Search

The article reviews the FaceTime Unified Security Gateway (USG) platform.

The article reviews the application software Protection Manager 1.0 from Winternals Software. INSET: Reaching outside AD.

SECURITY PERSPECTIVE: Fortunately I happened to be at my computer when somebody tried to take over my social media accounts, and I caught them in the act. But the story doesn't end there. [ABSTRACT FROM AUTHOR]

Microsoft 365 gains AI-powered tools and features, and USB Type-C will become more secure with a new authentication standard. [ABSTRACT FROM AUTHOR]

The USB Type-C authentication standard is moving forward in an effort to help protect systems against malicious USB devices. [ABSTRACT FROM AUTHOR]

TREND ANALYSIS: The attacks will get worse, the attackers will become more sophisticated and that means your countermeasures must evolve quickly--or you're about to be toast. [ABSTRACT FROM AUTHOR]

eWEEK DATA POINTS: Kubernetes is more than just vendor hype; it's real technology that helps to enable the modern cloud-native world. [ABSTRACT FROM AUTHOR]

At KubeCon + CloudNativeCon NA 2018, members of the Special Interest Group tasked with looking at authorization security issues outline what has been going on to help improve Kubernetes security. [ABSTRACT FROM AUTHOR]

Startup Orkus emerges from stealth with a graph database approach to identify and manage access and authorization in the cloud. [ABSTRACT FROM AUTHOR]

The article reports on the addition of the OneLogin Protect 4.0 authenticator and login experience of OneLogin Inc. Topics discussed include the improvements of OneLogin's security platform, its new features like multi-step authentication and one-click activation, and its aim to simplify customer experience.

The article informs that Google provides access to email as a way for developers for creating apps that use Gmail. Topics discussed include analysis of user permissions that enable developers to read company's email messages; use of Open Authentication that allows the access of the same; and services for email access provided by the Google while maintaining data security.

The article discusses the serverless functions protection of the Twistlock 2.0 platform of container security vendor Twistlock which will be available in July 2018. Topics include the protection of the platform from runtimes, its increased visibility into container application operations and the access control and the security group policies of the platforms which the functions run.

The article reports on the computer software company Nuance Communications which is doing with the latest version of its Security Suite, a software that is using things about a person that make him/her unique and using those characteristics for authentication. It states that the company has also developed methods to unmask people while they are in the act of committing fraud and stop them in their tracks.

The article provides information on the Business Email Compromise (BEC) attack discovered by International Business Machines Corp. Topics discussed include X-Force Incident Response and Intelligence Services (IRIS); Internet Crime Complaint Center (IC3) and investigations on phishing; and Multi-Factor Authentication (MFA).

The article offers information on Domain-based Message Authentication Reporting and Conformance email security protocol has been adopted by the U.S. government, reported by security firm Agari. Topics discussed include use of the Sender Policy Framework and Domain Keys Identified Email for the verification of email authenticity; Microsoft claims this Surface Pro is the fastest LTE-enabled device; and startup Splice Machine has developed a database management system .

The article provides information on recent security act of social media firm Twitter Inc. in which it expanded two factor authentication. Topics discussed include views of Kyle Lady, senior research and development engineer at Duo Security on the same; response of the U.S. National Institute of Standard and Technology (NIST); and security of cryptography.

The article discusses the "The Black Art of Wireless Post-Exploitation" session by Gabriel Ryan, security engineer at security firm Gotham Digital Science. Topics discussed include Extensible Authentication Protocol (EAP) wireless authentication protocol, attack methods to bypass misconfigured WPA2 WiFi networks and focus on breach containment.

The article focuses on the Oracle July Critical Patch Update of computer technology company Oracle Corp. which helped in recovering flaws in its software portfolio. Various topics discussed include authentication of vulnerabilities, Common Vulnerabilities Scoring System (CVSS) and cyber security in business-critical applications.

The article reports on the futuristic authentication technology built by the San Francisco, California-based startup UnifyID. UnifyID transforms the way users authenticate themselves by taking multi-factor authentication to new levels. It won the 2017 Innovation Sandbox Contest trophy at RSA Security's annual conference.

The article focuses on the delegated-account-recovery protocol published by social networking service company Facebook as an open-source project on the GitHub code repository. Topics discussed include enabling an application to delegate the ability to recover an account to another account at a third party service provider controlled by the same user. Authentication token and the Open Authorization (OAuth) protocol which has some conceptual similarities with the new protocol are also mentioned.

The article reports that technology company Google published a whitepaper that addresses a multi-layered plan for enterprise data protection in the Google Cloud Platform. Topics discussed include security measures implemented on Google cloud facilities like biometric identification, vehicle barriers and metal detection, a central identity service for detection and authentication of users to Google services, and data encryption and data deletion for Google storage systems.

The article looks at ways for enhancing data security of computer systems and mobile devices in 2017. Topics discussed include changing passwords regularly to mitigate risks of security breaches on online accounts in various websites, applying multifactor authentication tools to boost protection of online accounts, and keeping web browsers, operating system and applications updated.

The article offers suggestions for protecting data due to cyber threats pertaining in enterprises. Topics include security by using cryptography, using encryption protocols such as secure sockets layer (SSL) for protecting data in motion and ensuring identity and access management (IAM) controls and role-based access control (RBAC) for limited access to system-level accounts. Other topics include audit trails for investigating suspicious activities and keeping defense systems up to date.

The article offers tips on how organizations can protect themselves from the hackers who are using new ways of getting the data they need. These include taking advantage of whatever form of advanced authentication as soon as it is available, taking seriously the need to have unique passwords for each public site used and using some form of authentication management to keep track of everything and manage changes as needed.

This article offers tips for companies seeking to support employees' technology choices while mitigating security risks. It discusses the security risks facing graduates of information technology security, implementation of employee guidelines for web and computer use, and leveraging of multifactor authentication.

The article reports that technology firm Google is actively working on multiple efforts to make the Internet safer for everyone, as it pushes good password practices and auto-updates. Google is working on multiple fronts to make sure no hack or malware attack goes on against its users and the Internet at large.

The article reports that over 100 million LinkedIn users being at risk of a breach that targeted 6.5 million user passwords in June 2012. Topics discussed include security measures implemented by LinkedIn like the optional two-factor authentication and the hashing method for password encryption, and the advise by security experts to users to change passwords and using more than one email address for multiple online accounts.

The article looks at recommended approaches in solving mobile security flaws for business operations of companies. Topics discussed include conducting secure coding and configuration practices to manage flawed server-side controls, applying certificate pinning and two-way authentication for enhancing transport layer protection on mobile applications, and implementation of a mobile-device management solution for preventing data leakage.

The article discusses leak of passwords and login identification of various financial and banking accounts. Topics discussed include need of users to change their passwords, use of card reader to building access and for access to data systems, and views of security researcher Brian Krebs on the hacking of data.

The article presents the findings of the Verizon Data Breach Investigations Report (DBIR) that states the security vulnerabilities in the computer systems of the telecommunication company Verizon Communications Inc. The article further mentions that about 85 percent of unauthorized data access instances are due to patches that are existing since a long time. Other causes of system attacks include phishing and weak passwords.

The article reports that Google Inc., multinational company has included Microsoft Office 365, Facebook at Work, and Panorama9 in the applications for which it provides single sign-on support. It mentions that the companies using the Identity Platform for Work will be able to give workers a method to use their existing log-in credentials for authentication.

The article reports that the information security risk assessment company UpGuard Inc., formerly known as ScriptRock, has introduced the scoring system Cybersecurity Threat Assessment Report (CSTAR) that will provide a single score showing the vulnerability level of information systems to security threats. According to Alan Sharp-Paul, the co-founder and co-chief executive officer (CEO) of UpGuard, tools like CSTAR help companies understand and minimize data breaches in a cyber environment.

The article discusses threats to information security from third parties and the corresponding solutions to avoid any unauthorized access. The article further mentions the need to review the vendors' information needs and provide them access to the specific details accordingly. In addition, recording third party's interaction with the information systems to ensure transparency is suggested. Further, setting duration for a user session is recommended to curb information misuse.

The article presents the author's views on Internet of Things security. It is stated that setting an adequate level of security means implementing user names and passwords that are stronger than stupidly simple defaults. It is opined that in some cases one will have to take trouble of assigning user names and passwords, since not all such devices even have them.

The article focuses on the business of office application hosting. It discusses the growing probability of the business including SAAS products of becoming a mainstream alternative to traditional boxed software. However, it also identifies some of the limitations of the service. One is accessibility, wherein users are required access their application online 100 percent of the time that they use them. Hosted applications offer no functionality when users are not connected to the Web. Another case is profitability, since most hosted office suites offer their basic services for free.

The article focuses on issues concerning the fight against spyware. Early adopters of anti-spyware products focused primarily on a product's ability to identify and clean spyware on the desktop. But, now it is required that administrators must be proactive-emphasizing new practices or technologies that prevent malware threats before installation. Anti-spyware vendors are trying hard to cope with and compensate for new technologies that make malware harder to identify and eradicate. The latest malware instances may use root kits to hide their presence, self-healing mechanisms to spontaneously regenerate when threatened and active processes that try to disable resident security programs. Because signature-based scanning and cleaning is a reactive process, any anti-spyware program under test is unlikely to be able to identify and clean each malware instance in an enterprise network. Administrators need to examine methods of keeping spyware off the desktop in the first place. There are several organizations that are successfully avoiding malware by restricting users' privileges on the local system.

The article argues that to succeed in computer security services, VARs and integrators must create a methodology they follow consistently. And when tackling the security needs of customers, they must demonstrate how they will provide value. Channel companies, in the role of trusted advisers to small businesses, must not only assess the risks their customers face but also become intimate with customers' technology needs and business goals so they can deliver the most effective security solutions possible. Companies should find out where the customer is from a business standpoint and where the customer is most likely to be 12 to 18 months from now. Resist the temptation of selling customers technology just for its own sake, and instead drill down to their needs in improving business operations. In other words, VARs, integrators and service providers must solve the customer's business problem when delivering security solutions. Merely providing technology is not enough. VARs, integrators and service providers must advise customers that, indeed, technology breeds crime. But it is also the most effective tool to guard against it.

Reviews the identity management and access control software Identity 2.0 from Trusted Network Technologies Inc. INSET: Identity 2.0..

Too many content owners are opting to sit on their assets and wait for the coming of a perfect, unbreakable digital rights management (DRM) scheme — one that cannot possibly exist. Any DRM scheme that would allow for the broad control over users that the entertainment industry craves would be far too intrusive for consumers to stomach.

Reports on the security of Microsoft Corp.'s Internet information services (ISS) Web servers in the United States. Options for the protection of ISS servers; Importance of hardening for ISS security; Tasks of hardening.

Reports the goal of the access management products by IBM Corp. in the United States. Problems of enterprise networking; Introduction of the Indentity Director product; Plan integration of public-key infrastructure technology.

The article focuses on a survey conducted on importance of analysis of device data security for protection of networks. Topics discussed include need of deployment of products for automated security analysis solutions, increase in cyber threats, usage of anti-malware systems, blacklisting tools and authentication management systems to detect threats and benefits of security analytics include quick implementation and cost effective.

The article informs that internet services provider Google is joining technology company Yahoo and AOL, mass media company, in implementing stricter guidelines for e-mails failing authentication checks of the Domain-based Message Authentication, Reporting & Conformance (DMARC) standard. Topics include decision of Google to reject messages failing DMARC checks, adoption of new protocol Authenticated Received Chain (ARC), and views of Steven Jones, executive director of DMARC, on the same.

The article focuses on development of a set of standardized specifications by the organization Fast Identity Online (FIDO) Alliance to improve secured authentication for online application access. Topics launch of 1.0 versions of FIDO's Universal Second Factor (US2), views presented by Brett McDowell, executive director of the FIDO Alliance, on its advancement and designing of Universal Authentication Framework (UAF) that use biometrics to gain access.

The article focuses on strategies to implement an intelligence-driven security in business. The strategies include understanding current risk, visibility into network and managing digital identities. It mentions that immediate response to confirmed anomalies allows organizations to remove threats by enforcing controls including accessing restrictions or authentication.

The article focuses on a report by security firm Aorato regarding the susceptibility of software company Microsoft's Active Directory technology driven which can be downgraded to the security protocol NT LAN Manager (NTLM) from the authentication protocol Kerberos. It discusses the proof-of-concept tool provided by Aorato to Microsoft which is used to launch the susceptibility. Also discussed is Microsoft's statement regarding the Kerberos Network Authentication Service standard.

The article offers information on APIflow, an offering aimed at enabling secure data access, sharing and collaboration through application programming interfaces (APIs), launched by software developer Point.io.

The article focuses on the decision of software company Microsoft to extend multifactor authentication to the users of the Office 365 software, announced in February 2014. The decision is part of the company's effort to strengthen its cloud services line. The company is also considering to extend multifactor authentication to Office 365 client applications, such as Outlook, Excel and OneDrive for Business.

The article reports that in a Microsoft on the Issues blog post on January 20, 2014, Brad Smith, vocal General Counsel of software company Microsoft and executive vice president of its Legal and Corporate Affairs department, called for an international legal framework to address data privacy. Smith called on the world's governments for an international convention for the creation of surveillance and data-access rules that transcends borders.

The article focuses on the inaugural certification program launched by Centrify, a provider of unified identity services, to help customers and partners certify their knowledge and expertise in design and administration of the Server Suite. Benefits of the program include an online portal for managing certifications, early access to beta products and additional customer support services. Advantages of the Suite include secure authentication and role-based access control.