SecurityWeek

Microsoft is planning to release seven security bulletins – three of which are rated 'critical' – as part of this month's Patch Tuesday update.The fixes span a number of different products, with the critical bulletins covering issues in Microsoft Windows, Silverlight, Microsoft Office and the .NET Framework. All totaled, 23 security vulnerabilities are on tap to be patched.

What do Sex Surveys and Cybercrime Surveys Have in Common?Cybercrime is either getting worse or getting better. According to a recent report from Microsoft's research team, we simply do not have enough verified data to support either claim.

The Vulnerability Discovery Team at Carnegie Mellon University’s Software Engineering Institute CERT Program has released two new software testing tools designed to help developers find vulnerabilities across major operating systems including Microsoft Windows, Mac OS X, and Linux.The new tools, all available for free, include CERT Failure Observation Engine and the CERT Linux Triage Tools, as well enhancements to its CERT Basic Fuzzing Framework tool.

There is a class of complex vulnerabilities that are difficult to test for, are exploited in clever, stealthy attacks and can cost enterprises millions of dollars in losses. Think zero-day bugs are being described? Think again.Business logic attacks are the topic of the description above, as well as a new whitepaper from Web application security vendor NT OBJECTives. In the report, the company details 10 of the most common business logic attack vectors and offers advice to developers on closing...

CISO Role Shifting From Technology-focused to Strategic Business Leadership Role A new study coming from IBM’s Center for Applied Insights looked to tap into the minds of Chief Information Security Officers (CISOs) in order to get their take on the challenges they currently face and their thoughts on what they expect to see in the near future.

Boulder, Colorado-based identity and access management firm Symplified, on Wednesday announced “Symplified Structure”, a platform that enables telcos, cloud service providers, cloud application brokers, and cloud application hosting companies to integrate identity and access management (IAM) into their cloud services offerings.

Security giant Symantec (NASDAQ:SYMC) today reported the results of its fourth quarter and the fiscal year 2012, ended March 30, 2012. For the fiscal year, GAAP revenue was $6.73 billion, up 9 percent year-over-year and up 6 percent after adjusting for currency.The company reported GAAP revenue of $1.68 billion for its fiscal fourth quarter, flat year-over-year and up 1 percent after adjusting for currency.Key financial metrics reported today include:

Ice Cream is Always Tastier on the Other Cone. Why Cloud SEM is Better Than Your SEM.I'm going to take you through a story, then a rant and then I’ll sprinkle on some clarity. Although the correlation might be hard to grasp, I promise to take it full circle. If you get one thing out of this post, it’s that the cloud is tasty.

Wave Systems, a Massachusetts-based provider of security, data protection and encryption solutions, today launched "Scrambles", a new service designed to enable users to post secure content across social media sites.Scrambls is free and allows businesses and consumers to encrypt text over services including Facebook, Twitter, and Gmail, and define who can and cannot see the “scrambled” posts.

Researchers from Carnegie Mellon’s Software Engineering Institute have come together to create a layered approach for enterprises to deal with insider threats. The Insider Threat Security Reference Architecture (ITSRA) was born from existing best practices and data taken from 700 cases of insider related crime.There are four layers to the ITSRA:

Microsoft researchers have discovered new malware targeting Mac OS, but unlike Flashback, this one is targeting a flaw in Office for Mac that was patched years ago.

Verizon Wireless, the largest carrier in the U.S., has signed an agreement with Cellcrypt, a provider of mobile encryption software, to market its offerings to the government. At present, the co-branded service is undergoing testing; it will be widely available this fall.

Senior officials within Iran’s Oil Ministry have said that they now know what the attacker’s hidden agenda was when they launched a cyber attack last month. However, they won’t say what it is exactly, because they are still investigating.

Oracle users should apply a workaround in lieu of a patch for a critical vulnerability revealed in a bug disclosure flap, security experts say.

There is more to the Flashback attacks than simply infecting computers. According to Symantec, a version of the malware targets Google in an advertising fraud scheme that could generate up to $10,000 a day in profits for the fraudsters.Symantec dubbed the variant Flashback.K. After some reverse engineering, the firm determined the malware is being used in a click fraud scheme designed to hijack clicks on legitimate Google ads and send them to websites that paid them to generate traffic.

Pindrop Security, a startup focused on combating phone-based fraud, today announced that it has closed a $1 million seed round of financing, coming from a sizable pool of investors that the company says will be used to grow its customer base and expand product development.

USB-based Threats Persist Despite Years of Software Updates

By Identifying Areas of High Risk Across the Entire Infrastructure, Countermeasures Can be Implemented Where They’re Needed Most.

Attack Traffic Originating from The United States Jumped Nearly 37% in Q4 2011, Says Akamai Report.Internet infrastructure giant Akamai Technologies, released its Fourth Quarter, 2011 State of the Internet report on Monday which provides insights into global statistics including Internet penetration, mobile traffic and data consumption, connection speeds, and Internet attack traffic.

Attackers have updated the Flashback Trojan targeting Macs to use Twitter as a command and control mechanism, security researchers have found.