Get the LinuxSecurity news you want faster with RSS
Powered By
Linux Security Week: December 29th, 2008
Source: LinuxSecurity.com Contributors - Posted by Benjamin D. Thomas
This week, perhaps the most interesting articles include "Top 5 Cybersecurity News Stories of 2008," "5 Known Linux Anti-virus Software for Paranoid Users," and "Nipper - The Network Infrastructure Parser."
Linux+DVD
Magazine Our magazine is read by professional network and database administrators,
system programmers, webmasters and all those who believe in the power of Open
Source software. The majority of our readers is between 15 and 40 years old.
They are interested in current news from the Linux world, upcoming projects
etc.
In each issue you can find information concerning typical use of Linux: safety,
databases, multimedia, scientific tools, entertainment, programming, e-mail,
news and desktop environments.
LinuxSecurity.com
Feature Extras:
Review: Googling Security: How Much Does Google Know About You - If I ask "How much do you know about Google?" You may not take even a second to respond. But if I may ask "How much does Google know about you"? You may instantly reply "Wait... what!? Do they!?" The book "Googling Security: How Much Does Google Know About You" by Greg Conti (Computer Science Professor at West Point) is the first book to reveal how Google's vast information stockpiles could be used against you or your business – and what you can do to protect yourself.
A Secure Nagios Server - Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security.
Thank you for reading the LinuxSecurity.com
weekly security newsletter. The purpose of this document is to provide our readers
with a quick summary of each week's most relevant Linux security headline.
EnGarde Secure Community 3.0.22 Now Available! (Dec 9)
Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.
Data breaches continued to make their very public mark on cybersecurity news in 2008. And this time it wasn't TJX making headlines. Despite being PCI compliant, Hannaford Brothers supermarkets announced that 4.2 million credit and debit card numbers were pilfered from its servers. We also learned in 2008 that attackers aren't necessarily becoming more sophisticated.
Check out this list of top 5 cybersecurity news stories of of the year. Did they miss any that you think should be on the list?
Helping Protect Cookies With HTTPOnly Flag (Dec 29)
The bottom line is this - while this cookie option flag does absolutely nothing to prevent XSS attacks, it does significanly help to prevent the #1 XSS attack goal which is stealing SessionIDs. While HTTPOnly is not a "silver bullet" by any means, the potential ROI of implement it is quite large. Notice I said "potential" as in order to provide the intended protections, two key players have to work together.
This article looks at one way you can make your Web cookies more secure by using the Apache's extension called modsecurity. If you are interested in this please read on for more information and how you set this up on your own Apache web server.
Red Hat / CentOS: Chroot Apache 2 Web Server (Dec 26)
A chroot on Red Hat / CentOS / Fedora Linux operating changes the apparent disk root directory for the Apache process and its children. Once this is done attacker or other php / perl / python scripts cannot access or name files outside that directory. This is called a "chroot jail" for Apache. You should never ever run a web server without jail. There should be privilege separation between web server and rest of the system.
Chroot is great security practice to isolate an attack to only one part of ones system. If you are interested in using chroot check out this article it that will show you all the commands that you need.
PandaLabs' 2009 Predictions: Malware Will Increase In 2009 (Dec 24)
Glendale, CA (PRWEB) December 21, 2008 -- PandaLabs, Panda Security's malware analysis and detection laboratory, today announced that a significant increase in the volume of malware (viruses, worms, Trojans, etc.) is expected in 2009. Panda Security's laboratory detected more malware strains in the eight months between January and August of 2008 than in the previous 17 years combined.
What is your prediction on Malware in 2009? Will it increase? This article states some reasons on why PandaLabs thinks that Malware will increase in 2009.
5 Known Linux Anti-virus Software for Paranoid Users (Dec 23)
Like other Unix-like computer operating systems, Linux is widely considered as secured and well-guarded against computer viruses. Its multi-user environment makes it extremely hard for malware to gain root access to the system files. Though malicious programs that are specifically written for Linux are really small in number, there is still a possibility for them to cause some harm. So, it's necessary to take some precautionary measures.
Have you ever used an virus scanner on your Linux machine? This article looks at 5 different anti-virus software for Linux.
Nipper - The Network Infrastructure Parser (Dec 22)
Welcome to the Nipper Open Source project web site. Nipper enables network administrators, security professionals and auditors to quickly produce reports on key network infrastructure devices.
The report can include a detailed security audit of the device settings or be a configuration report, the output is customisable. Nipper supports a wide variety of devices from different manufacturers such as Cisco, Nokia, Juniper, HP, CheckPoint, Nortel, 3Com, SonicWALL and Bay Networks.
Do you need detailed reports of your networks traffic? You might about to check out the Open Source project called Nipper. Read on for more information....
