State of Internet Security Report on Protecting Enterprise Systems
678952
(Source: Webroot Software)  The latest State of Internet Security Report, released to you today by Webroot Software, provides an in-depth review and analysis of the most urgent computer and data security-related concerns facing businesses today. In this report, you will learn:  Industry data, trends, best practices and an evaluation of the threat landscape  The significant cost and legal implications of inadequate protection  Best practice guidance for businesses to follow to thwart unnecessary security breaches
386643
A survey of Internet vulnerabilities shows a sharp jump in attacks on Windows-based personal computers and a marked increase in commercially motivated threats.
431743
Worldwide spending on securing Web content is literally the hottest IT market today. With Web-based threats growing almost exponentially, IT and network managers are struggling mightily to stave off disaster while still letting employees reap the many benefits of the Web. The Webcast Barbarians At The Gate: Why Web Filtering Is So Hot, dives into the sources of the trouble while offering common-sense approaches to a secure Internet computing strategy.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.
267175
8e6 Technologies, a security company dedicated to Internet filtering and reporting, today announced a new enterprise reporting suite designed to alert corporate executives and IT professionals about Internet threats coming from within their organization.
752268
It's expected to analyze threats in real time and better report on Internet activity over time on enterprise networks.
738756
Network attacks are increasing &quot; and at an alarming pace, according to IBM&#39;s Global Security Intelligence Services. A report released this week found there were 997 Internet attacks in September
635804
(InfoWorld) - Enterprise companies will soon begin offloading many of their network security responsibilities to telecommunications and Internet service providers and save vast amounts of time and money doing so, if AT&T has its way. Speaking to the assembled crowd at the IDC Security Forum in New York on Wednesday, Edward Amoroso, chief security officer for AT&T's services division, predicted that enterprises will begin adopting more "virtual" security capabilities from their ISPs and bandwidth providers in the coming years as those companies are better positioned to do battle with botnets, spam, and denial-of-service )DoS) threats. Based on the bandwidth-providers' existing abilities to see spikes in traffic that are tell-tale signs of botnet, spam, or other malware activity -- long before enterprises can see evidence of the attacks on their own -- Amoroso contends that companies will soon concede the process of fighting the threats and turn to companies such as AT&T for help. "We think that security at the perimeter should be virtual, which is a somewhat controversial concept, because a lot of time, effort, and career capital has already been spent securing the perimeter," Amoroso said. "But we think a lot of existing technologies there are running out of legs, and simply running firewalls at the gateway is no longer a valuable proposition." The United States government's Telecommunications act of 1996 prevents carriers from approaching customers and marketing services to them based on any trends they observe on the end users' network connections. However, the companies can already identify much of the spam and malware activity being carried out in the pipe, based on their massive infrastructure, and should be enlisted to help solve security issues, he said. For threats such as distributed DoS that can easily be thwarted upstream, the CIO said, it makes little sense for companies to continue to invest in new technologies and staff when the carriers could easily detect and snuff out the campaigns ahead of time. "How do you stop DDoS at the edge? The physics just don't make sense. When these attacks happen, the customers' routers will already be dead," said Amoroso. "We think the idea that the pipe should be dumb is strange; with spam accounting for 90 percent of all traffic on the e-mail pipe, we're delivering nothing but more attacks, malware, and junk. If people want us to keep doing that we can, but why would they want us to keep doing that when we can see it, scoop it, study it, and stop it?" Lest someone should contend that AT&T and other carriers are merely licking their chops at the prospect of adding pricey new security services to their products, the expert said security services should eventually become a set of non-optional capabilities included with the purchase of ISP and telephony services. Much as the carrier community focused on providing faster services in the 1980s and added tools to improve quality to their products in the 1990s, the CIO said that security services will become a de facto element of all the capabilities that the firms market. While early adopters are already paying a premium to use the security capabilities offered by carriers today, eventually the price should be blended into the packages of capabilities that companies buy from providers such as AT&T, the expert predicted. At the same time, AT&T and other carriers would have to sacrifice their existing businesses of selling firewall management and intrusion detection-type systems into enterprises, he said. But the move to push security tools to the bandwidth providers is one that has been made even more likely by the complexity of those technologies. "I think we'll come out of this decade thinking it was silly to have separate perimeter security systems, it doesn't make sense to build the network and overlay security as an afterthought," Amoroso said. "We have as large of a managed security services business as anyone, but this work is better off embedded in the pipeline." Emerging mobile and Voice over Internet Protocol (VoIP) services will also include integrated security capabilities that replace many of the systems being implemented to protect those technologies today, according to the AT&T CIO. "We can virtualize these things, and any carrier can do it; this is the direction that perimeter security is headed in. It's not a collision course, but rather something very pleasant, as finally there's something smooth and simple to solve these problems," he said. "It's absurd that all we hear today is that the carrier plays no role in all of this, that companies should do it at the edge. We know it's a lot of work, but we're already prepared to do it."
639274
(Source: St. Bernard Software) IT professionals increasingly view the Web as a minefield. Trojans, phishing attacks, adware, and spyware are just some of the threats that have to be countered. Securing your organization against Web-borne attacks -- and keeping your users away from 'Net distractions -- often falls on filtering technologies. This program will discuss how organizations can use filtering and other security technologies to fight Web-borne dangers.
635724
In a new post on his blog, Christian Wenz mentions the latest results of the SANS Institute's Top 20 Internet Security Attack Targets list which both includes a new entry ("Users") and several mentions of PHP and PHP-related applications.   Of course you can debate how such a Top list came together and what the real value behind that is, but there are two specific points in this year's list that I found quite interesting.   There's two targets for the PHP community to worry about - sysadmin/hosting and things developers need to keep in mind. Items on these lists include:  Always test and deploy patches and new versions of PHP as they are released Use Intrusion Prevention/Detection Systems to block/alert on malicious HTTP requests. Consider using Apache's mod_security to block known PHP attacks If you use PHP, migrate your application to PHP 5.2 as a matter of urgency. Encode all output using htmlentities() or a similar mechanism to avoid XSS attacks  You can check out the full information over on the SANS Institute website.
265180
Microsoft has released bulletin MS04-039 reporting a security vulnerability in Internet Security and Acceleration (ISA) Server 2000 and in Proxy Server 2.0, and has also announced the availability of the patches to resolve these issues.
590170
Security company Internet Security Systems is warning of a critical security hole in a commonly used technology from the Mozilla Foundation called the Netscape Network Security Services library that could leave Web servers vulnerable to remote attack.
617853
Next-generation RF tags touted as a way to boost network security.
119512
The SANS Institute identifies the top 20 Internet vulnerabilities of the year.
54692
A nationwide inspection shows Internet users are not as safe online as they believe. The inspections found most consumers have no firewall protection, outdated antivirus software and dozens of spyware programs secretly running on their computers.
744409
Security researchers release code that shows how a pair of widely used technologies could be misused to take control of a victim's Web browsing experience.
604623
This organization's IT security officer leaves and isn't replaced. A year and a half later, the organization suffers a Web page defacement and malware attack -- and no one is really surprised.