This article was originally published on Help Net Security on August 1 , 2019.Microsoft has recently come out and said that mandatory password changing is ancient and obsolete. This goes directly against everything we were trained to think for the last couple of decades, and against most compliance directives including some of the most dominant security standards. And it is correct.If anything,...

What is IPSEC?In the world of VPNs, there are typically two types that an organization can choose from, IPSEC or OpenSSL. While many people have migrated to OpenSSL mode because of its new relative ease of deployment, there are still companies that deploy IPSEC-based VPNs because of the additional layers of security they provide that are not available in OpenSSL-based VPNs.Why Choose an IPSEC VPN...

PCI Compliance is adherence to the set of ground rules set forth in the Payment Card Industry Data Security Standard (PCI-DSS). The standard defines how vendors who accept credit cards are to manage not only the credit card data, but their own networks as well, to ensure that the card data stays protected from theft and abuse.Who Developed The PCI-DSS?The PCI-DSS was developed by the Payment Card...

Rootkits – When Bad Turns to UglyFew words strike more fear into the heart of IT administrators than rootkit. Once a rootkit has been discovered, it’s usually a strong indicator that one or more systems on a network have been compromised and that any data being stored on those systems is now suspect or even worse, has been captured by the rootkit attacker to be released “into the wild” of the...

Anti Malware – A New Type of ProtectionIn today’s world, everyone has heard of antivirus software. This is the same software that has been around for a decade or more that protects computers from infection from viruses and other types of malicious software.However, over the last few years the threat landscape has evolved to the point where having anti-virus software on your computer is not enough....

Anyone who works for a large organization knows that July isn’t just a time for fireworks and BBQs. It’s also when you plan your budget for the next fiscal year. If you work in IT, you know you’re always expected to have an answer for everything. But when it comes to planning your budget, there are really only two questions that need to be asked. Do you have enough resources on hand for the...

With the May 2019 Patch Tuesday release from Microsoft, it was revealed a number of older Microsoft operating systems are vulnerable to a condition known as BlueKeep (CVE-2019-0708). BlueKeep is a Remote Code Execution (RCE) flaw in Remote Desktop Services (RDS)/Remote Desktop Protocol (RDP) allowing code to run with system level access and is potentially “wormable” making it possible for an...

According to the Verizon Data Breach Investigations Report, published in November 2018, the #1 cause of a breach continues to be vulnerable systems left exposed and unpatched. Preventing the exploitation of vulnerabilities when using an effective solution is one of the few countermeasures that can pro-actively protect your infrastructure before an attack has even started as opposed to relying on...

Underestimating the consequences of downtime can be hugely detrimental to your productivity. Accurately calculating those costs won’t just prevent disasters, but also help you effectively manage your capacity planning efforts.

There are few vulnerabilities that strike fear into the hearts of security professionals more than a SQL injection attack. Why? Because unlike most vulnerabilities that can be readily detected, while a SQL injection attacker can hide within a vulnerable application until someone accesses and exploits it.What is a SQL Injection Attack?A SQL injection attack is basically an act by an attacker of...

What is Zeus Trojan?Today, there are more people online than ever before, with almost 300 million browsing the Internet in the United States alone.And while that offers numerous advantages, there are also risks – hackers and cybercriminals are always looking for ways to access people’s personal information and steal their money using malware and trojans.One of the most malicious and dangerous...

How Do We Define “Cybersecurity” in Modern TimesCybersecurity has steadily worked its way from being an Information Technology (IT) problem to being a boardroom priority. But what is ‘Cybersecurity’ at its core? The cybersecurity definition encompasses the technologies, practices, processes and procedures intended to protect networks, endpoints, programs, applications, and data from attackers...

This article was originally published on TechTarget on April 22, 2019.In an international collaboration, U.S.-based Beyond Security and Japan-based Ubiquitous AI Corporation developed and launched BeStorm X, a vulnerability verification tool designed specifically to test IoT devices. The vendors claim the tool is an amalgamation of Beyond Security's BeStorm version 7.6.8 and UAC's IoT technologies...

Do you know what devices are connected to your network? A network diagram can help you get a better sense of what's happening on your network. Check out the infographic to learn the pros and cons of network diagrams. s Not Loading? Check out the Text Version Keeping your network up and running can seem like an uphill battle. Especially without...

Compliance and Data Security:Do They Ever Meet?In my years working with technology and security data in the information security industry, I've heard numerous people confuse the word "compliance" with "security". We've all heard the stories in the news about an organization or company that was supposedly compliant with a particular ISO or NIST program imposed on them, only to find that later on...

This article was originally published on U.S. Chamber of Commerce on April 08, 2019.If you could create your own fantasy Board of Directors, who would be on it? CO— connects you with thought leaders from across the business spectrum and asks them to help solve your biggest business challenges. In this edition, a CO— reader asks how to improve a business’s cybersecurity when expert help isn’t...

Although phishing attacks can occur against individuals, we will primarily focus on attacks against organizations in this post. We will use the term organization to represent governments, educational and healthcare institutions, and commercial businesses, but we will draw distinctions in the “bounty” sought after in each industry. So, let’s get started…What is Phishing?There are lot of “nice” or ...

A vulnerability has been identified in SoftNAS Cloud(R) data storage platform discovered by our Vulnerability Research Team (VRT). The engineers at SoftNAS are to be commended for their prompt response to the identified flaw and their team’s work with VRT to provide prompt fixes for this cyber security issue.SoftNAS has provided a patch for the vulnerability identified on the application. The...