NetClarity's Official Blog - Infosec Insider Tips

The 12 Best Practices for Network Security in 2012, Part 1 of 12...

2012-02-09T08:41:00.000-08:00

The 12 Best Practices for Network Security in 2012

by Gary S. Miliefsky, Founder/CTO, NetClarity, Inc.

We all face it - the daily barrage of spam, now infested with zero-day malware attacks, not to mention the risks of malicious insiders, infected laptops coming and going behind our deep packet-inspecting firewalls and intrusion-prevention systems. Some even have to worry about how to prove steps of due care and due diligence towards a growing roster of regulatory compliance pressures.
What can you do under so much extreme pressure to make 2012 a better year, not a year loaded with downtime, system cleanup and compliance headaches? I've come up with what I would consider some of the best network security practices.
Best practices are things you do - steps you take - actions and plans. Within those plans, I'm certain you will include which security countermeasures to budget for in 2012. Although I thought about going into details about recent security concepts, such as unified threat management or network admission control, it seems more appropriate to focus on the seven best practices instead of the seven best security tools you might consider deploying. For example, I consider encryption a best practice and not a product or tool. I'm sure you'll find many commercial and freely available tools out there. You can always evaluate those tools which you find most suited for your own best-practice model.

Here's my best practice list, in order of importance:

1) Deploy corporate-wide encryption
2) Deploy a next generation HIPs solution
3) Deploy a next generation NACwall
4) Manage the bring your own device (byod) dilemma
5) Deploy a next generation Firewall
6) Centralize alerting and forensic logging with a SEIM
7) Roll out corporate security policies
8) Deliver corporate security awareness and training
9) Run frequent information security self-assessments
10) Perform regulatory compliance self-assessments
11) Value, protect, track and manage all corporate assets
12) Test business continuity and disaster recovery planning

Each week for the next 12 weeks, I’ll provide more details on items 1-12, above.

Although I could have made this list a little bit longer, these twelve make the cut because if you implement them, you should see a rapid improvement in network uptime, performance and your IT regulatory compliance posture. Let's take a closer look at the first item on my list:

1) Deploy corporate-wide encryption
There's an old saying: "Loose lips sink ships." If you take a look at all the identity theft that's occurred, much of it was done against systems that were not encrypted. For example, an e-commerce Web site of a public company was hackable not only because it had CVEs, but also because the company did not understand the importance of encryption. They thought that an encrypted SSL session was enough.
However, their shopping cart system took this encrypted credit card information and stored it, unencrypted in plain text on a database server that was attached to the Web server.
These two servers were like putty to the hackers - one SQL Injection attack and thousands of consumer records were grabbed, sold and used for siphoning money from the credit cards. You can buy lists of Social Security numbers, names, addresses, phone numbers, bank account records and credit cards on the black market. It's now an industry. Don't let your organization be one of those added to the list.
The best practice is to look at all aspects of electronic communication and data manipulation throughout your enterprise. That should include all instant messaging, file transfer, chat, e-mail, online meetings and webinars, plus all data creation, change, storage, deletion and retrieval.
How are customer records stored? How are electronic versions of other confidential information protected? Backing up the data is not enough.
You should setup a VPN for those who have access to your network from the outside. Make sure the systems that access your network through the encrypted tunnel are also not the weakest links in your infrastructure. Don't let them in if they aren't fully patched, up to date, scrubbed for malware and authenticated. If you let go of an employee with a laptop, get the equipment back - and in the meantime, close their VPN tunnel.
You can encrypt everything from your hard drives to your e-mail sessions to your file transfers. There are numerous free tools out there, for hard drives; for Web, e-mail and instant messaging; plus the grand-daddy of free encryption, PGP (Pretty Good Privacy), first created by Phil Zimmermann in 1991.
But encryption is not to be taken lightly. You'll need policies in place for key storage and password access so if ever the keys and passwords are lost by the end users, you'll have a way back in to decrypt the information, reset the keys or change the passwords.
You might find out that some of the servers and services you are running already offer encryption if you simply check the box and turn this feature on. If a laptop with confidential records is stolen, but the thief doesn't have the password or key to decrypt the data, it will be useless to them. If someone is eavesdropping on your new VoIP phone system using a tool like Ethereal and the voice-over-misconfigured-internet-telephony (VOMIT) attack, they won't get very far if all the data stream is encrypted.
I recommend you encrypt your communications and data whenever and wherever possible.

Stay tuned for more next week where I give you tips, tricks and secrets of the host-based intrusion prevention (HIPs) world.

Gary S. Miliefsky is founder and CTO of NetClarity, Inc., and a founding member of the U.S. Department of Homeland Security. He is a frequent cover story writer for Hakin9 Magazine and serves on Boards of the National Information Security Group (NAISG.org), the CyberDefense Labs of Norwich University and The Mitre Corporation.

Take Action Today:

Click here to signup for a demo of NetClarity’s award winning NACwall appliances

Click here to visit our home page and signup to receive free Whitepapers for 2012

Beginners’ Guide to Network Access Control (NAC)

2011-10-11T14:38:00.000-07:00

What you need to know about protecting your network assets from the inside.
Over the past few years, with increased and pervasive personal computing as well as employee, business partner, consultant and guest access to corporate networks, the network ‘behind the firewall’ has become the weakest link – the most susceptible area of risk. With over 80% of successful breaches occurring behind firewalls, internal network security and access control has become the most serious IT issue of the day.

As a result, some of the major firewall and managed switch manufacturers have tried to solve this problem by taking control of access through complex new software agents and switching protocols such as 802.1x coupled with active directory (AD), anti-virus software, patch management software and windows firewalls. This complex mix of upgrades and agents formed the first wave of Network Access Control (NAC) technologies.

Although they didn’t work well to solve the problems inherent from malicious insider access, vulnerable systems, rogue devices and zero-day (new) malware, they were a first step into the new frontier of Network Access Control.

NAC has now begun to evolve into a crucial tool for keeping potential snoops and attackers off business networks, as well as for managing the more complex business logic of permissions and authorizations needed for different groups of users to access parts but not all of a network. The technology helps a business enforce its security policies on any person — or any device — seeking network access. NAC also helps businesses comply with external regulations and internal policies, as well as safeguarding network resources from evolving threats.

NAC Benefits
NAC benefits can be broadly grouped into three categories:
Endpoint Security
A good NAC solution will make sure those endpoints – devices that have intranet or ‘internal’ access to the network stay ‘hardened’ – having few or no Common Vulnerabilities and Exposures (CVEs), which can be easily exploited by zero-day (new) malware. If these systems become infected by new malware, the NAC solution should be able to quarantine the endpoint in such a way as to protect peers and not disrupt the general flow of network traffic and business activity.

User Authentication
In addition, the NAC solution should help detect, manage, monitor and control identity based access to the network by binding devices to people. This can be done through Active Directory credentialing, coupled with device fingerprinting. The NAC solution should also protect against IP spoofing, MAC spoofing and other anomalies where a criminal might attempt to gain access by assuming a trusted identity.

Risk Management
Finally, best-of-breed NAC solutions help you manage, mitigate and document risk. They should be aware of the Risk formula (Risk = Threats x Vulnerabilities x Assets) and allow you to log, document and report upon improvements in your internal risk profile to show due care and due diligence as best practices for internal data protection and regulatory compliance.

Types of NACs
There are two types of NAC solutions on the market, today – 1) Inline and agent-based, 2) Non-inline, agentless.

Inline, Agent-based (First Generation) – these will evolve but will continue to require many moving parts. A typical deployment requires new managed switches, new proxy servers and client software called “NAC agents”.

Out-of-band, Non-inline, Agent-less (Next Generation) – these are much easier to deploy and more cost effective. They can be installed rapidly, gaining control over all endpoints, whether Microsoft or otherwise. The philosophical differences in security design will keep Next Generation NAC ahead for years to come in the areas of simplicity, ease of use, cost-effectiveness and overall intrusion defense capabilities.

NetClarity is about to Game Change the NAC Industry...Watch for it late August 2011

2011-08-16T18:26:00.001-07:00

With SMBs being the number one target of hackers, we have a solution coming.

Can't say much right now but stay tuned...

National Information Security Group Launches Securanoia 2011

2011-07-26T13:05:00.000-07:00

The National Information Security Group is working on a new security event that should knock your socks off and it will take place in the Boston, Massachusetts, USA area this year...it's called Securanoia!

As you may know, I serve on the Board of Directors for the NAISG.org and I'm very proud to be affiliated with this organization. Typically, we have chapter meetings around the country that take place monthly but we've never done an annual gathering - here it comes...Securanoia 2011.

Here's what I can share with you about Securanoia 2011 (so far):

--It is scheduled for Dec. 5th and 6th at Microsoft's NERD center in Cambridge.

--The website for the event will be here once all the pieces are in place.

--If all goes well, we can do this again next year and in the years to come.

Some raw facts about the organization, lifted right from the website:

The National Information Security Group (NAISG) was founded in August, 2002 as the New England Information Security User Group. In 2004, the group incorporated as a 501c(6) in the commonwealth of Massachusetts and changed its name to the New England Information Security Group. In 2007 it changed its name to the National Information Security Group to better reflect its membership and its goals. A board of directors provides guidance to the organization.

It's a non-profit organization that promotes awareness and education of information security through the support of local and regional chapters. Members include IT administrators, managers, law enforcement personnel, the media, educators and students and anyone else interested in getting or staying on the cutting edge of information security.

Key Points

Promotes awareness and education of all facets of information security through the support of local and regional chapters.

Holds monthly meetings that include presentations and discussions, a Q&A session, job announcements, demonstrations and/or hands-on workshops.

Is always free to the general public.

Is not biased toward any single vendor or technology.

Includes as members: IT administrators, managers, law enforcement personnel, students, educators and anyone else interested in getting or staying on the cutting edge of information security.

Provides a venue for organizations to distribute information and educate the general membership on security products, techniques and/or other issues related to security.

Maintains an online TechTips forum, through which subscribers can post or respond to security- and IT-related questions.
TechTips maintains an international subscription base.

No formal security experience is required. Come to learn, share tips and tricks and network with other professionals!

Each month, we have one or more speakers presenting on a wide range of topics, from vulnerability management, ID and access management and DLP to FBI investigation tactics and even lock-picking.

Since going national, NAISG chapters have popped up across the country, including Atlanta, Dallas, Houston, Orlando, Washington DC and Seattle. If you're studying to earn a CISSP certification or you're trying to maintain the cert, attending these meetings meets the requirement.

I'll have more information on Securanoia 2011 so stay tuned...

NetClarity Founder & CTO to Speak at HackInParis.com

2011-05-31T10:09:00.001-07:00

New "Stars" Malware is Next Stuxnet-like Worm - Hit's Iranian Reactor (again)

2011-04-25T07:14:00.000-07:00

Computer worm hits Iran government network, military official says

Tehran - Iran's government networks have been attacked by a second computer worm following last year's Stuxnet computer virus, a military official said Monday.

Gholam-Reaz Jalali, head of the anti-sabotage and civil defence unit, told Mehr news agency that the new worm is called Stars.

He did not comment further on the target or the damage but said experts were evaluating the malicious software.

The Stuxnet computer virus last year reportedly affected the computers of several industrial units, including the country's nuclear programme, although Iran's leaders have denied this.

The entire core of the country's only atomic power plant in the southern Gulf port of Bushehr had to be changed, reportedly due to technical problems.

Although reloaded earlier this month by Russian contractors, the operational phase of the plant and its connection to the national grid was again delayed.

Former industrial minister Hassan Ghafouri-Fard told Mehr news agency that it would have been more economical to build a new plant rather than solving the problems of the Bushehr plant.

Personal Recommendation to Keep Worms at Bay:

Download the free Comodo firewall here and set the Defense Security level to paranoid for a few days – you’ll really start to know everything about your computer running Windows….

http://www.comodo.com/home/internet-security/firewall.php

Debugging the RSA Breach

2011-04-08T08:52:00.000-07:00

Here's what happened at RSA that lead to this recent breach:

Spear phishing campaign was initiated, which saw two emails being sent over a two-day period to small groups of low/mid profile targets.

One of the employees was enticed by the subject line of "2011 Recruit Plan" and opened its attached spreadsheet, which was titled "2011 Recruitmentplan.xls."

Spreadsheet was embedded with a Flash attachment that exploits a new (zero-day) security vulnerability to install a backdoor in the form of a remote administration tool.

Attackers performed digital "shoulder surfing" using the remote administration tool for a path to more valuable assets. Access to high-value strategic users were sought and eventually obtained.

Data relating to SecurID was ultimately accessed and siphoned out via FTP to another compromised machine on the Internet. The files are subsequently erased in a bid to obfuscate the attackers' tracks.

This brings us back to the basic thought process in network security - training your employees is so important - social engineering is still a useful weapon in the cyber criminal's arsenal. Also, I believe HOST-BASED-INTRUSION-PREVENTION (HIPS) technology will come back out of the dark ages when BlackICE was acquired and later shelved by IBM (through their ISS acquisition). It's time for more intelligent software to help our user community. Checkout a few heading in the right direction - http://www.prevx.com/ and http://www.threatfire.com/.

What do you think?

The Five Steps of a Wireless PCI Breach and How to Avoid It with NACwalls...

2011-04-05T08:37:00.001-07:00

The largest PCI breach in history was TJMAXX. It cost them $200M+ to remediate the personally identifiable information (PII) data loss on over 100M consumers credit cards/profiles.

See: http://www.privacyrights.org/

The breach was done by a hacker who sat in the parking lot, hacked the wireless router’s (WIFI HACKING) common vulnerabilities and exposures (CVEs), spoofed a trusted asset (MAC SPOOFING), pretending to be a ‘wireless barcode scanner’ that was a trusted device, and then found the database server that connected to the Visa payment gateway and installed ‘eavesdropping’ software (PLANTING A BACKDOOR) to watch every credit card transaction that phoned home.

So the PCI compliance breach was:

WIFI HACKING
MAC SPOOFING
EXPLOITING CVEs
PLANTING BACKDOOR
PHONING HOME

The solution to this problem is:

NACwall EasyNAC blocking protection for WIFI against HACKING

No untrusted asset gains access to wifi
Even a WEPcrack, KISMET or BACKTRACK 4.0 (WPA) exploit attack is blocked.

NACwall MAC spoof protection should be enabled.
NACwall should be auditing all devices for their CVEs
Backdoors can’t be planted if there is no access allowed and there are no CVEs to exploit
NACwall’s Malware Quarantine engine should be enabled to block callbacks ie ‘phoning home’.

This should take about 30-60 minutes to setup at a single location or using the command center to replicate these rules to all branch locations, automatically.

Problem Solved. PCI Breach Avoided.

Cyberwar is Operational: Nations Attacking Nations, Digitally, Daily

2011-03-31T13:19:00.000-07:00

Stuxnet was not the beginning - only the most innovative attack. Here are the types of attacks nations are doing to other nations on a daily basis:

•Distributed Denial of Service (DDoS)

•Espionage (Spyware, Backdoors, Data theft)

•Critical Infrastructure (Stuxnet, etc.)

•Propaganda (Facebook, Twitter, etc.)

•Covert Channels (MUDS, Avatars, Virtual Worlds, Proprietary Encryption)

Next, we'll discuss this in more detail. Stay tuned...

Fact: Your Identity Was Stolen!

2011-03-28T11:37:00.000-07:00

~350M Americans & 516M records stolen

See http://www.privacyrights.org for proof. Look at the "Chronology of Data Breaches" search results...

More than 516M Personally Identifiable Information (PII) records for more than 350M citizens in America. How many have been lost, hacked and stolen?

According to PrivacyRights.org, the total number of records containing sensitive personal information involved in security breaches in the U.S. since January 2005:516,942,944 RECORDS BREACHED
from 2,392 DATA BREACHES made public since 2005

Still think you are secure?

Still believe your anti-virus and firewall can truly secure your network or your personal computer?

Stay tuned for more information...

Fact: Everyone can be exploited!

2011-03-24T06:51:00.000-07:00

All of our Systems have Holes! (CVEs)

According to the USCERT, SANS, FBI and MITRE, over 95% of security breaches are a direct result of exploiting a Common Vulnerability and Exposure (CVE®).

See: http://nvd.nist.gov/

Just Look at All This Hacking News...It Just Keeps Getting Worse...

2011-03-23T07:03:00.000-07:00

- Anonymous probed for hack threat against WikiLeaker captor

The Pentagon has asked for an investigation into threats made by the Anonymous hacking collective against officials at Quantico, the Marine brig that is holding accused WikiLeaker Pfc. Bradley Manning.

http://www.theregister.co.uk/2011/03/08/anonymous_investigated/

- Student hacked into his high school’s grade system like a real-life Ferris Bueller

If you’re like me, your purely academic interest in hacking was first sparked by a little movie called Ferris Bueller’s Day Off. At the start of that film, Ferris Bueller — who has stayed home sick from school, despite a healthy constitution — hacks into his computer’s mainframe and changes his number of absences, along with his grades.

http://www.geek.com/articles/geek-cetera/student-hacked-into-his-high-schools-grade-system-like-a-real-life-ferris-bueller-2011038/

- French gov't gives more details of hack: 150 PCs compromised

The French National IT Systems Security Agency released further details of the recent attack on French government computers, saying they were targeted by cyberspies.

http://www.computerworld.com/s/article/9213741/French_gov_t_gives_more_details_of_hack_150_PCs_compromised

- Hoping to Win Over a Town, Facebook Holds Urban Planning "Hack-a-thon"

Some social networks still function better in the flesh, and so, on Saturday, Facebook played host to a massive “design charrette” that brought four busloads of architects, designers, and urban planners together for an all-day cram session devoted to re-imagining Menlo Park’s Belle Haven community, soon-to-be home of the company’s global headquarters.

http://www.fastcodesign.com/1663372/hoping-to-win-over-a-town-facebook-holds-urban-planning-hack-a-thon

- A glance at GeoHot’s attempts at hacking PS3

George Hotz, aka GeoHot, who is being sued by Sony for hacking its PlayStation 3, had first attempted to hack the game console last year and he was successful in his attempt at that time too, but Sony released a series of firmware updates and re-secured it.

http://topnews.net.nz/content/212539-glance-geohot-s-attempts-hacking-ps3

- International Hacking Even More Widespread: GE, Disney Reportedly Victimized

Hackers broke into the networks of Johnson & Johnson (JNJ), Disney (DIS), DuPont (DD), Sony (SNE) and General Electric (GE) in a series of attacks similar to the one that hit Google (GOOG) last year, Bloomberg reported today after reviewing emails from security company HBGary that had investigated the attacks. The Google attack was no run-of-the-mill event: the sophisticated breach apparently compromised the company’s intellectual property and targeted Chinese human rights activists. Adobe Systems (ADBE) said it was hacked at about the same time, and Intel (INTC) also reported being attacked.

http://blogs.barrons.com/stockstowatchtoday/2011/03/08/international-hacking-even-more-widespread-ge-disney-reportedly-victimized/?mod=BOLBlog

- French government hacked for G20 documents

The French government has confirmed that it was infiltrated by hackers who seemed to be looking for documents relating to the

G20 summit.

http://www.zdnet.co.uk/blogs/security-bullet-in-10000166/french-government-hacked-for-g20-documents-10021934/

- Hacker group vows 'cyberwar' on US government, business

A leader of the computer hackers group known as Anonymous is threatening new attacks on major U.S. corporations and government officials as part of at an escalating “cyberwar” against the citadels of American power.

http://today.msnbc.msn.com/id/41972190/ns/technology_and_science-security/

- How N.Korean Hackers Could Inflict Maximum Damage

Friday's GPS jamming and cyber attacks, which are suspected to be the work of North Korea, have led to a flood of speculation among experts about possible future provocations by the North. Some now fear that it could resort simultaneous cyber attacks against South Korean power, traffic, communication, military and other state infrastructure.

http://english.chosun.com/site/data/html_dir/2011/03/09/2011030900429.html

- China refutes hacker accusation

Chinese analysts Monday dismissed statements by a South Korean official that Chinese hackers had attacked a computer network run by South Korea's defense ministry and stole secret documents.

http://china.globaltimes.cn/diplomacy/2011-03/630992.html

- How to join Anonymous Hacker - Identity less Cyber Heroes ?

Anonymous is not an organization. It is not a club, a party or even a movement. There is no charter, no manifest, no membership fees. Anonymous has no leaders, no gurus, no ideologists. In fact, it does not even have a fixed ideology.

http://www.thehackernews.com/2011/03/how-to-join-anonymous-hacker-identity.html

- Auto industry guards against hacking

Could modern cars operating with the help of internal computers be vulnerable to hackers? Could someone tamper with your software-controlled brakes or stop the engine from afar?

http://www.google.com/hostednews/ap/article/ALeqM5g7J3IIMXs3G93YPQp4IcD1bhpD_Q?docId=8921aae10cf54960a1207a5f161927a1

- 4chan students hack district schools; Changed grades and $9,000 meals

Students managed to gain access to their school data system and change their grades, after the username and password of the school data system was published on 4chan.

http://www.zdnet.com/blog/igeneration/4chan-students-hack-district-schools-changed-grades-and-9000-meals/8710

- Video: Hack Turns Kinect Into Home Automation Assistant

Ja! A gentleman known to the Internet as Nitrogen has put together a type of Kinect do-it-yourself project that’s certainly worth a moment of your time. The “hack” uses the libfreenect library to turn the Kinect into a home automation sensor. So, you walk into your room, the Kinect camera sees you enter, then libfreenect turns on your lights. Leave the room, out go the lights.

http://www.crunchgear.com/2011/03/09/video-hack-turns-kinect-into-home-automation-assistant/

- Chrome Plugs More Holes Ahead Of Hack Contest

Google sewed up 23 flaws in its Chrome Web browser late yesterday, hours before the opening of the Pwn2Own hacking contest at the CanSecWest security conference in Vancouver, British Columbia.

http://www.eweekeurope.co.uk/news/chrome-plugs-holes-ahead-of-hack-contest-23363

- Report: Websites of two Iranian institutions hacked

Tehran - The websites of two Iranian institutions were hacked on Wednesday and false news distributed, the Fars news agency reported.

http://www.monstersandcritics.com/news/middleeast/news/article_1624770.php/Report-Websites-of-two-Iranian-institutions-hacked

- Google issues hacking alert to 260,000 smartphone users who downloaded virus-infected apps

Google yesterday admitted that up to 260,000 smartphones have been hacked after handset users unwittingly downloaded virus-infected apps.

http://www.dailymail.co.uk/sciencetech/article-1364554/Google-Android-hacking-alert-260k-smartphone-users-downloaded-app-virus.html#ixzz1GaMkL0pL

- Sheriff's office employee arrested for alleged hacking

The Albany County Sheriff's Office says they have arrested one of their own employees on a series of charges.

http://www.fox23news.com/news/local/story/Sheriffs-office-employee-arrested-for-hacking/_7ZMvfO0m02e1LXMnO_5WA.cspx

- BMI website hacked

Performing rights org BMI temporarily took down its website Wednesday after a denial-of-service attack, allegedly by the notorious hacker group Anonymous.

http://www.variety.com/article/VR1118033664?refCatId=16

- Hacker Group Declares 'Cyberwar' on US Government

The hacker group that battled Visa, HBGary Federal, and even the Westboro Baptist Church is now threatening fresh attacks on government officials and major U.S. corporations, according to one of the organization's senior members Read more:

http://www.foxnews.com/scitech/2011/03/09/hacker-group-declares-cyberwar-government/#ixzz1GaND4Nm9

- Employee incompetence is a hacker's best friend

Security breaches -- they're an IT issue that's difficult to prevent completely, but even harder when the threats develop from the inside, whether it's hardware stolen by dishonest employees or data loss caused by oversight within the ranks.

http://www.infoworld.com/t/misadventures/employee-incompetence-hackers-best-friend-819

- Hacker Builds Working Hand-Held Laser Gun

George Lucas, if you're reading, there's a good reason why Han would have shot first: because he, like German laser hacker AnselmoFanZero, knew that lasers are very dangerous things capable of zapping holes through metal, plastic, and green dudes called Greedo.

http://techland.time.com/2011/03/09/hacker-builds-working-hand-held-laser-gun/#ixzz1GaNSDezg

- Microsoft Loses $1.2 Million To Hackers Who Manipulate Marketplace Codes

Some crafty hackers figured out something interesting recently, and that discovery led to the loss of about $1.2 million dollars.

http://geeksofdoom.com/2011/03/10/microsoft-loses-1-2-million-to-hackers-who-manipulate-marketplace-codes/

- 'Anonymous' Attacks Songwriters

Today, the hacker group known as 'Anonymous' launched a denial of service attack on the website of Broadcast Music Inc. For those who don't know, BMI is a songwriter organization dedicated to ensuring that composers receive the royalties they earn through public performances of their music. For example, when a song is broadcast on the radio, television, or on the web, BMI collects the money and distributes it directly to its member songwriters.

http://www.huffingtonpost.com/rick-carnes/anonymous-attacks-songwri_b_834331.html

- Hackers strike at major companies

DuPont, Johnson & Johnson, Sony, Walt Disney and General Electric are among more than a dozen previously unidentified companies whose networks were broken into in the past two years by hackers intent on stealing some of their most valuable assets, confidential e-mails show.

http://www.nj.com/business/index.ssf/2011/03/hackers_strike_at_major_compan.html

- Microsoft Xbox Live Marketplace Hacked For $1.2 M

Microsoft Points are the basic currency of the Xbox Live Marketplace, used in several games and to buy music from the Zune Marketplace. Game blogs such Joystiq and Save and Quit have reported that the problem is in the codes used on the gift cards used to add points to users' Xbox Live accounts.

http://www.ibtimes.com/articles/121395/20110310/microsoft-xbox-live-marketplace-hacked.htm#ixzz1GaPLpSbo

- Lawyer: Facebook abuser doesn't deserve prison

The attorney for a Sacramento-area man accused of violating the privacy of dozens of women after he used information from their Facebook pages to take over their e-mail accounts says her client was simply bored and naïve, and does not deserve prison.

http://www.sfgate.com/cgi-bin/article.cgi?f=%2Fn%2Fa%2F2011%2F03%2F10%2Fstate%2Fn125806S58.DTL

- 20 grand not enough to entice hackers to crack Google Chrome

Contestants participating in the Pwn2Own 2011 hacking contest at the CanSecWest cybersecurity conference this week in Vancouver, British Columbia, cracked into Safari 5.0.3 and Internet Explorer 8, the latest, most protected versions of Apple's and Microsoft's Web browsers.

http://content.usatoday.com/communities/technologylive/post/2011/03/20-grand-not-enough-to-entice-hackers-to-crack-google-chrome/1

Fact: Anti-virus is dead! No One Can Keep Up With New Malware

2011-03-21T13:31:00.000-07:00

According to independent malware test labs, ALL ANTI-VIRUS software agents FAILED to stop ALL new threats, known as zero-day malware.

http://www.anti-malware-test.com

http://blogs.zdnet.com/security/?p=5365

http://av-test.org/

See:

Another Important Fact: Wireless Will Never Be Secure!

2011-03-21T13:28:00.000-07:00

WEP was easy to crack; now WPA is also…Recently deployed tools such as Back Track v4.0 allow you to break wireless encryption by attacking the smaller 24-bit session initiation key and then gaining full “trusted” access to a wireless router.

Wireless Routers have Critical Flaws (CVEs)Now you can break into the admin interface of a wireless router by sending malformed packets from your laptop and pringles can…not worrying about the encryption, see NVD.NIST.GOV and type in “wireless”

Today's Fact: Nothing with an IP Address is ever secure!

2011-03-21T13:24:00.000-07:00

No device is safe – all IP-based devices are exposed to exploitation:

It is a target

It can be spoofed

It can be infected

It can be remotely controlled

It is probably already infected

NetClarity Launches Second Generation Network Access Control (2G NAC)...Wins...Most Innovative New Security Product for 2011 Award!

2011-03-21T13:06:00.000-07:00

Info Security Products Guide, the industry’s leading information security research and advisory guide, has named the NACwall 2G® appliances family the winner of the 2011 Global Excellence Awards Most Innovative New Security Product for 2011. More than 50 judges from a broad spectrum of industry voices from around the world participated and their average scores determined the 2011 Global Excellence Awards Finalists and Winners.

“We are honored to receive this coveted award from Info Security Products Guide, which affirms our game changing position in the NAC marketplace,” says Hal Charnley, CEO of NetClarity, Inc.

“We’re pleased to bestow this Award upon NetClarity as they continue to push the envelope on innovative network security products that solve the most serious internal security, risk and compliance problems which are plaguing networks worldwide,” said Rake Narang, Executive Director, Info Security Products Guide.