Security Experts:

long dotted

NEWS & INDUSTRY UPDATES

Damballa has raised $13 million from existing investors to capitalize on growing demand for its automated breach defense platform.
Ben-Gurion University of the Negev has signed a $8.5 million agreement with the Israel National Cyber Bureau to develop CyberSpark, which includes a National Cyber Research Center adjacent to BGU’s campus.
According to researchers at Mandiant, now a unit of FireEye, an attacker was able to leverage the Heartbleed vulnerability against a customers’ VPN appliance and hijacked multiple active user sessions.
Attackers are shifting away from traditional botnet-based distributed denial of service attacks in favor of other techniques to launch larger attacks, Akamai Technologies said in its latest report.
Officials at the Justice Department and FTC said they issued formal guidance telling companies that there would be no antitrust issues from the sharing of technical information about cyber attacks, malware or similar threats.
According to Mandiant’s M-Trends report, organizations are discovering breaches in their networks faster, but still not nearly soon as they must in order to contain damage and prevent loss of sensitive data.
The Heartbleed vulnerability is "catastrophic” for SSL and Internet security, Bruce Schneier, told SecurityWeek. “On the scale of 1 to 10, this is an 11,” he said. Here is what organizations need to know and what actions they should take.
Defense.Net is a startup providing DDoS mitigation as a service. SecurityWeek sat down with CTO and Founder Barrett Lyon to discuss the security startup.
AT&T is offering a new cloud-based security solution designed to protect customers against malware and malicious websites while offering security policy control across enterprise, web, social and mobile networks.
Entrust launched a new cloud-based service that consolidates the management of digital identities, SSL certificates and credentials via a single solution platform.

FEATURES, INSIGHTS // Network Security

rss icon

Chris Coleman's picture
The shaping of the threat intelligence management market is critical to its success, and there is much confusion about the very term “threat intelligence.” I am a firm believer that intelligence is a process, not an individual thing, and that Intelligence is not “done.” It is “created.”
Nimmy Reichenberg's picture
Security practitioners have long had a love-hate relationship with automation, and for good reason.
Torsten George's picture
A threat is the agent that takes advantage of a vulnerability. This relationship must be a key factor in the risk assessment process and can no longer be treated as risk’s neglected step child.
Wade Williamson's picture
As enterprises become increasingly focused on security, it’s important to take an honest look not just at what security measures are in place, but how they are really used.
Marcus Ranum's picture
When you start your metrics program, you'll find that a great deal of information can be gleaned from existing data that gets stored in various places – most likely in your system logs.
Chris Hinkley's picture
The most advanced technology in the world is only as good as the people and systems behind it. Otherwise your sophisticated security device is nothing more than a paperweight.
Danelle Au's picture
Trying to defend against modern, advanced attacks with one-off point solutions is like playing a whack-a-mole game, always one step behind the attacker and trying to play catch up with the alerts as they’re received.
Nimmy Reichenberg's picture
By properly segregating the network, you are essentially minimizing the level of access to sensitive information for those applications, servers, and people who don’t need it, while enabling access for those that do.
Torsten George's picture
The NIST Cybersecurity Framework is a good first step towards creating a standardized approach to cyber security, but requires many substantial updates before really improving our nation’s cyber resilience.
Marc Solomon's picture
The energy sector requires an approach to cybersecurity that doesn’t rely exclusively on air gaps or point-in-time detection tools but addresses the full attack continuum – before, during, and after an attack.