Security Now - Security challenges come in many forms


ABTV Application Cloud Endpoint Infrastructure IoT/Embedded Mobile Network Operational Security Management
Sign up for our weekly newsletter! REGISTER NOW

News & Views Best Defense: 5 Key Trends in Application Security Ameya Talwalkar Co-Founder and Chief Product Officer, Cequence Security, \| 6/26/2019 Looking back on all the application security discussions we have had with security practitioners in the past 12 months or so, there are five key trends that impact how enterprise firms seem to be addressing application security -- and increasingly they are looking to vendors for guidance here. Post a Comment \| READ () Developers Find Temporary Fix for OpenSSH Remote Access Software Vulnerability Larry Loeb Author, \| 6/26/2019 Researchers keep coming up with memory side-channel vulnerabilities in modern processors and DRAMs, like Rowhammer, RAMBleed, Spectre and Meltdown. All of these attacks bypass architectural safeguards that are supposed to keep data behind an unscalable wall. The attacks act to infer memory-resident data that is being stored in plaintext for operational ... Post a Comment \| READ () Millions of Dell PCs at Risk Due to Software Flaw Larry Loeb Author, \| 6/24/2019 SafeBreach Labs has found a problem with the disk trouble-shooting software that comes preinstalled on Dell Computers. It fails at DLLs. The software comes preinstalled on Dells that run Windows, which means that 100 million installs are at risk. Post a Comment \| READ () The Cracking of RSA-2048 Encryption Will Come Sooner Than Had Been Thought Larry Loeb Author, \| 6/21/2019 Quantum computing (QC) has long held the promise of exceeding what is possible in conventional computing. Physicists have held that a 50 qubit QC arrangement could outperform any of today's supercomputers, according to an MIT Technology Review article. Post a Comment \| READ () Defense Discovered for Defending Against BGP Hijacking & Off-Path DNS Attacks Larry Loeb Author, \| 6/20/2019 Certificate Authorities (CAs) are continually getting requests from threat actors who want certificates that they aren't entitled to so that their criminal schemes may be furthered. Post a Comment \| READ () New 'IPStorm' Malware Uses Peer-to-Peer Network for Communication Larry Loeb Author, \| 6/19/2019 Anomali Labs has found a new kind of malware (they call it IPStorm) that is controlled by peer-to-peer (p2p) communications rather than by a client-server model. The p2p network is established over the open-source InterPlanetary File System's (IPFS) p2p network. This is the first malware found in the wild that is using IPFS's p2p network for its command ... Post a Comment \| READ () XENOTIME Threat Actor Laying the Groundwork to Disrupt Utilities Larry Loeb Author, \| 6/17/2019 Dragos has been watching the XENOTIME threat actor since it first came on the scene in 2014. It wrote a new advisory that says this threat actor is showing new signs of expansion into new verticals. Post a Comment \| READ () Are US & UK Firms Keeping Up With 'Best Practice' Password Management? Larry Loeb Author, \| 6/14/2019 OneLogin, a password management tool vendor, did some research using Arlington Research into -- what else? -- password management. They surveyed 600 IT professionals in the US and the UK in order to gauge how companies are protecting passwords by means of tools, guidelines and practices in their report, Password Practices 2019. Post a Comment \| READ () Preempt Shows How to Sidestep EPA Authentication Larry Loeb Author, \| 6/13/2019 Security firm Preempt issued an advisory that showed how to conceptually bypass the Enhanced Protection for Authentication (EPA) that prevents attackers from performing a relay of NT Lan Manager (NTLM) messages to top-level security (TLS) sessions. Attackers could use NTLM to enable their own fake sessions. Since a relay attack is the most common one ... Post a Comment \| READ () Are Consumers Afraid of Biometrics for E-Commerce? Larry Loeb Author, \| 6/12/2019 Paysafe, a UK payment gateway provider, took a look at what people said they wanted to do when faced with online commerce. They found that 81% of consumers still favor passwords for making payments online due to concerns about the security of new biometric options. At the same time, 61% of consumers also agree that using biometrics is a much quicker and ... Post a Comment \| READ () Researchers Discover Way to Hack Hardware Security Module, Gain Access to Cryptographic Keys Larry Loeb Author, \| 6/11/2019 Ledger researchers Gabriel Campana and Jean-Baptiste Bedrune of the crypto-hardware wallet Ledger announced at the annual French security conference SSTIC they had found a way to remotely hijack a hardware security module (HSM). They show how an attacker could gain complete access to the keys and secrets stored on the HSM. Post a Comment \| READ () Digital Vigilantes Weaponize Vulnerability Disclosure Steve Durbin Managing Director, Information Security Forum, \| 6/11/2019 Over the next two years, vulnerability disclosure will evolve from a predominantly altruistic endeavor to one that actively damages organizations. Attackers will search for, and publicly disclose, vulnerabilities to undercut competitors and destroy corporate reputations. Fraudsters will manipulate financial markets by releasing exploits at opportune ... Post a Comment \| READ () Load More Articles + All Articles All Video All Slide Shows All Articles discussion board roch.smartcric11, 6/9/2019 9:05:09 PM Study Finds Most Popular iOS Apps Are Not Encrypting Data Re: Nice study on Smartcric.online, crictime live star sports live service Nice study. by the way its obvious that when one app get populairty then it's developer forget about security and he just will to earn more and more out of that. Post Your Reply LarryLoeb, 5/30/2019 10:53:52 AM Mobile Fraud Is on the March, Finds New RSA Report Re: Re: Mobile fraud is bad for smartcric, live video star sports ipl live @roch.smartcric11 As time goes on, quite probably Post Your Reply roch.smartcric11, 5/30/2019 9:35:53 AM Mobile Fraud Is on the March, Finds New RSA Report Re: Mobile fraud is bad for crictime, smartcric star sports live Mobile fraud is going to bigger and bigger. Post Your Reply batye, 5/24/2019 7:05:49 PM Suppliers Cut Off Huawei Re: Re: cut off @LarryLoeb interesting point, I could not agree more to it as remind of the the Cold War period - right after the WWII where KGB send well trained agents with suitecase of money to setup/buy legitamate Co. in the West... with purpose of... Post Your Reply LarryLoeb, 5/24/2019 5:57:49 AM Suppliers Cut Off Huawei Re: Re: cut off @Susan Companies can be agents of economic warfare. Would you change your view if you found Huawei's profits funded the Chinese army directly? (I have no such proof, btw. Making a point.) Post Your Reply Susan Fourtané , 5/24/2019 5:54:38 AM Suppliers Cut Off Huawei Re: Re: cut off I can't find it now but I have a statement from Huawei about this case. It's not right to try to put a company out of business for political reasons, Larry. Simply not right. The same with ZTE. Not right. Post Your Reply LarryLoeb, 5/24/2019 5:49:49 AM Suppliers Cut Off Huawei Re: Re: cut off @Susan I'm going to disagree. I think Huawei is inextriably linked with the government of China, a arm of it really, rather than some independent actor. China crushes independent actors. That doesn't mean the EO or the trade war is... Post Your Reply Susan Fourtané , 5/24/2019 5:34:00 AM Suppliers Cut Off Huawei Re: Re: cut off What the US government is doing to Chinese companies is war declaration. Technology and business should not be mixed with politics. Huawei is an independent company owned by its employees. What is happening is utterly ridiculous. Post Your Reply LarryLoeb, 5/22/2019 6:52:17 PM LightNeuron Sneaks In Through the Exchange Backdoor Re: Re: first @Ariella The little rotters never stand still. Post Your Reply Ariella, 5/22/2019 5:01:32 PM Cybercrime Study Finds Increasing Costs as Well as Changing Targets & Methods Re: Re: reliable stats? @mhhf1ve do you think it's higher or lower? Post Your Reply Ariella, 5/22/2019 5:00:32 PM DevSecOps Enables Security to Finally Move at the Speed of the Business Re: self-service I kind of like the idea of "self-service" security. I do go for self-service in other aspects of my life, so why not in security as well? Post Your Reply Ariella, 5/22/2019 4:58:49 PM LightNeuron Sneaks In Through the Exchange Backdoor Re: first Quite an accomplishment I guess. There is major innovation in the security breach world! Post Your Reply Next 5 messages + All messages All messages Chat 8/31/2017 3:54:21 PM Voice of Security Radio: A Security Partnership with Machine Learning: Thank you! klogan453 Keeper 8/31/2017 3:51:19 PM Voice of Security Radio: A Security Partnership with Machine Learning: Well, it seems like Steve and I managed to answer everyone's questions in our conversation. So I'll say thanks once again to Steve Grobman, CTO of McAfee, for being such a wonderful guest here on Voice of Security Radio! Curt Franklin Keeper 8/31/2017 3:47:35 PM Voice of Security Radio: A Security Partnership with Machine Learning: Thanks. Sr.Contr61262 Keeper 8/31/2017 3:47:19 PM Voice of Security Radio: A Security Partnership with Machine Learning: Thanks for helping out, Daren! Curt Franklin Keeper 8/31/2017 3:45:59 PM Voice of Security Radio: A Security Partnership with Machine Learning: (On behalf of Steve Grobman) - Data science and computer science expertise is definately in high demand by the cyber security technology industry as well as many other industries that are using similar capabilities daren Keeper 8/31/2017 3:44:38 PM Voice of Security Radio: A Security Partnership with Machine Learning: (On behalf of Steve Grobman) - There is not a formal certificatio process.. most users don't need to understand the nuance of the technology which is generally built by technology product providers daren Keeper 8/31/2017 3:42:40 PM Voice of Security Radio: A Security Partnership with Machine Learning: And how are mainline security pros/machine learning pros certified, i.e. how do you lknow that the person you're hiring to help you knows what they're dcoing? Sr.Contr61262 Keeper 8/31/2017 3:39:20 PM Voice of Security Radio: A Security Partnership with Machine Learning: Steve, one question we didn't get to is that of skilled practitioners. I know that mainline security pros are in short supply and high demand: Is it even worse when it comes to machine learning pros in the security space? Curt Franklin Keeper 8/31/2017 3:37:01 PM Voice of Security Radio: A Security Partnership with Machine Learning: Since I was late - and again - really sorry, I don't even know what to ask. Feel free to ask a question or my behalf. Sr.Contr61262 Keeper 8/31/2017 3:33:59 PM Voice of Security Radio: A Security Partnership with Machine Learning: Well folks, now's the time to ask any questions we didn't get to in the audio interview. Steve will be here in just a moment -- what would you like to know? Curt Franklin Keeper Next 5 chats +		Information Resources • Deliver a True Omni-Channel Experience • The Smart Way to Simplify PCI Compliance • Versa SD-WAN – Simple, Secure and Reliable Branch to Multi-Cloud Connectivity • Fortifying Your Branch Security • The Essential Guide to Understanding Risk and Quantification • 7 Experts on Threat and Vulnerability Management • A CISO’S Guide to Hybrid Cloud Security • Endpoint EcoSystems E-Book: Collaborating To Conquer Security Threats • (Sans) Understanding the (True) Cost of Endpoint Management Survey • Forrester Research - The Total Economic Impact of IBM BigFix Patch And BigFix Compliance All resources upcoming Webinars ARCHIVED Making an Intelligence-led Defense a Reality (archive available soon) Wednesday, June 26, 2019 1:00 p.m New York More Webinars Webinar Archives Analysts Corner Ovum Resources • Ovum 2018 Trends to Watch: IT & Cybersecurity • Ovum IoT Security: Technology Strategies & Vendor Profiles • Ovum 2018 Trends to Watch: Managed Security Services • Ovum's Mini-Guide to GDPR Analysts Corner archive Flash Poll All polls Video In a wide-ranging interview, Cisco security boss Gee Rittenhouse talks about how machine learning, AI, blockchain and other emerging technologies ... CloudPassage's new technology, called Container Secure, involves a five-step process to ensure seamless security in container deployments from the ... You can't so much as go to a coffee shop today without hearing the word 'blockchain.' Hearing about a useful blockchain is less common, but ... Last year, 60 million companies changed owners worldwide. That turnover makes it incredibly difficult to avoid doing business with entities (e.g., ... Keith Furst of Data Derivatives interviews Daniel Wagner, author of a new book, Virtual Terror: 21st Century Cyber Warfare. They discuss the ways ... All Videos Sponsored Video Sage Wagner, senior security pre-sales engineer with RiskSense, provides a demo of the company's latest technology 'RiskSense Solution,' a ... Janus Technologies is launching a line of products that protect against the many threats to enterprises' sensitive data. David Schultz, vice ... This new video will inspire companies to reimagine their business for success in a world where connectivity is more than a commodity. Sponsored Video All Videos Radio Shows ARCHIVED \| August 31, 2017, 3pm EDT Voice of Security Radio: A Security Partnership with Machine Learning An interview with Steve Grobman, CTO of McAfee ARCHIVED SHOWS DOWNLOAD TO CALENDAR Slideshows Top 10 Security Stories of 2018 Slideshow archive Twitter Feed Tweets by Security_Now_ like us on facebook