Hi, what are you looking for?
In an effort to help users get a better idea of the security status of their MySQL databases, McAfee today released a free open-source audit plug-in that provides detailed database activity audits and helps satisfy audit requirements for the wildly popular open source database platform.McAfee promises that the software-only implementation is easy to deploy and is highly scalable, and ideal for protecting and monitoring MySQL databases in the cloud, with key features including:
Microsoft made lots of news recently with the disclosure that a key vulnerability (MS12-020) involving the RDP protocol had been leaked, apparently from Microsoft’s Active Protections Program (MAPP).
Today, Microsoft announced that in collaboration with partners from the financial services industry including FS-ISAC and NACHA, The Electronic Payments Association, and Kyrus Tech, it has successfully taken action against cybercriminal operations that fuel a number of botnets powered by the notorious Zeus family of malware.
Given the necessity of backups, because lets face it - hardware fails, users make mistakes, and hackers have no issue wiping the server after they’re done with it, organizations make it a key part of their business continuity and incident response plans. What about the data stored in that mythical cloud? How is it protected?SecurityWeek recently spoke with a company that wanted to answer that question.
Mandiant this week released the latest version of its Redline tool, a software utility that helps incident responders work faster and more efficiently, promising improved analytics, along with enhancements to audit data collection and configurations in the latest version.
With estimated worldwide cyber crime losses in 2011 over $388 billion, corporations, both large and small, are focusing considerable attention towards the security of their physical infrastructures as well as their outward facing web applications. While most physical infrastructures have been secured, there are still many critical security vulnerabilities in the majority of web applications.
Researchers at ESET have discovered a botnet dubbed "Georbot", a new botnet that targets victims living in the Eurasian state of Georgia. The information stealing Trojan is unusual to a degree, researchers said, given some of its functions and location of its command and control (C&C) server.
Government, Industry Organizations Unite to Launch "Anti-Bot Code of Conduct" for ISPs
In late January 2012 and earlier this month, hundreds and perhaps thousands of WordPress-based domains were compromised in a series of automated attacks. Though there was no official number given, the reason for the compromises has made itself known. They are being used as the final stage in a spam run, likely from the Cutwail botnet, to spread malware.
2011 Cost of Data Breach Study Shows Organizations Employing a CISO With Overall Responsibility for Enterprise Data Protection, Paid Less after a Breach, Saving as much as $80 per compromised Record
eEye Digital Security released a new piece of freeware today for checking system configurations in the name of security.The tool was released on the back of research by eEye about best practices. Among the company’s findings, disabling WebDAV and Microsoft Office document converters prevented 20 percent of Microsoft vulnerabilities in 2011. In addition, eEye also found that users should also limit administrative privileges, use proxy servers, encrypt traffic on VLANs and IPsec and deny access to Windows subsystems.
Attackers are adapting their techniques as software vendors get better at patching vulnerabilities, according to a new report from IBM. In its X-Force 2011 Trend and Risk Report, IBM notes that the amount of vulnerabilities left unpatched in 2011 dropped to 36 percent from 43 percent in 2010. But improvements in securing Web applications may have led attackers to change tactics, sparking an increase in automated password guessing and shell command injection attacks against Web servers, the firm reported.
Hacktivism dominated more than just the headlines in 2011; according to Verizon, it also dominated the world of data breaches.In its 2012 Data Breach Investigations Report, hacktivism was linked to 58 percent of the data that was stolen in 855 incidents last year around the world.
New Duqu Variant Discovered in IranIt’s been an interesting week in developments related to Duqu, the complex cyber-espionage malware often referred to as “Son of Stuxnet.”
The assistant secretary of defense for global strategic affairs, Madelyn Creedon, told the House Armed Services Committee’s subcommittee on emerging threats and capabilities on Tuesday that the U.S. Department of Defense is developing rules of engagement for cyberspace.
On Tuesday, Russian law enforcement arrested eight men in Moscow for allegedly boosting millions of dollars from the nation’s banks by installing the Carberp Trojan on their victim’s computers. According to a press release by the Ministry of Internal Affairs, the group’s crime spree was first discovered by law enforcement last October.
Security researchers at BitDefender have identified an attack campaign that enlists multiple banking Trojans to help compromise bank account information.
A new survey of developers and security professionals revealed that many organizations are still not baking security into the application development process.According to research by Security Innovation and the Ponemon Institute, 80 percent of the developers and two-thirds of the security personnel surveyed do not have a process where they build security into their software applications. In addition, 47 percent of developers state that there is no formal mandate in place to remediate vulnerable software code.
The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
A total of 22 patches were releaased, a majority for code execution, privilege escalation, and information disclosure vulnerabilities.
Late amendments to the Cyber Security and Resilience Bill would give ministers new powers to restrict risky technology providers as supply chain attacks intensify.
