Security Beat: A monthly review of new security technologies

Conventional perimeter firewalls shouldn’t compromise high-speed flows, according to a recent report by Educause, a US-based non-profit association whose mission is to advance higher education by promoting the intelligent use of IT. Here in Canada, CANARIE is working with its regional optical networking organizations to address this problem. Bill St. Arnaud, CANARIE Inc.’s chief research officer and a member of the Telemanagement advisory board, says CANARIE has helped ensure both security and fast speeds by extending the backbone optical network to a number of individual labs on various campuses across Canada. “In some cases we have even installed backbone ROADM (reconfigurable optical add-drop multiplexer) equipment right on campus to allow researchers access to potentially hundreds of lambdas,” he explains. “To do this we had to extend dark fibre connections across the campus, bypassing the campus network, from the local regional and/or CANARIE POP. This is necessary not only for high end users, but also health and government data users who are subject to HIPAA requirements.” HP releases application security software Hewlett-Packard (HP) has announced major new releases of its application security software. New offerings include: the HP Assessment Management Platform, a web application security testing platform; HP WebInspect, which helps customers analyze complex web applications; and HP Software-as-a Service (SaaS) Project Services for Application Security Center, which helps customers implement their application security initiatives with a solution maintained and managed by HP. Gardien Virtuel is the first Canadian company certified ISO 27001 Gardien Virtuel Inc, an IT security consultancy firm headquartered in Laval, Québec, announced that it has received the ISO/CEI 27001 certification, becoming the first such company in Canada to receive the distinction. The certification audit was performed by the Canadian branch of Swiss organization SGS S.A. (Societe Generale de Surveillance). Published in 2005, the ISO 27001 certification strictly concerns IT security and describes the corporate compliance requirements that the applicant must adhere to when implementing an Information Security Management System (ISMS). SecPoint releases PortablePenetrator 6.6 Danish IT security company SecPoint ApS’s has released is Portable Penetrator 6.6, which “combines all of the latest hacking and cracking tools to offer the most comprehensive penetration testing kit available.” The new release cracks wireless networks 300% faster, allowing customers to perform real-life hacking attacks on their own networks, including breaking the security of their Wi-Fi networks. Users of the Penetrator can launch real exploits to verify that an identified vulnerability is exploitable, including Denial of Service attacks to test pre-production systems for stability. Qualys says one in five Windows PCs still at risk for Conficker... The April 1st Conficker threat resulted in increased vulnerability scanning within organizations. Scans of more than 300,000 Windows PCs owned by customers of Qualys Inc show that patching of the MS08-067 vulnerability – a bug that Microsoft Corp fixed with an emergency update issued in October 2008 – picked up dramatically. But despite the additional attention Conficker and the MS80-67 bug received, about one in every five PCs scanned by Qualys remains unpatched. Qualys’ scans also revealed that approximately 5% of the scanned PCs pinged were infected with one of the four Conficker variants. ...And beware the Conficker worm swindlers The ingeniously programmed Conficker worm has – so far – limited itself to mostly defensive actions: on April 1st, when Conficker.C was supposed to start looking for updates, virtually nothing happened. But now Conficker is a business: computers infected with the Conficker worm are downloading the scareware program SpywareProtect2009, and fraudsters are making money with other scareware products like Antivirus 2009, Malwarecore, WinDefender, WinSpywareProtect, and XPDefender. These scams run a small injected program that displays pop-up messages warning that a PC is infected. Users can sometimes be persuaded to pay for these fake anti-virus products, and in some instances the purchased software loads malware on to a PC, turning it into a zombie computer, or bot. AVG offers free LinkScanner for real-time web page scanning AVG Technologies is now offering a free version of its LinkScanner software, which offers real-time scanning of web pages while surfing or doing web searches. LinkScanner, which is currently part of the AVG Free Edition suite, scans a web page before a surfer visits and warns if the page appears to be unsafe. AVG LinkScanner also offers safety rankings for all organic search results on Google, Yahoo, and MSN. Safe pages in searches will have green check marks next to them and unsafe ones will have red Xs and pop up windows offering more explanation. AVG LinkScanner scans bookmarks as well as links in e-mails and instant messages before they are opened. Cisco expands security services into the cloud At the RSA Conference in San Francisco, Cisco Systems announced new additions to its portfolio that bolster network security infrastructure and the delivery of cloud security services. The company unveiled a new software-as-a-service (SaaS) architecture and enhancements to its SaaS-based Cisco WebEx collaborative applications. Cisco is now extending the cloud into the enterprise network infrastructure through the Cisco WebEx Collaboration Cloud and the Cisco ASR 1000 Series Aggregation Services Routers.

Security Beat: A monthly review of new security technologies

News | 04/30/2009 2:05 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us