Linux Security Week: November 7th 2005

Encryption experts met in Gaithersburg, Maryland, this week to discuss retiring the SHA-1 hashing algorithm and creating a stronger version of the cryptographic workhorse.

news/cryptography/crypto-gurus-hash-out-future

Organizations need a Web application scanning solution that can scan for security loopholes in Web-based applications to prevent would-be hackers from gaining unauthorized access to corporate applications and data.

A new patch is out for a prior version of open source scripting language PHP, which addresses a recently-discovered security issue in version 4. But the current version of PHP 5 (define) may also be at risk from vulnerabilities that aren't currently patched in that version.

news/server-security/php-users-at-risk

What's Federated Identity Management (FIM)? Actually, we should be asking how important is FIM. It's the linchpin of digital convergence and probably one of the most important technologies of the modern era. Soon, we will begin to swim in digital television, multifunctional phones, devices of all kinds, and at the core of making all these things work together with our computer networks and the Internet lies identity management. At the core of identity management lies federation.

news/server-security/linux-in-action-understanding-federated-identity-management-business-drivers

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.1 (Version 3.0, Release 1). This release includes several bug fixes and feature enhancements to the Guardian Digital WebTool, the SELinux policy, and the LiveCD environment.

news/vendors-products/engarde-secure-linux-v301-now-available

Yesterday OpenBSD, the proactively secure Unix-like operating system, released version 3.8, featuring several improvements to networking, RAID management tools, and increased security. At openbsd.org you can download installation files or order the official three-disc CD set, which supports 16 processor architectures out of the box. I took this new release as an opportunity to perform my first ever OpenBSD install.

news/vendors-products/trying-out-the-new-openbsd-38

MandrakeLinux always had a reputation as an ideal distribution for beginners. Now that the renamed Mandriva has included technologies from Conectiva and Lycoris into Mandriva Linux 2006, this reputation seems more justified than ever. From its installation program to its selection of software and desktop design to its package design and security options, Mandriva is one of the easiest to use distributions available today.

news/vendors-products/review-mandriva-linux-2006

The clocks have fallen back, the leaves are hitting the ground and new BSD releases are on the Net. Among all the noise and buzz created by Linux, it's important to remember that it's not the only open source variant of Unix. OpenBSD, NetBSD and FreeBSD are all still very much alive and kicking and have recently been released from their respective projects

news/vendors-products/return-of-the-bsds

The Common Criteria evaluation covers three protection profiles related to controlling access to information. A successful evaluation will mean that the operating system meets government security standards for assured information sharing within and across government agencies.

A survey conducted by the National Cyber Security Alliance (NCSA) and the US Department of Homeland Security found that more than 70% of computer owners falsely believed they were safe from online threats such as adware, spyware and viruses. The eight top cyber security practices recommended by NCSA are "practical steps you can take to stay safe online and avoid becoming a victim of fraud, identity theft, or cyber crime". (1) Protect your personal information.

Author: Nerys Grivolas, Senior Consultant, Net Report SAS
The key to turning your company’s conformity with Sarbanes-Oxley into a strategic advantage is to sustain your compliance year-on-year. To do so, you must embrace the idea that Sarbanes-Oxley compliance is an ongoing journey not a final destination.

The secret agent quietly enters the generic-looking office complex. The agent's assault team has the building surrounded and is standing by in case the operation goes bad. The mission: to find a computer containing information that will save the country from an enemy attack. The agent moves from the warehouse area to the offices in search of the target's computer. He finds it in the last office. The machine is on, and after gaining access to the computer, the agent starts scanning through files only to find them encrypted.

Companies are devoting too much of their IT security budgets trying to comply with EU directives and regulations like Sarbanes-Oxley when they should be spending more on other security threats, according to the yearly security report by Ernst and Young.

Members of AVIEN take the spyware threat seriously and call upon all parties involved, including vendors of security software, leaders in organizations, and government officials alike to increase their dedication to fighting this problem.

The Trusted Network Initiative is not just about who the user is, but their devices too -- and how we can only allow access to devices with up-to-date security patches and without any known Trojans and malware.

IT security used to be a matter of securing the organization, but with more and more components of the organization outsourced to strategic partners, each given access to important information, it is now a matter of being able to trust these partners.

To many, the name Kevin Mitnick is synonymous with "notorious hacker." He was caught by the FBI in 1995 after a well-publicized pursuit. Mitnick pled guilty to charges of wire and computer fraud and served five years behind bars. Today, Mitnick is a computer security consultant and has written two books, including one on social engineering, his forte. He is a celebrity, especially at events such as the annual Defcon gathering of hackers in Las Vegas, where attendees ask him to sign their badges.

It has been a bad year for data security. The Privacy Rights Clearinghouse, a consumer advocacy group in San Diego, has counted 80 data breaches since February, involving the personal information of more than 50 million people. The sensitive data--names, Social Security and credit card numbers, dates of birth, home addresses and the like--have either been lost by or stolen from companies and institutions that compile such data.

news/government/the-battle-to-shape-data-security-laws

A judge has ruled that denial of service attacks are not illegal under the UK's outdated Computer Misuse Act. A teenager charged with launching a denial of service (DoS) attack against his former employer escaped punishment when the judge threw out the charge after his defence successfully argued that DoS attacks were not covered by the parts of the act he was charged under.

news/hackscracks/court-shock-denial-of-service-attacks-not-illegal

AirMagnet introduced its BlueSweep software, designed to identify nearby devices with Bluetooth wireless technology and alert users to potential Bluetooth security risks. The AirMagnet software identifies and tracks devices up to 300 feet away and lets users know what their own Bluetooth devices are doing.

"As soon as the enterprise opens up VoIP to the Internet, they put a potentially huge security hole in their network," Andrew Graydon, vice president of technology at BorderWare Technologies, says. Essentially the days of closed corporate VoIP systems are over.

Wi-Fi networks are not secure enough for enterprises to run their businesses, according to a senior AT&T executive. Steve Hurst, product director for managed security services at AT&T, told ZDNet Asia that although some attempts to improve the security of Wi-Fi networks have met with success, engineers involved in the technology have yet to develop a secure architecture.

The next time Bill Gates sends an e-mail through Microsoft's shiny new Wireless LAN it will be passed through a behind-the-scenes Linux-based network appliance. Earlier this year Microsoft and Aruba Networks jointly announced the two companies will work to replace Microsoft's existing Cisco wireless network with Aruba's centrally-managed infrastructure, which eliminates the need for individual changes on the access points.