Linux Security Week: November 21st 2005

Greetings from all of us at Linuxsecurity.com. We've upgraded the site today to a newer version of Joomla (formerly Mambo), and replaced the old forums with a new more robust commenting system. Soon we'll be rolling out new RSS version 2.0 feeds, and we have some other new features planned for the coming weeks.

Is your server as secure as it could be? Sure, you use a firewall, mandate strong passwords, and patch regularly. You even take a proactive approach by performing security audits with tools such as nmap and Nessus. Yet you may still be vulnerable to zero-day exploits and privilege escalation attacks. If these possibilities keep you awake at night, you're not alone. The sleepless folks with the grsecurity project have developed an easy-to-use set of security enhancements to help put your fears to rest.

A flaw in a key Internet security protocol used by major networking products could open systems up to denial-of-service (DoS) and other kinds of attacks, experts have warned. Finnish researchers at the University of Oulu announced Monday that they have found a vulnerability in the Internet Security Association and Key Management Protocol, or ISAKMP. The technology is used in IPsec virtual private network and firewall products from a range of networking companies, including giants Cisco and Juniper.

news/network-security/vpns-at-risk-from-security-glitch

Finnish researches today announced a high-risk vulnerability in a security protocol that serves an important role in key exchanges in IPsec VPNs. The severity of the flaw depends on different vendors, some of whom report it exists in their products and others who for now maintain their offerings are unaffected. But its impact could be great, given those vendors include heavyweights Cisco Systems, 3Com, Juniper Networks, Microsoft and IBM.

news/network-security/internet-security-cisco-flaws

The lure of open source is strong, and it's starting to be felt by the traditional network monitoring and analysis companies - but they are finding ways to fight back, according to Janice Spampinato, VP international at WildPackets. "Packet analysis tools are very much a commodity now," she says. "Ethereal and the like has taken the legs off the portable market, so thank goodness we decided to go for the distributed market."

news/network-security/network-monitors-head-for-the-high-ground

When Zotob and other worms attacked a Windows vulnerability in August, some (yeah, that's me) were surprised that large companies were affected. After all, even a simple firewall should have blocked the attack. The problem was that many large corporate networks aren't as controlled as you'd think.

news/network-security/nac-will-fill-a-big-it-security-gap

Organizations that use computing system as their business enabler are faced with the challenges to protect and mitigate their critical information assets from internal and external security risks. In such a scenario, where 100% security is hard to achieve, it is imperative to reduce time taken to detect and respond adequately to a security incident that could adversely impact normal services.

Despite claims that intrusion detection tools are "old school" and often tedious to use, one technologist says an IDS, such as Snort, can be quite educational when grading an organization's network security. During a session at the CSI 32nd annual Computer Security Conference this week, Matthew Hicks, senior information security analyst with the Children's National Medical Center in Washington D.C., said those who scoff at IDS typically don't understand how to use it.

Sourcefire, Inc., the creators of Snort and the world leader in intrusion prevention, and Bleeding Snort today announced the launch of the Open Source Snort Rules Consortium (OSSRC), focused on the development and advancement of Snort Rules. With over 90 Charter members from the open source user and vendor communities, the OSSRC enables the entire Snort community to contribute to the open source model, as well as Snort development and direction. Focusing on innovation and standardization, the OSSRC is an independent organization founded to ensure that Snort continues to reflect the needs of the open source community, while also remaining one of the industry’s leading security tools.

CMP Media, a marketing solutions company serving the technology, healthcare and entertainment markets, announced today that it has acquired Black Hat Inc., a producer of information security conferences and training that includes Black Hat Briefings and Conferences.

news/organizations-events/cmp-media-buys-black-hat

If your organization depends on tape backup, it's time to think about tapering off. Here are five ways to improve data protection and backup with less tape. IT architects are talking a lot these days about getting rid of tape, and for a multitude of reasons--it's too slow and hard to use, hard disks have gotten cheaper, certain databases and applications require faster recoveries, and so on. According to consulting firm TheInfoPro, 90 percent of companies plan to move from tape to Serial Advanced Technology Attachment (SATA) disk drives as part of their backup/recovery and data lifecycle management plans by 2006

news/server-security/better-backup-strategies

If cars were sold in the same way as software, you would have to hook your Mondeo to the internet and download the latest code update before you left the garage. Managing software patches across an organisation can be one of the biggest headaches for IT departments, but luckily there are products to help.

news/server-security/easy-and-efficient-patching-all-comes-down-to-having-the-right-management-software

The overwhelming number of open source Web sites and the widespread use of OpenSSL to secure connections create a tremendous problem when vulnerabilities emerge. Case in point: In October 2005, the OpenSSL.org Project released a patch to fix a vulnerability in all previously released versions of OpenSSL. Get the details about this vulnerability, and get Mike Mullins' take on the overall challenges of patch management.

news/server-security/guard-against-this-openssl-vulnerability

StandGuard Anti-Virus for Linux brings the industry-leading power of McAfee's scanning engine and the ease-of-use of the award-winning StandGuard Anti-Virus to Linux running on x86-based PCs. StandGuard Anti-Virus for Linux (x86-based PCs) allows users to detect and clean the full 150,000+ threats identified by McAfee’s AVERT, a huge improvement over the 40,000 viruses that some Linux solutions promise to detect. Bytware and McAfee's AVERT support users’ needs 24/7/365.

news/vendors-products/mcafee-protection-comes-to-linux

Security is definitely high on the agenda of many countries these days, as terrorism continues to rear its ugly head in several parts of the world, resulting in the loss of lives and other destructions. Many Governments have taken the necessary measures to combat terrorism and ensure the safety of their people.

There you are all bright-eyed and eager, ready to roll up your sleeves and go to work in the exciting new world of Free/Open Source software. You have rosy visions of getting paid to do enjoyable, challenging work. Maybe even fat stock options that vest while you are still young, so you can quit the wage-slave routine and venture forth on your own and maybe even fund projects yourself.

Linux has firmly stamped its authority on the supercomputing sector. The latest report from Top500, which releases a bi-annual report of the fastest computers in the world, shows Linux increasing its market share in this segment from 51.8% six months ago to 74.4%.

The many gadgets carried around by workers today pose a real security risk to organizations and require action, session attendees at a security conference agreed Tuesday. Smart phones, handheld computers, thumb drives, digital cameras, iPods and other MP3 players can all connect to computers. That's fine when used at home, but when connected to a work PC, the devices can pose a serious risk, said Norm Laudermilch, chief security officer at Trust Digital, a McLean, Va., mobile security vendor.

Small- and medium-sized enterprises (SMEs) are leaving themselves vulnerable to security and compliance risks by not having internet acceptable use policies (AUPs) that address the latest and most dangerous internet-based threats, a new study has warned. According to a poll of IT administrators at 500 companies carried out by security firm St. Bernard Software, four key IT threat areas were found to be commonly missing written AUPs. These so-called gaping holes in AUPs include clauses to cope with use of spyware, inappropriate surfing, instant messaging and P2P networks.

Many years ago, while directing IT operations for a small company on the West Coast, I became aware that our network security was particularly weak. The company was growing at a rapid pace, IT was understaffed, the network was at capacity in a number of ways, and the demands were brutal both in terms of time and technology needs. While I didn't mind the long hours, I did mind that I didn't feel "up to snuff" in terms of selecting technologies that would enable us to expand the network and secure it. I had responsibility for IT and security, but I felt that there were holes in my knowledge. I wanted to fix that. So began my quest to become an information security professional.

It's a David and Goliath story of the tech blogs defeating a mega-corporation. On Oct. 31, Mark Russinovich broke the story in his blog: Sony BMG Music Entertainment distributed a copy-protection scheme with music CDs that secretly installed a rootkit on computers. This software tool is run without your knowledge or consent -- if it's loaded on your computer with a CD, a hacker can gain and maintain access to your system and you wouldn't know it.

The number of open source deployments by governments across the world has accelerated over the last few years. To date at least 160 international local and national governments have deployed open source software and over $2bn has been spent on the Linux open source operating system, according to figures from Linux vendor Red Hat.

news/government/why-governments-really-choose-open-source

Google said Wednesday it has fixed a problem in its widely used email program that allowed hackers to break into people’s Gmail accounts to read messages and pose as legitimate email users. Security researchers in Spain exposed a flaw in the way Google authenticates its users, allowing the breach in the system that counts more than 5 million users.

news/hackscracks/hackers-cracked-gmail

iStumbler is the leading wireless discovery tool for Mac OS X and in this interview with its creator, Alf Watt, you can read about the project in general, various wireless security issues as well as recent developments that will make iStumbler a paid tool in its Pro version.

Information technology professionals have been conditioned to think defensively, draping their networks with sensor-studded barbed wire and using firewalls to lock down doors and windows. Another school of thought advocates a more proactive approach to security.