BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Have the Feds Stumbled Upon a Global Cybersecurity Predicament?

Posted November 18, 2010    Peter McCalister

The Department of the Interior Inspector General has issued a report that is critical of the agency’scybersecurity performance, summarizing that its efforts fall short of the federal government requirements.  For example, the security levels of certain types of IT systems were not categorized correctly.

This was true for the U.S. Geological Survey who originally determined that it did not have any mission-critical systems, but the Department’s report illustrates that this is not true because this agency’s operating systems handle earthquake monitoring and research, as well as toxic substance analysis.

Cybersecurity covers a broad, yet dynamic area of government and private business; however, this report should give every CIO a moment to pause. According to the latest edition of the Kroll Annual Global Fraud Report, incidence of theft of information and electronic data at global companies has overtaken physical theft for the first time, according to a study released yesterday.

Theft of confidential information is on the rise because data is increasingly portable, access to such data is easier, and perpetrators — often departing or disgruntled employees — can remove it with ease absent sufficient controls. Controlling privileged access  and centrally managing security policies over critical data stored on UNIX, Linux, Mac or Windows platforms is the first step in solving this crisis. The Interior’s report outlining needs within their agency should serve as a warning for every enterprise to assess their IT network and cybersecurity performance.

Leave a Reply

Additional articles

6

A Quick Look at MS14-068

Posted November 20, 2014    BeyondTrust Research Team

Microsoft recently released an out of band patch for Kerberos.  Taking a look at the Microsoft security bulletin, it seems like there is some kind of issue with Kerberos signatures related to tickets. Further information is available in the Microsoft SRD Blogpost So it looks like there is an issue with PAC signatures.  But what…

Tags:
, , , ,
Password Game Show

Managing Shared Accounts for Privileged Users: 5 Best Practices for Achieving Control and Accountability

Posted November 20, 2014    Scott Lang

How do organizations ensure accountability of shared privileged accounts to meet compliance and security requirements without impacting administrator productivity? Consider these five best practices…

Tags:
, , , , , ,
Triggering MS14-066

Triggering MS14-066

Posted November 17, 2014    BeyondTrust Research Team

Microsoft addressed CVE-2014-6321 this Patch Tuesday, which has been hyped as the next Heartbleed.  This vulnerability (actually at least 2 vulnerabilities) promises remote code execution in applications that use the SChannel Security Service Provider, such as Microsoft Internet Information Services (IIS). The details have been scarce.  Lets fix that. Looking at the bindiff of schannel.dll, we see a…

Tags:
, , , , ,