Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.


Security Research


Microsoft Patch Tuesday – April 2011

Posted April 13, 2011    Chris Silva

Well, Microsoft is nothing if not predictable these days. After a nice, light March, they dropped a ton of security bulletins this month – 17 to be exact. That ties their record set just a few months ago (back in December 2010), and gives them a total of 34 so far this year. Today’s release…


Talking Ninja Monkey Hacks Android

Posted March 10, 2011    Peter McCalister

No, we are not talking about a new John Carpenter movie or tabloid headline, although this is the headline I would love to see. The real headline is that hackers found a way to hijack root for Google Android and injected malware into 21 applications.


What Do You Think About VEF?

Posted March 9, 2011    The eEye Research Team

Please use the “Leave a Reply” function below and tell us your comments, thoughts, and suggestions about VEF. – One person will be selected at random to win a new Amazon Kindle and $25 gift card – Deadline to be entered into the VEF contest is Friday 03/11 at noon PST. – Please note that all…


Microsoft Patch Tuesday – March 2011

Posted March 8, 2011    Chris Silva

Before I get started today, I want to first point out that tomorrow’s Vulnerability Expert Forum (VEF) will be at a new time – 1PM PST. Sign up to hear what Marc Maiffret and the eEye Research team have to say about today’s security bulletins and other security related topics. For this Patch Tuesday, Microsoft…


Does Compliance = Security?

Posted February 15, 2011    Peter McCalister

Since it’s hard to analyze the tradeoffs between security and productivity, IT organizations can fall back on gut feel, rules of thumb and past practices in making these decisions. The easiest answer is frequently to just follow the rules and regulations so you remain in compliance with industry regulations or current policies. As a result, compliance becomes a substitute for security. But are they really equal? Does being in compliance mean you have a secure IT environment?


Microsoft Patch Tuesday – February 2011

Posted February 8, 2011    Chris Silva

Microsoft is back at it with a fairly large release today, including 12 security bulletins which patch a total of 22 vulnerabilities. Six of the bulletins address zero-day vulnerabilities (MS11-003, MS11-004, MS11-005, MS11-006, MS11-011, and MS11-013) including two (MS11-003, MS11-006) that have public exploit code circulating. MS11-013 (Kerberos) is most likely similar to vulnerabilities that…


There is No Patch For Stupidity

Posted January 24, 2011    Peter McCalister

No, I’m not talking about a Boy or Girl Scout patch (or merit badge) now awarded for making dumb errors with information technology at work. I’m referring to the ever present vendor tech support cry of “just install the patch” whenever something goes wrong.

Tell Us Your Patch Tuesday Story!

Posted January 12, 2011    The eEye Research Team

Please use the “Leave a Reply” function below and tell us your Patch Tuesday story for a chance to win a new Amazon Kindle and $25 gift card. Deadline to be entered into the VEF contest is Friday 1/14 at noon PST. Please note that all email/contact info will be kept private from public view,…

Microsoft Patch Tuesday – January 2011

Posted January 11, 2011    Chris Silva

The ebb and flow of Microsoft Security Bulletins continued this month, with a nice slow release of only two bulletins to follow up the record set in December. Unfortunately, neither of these two bulletins patched any of the zero-day vulnerabilities that are currently affecting Microsoft products. Microsoft continued to patch DLL preloading vulnerabilities, this time…


Microsoft Patch Tuesday – December 2010

Posted December 15, 2010    Chris Silva

To make up for a relaxing November, Microsoft unleashed 17 security bulletins today. That puts their 2010 total at 106 bulletins (unless they release an emergency out of band patch before the end of the year). This is a record for Microsoft – their previous high was 100 bulletins way back in 2000. It is…