BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Filter:

August, 2011

smartphone4-resized-600.jpg

It’s an Insecure Mobile World Without Least Privilege

Posted August 23, 2011    Peter McCalister

It’s hardly a stretch in this day and age to say that every one of your employees has a mobile device, whether it is company issued or personal, but either way these devices can be the culprit of accidental insider threats more easily than ever before.

Break in

Enterprise Security and Risk Management

Posted August 23, 2011    Morey Haber

Searching the internet finds a plethora of definitions, services, products, solutions, and even training classes for Enterprise Security and Risk Management. The topic is so broad that almost every security vendor falls into this category. At the middle of almost all the definitions (excluding physical security theft) is the protection of an organizations most treasured…

rockybalboa

Enterprise Security Lessons from Rocky Balboa

Posted August 22, 2011    Peter McCalister

It’s amazing the effect songs have on us. Take, for example, Eye of the Tiger. If you’re like me, this brings you right back to Rocky, the Italian Stallion that won the hearts of America as he trained and fought his way to victory. That song elicits images of strategy and dedication, the two key traits to Rocky’s success. Why, you ask, do I bring this up here, on an Information Technology blog? Because the same elements that drove Rocky to success in the movie can ensure a data security victory in your IT environment.

adobe

Adobe Flash Clickjacking Vulnerability

Disclosed August 20, 2011    Fully Patched
Vendors: Adobe, Google
Vulnerability Severity: Medium
Exploit Impact:
Exploit Availability:
cloudlock1

The Value of Attack and Malware Data in Prioritizing Remediation

Posted August 19, 2011    Morey Haber

Here at eEye, we’ve been discussing in great depth, the value of various risk scoring mechanisms, attack vectors, and exploit intelligence. Considering all the various standards that are being used to derive risk scores (proprietary, CVSS, PCI (based on CVSS with conditions), DoD Categories, etc.) and how organizations are currently prioritizing remediation efforts, we found a…

annie

Accident Prone Annie Requires New Policies For Control

Posted August 19, 2011    Peter McCalister

I introduced you to Accident Prone Annie as an archetype for the type of insider villain who may already be infiltrating your extended enterprise a couple of weeks ago and guess what? Almost every day I see an article that represents “Dave” as manifesting in another company with some measurable harm that was newsworthy.

apache

Apache httpd Remote Denial of Service (Memory Exhaustion)

Disclosed August 19, 2011    Fully Patched
Vendors: Apache Software Foundation
Vulnerability Severity: High
Exploit Impact: Denial of Service
Exploit Availability:
cropcircle

Is Public Cloud Security As Mysterious As Crop Circles?

Posted August 18, 2011    Peter McCalister

There are many of you out there who have seen pictures of crop circles and believe that they are truly a mystery that no one will ever get to the bottom of. For those of us in the information security field, I think we are starting to believe that the key to security in public clouds may be as elusive as the secret to crop circles.

dave2

Disgruntled Dave Snoops Your Healthcare Records

Posted August 17, 2011    Peter McCalister

I introduced you to Disgruntled Dave as an archetype for the type of insider villain who may already be infiltrating your extended enterprise a couple of weeks ago and guess what? Almost every day I see an article that represents “Dave” as manifesting in another company with some measurable harm that was newsworthy.

MMPC

Why Less is More with Admin Rights

Posted August 16, 2011    Peter McCalister

A recent blog post at Microsoft Malware Protection Center warns that disabling the User Account Control (UAC) tool increases the likelihood of malware threats. According to Microsoft’s Joe Faulhaber who published the entry, the Sality virus family, Alureon rootkits, Rogue antivirus like FakePAV, Autorun worms, and the Bancos banking Trojans all have variants for turning UAC off.