Symantec releases online cybersecurity quiz
121818
It's an odd bid to get some attention by one of the leaders in computer security, because it poses interesting questions but doesn't vary at all if you play multiple times.
126519
(InfoWorld) - It may have taken enterprise customers years to get proper security tools in place to defend their PCs, but if large businesses drag their feet in aligning the applications necessary to protect their smartphones, they will pay a heavy price, says Symantec. As part of a media tour to call attention to the planned launch of its Symantec Mobile Security Suite 5.0 package on June 4 -- touted as its most comprehensive product to date for protecting handheld devices against loss or attack -- experts with the company said hackers and electronic scammers are already creating a mobile environment that will soon rival the dangers of today's PC security landscape. All of the attack profiles that have become standard fare for desktops and laptops, from root kit-like programs that attempt to infect device operating systems, to ingenious social engineering attempts that play on the multimedia footprint of smartphones, have already arrived, said Khoi Nguyen, group product manager for mobile security at Symantec. How quickly the attacks multiply and proliferate will be determined only by the pace with which people adopt more powerful handhelds and how aggressive they are in defending the devices, he said. Unlike in previous years where much of the buzz around wireless security could be attributed to forward thinking, Symantec believes that handheld platforms are about to be deluged by a storm of different types of attacks. "Since the first mobile threats started arriving several years ago things have evolved dramatically, these attacks are real and people are being impacted by them today, particularly in other regions of the world where smartphone use is higher than in the U.S.," Nguyen said. "We are still in the early stages here, but things are evolving much more rapidly than they did on the PC side; as more enterprises adopt smartphones and they are being used more frequently to carry out financial transactions, the attackers will be there waiting." While Symantec estimates that there are still about 450 PC-oriented threats for every attack designed to assail mobile devices, the company expects the gap to close rapidly over the next several years. As new devices and applications that are expected to drive adoption of smartphones hit the market, such as those built to run on Microsoft's Windows Mobile platform, more enterprises will buy the memory-heavy handhelds and hackers will follow, the security expert said. In the last month alone, Symantec has uncovered root-kit style threats attacking Symbian smartphones which attempt to modify the devices' operating system files to bypass onboard security features. The company has also observed so-called snoopware programs, which add voice-driven schemes into the malware mix. One snoopware attack, which had the ability to remotely activate a smartphone's microphone to secretly eavesdrop on calls, take control of its camera to surreptitiously take pictures, and forward all of a user's text messages to another account, was aimed at users of Windows Mobile With an estimated 60-70 percent of the world's smartphones running on Symbian software today, most mobile previously-identified device attacks have targeted the company's OS. In moving to target Windows Mobile users in such a way, hackers illustrate how they are already preparing to cash in on the projected growth of Microsoft's platform, according to Nguyen. "Basically the threats have gone from proof-of-concept to full-blown spyware in a span of three years, whereas it took over a decade for the same type of evolution to occur on the desktop side," said Nguyen. "On the enterprise side, companies are finding that the smartphone is just another endpoint that is going to need to be protected in the same way that desktops and laptops are protected today." As a result of the need for PC-like protection for their handhelds, Symantec is pitching a range of applications in Mobile Security Suite 5.0 that mimic its products for larger computers. Included in the package will be what the company is touting as the first network access control (NAC) system for smartphones, with NAC applications still existing as a fairly new security development in the PC space. Much like a PC-oriented NAC system, the smartphone tools -- which must be used in concert with Symantec's standalone mobile VPN product line -- promise to perform a series of security health checks on devices before the handhelds are allowed to access corporate networks. Another capability unique to the company's latest enterprise smartphone defense package is a tamper-protection feature that monitors devices' operating systems to detect any attempts to modify the code, such as in root kit attacks. As with its Norton consumer smartphone offerings, the Mobile Security Suite 5.0 package will also include more traditional anti-virus and firewall tools as well. Other industry watchers agree that enterprises must have their smartphone security plans firmly in place as they hand out more of the devices to employees. And according to executives at Nokia, the world's top producer of mobile devices, more customers than ever are asking about security implications upfront as they consider wider smartphone distribution. One of the most significant concerns among customers remains the use of unsanctioned devices in the enterprise, typically occurring when workers who have not yet been offered smartphones by their employers instead begin using their own handhelds to carry out business tasks. "A lot of people are still asking us about dealing with unsanctioned devices, the administrators realize that there are often a lot of people using their smartphones in the enterprise without authorization, and they need to find a way to protect themselves," said Kara Hayes, senior product marketing manager for Nokia's Security & Mobility Connectivity group. "People are also very concerned about device loss and theft, they want the ability to wipe the data on the device and kill service," she said. "They want mobile e-mail protection and they're concerned about preventing against data loss; security really has become a big part of the conversation with customers looking to adopt smartphones across more of their organization." Sam Bhavnani, an analyst with Current Analysis, said that organizations should take the best practices they have developed for laptops and port them directly into their smartphone adoption plans. "This all goes back to the migration from desktops to laptops. There are a lot of common sense implications, and people need to be sensible about creating realistic policies that both protect the data on the device and allow users to tap into the potential of the smart phones," Bhavnani said. "Some people are still scared to go there, they know that adopting these devices will open another can of worms, but creating smart policies ahead of time and building on their laptop experience will be the best ways to foster strong mobile security."ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
177244
Symantec issued an alert after exploit code was posted to the Securityfocus Web site. The alert raised the urgency and severity of an earlier warning about the security holes in ARCServe Backup versions 9.01 through 11.5 SP1, as well as CA's Business Protection Suite software.
627945
InfoWorld - Symantec will kick off its annual Symantec Vision conference next week with the first public release of its next-generation corporate anti-virus software, Symantec Endpoint Protection 11.0.
364679
In a curious decision on the part of a security software company, a white paper released today on the Symantec's Web site contains the address of an independent research paper which includes a demonstration of defeating PatchGuard, complete with source code, in an early Windows Vista beta.  The address comes by way of a 16-page reduction of Vista's security technologies.
309307
Newly updated. This article provides insight into the Metasploit Framework, a very useful tool for the penetration tester. Part two of three.
145592
Symantec has released firmware fixes for a string of critical security holes in its firewall/VPN and Gateway Security products which could be exploited to cause a denial of service, identify
703160
Symantec is looking for beta testers for two of its newest products, Norton Internet Security 2008 and Norton AntiVirus 2008. Both are slated to ship later this year, but the company has opened up the beta process to iron out the bugs before its final release.
681770
AOL has launched its 9.0 Security Edition, which includes McAfee&#39;s VirusScan Online application, offering protection against infection from peer-to-peer file sharing, Web site downloads, CD-ROMs and disks, or multimedia files.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
224951
Those who have not changed the default passwords on their home routers may be putting themselves at risk of attack, researchers at Indiana University and Symantec are warning.
725526
In an effort to include storage within its empire of security products, Symantec Corp. announced Tuesday that it is going after the backup market with live state recovery
228047
Symantec Corp. has released new editions of its consumer Norton AntiVirus and Norton Internet Security software, adding browser defenses for some users in both packages and wrapping its new identity initiative into the software.
179658
As part of its service, Symantec will use a global network of probes and decoy e-mail accounts to collect, analyze and identify new phishing scams targeted at customers that use its Online Fraud Management services.
593893
(InfoWorld) - Symantec will kick off its annual Symantec Vision conference next week with the first public release of its next-generation corporate anti-virus software, Symantec Endpoint Protection 11.0. Under the code name Hamlet, the product has been available to a select group of beta testers since March, but next week it will be released in a public beta, according to Symantec. Company representatives declined to reveal Hamlet's official product name, but it's listed on the Vision conference Web site. Hamlet will be a follow-up to Symantec's AntiVirus Corporate Edition, version 10. The new software is a major advance for Symantec, which has been working for more than a year to integrate firewall, zero-day protection, and network access control features into its anti-virus product. "This is the next major version of the code base," said Brian Foster, senior director of product management with Symantec's endpoint security group. "With this release, we're really focused on changing the game for anti-virus." In addition to performance improvements, Hamlet will be easier to use and to manage, Foster said. Hamlet includes code from two recent Symantec acquisitions. It will include firewall capabilities based on the Sygate Enterprise Protection software Symantec acquired in 2005. Another new feature will be SONAR (Symantec Online Network for Advanced Response), based on code that Symantec acquired as part of its 2005 purchase of Whole Security. Although Hamlet is a step forward, anti-virus vendorsÂ such asÂ Symantec are playing catch-up in the fight against malware writers, who are increasingly evading detection with a large number of low-circulation variants of their code, said Andrew Jaquith, an analyst with Yankee Group. "They still have work to do," he said. "I don't think Symantec is quite cognizant of the degree to which these variants are making their [research] labs a lot less effective." Symantec needs to add "much more comprehensive behavior blocking" and possibly "herd intelligence" capabilities that would allow users to directly identify and share information on the latest threats, Jaquith said. "Most of theÂ [anti-virus] labs are like fishing boats with a drift net," he added. "They are good at catching the big fish, but the bad guys are basically flooding the ocean with little minnows that are going right through the net." Symantec competitor McAfee is planning to announce a rival product to Hamlet next week relating to the company's "Total Protection for Enterprise with ePolicy Orchestrator security management software," a McAfee spokesman said Thursday. He declined to offer further details on the announcement, however. The commercial version of Hamlet is expected to be available later this year. Pricing has not yet been released. Symantec Vision runs from Tuesday to Thursday next week at the Venetian Hotel in Las Vegas.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
551819
(InfoWorld) - Symantec Corp. plans to integrate two of its compliance assessment products to make it easier for IT administrators to manage the software, a company executive said Thursday. Engineers at the company are working on integrating Symantec's Enterprise Security Manager and Control Compliance Suite, said Tom Kendra, president of Symantec's Security and Data Management group, speaking on a webcast of the company's annual financial analyst conference Thursday. The project, code-named "Nextgen," is expected to ship in 2008, or possibly even as soon as the end of the year, Kendra said. Symantec did not disclose many other details about Nextgen. "The real key with Nextgen is it will be combining agent and agentless technologies," according to a company spokesman. These compliance products are used to identify systems on the network that are misconfigured or that do not have the latest security patches. Control Compliance Suite can perform scans of the network without requiring the installation of "agent" software on the devices being scanned.
653092
(InfoWorld) - On Aug. 14, IT security training and research authority SANS Institute will convene its inaugural set of exams for software developers seeking to attain its new secure coding certifications. The rise of such initiatives -- and increasing adoption of source code vulnerability scanning tools among internal software development teams -- are finally making a difference in overall applications security, some end users and industry experts contend. According to Allan Paller, director of research for SANS, based in Bethesda, Md., large businesses have moved aggressively in the last 18 months to push their applications developers to incorporate security testing into almost every facet of their work. As a result, he said, companies are finally beginning to realize significant applications security gains as developers become more careful and enlist new tools to drive vulnerabilities out of their code. "There's no older question in security than when will developers finally figure out a way to eliminate buffer overflows, everyone as asked that at some time or another, the difference is that developers themselves have discovered that they have become targets," said Paller. "People traditionally haven't thought about designing applications with the idea that someone else would be attacking them, and that's been a major discovery." It wasn't until roughly two years ago -- when more comprehensive systems software patching programs and the arrival of stronger intrusion prevention systems (IPS) pushed hackers to move their work to the applications level -- that developers were finally forced to face unwavering demands from management to clean up their code, said the expert. The internal secure development initiatives that arose from those mandates are finally bearing fruit, he said. "As soon as developers started thinking that someone would be trying to misuse everything they designed, things started to change, but it's taken time since it wasn't on their radar 18 months ago," said Paller. "Some people obviously started doing this work years ago, but it never became a trend until attackers came directly after the applications." In addition to offering security training and certification tests for programming languages including .Net and Perl, SANS is working with 60 universities to inject secure coding programming into their software development curriculums. Along with a more aggressive approach to security on the part of developers, Paller cited the arrival of more powerful applications code scanning tools as key to the recent improvements. According to a research report published by Stamford, Conn.-based Gartner in May 2007, approximately 60 percent of all IT organizations will have made security vulnerability detection an "integral" part of their software development process in 2010. By that time, an estimated 40 percent of organizations will have enlisted the help of a vendor marketing both source code scanning and Web application vulnerability testing tools, the research company said. For organizations such as the United States Agency for International Development (USAID) -- an independent federal government agency that carries out economic and humanitarian efforts under guidance from the U.S. Secretary of State -- the work to improve development security goes slowly, said Bill Geimer, a program manger in the organization. Trying to improve the security of applications development spread across the globe is no easy task, he said, but with the help of some new tools the effort is making headway. "We don't have the software development budget of Amazon.com or eBay, it's an incremental process, but we've found that developers are responding more positively to security assessment reports than we had originally imagined," Geimer said. "When it comes down to it, these people don't want to develop insecure code or get their Web sites defaced," he said. "The first phase is to fix issues before they reach production, and to do that we're trying to drive secure tools and methods into their hands." One of the technologies USAID is arming its developers with is Atlanta-based SPI Dynamics' Assessment Management Platform (AMP), used to track and measure Web applications security risks. Brian Cohen, chief executive of SPI, said that his company has been trying to sell its applications testing tools to developers for over two years, but he has only seen adoption begin to grow significantly since mid-2006. Prior to that time, the only consistent demand for the technology came in the form of partnerships with software development platform providers including IBM, Mercury and Microsoft, he said. "The message just didn't resonate with end users unless it was something built directly into one of the popular development platforms," Cohen said. "Now we're finally seeing more development groups ask for this technology for themselves; at a high level, organizations would prefer just to block vulnerabilities after the fact, but they've finally learned that they can't afford to maintain that type of approach." Despite the growing predisposition toward the use of secure development automation tools among businesses, the ages-old question of what types of problems should be handled by software designers -- and which should be tackled by IT security specialists, remains a stumbling block, according to the executive. "There's still a lack of understanding among security workers and development teams as to who is responsible for what," said Cohen. "But hopefully we'll see experience and education lead to new progress in that areas as well." Mike Weider -- founder and chief technology officer at rival Web application security testing tools vendor Watchfire, Waltham, Mass. -- said that targeted attacks against online transactional and customer service systems at retailers and financial services companies have served as a wakeup call. With the fear of having their Web sites hacked and facing sharp criticism from regulators and customers hanging over their heads, companies are finally embracing vulnerability testing applications designed specifically for use by developers, he said. In mid-April, Watchfire added features in its new AppScan 7.5 release aimed specifically at users in the development realm of Web applications quality assurance. Tired of paying high-priced consultants to ferret-out vulnerabilities on a cyclical basis, more large organizations than ever are creating security testing teams within their software development departments, he said. "Many of these companies have thousands of applications and developers, and only small teams of security professionals available to do all the work necessary to track and remove all the errors, so security teams are reaching out to development to take on some of this daunting workload," said Wieder. "Everyone from the government to financial services firms and retailers are looking at the regulatory environment and seeing the writing on the wall in terms of being forced to take responsibility for breaches; this is pushing the work down to developers who are creating demand for new tools." At least one Watchfire customer said that the availability of such security testing technologies is allowing it to make headway in instilling new secure coding practices among its developers. "We used to hire a third party to do vulnerability assessment of production level code, then we would report their findings to business unit, and unless something was high-level it would just get put on a release schedule," said Ethan Stieger, chief security officer at automotive market intelligence firm Polk Global Automotive, based in Southfield, Mich. "This technology allows us to fix things when they're being developed, which is the right way to do things, if you wait until production, that's a lot more invasive in environment, and the security issues are exposed to the outside world," he said. "We're still tying to sell this effort internally, but now we can do so on the commercial value of keeping potential attacks at bay."