BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Filter:

October, 2011

patch-tuesday

Microsoft Patch Tuesday – October 2011

Posted October 11, 2011    Chris Silva

Welcome to another exciting episode of Patch Tuesday, where Microsoft has released a total of 8 bulletins concerning 23 CVEs. 2 bulletins are rated as critical, mostly covering issues within Internet Explorer, while the rest are not as riveting.

guy tie

Insiders Run Rampant in Healthcare and Financial Services Industries

Posted October 11, 2011    Peter McCalister

Most consumers don’t blink an eye when they’re asked to provide their social security number to a healthcare or banking professional. We place complete trust into the hands of these individuals, yet employees within financial services and healthcare industries perhaps are the most notorious for snooping and disclosing sensitive information.

img-android

Android Handset Makers – Adding Value or Vulnerabilities?

Posted October 10, 2011    The eEye Research Team

So many things in life can cause perception to over take reality and one great example of that is as it relates to Google’s Android security. Android itself is a very robust and security minded operating system backed by one of the best security research teams in the business. One of the big things that…

Tags:
, ,
Intentional Harm

Speaking of Human Nature, Desktop Computing And Least Privilege

Posted October 10, 2011    Peter McCalister

Indeed, people are known to behave differently inside and outside of the office, where the culture is different. Lines between professional and home life become blurred, and people take the suit off at home, log in in their shorts, but that doesn’t mean they should take their corporate hat off, as well. But what is the answer? Eliminating administrator rights without allowing for the elevation of certain job-necessary privileges is not the answer. Locking down a system is like asking everyone to raise his or her hand to go to the bathroom, – it shows the downside of mistrusting human nature.

opera

Opera Browser SVG Layout Memory Corruption

Disclosed October 10, 2011    No Patch Available
Vendors: Opera Software
Vulnerability Severity: High
Exploit Impact: Remote Code Execution
Exploit Availability:
it hell

Least Privilege And The 9 Circles Of IT Hell

Posted October 7, 2011    Peter McCalister

Anybody remember the classic works from their college reading curriculum? Specifically today’s blog will reference an epic poem considered by many to be one of the greatest in world literature: Dante Alighieri’s “Divine Comedy”. Now you might be asking what does Dante’s nine circles of hell have to do with least privilege and why should…

Abstract clockwork

Governance, Risk, and Compliance- Cogs of Security Clock

Posted October 5, 2011    Peter McCalister

Enterprise security, as I’m sure all of you are aware of, is complex. There are a lot of differentfacets and initiatives, and they all fit together in a very intricate and complicated way. The image of a clock, with all those little gears moving together, is how I picture a healthy security program in any given organization. But to think of security objectives like cogs in a clock begs the question of where is the IT parallel? What cogs are crucial to making the clock tick and which ones aren’t? I submit that the governance, security, and compliance mechanisms are the most significant. With these cogs, you set the pattern for security in your enterprise.

galileo

The Road To The Truth About Insider Threats

Posted October 4, 2011    Peter McCalister

New research from the Ponemon Institute was released this week, indicating that the majority of executives have a ways to go before they discover the staggering truth about the dangers of insider threats. The study says only 16 percent of respondents indicated that CEOs and other C-level executives acknowledge the dangers of insider fraud as significant. This statistic is a little shocking, given the volume of news stories published on an almost daily basis involving insider threats and the staggering financial effects they can have on an organization.

irene2

It Must Be Bad If The Wall St. Journal Is Reporting On It

Posted October 3, 2011    Peter McCalister

What is the “it” that must be so bad? What did the Wall St Journal report as “What’s A Company’s Biggest Security Risk? You.” That’s correct… everything we have been blogging about for the last year was boiled down by Geoffrey Fowler in the subhead of the article of September 26, 2011: “Employees don’t mean…