WindowSecurity.com Newsletter of February 2012
Sponsored by: Collective Software <http://www.collectivesoftware.com/isaserver.newsletter.201202.lockoutguard>
-------------------------------------------------------
Welcome to the WindowSecurity.com newsletter by Stu Sjouwerman, Founder of Sunbelt Software & CEO of KnowBe4.com . Each month we will bring you interesting and helpful information on the world of Security. We want to know what all *you* are interested in hearing about. Please send your suggestions for future newsletter content to: feedback@windowsecurity.com
1. Editor's Corner
-------------------------------------------------------
*There Are Three Ways To Learn*
There are three ways to learn. 1) Read it in a book and apply it to your own situation. 2) See someone else do it and do the same. 3) Pee on the electric fence. The third example is the most painful, and in IT security, unfortunately it's very often the case.
I found a very instructive article for you that will allow you to learn using option 1) or 2) above, and hopefully not be forced into option 3. The article is called the 15 worst data security breaches of the 21st Century. The nominations for the list came from the Chief Security Officer LinkedIn community and here is the list. Note that they mention how this company was hacked if that data is available. Read and learn!
<http://www.csoonline.com/article/700263/the-15-worst-data-security-breaches-of-the-21st-century>
*Poll: Security Resource Allocation*
Here is my first WindowSecurity Poll. Please take 10 seconds to answer and next month we will publish the results! Here is the question:
"When making resource allocation decisions for security programs, do you have a methodology that helps you prioritize your investments based on greatest risk to the organization's overall business strategy?"
- Yes
- No
- Somewhat, but immature
Take the poll now:
<https://www.surveymonkey.com/s/ResourceAlloc>
*Quote Of The Month*
"All truths are easy to understand once they are discovered; the point is to discover them." - Galileo Galilei, born this month in 1564.
Email me at feedback@windowsecurity.com
Warm regards,
Stu Sjouwerman
Editor, WindowSecurity.com Monthly Newsletter
2. Security Detail
----------------------------------------
*Cool Cop Tech: 5 New Technologies Fighting Crime*
Computerworld reported: CSI and its imitators have introduced TV viewers to some of the advanced technologies used by crime-scene investigators. But they aren't the only law enforcement personnel benefiting from technology; police officers across the nation have an arsenal of high-tech devices to help them investigate and solve cases. From eye-in-the-sky drones to GPS vehicle pursuit darts and even ordinary iPads, here's a look at five tech tools that are being used or tested by police to protect their communities.
Some of these technologies are relatively uncontroversial, while others have raised eyebrows among privacy and civil rights advocates. The legality of one has even been called into question by the courts, highlighting a potential pitfall of using advanced tech to conduct police work.
*How Do I Know If A Wireless Network Is Secure?*
Microsoft has a very useful page on their site that you should send to your employee road warriors with laptops. It may very well prevent their machines getting infected, or worse:
<http://windows.microsoft.com/en-us/windows7/How-do-I-know-if-a-wireless-network-is-secure>
*Security Manager's Journal: Hackers Phone Home -- On Our Dime*
"At issue: A small office in Europe discovers that someone has hacked its IP telephony router.
Action plan:: Update the operating system to prevent toll fraud, and assess the IP telephony setups at offices around the world.
It's been a while since we've had a security breach worth mentioning (that we know of). Last week we had one, and it was an eye-opener. A small development office in Western Europe was informed by the local telephone company that a high number of calls were being made from the office's IP telephony setup to a Middle Eastern country. When we looked into it, we found that in just 15 days, over $30,000 in calls had been made to several Middle Eastern countries, as well as Russia, China and a couple of Central American nations." Here is the story:
<http://www.csoonline.com/article/700100/security-manager-s-journal-hackers-phone-home-on-our-dime>
3. SecureToolBox
-----------------------------------------------
* Free Service: Email Exposure Check. Find out which addresses of your organization are exposed on the Internet and are a phish-attack target:
http://www.knowbe4.com/eec/
* Frustrated with gullible end-users causing malware infections? Find out who the culprits are in 10 minutes. Do this Free Phishing Security Test on your users:
http://www.knowbe4.com/phishing-security-test/
4. ViewPoint – Your Take
-------------------------------------------
Write me! This is the spot for your take on things. Let me know what you think about Security, tools, and things that need to be improved. Email me at feedback@windowsecurity.com
5. SecOps: What You Need To Know
--------------------------
*Microsoft Fixes 21 Security Flaws*
Paul Thurrott has the best write-up about them, and make sure you test, test, test on a testbed before you deploy. These updates tend to break things. "Microsoft on Tuesday issued nine security updates addressing 21 separate flaws in products such as Windows, Internet Explorer (IE), .NET, Silverlight, and SharePoint. Several of the fixes address critical flaws, including some that could aid in so-called drive-by attacks.
The fixes come as part of Microsoft's regularly scheduled Patch Tuesday event. And the software giant noted that it has now been providing these regular fixes, and the associated guidance, for a bit over 10 years. More:
*What Is Your Email Attack Surface?*
Always been curious to find out what percentage of your employees actually are Phish-prone? Did you know that almost half of all network malware infections are caused by social engineering? Because cyber-attacks are rapidly getting more sophisticated, the frustration level and risk continues to mount.
Take the first step now to improve your organization's defenses against cybercrime. Fill out the form, and you will be able to start your Free Simulated Phishing Attack. That allows you to find out what percentage of your users is Phish-prone. The number is usually much higher than you think.
You will get immediate access to start the simulated attack. We call it the 'Phishing Security Test' (PST). Sign Up For Your FREE Simulated Phishing Attack Now:
<http://www.knowbe4.com/simulated-phishing-attack/>
*13 Security Myths*
Ellen Messmer at Network World had a good story that you should take a look at. "They're "security myths," oft-repeated and generally accepted notions about IT security that arguably are simply not true -- in order words, it's just a myth. We asked security experts, consultants, vendors and enterprise security managers to share their favorite "security myths" with us. Here are 13 of them."
<http://www.networkworld.com/news/2012/021412-security-myths-256109.html>
6. Hackers' Haven
--------------------------
*Adobe Confirms New Zero-Day Flash Bug*
"Adobe on Wednesday patched seven critical vulnerabilities in Flash Player, including one reported by Google researchers that hackers are using in "active targeted attacks." The bug attackers have been exploiting is a cross-site scripting (XSS) flaw in the Flash Player plug-in used by Microsoft's Internet Explorer (IE).
"This update resolves a universal cross-site scripting vulnerability that could be used to take actions on a user's behalf on any website or Web mail provider, if the user visits a malicious website," read the Adobe security advisory that accompanied yesterday's Flash update. "There are reports that this vulnerability is being exploited in the wild in active targeted attacks designed to trick the user into clicking on a malicious link delivered in an email message."
<http://cwonline.computerworld.com/t/7858859/987374514/552236/0/>
*Java Security Update Scrubs 14 Flaws*
Oracle has shipped a critical update that fixes at least 14 security vulnerabilities in its Java JRE software. The company is urging users to deploy the fixes as quickly as possible.
*http://krebsonsecurity.com/2012/02/java-security-update-scrubs-14-flaws/*
*Nortel Was Hacked For 10 Years - Execs Did Nothing*
Now this is a scandal from many different angles. The Chinese had penetrated their networks, it was reported up the flagpole, and nothing was done about it. Then they sold the company in parts, and the infected machines were sold as well. So this may be the first instance of a Corporate Transmitted Infection (CTI).
CSO Online has the whole story, and it's a cautionary tale that you should all have a look at. Wipe any strange machine completely clean by formatting the drive, and rebuild them from scratch!
<http://www.csoonline.com/article/700193/nortel-executives-knew-of-data-breach-chose-to-do-nothing>
7. Fave links & Cool Sites
--------------------------
SUPER FAVE: An abandoned iPhone turns out to be a killer of a deal in
the 4 min short film "Psycho Siri":
http://www.flixxy.com/psycho-siri-short-film.htm
---
Time-lapse footage from 179 different and beautiful places around the planet.
Best viewed in Full Screen HD:
http://www.flixxy.com/welcome-to-earth-universal-time-lapse.htm
---
A 3D LED Cube creates a large moving display in three dimensions:
http://www.flixxy.com/3d-led-screen-dance.htm
---
The iPad keyboard has six hidden keys you don't know about!
http://www.businessinsider.com/the-ipad-keyboard-has-six-hidden-keys-you-dont-know-about-2012-2?
---
Future Hipsters:
http://www.youtube.com/watch?v=uGi_r9xlvqE
---
Inventor claims this robot is "the greatest toy in the universe,":
http://www.gizmag.com/greatest-toy-robot-in-the-universe/21424/
---
Formula 1 car on ice and snow on the toughest Grand Prix track in the world,
that's not something you see every day:
http://www.flixxy.com/formula-one-car-on-ice-and-snow.htm
---
"Urban Paragliding". Fantastic flying and beautifully filmed and edited.
Jean-Baptiste Chandelier flies over Lima, Peru, Iquique, Chile and Mont
Dauphin, France:
http://www.flixxy.com/urban-paragliding.htm
TechGenix Sites
----------------------------------------------------------------
ISAserver.org <http://www.isaserver.org/>
MSExchange.org <http://www.msexchange.org/>
VirtualizationAdmin.com <http://www.virtualizationadmin.com/>
WindowsNetworking.com <http://www.windowsnetworking.com/>
----------------------------------------------------------------
Visit the Subscription Management (http://www.techgenix.com/newsletter/) section to unsubscribe.
WindowSecurity.com is in no way affiliated with Microsoft Corp.
For sponsorship information, contact us at advertising@windowsecurity.com
Copyright c WindowSecurity.com 2012. All rights reserved.
No comments:
Post a Comment