With SQL Server 2005 now out of support, if you haven’t already started migrating your older databases onto a newer, supported release to stay in compliance with regulations like PCI DSS, that’s now urgent.
But even if you don’t have an urgent need to migrate, there are several reasons why you may want to consider SQL Server 2016.
The new security options will be significant for many businesses. Integration with Azure gives businesses a new approach for both availability and bursting performance to the cloud. And Power BI is an option today that will become a key part of SQL Server reporting in the future. Plus, this is the version that Microsoft will be bringing to Linux, giving you a new option for moving off Oracle.To read this article in full or to leave a comment, please click here(Insider Story)
Have you opted for lower car insurance premiums via installing an insurance-supplied dongle? If so, then did you realize that dongle could narc you out when brake pedal usage is used a biometric identifier? Kiki der Gecko
If you are thinking surely not, then think again as researchers had nearly a 90% accuracy in identifying drivers via brake pedal sensor data after only 15 minutes of driving.To read this article in full or to leave a comment, please click here
Oracle has released a new quarterly batch of security updates for more than 80 products from its software portfolio, fixing 276 vulnerabilities.This is the largest Oracle Critical Patch Update (CPU) to date. The average number of flaws fixed per Oracle update last year was 161, according to security vendor Qualys. Furthermore, out of the 276 security flaws fixed in this update, 159 can be exploited remotely without authentication.At the top of the priority list should be the Java patches, which address 13 new vulnerabilities. That's because Java is used in a lot of applications and is installed on a large number of systems."Customers really do need to apply these Java CPU patches as soon as possible," said John Matthew Holt, the CTO of application security firm Waratek, via email. Among the patches that require urgent attention are those for the HotSpot Java virtual machine for desktops and servers, which received high CVSS (Common Vulnerabilities Scoring System) scores, Holt noted.To read this article in full or to leave a comment, please click here
The U.S. Department of Human Services has released new guidance for health care organizations that focuses on the growing threat of ransomware, stresses the need for better education and regular backups, and confirms that a ransomware attack against plain-text health information is, in fact, a breach that must be disclosed.
The guidance recommends that organizations identify the risks facing their patient information, create a plan to address those links, set up procedures to protect systems from malware, train users to spot malware, limit access to sensitive information to just the people who need it most, and have a disaster recovery plan that includes frequent data backups.To read this article in full or to leave a comment, please click here
Federal authorities have shut down several alleged tech support scammers working out of Florida, Iowa, Nevada and Canada, freezing their assets and seizing control of their businesses.The action was one of the largest in the U.S. against scammers, who bilk consumers out of an estimated $1.5 billion annually with bogus tales of infected Windows PCs and Apple Macs, high-pressure sales tactics, and grossly overpriced services and software.After the Federal Trade Commission (FTC) filed complaints against six companies and six individuals in late June, courts shuttered alleged scammers doing business under names like Big Dog Solutions, Help Desk National, Help Desk Global, PC Help Desk, Inbound Call Specialist, BlackOptek CE, 9138242 Canada and Digital Growth Properties. Five of the six operated as a single enterprise, muddying the waters with multiple names.To read this article in full or to leave a comment, please click here
Suprisingly long historyImage by ThinkstockRansomware has been the most pervasive cyber threat since 2005. According to publicly available information, ransomware infections have outnumbered data breaches 7,694 to 6,013 over the past 11 years.To read this article in full or to leave a comment, please click here
The same hacking group that took over Mark Zuckerberg's Twitter account has now found a way to break into accounts connected to the hit game Minecraft.The group, OurMine, made the claim on Tuesday in a video demonstrating its hack. The attack is aimed at the user login page run by Minecraft's developer, Mojang.OurMine isn't revealing all the details behind the hack. The group said it works by stealing the Internet cookies from the site, which can be used to hijack any account. All that OurMine needs is the victim's email address.To read this article in full or to leave a comment, please click here
The same hacking group that took over Mark Zuckerberg's Twitter account said on Tuesday it had found a way to break into accounts connected to the hit game Minecraft.
The group, OurMine, made the claim in a video in which it demonstrated the hack, which was aimed at the user login page run by Minecraft's developer, Mojang.
Later on Tuesday, Microsoft, which bought Mojang two years ago, said it had fixed the issue.To read this article in full or to leave a comment, please click here
IT decision-makers who have responsibility for security believe security teams are brought in too late to have a meaningful effect on digital transformation initiatives, according to a new study.
Dimensional Research, commissioned by by Dell, recently surveyed 631 IT decision-makers with responsibility for security from companies with 1,000 or more employees in the U.S., U.K., Germany, Australia, Scandinavia and the Benelux region. Ninety-seven percent of respondents report their organizations were investing in digital technologies to transform their business: 72 percent of the respondents said their organizations had active projects in mobile, 68 percent in cloud and 37 percent involving the Internet of Things (IoT) — all areas commonly associated with digital transformation.To read this article in full or to leave a comment, please click here
Carbon Black has bought Confer to boost its protection for network endpoints using a behavioral form of antivirus combined with cloud analysis of threats rather than traditional signature-based software.Called Cb Defense, the renamed Confer product uses behavior-based techniques to prevent attacks from getting started and blends in attack-detection and response as a way to halt ongoing attacks.These are supported by analytics based in the cloud that help detect malwareless attacks that employ legitimate tools that are built into operating systems as a way to stay below the radar of defenses that use hashes and signatures to detect.To read this article in full or to leave a comment, please click here
It's one thing to have security vendors email me suggesting that cyber attacks are getting worse. It's another thing altogether when a vendor comes to me with hard metrics. Such is the case with Arbor Networks, the security division of NETSCOUT.Given Arbor is all about helping to protect enterprise and service provider networks from distributed denial-of-service (DDoS) attacks, it is fair to suggest that any mention of increasing attack numbers is a little self-serving. But ulterior motives notwithstanding, it's worth hearing what they found.+ Also on Network World: DDoS attacks are more than disruptions to service +To read this article in full or to leave a comment, please click here
Is it possible to develop chip technology that combines the high-performance characteristics of ASICS with the speedy, low-cost features of printed circuit boards?Scientists at the Defense Advanced Research Projects Agency this week said they were looking for information on how to build interface standards that would enable modular design and practical circuit blocks that could be reused to greatly shorten electronics development time and cost.+More on Network World: DARPA: Researchers develop chip part that could double wireless frequency capacity+To read this article in full or to leave a comment, please click here
If you are a cybersecurity professionals or interested in cybersecurity at all, you should be familiar with the Cybersecurity Canon. Just what is a Canon? There are lots of definitions but that one that applies here is, “a sanctioned or accepted group or body of related works.” With this definition in mind, the stated goal of the Cybersecurity Canon is:“To identify a list of must-read books for all cybersecurity practitioners -- be they from industry, government or academia -- where the content is timeless, genuinely represents an aspect of the community that is true and precise, reflects the highest quality and, if not read, will leave a hole in the cybersecurity professional’s education that will make the practitioner incomplete.”To read this article in full or to leave a comment, please click here
Governments may order telcos to retain customer data, but only to fight serious crime, a top European Union judge has advised.Lobby groups European Digital Rights (EDRi) and Privacy International welcomed the recommendation, saying it adds to a growing body of legal opinion opposing mass data retention. It could even, said Privacy International, derail the U.K.'s Investigatory Powers Bill, introduced in March by Theresa May, then home secretary and now prime minister.Advocate General Henrik Saugmandsgaard Øe advised that a general obligation to retain data may be compatible with EU law, but cautioned that laws imposing such obligations should respect personal privacy and impose strict controls on access to the retained data, its security, and the period it is kept. Furthermore, such obligations can only be justified when strictly necessary in the fight against serious crime.To read this article in full or to leave a comment, please click here
Democratic National Committee hacker Guccifer 2.0 gave The Hill another batch of pilfered DNC documents; these are different than those files which included information on 11,000 donors given to The Hill last week. At that time, Guccifer had claimed that the press had been forgetting about him, that WikiLeaks was “playing for time” and he still had documents to dump.To read this article in full or to leave a comment, please click here
Some of the intrusive techniques used by security, performance, virtualization and other types of programs to monitor third-party processes have introduced vulnerabilities that hackers can exploit.
Researchers from data exfiltration prevention company enSilo found six common security issues affecting over 15 products when they studied how software vendors use 'hooking' to inject code into a process in order to intercept, monitor or modify the potentially sensitive system API (application programming interface) calls made by that process.
Most of the flaws enSilo found allow attackers to easily bypass the anti-exploit mitigations available in Windows or third-party applications, allowing attackers to exploit vulnerabilities that they couldn't otherwise or whose exploitation would have been difficult. Other flaws allow attackers to remain undetected on victims' computers or to inject malicious code into any process running on them, the enSilo researchers said in a report sent via email that's scheduled to be published Tuesday.To read this article in full or to leave a comment, please click here
DDoS attacks are becoming increasingly sophisticated, combining multiple attack techniques that require different mitigation strategies, and abusing new protocols.Incident responders from Akamai recently helped mitigate a DDoS attack against an unnamed European media organization that peaked at 363G bps (bits per second) and 57 million packets per second.While the size itself was impressive and way above what a single organization could fight off on its own, the attack also stood out because it combined six different techniques, or vectors: DNS reflection, SYN flood, UDP fragment, PUSH flood, TCP flood, and UDP flood.Almost 60 percent of all DDoS attacks observed during the first quarter of this year were multi-vector attacks, Akamai said in a report released last month. The majority of them used two vectors, and only 2 percent used five or more techniques.To read this article in full or to leave a comment, please click here
IBM’s revenue continued to decline in the second quarter but growth in some of its strategic initiatives like cloud computing and data analytics suggest that the company may be on track in its transition plans.The Armonk, New York, company said Monday that revenue from its new “strategic imperatives” like cloud, analytics and security increased by 12 percent year-on-year to US$8.3 billion. That increase was, however, lower than the growth the company had reported in these businesses in the first quarter.Cloud revenue – public, private and hybrid – grew 30 percent in the second quarter, while revenue from analytics grew 4 percent, revenue from mobile increased 43 percent and the security business grew 18 percent.To read this article in full or to leave a comment, please click here
AT&T uses artificial intelligence to tell if things are going wrong in its network. Soon, AI may know it before it happens.The carrier says it’s been using AI for decades in areas like call-center automation but developed it for each use as they came along. Now AT&T is pouring its AI smarts into a one platform that can be used with multiple applications.“I can’t just keep doing this once at a time. We need a foundation,” said Mazin Gilbert, assistant vice president of the company’s Inventive Sciences division, in an interview last week at the AT&T Shape conference in San Francisco.That foundation is about two million lines of the code that powers AT&T’s Domain 2.0 software-defined network, which the carrier built so it could roll out new services more quickly and efficiently. Along with its own AI code, much of which is open source, the company is using open-source components from partners including universities and third-party vendors.To read this article in full or to leave a comment, please click here
Pay up or face your patients' wrath.That’s how one hacker is trying to shake down U.S. healthcare providers after stealing sensitive data about their patients.TheDarkOverlord claims to have stolen 10 million patient records and is selling them on the black market. In the meantime, the hacker is trying to extort the providers by telling them their patient data won't be sold if they pay a ransom.At least one of the healthcare providers so far has refused to give in, TheDarkOverlord said in an interview Friday. To apply pressure, the hacker claims to have called some of its patients to warn them their records will be leaked if the provider doesn't pay up.To read this article in full or to leave a comment, please click here