InfoSec News, March 11, 2009

Browser Security
(SC Magazine US) Firefox 3.07 update addresses multiple security issues
(H-online) Firefox: most vulnerabilities, but quickly patched
(Security Focus) Mozilla, Opera plug security holes

---

Malware
(SC Magazine US) Conficker worm variant kills security processes
(H-online) Conficker modified for more mayhem

---

Cyberwarfare
(ZDNet.com) Russia kinda-sorta owns up to Estonia cyberwar
(The Register) Russian politician: ‘My assistant started Estonian cyberwar’

---

Patches
(The Register) Critical kernel fix stars in Patch Tuesday updates
(Computerworld) Microsoft patches ‘evil’ Windows kernel bug
(Computerworld) Microsoft patches Windows DNS, kernel flaws
(The Register) The long road to Adobe Reader and Flash security Nirvana
(Computerworld) Adobe patches zero-day PDF bug, mum on details
(Computerworld) Bad Symantec update leads to trouble
(H-online) Norton causes alarm and despondency

---

Social Networking
(H-online) Twitter closes SMS spoofing hole – Updated
(H-online) Spam from compromised Twitter accounts

---

Other InfoSec News
(SC Magazine US) Gartner: Data breaches hit 7.5 percent of all U.S. adults
(H-online) Version 3 of Microsoft’s Threat Modeling Tool released
(Computerworld) Gmail down; outage could last 36 hours for some
(H-online) Windows Defender: False alarm triggered by hosts file
(The Register) Court rules airline secret security list is stupid
(Techworld) Security needs to be ‘baked in’ say experts
(GCN) Securing cyberspace requires a new attitude
(Stuff.co.nz) Student wiped data worth thousands
(The Register) Feds file new felonies against alleged Palin hacker

---

Tips
(Computerworld) Biometrics: three tips for success

---

Webcasts
(LogLogic) Unleashing your log power to do more with less
Date: Wednesday, March 18, 2009
Time: 2:00 p.m. EST/11:00 a.m. PST

---

Whitepapers
(HID) Username and Password: A Dying Security Model
(Computerworld) Social Elements of Security Policy and Messaging

---

Advertisement

Info Sec News, Feb 4, 2009

There seems to be confusion on a new draft bill by the NTC which is aimed at online content providers and VAS providers for mobile phones. Some have argued that the seemingly catch all bill may include people who blog and upload pics on Social Networking sites, although the spirit of the bill seems to be more for online applications.

(Business Mirror.com) NTC issues draft circular on content development…
(Blog) MikeAbundo.com
(Blog) Pinoy Pro Blogger

---

Don’t we all just wish that what happened in the US National Science Foundation can actually be audited and checked in the Philippines? The questions would be, are logs even activated? And secondly, does someone with the skill and competence actually take the time to consistently check those logs?

Speaking of Log Management, Prism Microsystems has a video series on 100 uses of Log Management which so far, is on #9 Email Trends.

#8 Windows disk space monitoring
#7 Windows lockout
#6 Password reset
#5 Outbound Firewall traffic
#4 Solaris BSM SU access failure
#3 Antivirus update
#2 Active Directory login failures
#1 Firewall blocks

---

9th e-Services Global Sourcing Exhibition will be held at the SMX Convention Center from from Feb 9-10, 2009
APNIC 27 will be held in Manila from Feb 23-27, 2009

---

Other News:
(CNN.com) Teens Face Porn Charges for “Sexting”

Recent Whitepapers from Search Security.com

All the abstracts are from the searchsecurity.bitpipe.com website.

Accelerating PCI Compliance with Log Management and Intelligence.

Posted: 19 Sep 2008
Published: 19 Sep 2008
Format: PDF
Length: 6 Page(s)

ABSTRACT:
Today, all service providers and retailers that process, store or transmit cardholder data have a fiduciary responsibility to protect that data. As such, they must comply with a diverse range of regulations and industry mandates. One of the most important for the service provider and retailer is the Payment Card Industry Data Security Standard (PCI DSS), which sets forth 12 requirements for IT controls to ensure data security and protection. However, retailers both large and small face tremendous challenges in implementing policies and controls that enable PCI compliance, and the task of implementing best practices can be overwhelming.

---

Executive Summary: How to Achieve Comprehensive Network Security.

Posted: 16 Sep 2008
Published: 16 Sep 2008
Format: PDF
Length: 14 Page(s)

ABSTRACT:
Security practitioners need to think about security management along three separate axes – operations, investigations, and compliance reporting. Each of these functions is distinct, and typically involves different organizational hierarchies, which dramatically complicates the challenge of security management. The good news is that all of these management functions ultimately can be driven by a common data set, and that is the opportunity for a security management platform to aggregate this data once and leverage it for a number of suitable purposes.

---

Unauthorized Applications: Taking Back Control.

Posted: 01 Jul 2008
Published: 01 Dec 2007
Format: PDF
Length: 7 Page(s)

ABSTRACT:
This paper explains why it is important for businesses to control unauthorized applications such as instant Messaging, VoIP, games and peer-to-peer file-sharing and how malware protection is the simplest and most cost-effective solution.

The rapid emergence of Web 2.0 is beginning to redefine how individuals interact with the internet, and the related technologies pose a range of new threats. While there are a number of solutions available that help IT administrators to manage the problem, many require additional investment and, for many organizations, they can be expensive, unwieldy and difficult to maintain. A better solution is one which completely integrates the blocking of unauthorized applications into the existing anti-malware detection and management infrastructure.

---

Techniques for Transitioning to an IAM Suite.

Posted: 14 Oct 2008
Published: 14 Oct 2008
Format: PDF
Length: 5 Page(s)

ABSTRACT:
Organizations often fill their IAM needs with a variety of disparate techniques and applications, many of which are home grown or built by a variety of third parties. This tip will explain how an organization can ensure a successful transition from multiple products and tools to a single suite. It will look at:

* How to successfully map functionality from old product/tool functions to new ones
* How to evaluate and manage new and existing policy exceptions
* Guidelines for implementing custom connectors with legacy applications

---

Anonymous Proxy: A Growing Trend in Internet Abuse, and How to Defeat It.

Posted: 09 Sep 2008
Published: 09 Sep 2008
Format: PDF
Length: 5 Page(s)

ABSTRACT:
Anonymous proxies are an unseen threat-a student’s or employee’s backdoor to malicious or productivity-sapping sites on the Internet. If your URL filtering solution relies on the old-school URL database/keyword approach, your ship is leaking and you may not see the holes.

With hundreds of new proxy sites created each day, traditional URL filtering just can’t keep up, even when supplemented by standard keyword analysis. What follows is a primer on the problems, the sizable costs and time drain for IT professionals, and a discussion of an effective third-generation solution that goes far beyond the traditional strategy.

Upcoming Free Webinars

Infosecurity magazine will have an upcoming webinar on “Advancements in eCrime and their implications on web security” on Tuesday, November 11, 2008 at 11pm Philippine Standard Time. Duration of the Webinar will be an hour.

Description:
Modern Crimeware is a term coined to describe recent web-related attacks. In the ‘old’ days of virus and malware, the primary motive was fame. Modern crimeware is fuelled by financial motives and has evolved into an intricate economy of supply and demand, distributors, affiliations, and pricing models.

For more details, click here.

---

Wednesday, November 05 at 2:00 PM EST (1900 UTC/GMT) Note: This would be November 06 at 3:00 AM Philippine Time.

SANS is happy to bring you the latest in our complimentary series of Webcasts. Join us as SANS presents:

Reduce IT Costs by Unleashing Log Power

Featuring: Chima Njaka

Sponsored by:

For more details, click here.

---

WhiteHatWorld.com will have Webinars on

(Wednesday November 5, 2008 2:00PM Eastern)

Thursday November 6, 2008, 3:00 AM Philippine Time

Data Leakage Though Leadership Roundtable Webcast

Moderated by Rich Mogull

Panelists from Courion, Proofpoint, Secure Computing and Vericept

https://whitehatworldevents.webex.com/whitehatworldevents/onstage/g.php?t=a&d=665319446

(Thursday November 6, 2008 2:00PM Eastern)

Friday November 7, 2008 3:00AM Philippine Time

Forensics are Not Enough! Case Studies in Proactive Network Defense using Security Information and Event Management (SIEM) Technology

Presented by TriGeo

https://whitehatworldevents.webex.com/whitehatworldevents/onstage/g.php?t=a&d=661129372