Saturday 26 July 2014 at 9:21 pm
A long time between posts again.
People write about some interesting stuff -
How the Presidents Blackberry is secured, and from the same site,
How Air Force Ones phones work.
Saturday 25 October 2008 at 6:59 pm
So apart from
running out of fresh water, Australia appears to be about to implement its own
Great Firewall just like
China.
So i suspect things like
TOR, private VPN and external public Proxies are going to become really popular.
On a related note the
UK seems to be going surveillance mad - so 'Go
Banksy!'
Friday 16 May 2008 at 7:20 pm
A must read if you're a interested in IT security -
Exploiting Network Cards.
Be afraid if you run a firewall on x86 hardware!
Monday 30 October 2006 at 4:08 pm
Some well thought out security guides from the Universty of Texas:
Also if you're looking for guidelines or templates to formulate your own IT Policy they have some excellent documents:
Thursday 19 October 2006 at 12:24 pm
Nifty browser tool (IE & Firefox) -
McAfee SiteAdvisor - installs and tells you wether a site is 'good' or 'bad' based on the amount of mail you'll get if you sign up for its services along with the sites affiliates, downloaded cookies and reviews. It also parses search engine results and provides a summary for each hit relating to wether its a good or badly behaved site.
Pretty cool. Possibly a must-have for all home and corporate browsers.
You do wonder if it reports back on your browsing habits to McAfee ? Also how long will it remain free ?
Tuesday 19 September 2006 at 09:53 am
The people over at
TinyApps always point to good stuff.
Two recent security related posts from them -
*
SecureRDP is a free tool to add an extra layer of security to RDP. You can accept/deny incoming RDP connections by IP, Mac address or Host name. Handy for locking down server administration only to admin PC's.
* TinyApps points to
SSLExplorer which is an open-source SSL VPN solution. A two part setup guide is available form Toms Hardware -
part 1 and
part 2. Looks like a really really handy way of offering secure access to a small internal LAN without having to roll out a full IPSec based VPN solution.
Monday 28 August 2006 at 09:58 am
Endpoint Security checking is going to be huge as more and more people start connecting into their corporate LAN's remotely (actually even in a wired LAN its pretty important given the proliferation of trojans, spyware and malicious hackers).
Essentially EP lets the network administrator define certain conditions that must be met before being able to participate on the corporate LAN. In some case the tools will even allow direct you towards a quarantined location which will explain why the connection was refused and assist you to rectify the problem. For example an EP tool can direct an authorised client that fails post-connection criteria to a web page with links to security patches, antivirus software and firewall tools - it can even offer up different LAN access profiles (eg webmail or terminal services but not a direct connection).
* Wikipedia on
Endpoint Security
* Wikipedia on
Checkpoint Integrity a centralised EP system
* Nice flowchart tool to design EP access control for
Firepass
* Flash Demo of
CheckPoints Interspect appliance - actually more of an IDS/IDP (Intrudion detection sensor / Intrusion detection and prevention) system which works hand in hand with end-point solutions
* McAfee have their
Host Intrusion Protection (PDF) system which integrates into their ePO framework
* Juniper have a cool
Flash Demo of their IDP product (unfortunately you need to register to see it)
* ISS (who've been
bought out by IBM) have
Proventia - it looks like they also bought Black Ice Defender (fyi - Checkpoint bought Zone Alarm)
Security seems to be a serious growth industry given the trail of acquisitions and mergers in the small group of companies listed above.
Endpoint solutions seem to rely heavily on application and system profiling - if the app hasn't been approved or doesn't comply with a known checksum it won't run. This means someone needs to keep a constant eye on what applications and patches are likely to be installed and approve them before the endpoint solution takes remedial action. Ideal for a restricted environment but trickier for a more open environment.
Simple options that can be implemented immediately (without spending on new tools) include:
* ensuring appropriate desktop access
* centrally managed anti-virus / patching / desktop policy restrictions
* mac address restrictions on dhcp / switch ports (depends on the mobility of the client)
Friday 21 July 2006 at 10:42 am
Came across
Stratagaurd and
OSSIM - Open Source Security Information Management which both offer VMWare images for their tools.
I'll have to try them out and see what they offer.
Wednesday 14 April 2004 at 8:11 pm
The
Sleuthkit lets you carry out an 'exam' on a comprimised or suspect system.
Dana Epp has written about performing a forensic exam on a
comprimised Linux system.