisories were releaed for bluez-utils, thunderbird,
mysql, epiphany, system-config-netboot, kdbg, doxygen, kdeedu, ncpfs, gaim,
system-config-bind, tar, vnc, metacity, cups, pygtk, slocate, myodbc, xpdf,
libgal2, dhcpv, diskdumputils, kdebase, cvs, hwdata, eject, pcre, kismet, wikiwiki,
apache, tor, netpbm, vim, and elm. The distributors include Debian, Fedora,
Gentoo, and Red Hat.
LinuxSecurity.com
Feature Extras:
Linux File
& Directory Permissions Mistakes - One common mistake Linux administrators
make is having file and directory permissions that are far too liberal and
allow access beyond that which is needed for proper system operations. A full
explanation of unix file permissions is beyond the scope of this article,
so I'll assume you are familiar with the usage of such tools as chmod, chown,
and chgrp. If you'd like a refresher, one is available right here on linuxsecurity.com.
Introduction:
Buffer Overflow Vulnerabilities - Buffer overflows are a leading type
of security vulnerability. This paper explains what a buffer overflow is,
how it can be exploited, and what countermeasures can be taken to prevent
the use of buffer overflow vulnerabilities.
Getting
to Know Linux Security: File Permissions - Welcome to the first
tutorial in the 'Getting to Know Linux Security' series. The topic explored
is Linux file permissions. It offers an easy to follow explanation of how
to read permissions, and how to set them using chmod. This guide is intended
for users new to Linux security, therefore very simple.
Bulletproof
Virus Protection - Protect your network from costly security
breaches with Guardian Digital’s multi-faceted security applications.
More then just an email firewall, on demand and scheduled scanning detects
and disinfects viruses found on the network. Click
to find out more!
Take advantage of our Linux Security discussion
list! This mailing list is for general security-related questions and comments.
To subscribe send an e-mail to security-discuss-request@linuxsecurity.com
with "subscribe" as the subject.
Thank you for reading the LinuxSecurity.com
weekly security newsletter. The purpose of this document is to provide our readers
with a quick summary of each week's most relevant Linux security headline.
Storm brewing over SHA-1 as further breaks
are found
24th, August, 2005
Three Chinese researchers have further refined an attack on
the encryption standard frequently used to digitally sign documents, making
the attack 64 times faster and leaving cryptographers to debate whether
the standard, known as the Secure Hash Algorithm, should be phased out
more quickly than planned.
Data security is a major concern for all CIOs. This has been
addressed from access and identity controls through encrypting data in
transmission through to securing data at rest, on disk or on tape.
The difference today is that threats are more sophisticated and business
practices are more dependent on IT practices that span each organisation
from individuals through to the data centre. The requirements for sound
information governance include company practices, as well as financial
reporting standards and legal issues, such as the Data Protection Act.
Host Integrity Monitoring Using Osiris
and Samhain
22nd, August, 2005
Host integrity monitoring is the process by which system and
network administrators validate and enforce the security of their systems.
This can be a complex suite of approaches, tools, and methodologies, and
it can be as simple as looking at loggin output. In the past, tools like
Tripwire were used to check the configurations on hosts. The freeware
version of this tool was limited in its manageability, which was available
mainly in the commercial version.
Why You Need To Add “Protect Domain Name�
To The Security Checklist
25th, August, 2005
Domain name hijacking broadly refers to acts where a registered
domain name is misused or stolen from the rightful name holder. A domain
hijacking is a security risk many organizations overlook when they develop
security policy and business continuity plans. While name holders can
take measures to protect their domain names against theft and loss, many
measures are not generally known.
Linux/Unix e-mail flaw leaves system
open to attack
26th, August, 2005
Two serious security flaws have turned up in software widely
distributed with Linux and Unix. The bugs affect Elm (Electronic Mail
for Unix), a venerable e-mail client still used by many Linux and Unix
sysadmins, and Mplayer, a cross-platform movie player that is one of the
most popular of its kind on Linux. The Elm flaw involves a boundary error
when the client reads an e-mail's "Expires" header. A specially crafted
e-mail could exploit the bug to cause a buffer overflow and execute malicious
code on a system, according to security researchers.
Linux Kernel Denial of Service and IPsec
Policy Bypass
25th, August, 2005
Two vulnerabilities have been reported in the Linux kernel,
which can be exploited by malicious, local users to cause a DoS (Denial
of Service) or bypass certain security restrictions.
This
article looks beyond the hype of mobile working to consider some of
the practical issues of an organisation implementing an ICT strategy that
ensures data security wherever employees connect to corporate systems.
Information Security in Campus and Open
Environments
23rd, August, 2005
This
article is geared towards techies at libraries and schools and will
attempt to address common security problems that may pop up at these institutions.
The author gears the solutions towards Open Source, freeware, and base
operating system security in a Windows XP/2k environment.
The question for security researchers going forward is modeled
by the Lynn saga. Is it legal to decompile source code to find vulnerabilities?
Of course, the answer is mixed. Maybe it is, maybe it's not.
Some of the biggest banks have abandoned the practice of posting
their online account log-in screens on SSL-protected pages in an effort
to boost page response time and guide users to more memorable URLs, a
U.K. Web performance firm said Tuesday.
True, a normal Linux installation and setting up basic internet
access and email settings is proven to be equally easy under Windows as
under Linux- if not easier under Linux. But I've been using Linux distributions
for several years now, and I must say that for advanced problems it's
harder to get things worked out under Linux.
Sean Stenovich often sees his small and midsize business clients
pick and choose their security solutions based on what they think they
need and can afford. The result is a security plan that covers some areas
but leaves many others exposed, said Stenovich, a principal at Dallas
security solutions provider M&S Technologies.
The Sarbanes-Oxley rules will be the biggest waste of IT resources
for public companies this year, according to a poll of 444 US companies
by IBM user group Share. Share polled those who were pre-registering for
its Boston conference and asked people to imagine themselves transported
to 2015 and looking back at 2005, and asked what they thought in retrospect
would prove to be either an ineffective or wasteful use of their IT time.
In the early days of computer attacks, when bright teens could
bring down corporate systems, the point was often to trumpet a hacker's
success. No longer. In today's murky world of digital viruses, worms,
and Trojan horses, the idea is to stay quiet and use hijacked computers
to flood the Internet with spam, spread destructive viruses, or disgorge
e-mail to choke corporate systems. Not only can networks of these compromised
computers be leased or sold, experts say, they are becoming more valuable
as the number of vulnerable computers slowly shrinks.
