Archive

Category Archives for "Network World Security"

IDG Contributor Network: When SD-WAN is more than SD-WAN

As the SD-WAN market has matured, one thing has become very clear: SD-WAN will not exist on its own. The technology is merging with other networking technologies, ultimately becoming a feature of a much larger bundle. While it may be too early to say what this “new thing” will be, the rough contours are emerging.Predominantly, we’re seeing security and SD-WANs merge. Just consider some of the activity: Velocloud recently announced its SD-WAN Security Technology Partner Program to integrate with other security vendor’s products. Viptela (soon to be Cisco), Silver Peak, Velocloud and others have long (well, long in the SD-WAN sense) touted integration with security vendors using service chaining. Cato Networks built its own integrated security and networking stack in the cloud. Masergy bundles SD-WAN (Silver Peak and its own technology) with third-party security services in the cloud. But what’s missing in many of these integrated offerings is the completeness of the edge solution. Companies need more than just an SD-WAN in branch offices. They need firewall, IPS, anti-malware, URL filtering and anti-virus for security. Internally, networking calls for Active Directory, DHCP, DNS, and print services. Externally, the edge may need WAN optimization, bandwidth management, QOS, traffic balancing, Continue reading

DHS and FBI issue alert about North Korean ‘Hidden Cobra’ hackers

Watch out for attacks by Hidden Cobra, aka North Korean government hackers, the DHS and the FBI warned in a joint technical alert. The US government didn’t tiptoe around the issue, instead pointing the finger of blame at North Korea for a series of cyberattacks dating back to 2009.Who the heck is Hidden Cobra? You probably already know about these cyber actors who are usually referred to as the Lazarus Group. Back in 2014 when the hackers targeted Sony Pictures Entertainment, the group was publicly referring to itself as Guardians of the Peace.To read this article in full or to leave a comment, please click here

Crash Override: Malware that took down a power grid may have been a test run

Two security firms have released reports about the malware which was used in the December 2016 Ukraine power outage, warning that the partial power outage in Kiev may have been test run; the malware could be leveraged against other countries, including the US.The malware, dubbed Crash Override in the Dragos report (pdf) and Industroyer in the ESET report (pdf), has nothing to do with espionage and everything to do with cyber-sabotage.Crash Override, Dragos says, “is the first ever malware framework designed and deployed to attack electric grids.” It could be “leveraged at multiple sites simultaneously.” Dragos founder Robert M. Lee told Reuters, “The malware is capable of causing outages of up to a few days in portions of a nation's grid, but is not potent enough to bring down a country's entire grid.”To read this article in full or to leave a comment, please click here

South Korean web hosting company infected by Erebus ransomware

Nayana, a web hosting company in South Korea, suffered a ransomware attack over the weekend which resulted in more than a hundred Linux servers and thousands of websites being infected with Erebus ransomware. The initial ransom amount was astronomically high.Yesterday, I came across the news that a South Korean web hosting company had been infected by ransomware, but it was extremely short on details. The ransomware was Erebus; the attack occurred on Saturday and thousands of sites were reportedly infected.Today, Aju Business Daily provided more details. Nayana reportedly said 153 of its Linux servers were infected with Erebus. In turn, about 3,400 sites on the web hosting company’s servers were also infected.To read this article in full or to leave a comment, please click here

Witcher 3 developers won’t bow to extortion for stolen Cyberpunk 2077 files

With E3 (Electronic Entertainment Expo) starting this week, we can expect a flood of gaming news. It remains to be seen if the person or people trying to extort Polish game developer CD Projekt Red will choose this week to leak stolen Cyberpunk 2077 game files.Instead of staying quiet about an extortion attempt, CD Projekt Red, the developers behind The Witcher 3, got out ahead of any potential leak by tweeting: An unidentified individual or individuals have just informed us they are in possession of a few internal files belonging to CD PROJEKT RED. Among them are documents connected to early designs for the upcoming game, Cyberpunk 2077.To read this article in full or to leave a comment, please click here

24% off Resqme Keychain Car Escape Tool 2-Pack – Deal Alert

Made in the USA and originally developed for first responders, this 2-in-1 safety and survival tool is amazingly powerful despite its mini size. A fierce but safe spring loaded stainless steel spike allows the vehicle occupant to easily break side windows, and a carefully concealed stainless steel razor blade slices through a jammed seat belt to prevent vehicular entrapment. resqme is small enough to keep on your keychain, or clip it to your visor where it will always be at arm's reach. The resqme vehicle escape tool averages 4.5 out of 5 stars on Amazon from over 2,600 reviewers (read reviews). The typical list price on a 2-pack is $19.95, but with this 24% discount you can pick them up for $15.25. See this deal on Amazon.To read this article in full or to leave a comment, please click here

IDG Contributor Network: Top 5 InfoSec concerns for 2017

Cloudbleed, WannaCry, ransomware, hackers. Each and every day, it seems, the tech community wakes up to news of another attack on data security and privacy. As IT professionals, we spend our days working to the best of our knowledge and ability to keep company information secure. Some days, however, when news of new attacks hit, it can feel like we’ll never get ahead. As soon as we learn one method of protection, the hackers have invented a new workaround.To read this article in full or to leave a comment, please click here

NSA’s EthernalBlue exploit ported to Windows 10

If you were running Windows 10, then you didn’t need to worry about your box being hit with the leaked NSA EternalBlue exploit; but things change and now researchers have ported EternalBlue to Windows 10.After the WannaCry ransomware attack, some defenders focused on building detection rules to protect against the DoublePulsar backdoor implant; but beware as RiskSense researchers completely removed DoublePulsar. They warned that DoublePulsar is a “red herring for defenders to focus on, as stealthier payload mechanisms can be crafted.”While they are not revealing all the details about the exploit chain so attackers can jump on them, they hope white hat security researchers benefit from the technical overview of the exploit process “so that new generic and targeted techniques can be developed to prevent attacks.”To read this article in full or to leave a comment, please click here

What Extreme’s string of networking acquisitions means for enterprises

Extreme Network’s recent string of acquisitions – including it’s recent $100 million auction-buy of Avaya’s networking business, it’s purchase of Brocade’s Ethernet IP networking assets and its purchase of wireless vendor Zebra Technologies last year – should cause enterprise end users to potentially rethink their network infrastructure buying decisions when it comes time for their next hardware refresh, according to Forrester analyst Andre Kindness.Kindness says in the immediate short term, there are not likely to be any major changes to offerings from these vendors; all current Avaya and Brocade networking gear will still be supported. But given Extreme’s acquisition spree, it’s expected there will be some consolidation and blending of products over the medium and long-term. “As with anything, it will take some time to reconcile the moves and figure out the new direction,” says Kindness.To read this article in full or to leave a comment, please click here

Researchers find gaps in IoT security

Researchers from the University of Michigan and Stony Brook University published a paper explaining a novel approach to IoT security challenges (pdf). The researchers pose the question:  “What are the new intellectual challenges in the science of security when we talk about the Internet of Things, and what problems can we solve using currently known security techniques?” This research approach is very accessible because it uses existing categories and concepts by comparing security methods developed for smartphones, PCs and the cloud to identify the gaps and challenges to IoT security. The IoT stack is defined with the familiar layers:To read this article in full or to leave a comment, please click here

IDG Contributor Network: Learn What NIST’s Cybersecurity Framework Can Do For You

The meteoric rise of cybercrime has caught many organizations unawares. Malware has spread from PCs to smartphones, phishing scams have grown more sophisticated, and ransomware is running rampant.You can hire hackers and botnets, or buy cybercrime software, complete with technical support, all too easily. The rapidly expanding Internet of Things is woefully insecure, creating many more access points that can be exploited by hackers.To read this article in full or to leave a comment, please click here

Feds charge NSA contractor for leaking Top Secret report about Russia hacking election

Russian military intelligence hackers, believed to be working within the Russian General Staff Main Intelligence Directorate (GRU), tried to break into VR Systems, a company that sells voting registration equipment which was used in the 2016 election. That’s what the NSA determined, according to a classified intelligence report which was leaked to The Intercept.An hour after The Intercept published the NSA document, the Justice Department announced charges against Reality Leigh Winner, a 25-year-old intelligence contractor working for Pluribus International Corporation in Georgia. She had only been working as a Pluribus contractor since Feb. 13. Winner, accused of “removing classified material from a government facility and mailing it to a news outlet,” has been charged with Espionage Act.To read this article in full or to leave a comment, please click here

IDG Contributor Network: Armis wants to resolve the IoT security issue

The Internet of Things (IoT) is a big deal. A really big one.There are approximately 8 billion connected devices on the market today, collectively accounting for 50 percent of internet traffic. And that is but a taste of the future—the number of devices is anticipated to increase 150 percent in the next three years. And where growth like that is predicted, every man and his dog is keen to grab market share. The security for IoT space is no different.+ Also on Network World: A lack of IoT security is scaring the heck out of everybody + There are some justified reasons why security in this new IoT context will be different. Connected devices (e.g., laptops, webcams, HVAC systems, etc.) are designed to connect wirelessly, without corporate oversight or control. This creates a dynamic, ever-expanding matrix of connections that not only boosts employee productivity and business efficiency, but simultaneously flies under the radar of security.To read this article in full or to leave a comment, please click here

Armis wants to resolve the IoT security issue

The Internet of Things (IoT) is a big deal. A really big one.There are approximately 8 billion connected devices on the market today, collectively accounting for 50 percent of internet traffic. And that is but a taste of the future—the number of devices is anticipated to increase 150 percent in the next three years. And where growth like that is predicted, every man and his dog is keen to grab market share. The security for IoT space is no different.+ Also on Network World: A lack of IoT security is scaring the heck out of everybody + There are some justified reasons why security in this new IoT context will be different. Connected devices (e.g., laptops, webcams, HVAC systems, etc.) are designed to connect wirelessly, without corporate oversight or control. This creates a dynamic, ever-expanding matrix of connections that not only boosts employee productivity and business efficiency, but simultaneously flies under the radar of security.To read this article in full or to leave a comment, please click here

HPE highlights innovation in software-defined IT, security at Discover

At its Discover conference this week, HPE is pulling back the curtains on firmware security and advances in software-defined IT aimed to reduce costs and increase system flexibility for its users and help it stay ahead of competitors in next-generation infrastructure.There is plenty of competition in the market for converged and hyperconverged data center systems, but at the moment HPE has the lead in composable infrastructure, a term gaining currency in the system management world.Composable infrastructure allows data center managers to deploy infrastructure resources using software commands, notes Patrick Moorhead, founder of Moor Insights and Strategy.To read this article in full or to leave a comment, please click here

Dealing with NIST’s about-face on password complexity

In the last few years, we've been seeing some significant changes in the suggestions that security experts are making for password security. While previous guidance increasingly pushed complexity in terms of password length, the mix of characters used, controls over password reuse, and forced periodic changes, specialists have been questioning whether making passwords complex wasn't actually working against security concerns rather than promoting them.Security specialists have also argued that forcing complexity down users' throats has led to them writing passwords down or forgetting them and having to get them reset. They argued that replacing a password character with a digit or an uppercase character might make a password look complicated, but does not actually make it any less vulnerable to compromise. In fact, when users are forced to include a variety of characters in their passwords, they generally do so in very predictable ways. Instead of “password”, they might use “Passw0rd” or even “P4ssw0rd!”, but the variations don't make the passwords significantly less guessable. People are just not very good at generating anything that's truly random.To read this article in full or to leave a comment, please click here

Hackers leak 8 unaired episodes of ABC’s Steve Harvey’s Funderdome TV series

They’re back…The Dark Overlord, the hacking group which released 10 of 13 new Orange Is the New Black episodes in late April after Netflix refused to pay a ransom, has now leaked nearly the entire first season of ABC’s upcoming Steve Harvey’s Funderdome.Back in April, TDO warned ABC, National Geographic, Fox and IFC that the group wasn’t playing games anymore. Then on June 2, TDO tweeted, “American Broadcasting Company may be up next, ladies and gentlemen.”To read this article in full or to leave a comment, please click here

Tell the FCC you don’t want robo-voicemail, spammy direct-to-voicemail messages

If your phone doesn’t ring, yet you have received voicemail, did that voicemail qualify as a call? If it didn’t count as a call, then the telemarketer behind the pre-recorded voicemail message may claim it can leave “ringless voicemail” (RVM) for people even on the Do Not Call list.The FCC is currently deciding if it should ban ringless voicemail or if those spammy voicemail messages don’t count as calls as companies using direct-to-voicemail insertion technology claim.All About the Message, a ringless voicemail company, petitioned the FCC to “declare that the delivery of a voice message directly to a voicemail box does not constitute a call that is subject to the prohibitions on the use of an automatic telephone dialing system (ATDS) or an artificial or prerecorded voice” under the Telephone Consumer Protection Act (pdf).To read this article in full or to leave a comment, please click here

1 … 46 47 48 49 50 … 319