Security Archives - Page 67 of 178

IBM and Google Create New Certifications for Data Scientist and Cloud Skills

Job site Indeed found that listings for “data scientist" have surged 344 percent over the past five years.

Cumulus and Nutanix Integrate HCI, Open Networking

The partnership also allows Cumulus to battle Cisco. “That’s what we do everyday, and having a better story for Nutanix customers is just one more way to do that,” Cumulus CEO Josh Leslie says.

Cisco Pushes ACI to AWS and Azure, Embraces ‘Data Center Anywhere’ Strategy

It sounds similar to VMware’s “NSX everywhere” push, which seeks to stretch that vendor’s networking and security capabilities from data centers to clouds and the edge.

Passwords in a file

My dad is on some sort of committee for his local home owners association. He asked about saving all the passwords in a file stored on Microsoft's cloud OneDrive, along with policy/procedures for the association. I assumed he called because I'm an internationally recognized cyberexpert. Or maybe he just wanted to chat with me*. Anyway, I thought I'd write up a response.

The most important rule of cybersecurity is that it depends upon the risks/costs. That means if what you want to do is write down the procedures for operating a garden pump, including the passwords, then that's fine. This is because there's not much danger of hackers exploiting this. On the other hand, if the question is passwords for the association's bank account, then DON'T DO THIS. Such passwords should never be online. Instead, write them down and store the pieces of paper in a secure place.

OneDrive is secure, as much as anything is. The problem is that people aren't secure. There's probably one member of the home owner's association who is constantly infecting themselves with viruses or falling victim to scams. This is the person who you are giving OneDrive access to. This is fine for the Continue reading

Cisco Issues Patches for Several SD-WAN Software Vulnerabilities

Cisco discovered a number of vulnerabilities affecting devices that connect to its SD-WAN software. This includes one critical security flaw to its vController software.

ExtraHop CEO Sets His Sights on Becoming a Half-Billion-Dollar Security Firm

ExtraHop CEO Arif Kareem is also positioning the software provider for an IPO in the next 24 months. But he’s quick to add, “that’s not our end goal.”

5G SA Core, Handset Deployments to be Delayed, Dell’Oro Says

The one-year delay is because initial 5G network launches are using the non-standalone architecture that relies on already deployed 4G LTE evolved packet core technology.

McAfee Cuts 200 Employees as Buyout Rumors Persist

Thoma Bravo, the private equity firm rumored to want to buy McAfee, spent billions scooping up security companies in 2018. It also approached Symantec about acquiring that company.

Carbon Black Reports 1 Million-Plus Security Attacks Daily

China and Russia were responsible for almost half of the incident response episodes.

Netskope IDs New Google Cloud Attack, McAfee Finds Ransomware

Threat researchers at Netskope and McAfee this week described new and potentially dangerous networking vulnerabilities.

Linux Foundation Launches LF Edge Group With 5 Projects

The new group’s list of founding members reads like a who’s who of chipmakers, telecommunications companies, cloud providers, edge infrastructure vendors, and others.

HTTP/3: From root to tip

HTTP is the application protocol that powers the Web. It began life as the so-called HTTP/0.9 protocol in 1991, and by 1999 had evolved to HTTP/1.1, which was standardised within the IETF (Internet Engineering Task Force). HTTP/1.1 was good enough for a long time but the ever changing needs of the Web called for a better suited protocol, and HTTP/2 emerged in 2015. More recently it was announced that the IETF is intending to deliver a new version - HTTP/3. To some people this is a surprise and has caused a bit of confusion. If you don't track IETF work closely it might seem that HTTP/3 has come out of the blue. However, we can trace its origins through a lineage of experiments and evolution of Web protocols; specifically the QUIC transport protocol.

If you're not familiar with QUIC, my colleagues have done a great job of tackling different angles. John's blog describes some of the real-world annoyances of today's HTTP, Alessandro's blog tackles the nitty-gritty transport layer details, and Nick's blog covers how to get hands on with some testing. We've collected these and more at https://cloudflare-quic.com. And if that tickles your fancy, be sure Continue reading

StackRox Extends Its Container Security Platform

StackRox updated its container security platform with additional visibility, profiling, and network management features.

Emergency Directive 19-01, DNS 2FA suggested

Check your domain registration and protect those logins

The post Emergency Directive 19-01, DNS 2FA suggested appeared first on EtherealMind.

Cohesity Fights Ransomware, Dips Its Toes Into Security

The vendor added new capabilities to its data backup platform that prevent, detect, and respond to ransomware attacks.

Tracing Soon-to-Expire Federal .gov Certificates with CT Monitors

As of December 22, 2018, parts of the US Government have “shut down” because of a lapse in appropriation. The shutdown has caused the furlough of employees across the government and has affected federal contracts. An unexpected side-effect of this shutdown has been the expiration of TLS certificates on some .gov websites. This side-effect has emphasized a common issue on the Internet: the usage of expired certificates and their erosion of trust.

For an entity to provide a secure website, it needs a valid TLS certificate attached to the website server. These TLS certificates have both start dates and expiry dates. Normally certificates are renewed prior to their expiration. However, if there’s no one to execute this process, then websites serve expired certificates--a poor security practice.

This means that people looking for government information or resources may encounter alarming error messages when visiting important .gov websites:

The content of the website hasn’t changed; it’s just the cryptographic exchange that’s invalid (an expired certificate can’t be validated). These expired certificates present a trust problem. Certificate errors often dissuade people from accessing a website, and imply that the site is not to be trusted. Browsers purposefully make it difficult to continue to Continue reading

Archive