Insecurity in Security Software
|
|
|
- Olivia Mitchell
- 8 years ago
- Views:
Transcription
1 Insecurity in Security Software Maik Morgenstern Andreas Marx AV-Test GmbH Virus Bulletin 2005 Conference presentation about Insecurity in Security Software Copyright 2005 AV-Test GmbH, Klewitzstr. 6, D Magdeburg, Germany Phone: , Fax: ,
2 Table of content The paradox Types of security software Comparison of CVE advisories Examples of bugs and security vulnerabilities Why bugs occur Vulnerability lifecycle What to do? (for users and developers) Trustworthy computing development lifecycle
3 The paradox All software products contains security vulnerabilities (and other bugs) AV software is widely deployed to protect companies, organizations and home users Every week, security flaws are discovered in different AV products The paradox: Security software is meant to secure the system, but nowadays it introduces new security holes.
4 Types of security software Two different groups of security software: Home and business user software (widely used) Firewalls IPSec products IDS/IPS AV software Tools used by researchers (small deployment) IDA Pro OllyDbg Softice
5 CVE advisories for vendor products (2001 quarterly average = 100, Source: The Yankee Group) Microsoft / Security vendors / All vendors
6 Bug leading to a security vulnerability A couple of examples from the last months (advisory titles): ISS and the Witty Worm Trend Micro VSAPI ARJ parsing McAfee Virus Library Symantec Multiple Products UPX Parsing Engine Heap Overflow Computer Associates Vet Antivirus Library Remote Heap Overflow Kaspersky AntiVirus "klif.sys" Privilege Escalation Vulnerability OllyDbg "INT3 AT" Format String Vulnerability DataRescue IDA Pro Dynamic Link Library Format String Vulnerability Clam AntiVirus ClamAV Cabinet File Handling DoS Vulnerability
7 Bugs vs. security vulnerabilities Some more examples of the last months: Trend Micro Virus Sig 594 causes systems to experience high CPU utilization Windows NTFS Alternate Data Streams Archive Problems BitDefender bug bites GFI Panda AntiVirus deleting Tobit David communications software Symantec Brightmail AntiSpam Static Database Password McAfee Internet Security Suite 2005 Insecure File Permission
8 Why bugs occur: 3 main factors Technical factors The underlying complexity of the task itself Psychological factors The mental models, for example, that make it hard for human beings to design and implement secure software Real-world factors Economic and other social factors that work against security quality Source: Mark G. Graff, Kenneth R. van Wyk, Secure Coding: Principles & Practices, O'Reilly, 2003
9 Vulnerability lifecycle A never-ending story! 1. Discover vulnerability 2. Develop patch 3. Get alert and install patch 4. Goto 1 Source: Mark G. Graff, Kenneth R. van Wyk, Secure Coding: Principles & Practices, O'Reilly, 2003
10 What to do? (I) Corporate users: Update your products frequently! not only signature files in case of AV software, but really all components (e.g. engine, GUI)! Read publicly available information about newly discovered flaws and don t call the people first Try to shorten test intervals (months vs. weeks) for security vulnerability related updates Scan throughput is not the only important thing!
11 What to do? (II) Software developers: Check your old known-working code Check for updates of 3rd party software included in your products File format Sandbox (enforce protocol) Strategy to use minimal rights only whenever possible (do not use Administrator or Root rights) Create easy update deployment mechanisms
12 Trustworthy computing development lifecycle (I) Four principles of secure development: Secure by design Secure by default Secure in deployment Communications Source: Steve Lipner, Michael Howard, The Trustworthy Computing Security Development Lifecycle, Microsoft 2005
13 Trustworthy computing development lifecycle (II) Example (Microsoft s suggestions): Implementation phase: Apply coding and testing standards Apply security-testing tools including fuzzy logic Apply static analysis code scanning tools Conduct code reviews Source: Steve Lipner, Michael Howard, The Trustworthy Computing Security Development Lifecycle, Microsoft 2005
14 Summary Security vulnerabilities are an industry-wide problem Microsoft isn t the only target today anymore Every error could be security relevant when it happens in security software! Proactive actions (e.g. automated and manual code reviews, rewriting of code) has to be considered Implement several layers of security ( Sandbox ) Responsible way of updating: Update often, update early, not too often and not too early
15 Any questions? Are there any questions?
INSECURITY IN SECURITY SOFTWARE
INSECURITY IN SECURITY SOFTWARE Maik Morgenstern AV-Test GmbH, Klewitzstr. 7, 39112 Magdeburg, Germany Tel +49 391 6075464 Email mmorgen@av-test.de Contributors: Andreas Marx AV-Test GmbH, Klewitzstr.
Real World and Vulnerability Protection, Performance and Remediation Report
Real World and Vulnerability Protection, Performance and Remediation Report A test commissioned by Symantec Corporation and performed by AV-Test GmbH Date of the report: September 17 th, 2014, last update:
D. Best Practices D.1. Assurance The 5 th A
Best Practices I&C School Prof. P. Janson September 2014 D. Best Practices D.1. Assurance The 5 th A 1 of 20 IT systems are insecure for two main reasons: People are fallible and systems are complex and
Release: 1. ICASAS206A Detect and protect from spam and destructive software
Release: 1 ICASAS206A Detect and protect from spam and destructive software ICASAS206A Detect and protect from spam and destructive software Modification History Release Release 1 Comments This Unit first
Assuria can help protectively monitor firewalls for PCI compliance. Assuria can also check the configurations of personal firewalls on host devices
The Payment Card Industry (PCI) Data Security Standard (DSS) provides an actionable framework for developing a robust payment card data security process. The Payment Application Data Security Standard
31-05-2007. Sérgio Martinho Microsoft Portugal Sergio.Martinho@microsoft.com
As melhores soluções servidoras empresariais e a maior facilidade de gestão 31-05-2007 Sérgio Martinho Microsoft Portugal Sergio.Martinho@microsoft.com Agenda IT Solution Priorities by Vertical Market
GFI White Paper PCI-DSS compliance and GFI Software products
White Paper PCI-DSS compliance and Software products The Payment Card Industry Data Standard () compliance is a set of specific security standards developed by the payment brands* to help promote the adoption
iviz Security Inc (In) Security in Security Products 2013
iviz Security Inc (In) Security in Security Products 2013 iviz Security Inc 2013 Introduction We use security products to secure our systems and our businesses. However, the very security products we use,
PCI DSS Requirements - Security Controls and Processes
1. Build and maintain a secure network 1.1 Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data
More Than A Microsoft World. Marc Maiffret Co-Founder Chief Hacking Officer
More Than A Microsoft World Marc Maiffret Co-Founder Chief Hacking Officer The eeye Marketing Slide We Make Security Software Retina Network Security Scanner Blink Host Based Security REM Enterprise Vulnerability/Threat
Desktop Security. Overview and Technology Guidance. Michael Ramsey Network Specialist, NC DPI
Desktop Security Overview and Technology Guidance Michael Ramsey Network Specialist, NC DPI Desktop Security Best practices for both the technical type and the typical user Defensive Layering Top Vulnerabilities
Proactive Rootkit Protection Comparison Test
Proactive Rootkit Protection Comparison Test A test commissioned by McAfee and performed by AV-TEST GmbH Date of the report: February 2 th, 213 Executive Summary In January 213, AV-TEST performed a comparative
Fully supported Antivirus software (Managed Antivirus)
You are here: Antivirus > Managed Antivirus Vendors Fully supported Antivirus software (Managed Antivirus) Antivirus (AV) vendors often release software updates. We hard-code the update into our RMM agent
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
Banker Malware Protection Test Report
Banker Malware Protection Test Report A test commissioned by Kaspersky Lab and performed by AV-Test GmbH Date of the report: April 10 th,, last update: April 10 th, Executive Summary In March, AV-Test
Windows 8 Malware Protection Test Report
Windows 8 Malware Protection Test Report A test commissioned by Kaspersky Lab and performed by AV-Test GmbH Date of the report: January 11 th, 2013, last update: January 11 th, 2013 Executive Summary In
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006
Enterprise Cybersecurity Best Practices Part Number MAN-00363 Revision 006 April 2013 Hologic and the Hologic Logo are trademarks or registered trademarks of Hologic, Inc. Microsoft, Active Directory,
Managing Vulnerabilities for PCI Compliance White Paper. Christopher S. Harper Managing Director, Agio Security Services
Managing Vulnerabilities for PCI Compliance White Paper Christopher S. Harper Managing Director, Agio Security Services PCI STRATEGY Settling on a PCI vulnerability management strategy is sometimes a difficult
Symantec Endpoint Protection Analyzer Report
Symantec Endpoint Protection Analyzer Report For Symantec Customer Table of Contents Statement of Confidentiality... 3 1. Introduction... 4 2. Environmental Analysis Overview... 5 2.1 Findings Overview...
74% 96 Action Items. Compliance
Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated
PCI DSS Policies Outline. PCI DSS Policies. All Rights Reserved. ecfirst. 2010. Page 1 of 7 www.ecfirst.com
Policy/Procedure Description PCI DSS Policies Install and Maintain a Firewall Configuration to Protect Cardholder Data Establish Firewall and Router Configuration Standards Build a Firewall Configuration
Did you know your security solution can help with PCI compliance too?
Did you know your security solution can help with PCI compliance too? High-profile data losses have led to increasingly complex and evolving regulations. Any organization or retailer that accepts payment
Industrial Security for Process Automation
Industrial Security for Process Automation SPACe 2012 Siemens Process Automation Conference Why is Industrial Security so important? Industrial security is all about protecting automation systems and critical
Society for Information Management
Society for Information Management The Projected Top 5 Security Issues of 2010 Steve Erdman CSO and Staff Security Consultant of SecureState Network +, MCP Precursor 2009 has been a difficult year in Information
Virtual Desktops Security Test Report
Virtual Desktops Security Test Report A test commissioned by Kaspersky Lab and performed by AV-TEST GmbH Date of the report: May 19 th, 214 Executive Summary AV-TEST performed a comparative review (January
BBM 461: SECURE PROGRAMMING INTRODUCTION. Ahmet Burak Can
BBM 461: SECURE PROGRAMMING INTRODUCTION 1 Ahmet Burak Can COURSE MATERIAL Counter Hack Reloaded:A Step-by- Step Guide to Computer Attacks and Effective Defenses, Edward Skoudis, Tom Liston, Prentice Hall
How To Manage A System Vulnerability Management Program
System Vulnerability Management Definitions White Paper October 12, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that allows
Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices
350 PIERS Proceedings, Cambridge, USA, July 5 8, 2010 Optimizing Windows Security Features to Block Malware and Hack Tools on USB Storage Devices Dung Vu Pham 1, Malka N. Halgamuge 2, Ali Syed 1, and Priyan
The Security Development Lifecycle
The Security Development Lifecycle Steven B. Lipner Director of Security Engineering Strategy Security Business and Technology Unit Microsoft Corporation Context and History 1960s penetrate and patch 1970s
Company Co. Inc. LLC. LAN Domain Network Security Best Practices. An integrated approach to securing Company Co. Inc.
Company Co. Inc. LLC Multiple Minds, Singular Results LAN Domain Network Security Best Practices An integrated approach to securing Company Co. Inc. LLC s network Written and Approved By: Geoff Lacy, Tim
Microsoft Software Update Services and Managed Symantec Anti-virus. Michael Satut TSS/Crown IT Support m-satut@northwestern.edu
Microsoft Software Update Services and Managed Symantec Anti-virus Michael Satut TSS/Crown IT Support m-satut@northwestern.edu Introduction The recent increase in virus and worm activity has created the
Nessus and Antivirus. January 31, 2014 (Revision 4)
Nessus and Antivirus January 31, 2014 (Revision 4) Table of Contents Introduction... 3 Standards and Conventions... 3 Overview... 3 A Note on SCAP Audits... 4 Microsoft Windows Defender... 4 Kaspersky
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
Security Maintenance Practices. IT 4823 Information Security Administration. Patches, Fixes, and Revisions. Hardening Operating Systems
IT 4823 Information Security Administration Securing Operating Systems June 18 Security Maintenance Practices Basic proactive security can prevent many problems Maintenance involves creating a strategy
How To Manage A Patch Management Program
Patch Management Best Practices What is Patch Management? Patch management is the practice of reviewing, understanding, testing, deploying and reconciling the deployment state for software product updates.
B-HAVE the road to success
B-HAVE the road to success A case study in the successful deployment of new anti-malware technology Speed is the name of the game In October 2004, AV-Test, an independent testing organization based in
How To Control Vcloud Air From A Microsoft Vcloud 1.1.1 (Vcloud)
SOC 1 Control Objectives/Activities Matrix goes to great lengths to ensure the security and availability of vcloud Air services. In this effort, we have undergone a variety of industry standard audits,
1.3 Prohibit Direct Public Access - Prohibit direct public access between the Internet and any system component in the cardholder data environment.
REQUIREMENT 1 Install and Maintain a Firewall Configuration to Protect Cardholder Data Firewalls are devices that control computer traffic allowed between an entity s networks (internal) and untrusted
Security Testing. How security testing is different Types of security attacks Threat modelling
Security Testing How security testing is different Types of security attacks Threat modelling Note: focus is on security of applications (not networks, operating systems) Security testing is about making
Building More Secure Commercial Software: The Trustworthy Computing Security Development Lifecycle
Building More Secure Commercial Software: The Trustworthy Computing Development Lifecycle Steven B. Lipner Microsoft Corporation With the growth of the Internet as a vehicle for commercial, governmental,
PCI Requirements Coverage Summary Table
StillSecure PCI Complete Managed PCI Compliance Solution PCI Requirements Coverage Summary Table January 2013 Table of Contents Introduction... 2 Coverage assumptions for PCI Complete deployments... 2
Zscaler Cloud Web Gateway Test
Zscaler Cloud Web Gateway Test A test commissioned by Zscaler, Inc. and performed by AV-TEST GmbH. Date of the report: April15 th, 2016 Executive Summary In March 2016, AV-TEST performed a review of the
Host Hardening. Presented by. Douglas Couch & Nathan Heck Security Analysts for ITaP 1
Host Hardening Presented by Douglas Couch & Nathan Heck Security Analysts for ITaP 1 Background National Institute of Standards and Technology Draft Guide to General Server Security SP800-123 Server A
Cesar Cerrudo Argeniss
Cesar Cerrudo is a security researcher specialized in application security. Cesar is running his own company, Argeniss. Regarded as a leading application security researcher, Cesar is credited with discovering
Application Intrusion Detection
Application Intrusion Detection Drew Miller Black Hat Consulting Application Intrusion Detection Introduction Mitigating Exposures Monitoring Exposures Response Times Proactive Risk Analysis Summary Introduction
Scripting AV Signature File Updates and Testing. By Randy Abrams and Andreas Marx With Mary Landesman as contributing editor
Scripting AV Signature File Updates and Testing By Randy Abrams and Andreas Marx With Mary Landesman as contributing editor About the authors: Randy Abrams Operations Manager Microsoft Corporation, One
AN OVERVIEW OF VULNERABILITY SCANNERS
AN OVERVIEW OF VULNERABILITY SCANNERS February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole
Software Development: The Next Security Frontier
James E. Molini, CISSP, CSSLP Microsoft Member, (ISC)² Advisory Board of the Americas jmolini@microsoft.com http://www.codeguard.org/blog Software Development: The Next Security Frontier De-perimiterization
What Do You Mean My Cloud Data Isn t Secure?
Kaseya White Paper What Do You Mean My Cloud Data Isn t Secure? Understanding Your Level of Data Protection www.kaseya.com As today s businesses transition more critical applications to the cloud, there
Manually Add Programs to Your Firewall or Anti-Virus Programs Trusted List. ZoneAlarm
Manually Add Programs to Your Firewall or Anti-Virus Programs Trusted List ZoneAlarm AVG Open the AVG Anti-Virus plus Firewall. Double-click the Firewall button to configure the Firewall. Add the programs
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for
PROACTIVE PROTECTION MADE EASY
PROACTIVE PROTECTION AUTHOR: ANDREW NIKISHIN KASPERSKY LAB Heuristic Analyzer Policy-Based Security Intrusion Prevention System (IPS) Protection against Buffer Overruns Behaviour Blockers Different Approaches
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements
How NETGEAR ProSecure UTM Helps Small Businesses Meet PCI Requirements I n t r o d u c t i o n The Payment Card Industry Data Security Standard (PCI DSS) was developed in 2004 by the PCI Security Standards
BAE Systems PCI Essentail. PCI Requirements Coverage Summary Table
BAE Systems PCI Essentail PCI Requirements Coverage Summary Table Introduction BAE Systems PCI Essential solution can help your company significantly reduce the costs and complexity of meeting PCI compliance
Symantec Endpoint Protection 12.1.4
Data Sheet: Endpoint Security Overview provides unrivaled security across physical and virtual platforms and support for the latest operating systems-mac OS X 10.9 and Windows 8.1. Powered by Symantec
Integrating Tools Into the SDLC
Integrating Tools Into the SDLC FIRST Conference 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to
GFI Product Manual. Administration and Configuration Manual
GFI Product Manual Administration and Configuration Manual http://www.gfi.com info@gfi.com The information and content in this document is provided for informational purposes only and is provided "as is"
SonicWALL PCI 1.1 Implementation Guide
Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard
Web Application Security
Chapter 1 Web Application Security In this chapter: OWASP Top 10..........................................................2 General Principles to Live By.............................................. 4
26 Protection Programs Undergo Our First Test Using Windows 8
Test: Internet Security Packages 1/2013 26 Protection Programs Undergo Our First Test Using Windows 8 Windows 8 is considered to be a secure system thanks to its internal protection package containing
Chapter 4 Application, Data and Host Security
Chapter 4 Application, Data and Host Security 4.1 Application Security Chapter 4 Application Security Concepts Concepts include fuzzing, secure coding, cross-site scripting prevention, crosssite request
Created By: 2009 Windows Server Security Best Practices Committee. Revised By: 2014 Windows Server Security Best Practices Committee
Windows Server Security Best Practices Initial Document Created By: 2009 Windows Server Security Best Practices Committee Document Creation Date: August 21, 2009 Revision Revised By: 2014 Windows Server
Virtualized In-Cloud Security Services for Mobile Devices
Virtualized In-Cloud Security Services for Mobile Devices Jon Oberheide, Kaushik Veeraraghavan, Evan Cooke, Jason Flinn, Farnam Jahanian University of Michigan June 17, 2008 MobiVirt '08 Roadmap Motivation
BitDefender for Microsoft ISA Servers Standard Edition
BitDefender for Microsoft ISA Servers Standard Edition Copyright 2006 SOFTWIN Edition 1. How Does It Work? As content entering or leaving your company must meet security policies, it is crucial to choose
Security aspects of e-tailing. Chapter 7
Security aspects of e-tailing Chapter 7 1 Learning Objectives Understand the general concerns of customers concerning security Understand what e-tailers can do to address these concerns 2 Players in e-tailing
ESAP 2.7.9. Release Notes. Version Published
ESAP 2.7.9 Release Notes Version Published Mac and Windows 3.6.10004.2 (V2 Unified + V3) July 2015 Note: The SDK embedded in this ESAP version has been tested and qualified to interoperate with an extensive
Agile and Secure: Can We Be Both?
Agile and Secure: Can We Be Both? OWASP AppSec Seattle Oct 2006 Keith Landrus Director of Technology Denim Group Ltd. keith.landrus@denimgroup.com (210) 572-4400 Copyright 2006 - The OWASP Foundation Permission
Lifecycle Solutions & Services. Managed Industrial Cyber Security Services
Lifecycle Solutions & Services Managed Industrial Cyber Security Services Around the world, industrial firms and critical infrastructure operators partner with Honeywell to address the unique requirements
System Security Policy Management: Advanced Audit Tasks
System Security Policy Management: Advanced Audit Tasks White Paper October 6, 2005 2005 Altiris Inc. All rights reserved. ABOUT ALTIRIS Altiris, Inc. is a pioneer of IT lifecycle management software that
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR
PCI COMPLIANCE REQUIREMENTS COMPLIANCE CALENDAR AUTHOR: UDIT PATHAK SENIOR SECURITY ANALYST udit.pathak@niiconsulting.com Public Network Intelligence India 1 Contents 1. Background... 3 2. PCI Compliance
12 Security Camera System Best Practices - Cyber Safe
12 Security Camera System Best Practices - Cyber Safe Dean Drako, President and CEO, Eagle Eye Networks Website version of white paper Dean Drako video introduction for cyber security white paper Introduction
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
PCI Compliance - A Realistic Approach. Harshul Joshi, CISM, CISA, CISSP Director, Information Technology CBIZ MHM hjoshi@cbiz.com
PCI Compliance - A Realistic Approach Harshul Joshi, CISM, CISA, CISSP Director, Information Technology CBIZ MHM hjoshi@cbiz.com What What is PCI A global forum launched in September 2006 for ongoing enhancement
Why one virus engine is not enough
GFI White Paper Why one virus engine is not enough Multiple virus engines are needed to reduce time lag between virus outbreak and signature update There is no single antivirus engine on the market that
Prinect. Is Your Prinect Workflow Safe from a Cyber Attack?
Prinect Is Your Prinect Workflow Safe from a Cyber Attack? Anti-Virus Software & Your Prinect Workflow Security is a key concern of today s digital world. Fully protecting your business requires a multi-prong
PCI Data Security Standards (DSS)
ENTERPRISE APPLICATION WHITELISTING SOLUTION Achieving PCI Compliance at the Point of Sale Using Bit9 Parity TM to Protect Cardholder Data PCI: Protecting Cardholder Data As the technology used by merchants
OutbreakShield Effective and Immediate Protection against Email Virus Outbreaks
OutbreakShield Effective and Immediate Protection against Email Virus Outbreaks Ralf Benzmüller G DATA Software AG Introduction The virus protection provided by all current antivirus software products
On-Site Computer Solutions values these technologies as part of an overall security plan:
Network Security Best Practices On-Site Computer Solutions Brian McMurtry Version 1.2 Revised June 23, 2008 In a business world where data privacy, integrity, and security are paramount, the small and
Open Data Center Alliance Usage: Provider Assurance Rev. 1.1
sm Open Data Center Alliance Usage: Provider Assurance Rev. 1.1 Legal Notice This Open Data Center Alliance SM Usage:Provider Assurance is proprietary to the Open Data Center Alliance, Inc. NOTICE TO USERS
The Leader in Cloud Security SECURITY ADVISORY
The Leader in Cloud Security SECURITY ADVISORY Security Advisory - December 14, 2010 Zscaler Provides Protection in the Face of Significant Microsoft Year End Patch Cycle Zscaler, working with Microsoft
The Challenge of a Comprehensive Network Protection. Introduction
Index Introduction...3 Corporate Network Security Management Challenge...5 Multi-layers and heterogeneous network...5 Roaming Clients...5 Control of unproductive and restricted applications...5 Securing
ESAP 2.7.4 Release Notes
ESAP 2.7.4 Release Notes SDK Version: Mac and Windows 3.6.9845.2 (V2 Unified + V3). Note: The SDK embedded in this ESAP version has been tested and qualified to interoperate with a limited list of end
Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities?
ANALYST BRIEF Can Consumer AV Products Protect Against Critical Microsoft Vulnerabilities? Author Randy Abrams Tested Products Avast Internet Security 7 AVG Internet Security 2012 Avira Internet Security
Getting started. Symantec AntiVirus Corporate Edition 8.1 for Workstations and Network Servers
Getting started Symantec AntiVirus Corporate Edition 8.1 for Workstations and Network Servers Copyright 2003 Symantec Corporation. All rights reserved. Printed in the U.S.A. 03/03 Symantec and the Symantec
Question Name C 1.1 Do all users and administrators have a unique ID and password? Yes
Category Question Name Question Text C 1.1 Do all users and administrators have a unique ID and password? C 1.1.1 Passwords are required to have ( # of ) characters: 5 or less 6-7 8-9 Answer 10 or more
Protecting productivity with Plant Security Services
Protecting productivity with Plant Security Services Identify vulnerabilities and threats at an early stage. Take proactive measures. Achieve optimal long-term plant protection. siemens.com/plant-security-services
APPLICATION SECURITY: ONE SIZE DOESN T FIT ALL
APPLICATION SECURITY: ONE SIZE DOESN T FIT ALL Charles Henderson Trustwave SpiderLabs Session ID: Session Classification: SPO2-W25 Intermediate AGENDA One size rarely fits all Sizing up an application
Simplicity Value Documentation 3.5/5 5/5 4.5/5 Functionality Performance Overall 4/5 4.5/5 86%
Alt-N SecurityGateway for Email Servers - Universal Email Security Gateway Manufacturer: Alt-N Technologies Model: Standard Origin: Texas, USA Website: www.altn.com Price: 204 for up to 25 users Simplicity
The Multiple Scan Engine Advantage and Best Practices for Optimal Security and Performance
The Multiple Scan Engine Advantage and Best Practices for Optimal Security and Performance Microsoft Forefront Security for Exchange Server Microsoft Forefront Security for SharePoint Paul Robichaux 3Sharp
PI Server Security Best Practice Guide Bryan Owen Cyber Security Manager OSIsoft
PI Server Security Best Practice Guide Bryan Owen Cyber Security Manager OSIsoft Agenda Security Development Lifecycle Initiative Using PI to Protect Critical Infrastructure Hardening Advice for the PI
Network Configuration Management
Network Configuration Management Contents Abstract Best Practices for Configuration Management What is Configuration Management? FCAPS Configuration Management Operational Issues IT Infrastructure Library
CS 356 Lecture 25 and 26 Operating System Security. Spring 2013
CS 356 Lecture 25 and 26 Operating System Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control
Xerox Mobile Print Cloud
September 2012 702P00860 Xerox Mobile Print Cloud Information Assurance Disclosure 2012 Xerox Corporation. All rights reserved. Xerox and Xerox and Design are trademarks of Xerox Corporation in the United
Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN
Threat Modeling Frank Piessens (Frank.Piessens@cs.kuleuven.be ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process
Powerful and reliable virus and spam protection for your GMS installation
Introducing integrated, Enterprise-grade malware protection for GMS on-premise deployments Malware protection from Gordano Messaging Services provides powerful anti-virus and anti-spam for all on-premise
Basic computer security
Mag. iur. Dr. techn. Michael Sonntag Basic computer security E-Mail: sonntag@fim.uni-linz.ac.at http://www.fim.uni-linz.ac.at/staff/sonntag.htm Institute for Information Processing and Microprocessor Technology
Endpoint Business Products Testing Report. Performed by AV-Test GmbH
Business Products Testing Report Performed by AV-Test GmbH January 2011 1 Business Products Testing Report - Performed by AV-Test GmbH Executive Summary Overview During November 2010, AV-Test performed
Secondary DMZ: DMZ (2)
Secondary DMZ: DMZ (2) Demilitarized zone (DMZ): From a computer security perspective DMZ is a physical and/ or logical sub-network that resides on the perimeter network, facing an un-trusted network or
SecurityTracker Monday Morning Vulnerability Summary Dec 17, 2012
SecurityTracker Monday Morning Vulnerability Summary Dec 17, 2012 In This Week's SecurityTracker Vulnerability Summary SecurityTracker Alerts: 26 Vendors: Adobe Systems Incorporated - Blue Coat Systems
A43. Modern Hacking Techniques and IP Security. By Shawn Mullen. Las Vegas, NV IBM TRAINING. IBM Corporation 2006
IBM TRAINING A43 Modern Hacking Techniques and IP Security By Shawn Mullen Las Vegas, NV 2005 CSI/FBI US Computer Crime and Computer Security Survey 9 out of 10 experienced computer security incident in