BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Filter:
apple

Apple Mac OS X Keychain Certificate Security Bypass

Disclosed September 2, 2011    Fully Patched
Vendors: Apple
Vulnerability Severity: Medium
Exploit Impact:
Exploit Availability:
Categories:
Zeroday Tracker

Appliance, Software, or SaaS: Choosing the Best Deployment Option

Posted September 1, 2011    Morey Haber

Businesses tend to prefer appliances or software for new solution deployments. There are many reasons why from ease of deployment, to complete ownership of the host and the application.  Unfortunately, sometimes departmental whims are not always the best solution for the company. There are several factors from deployment to security policies that may warrant a…

Categories:
General, Vulnerability Management
goldie locks cover

Goldie Locks And The 3 Least Privilege Desktops

Posted August 31, 2011    Peter McCalister

It’s always fun to catch our competitors pointing to BeyondTrust educational materials as shining examples of the value for least privilege, and recently it came to my attention that just that has occurred yet again.

Categories:
Privileged Account Management
dave2

Red Flags Are Not Enough to Thwart Insider Attacks

Posted August 30, 2011    Peter McCalister

KPMG recently released a report titled, “Who is the typical fraudster?,” indicating that companies were not seeing the red flags when it came to insider threats. According to KPMG’s analysis of 348 cases across 69 countries from 2008 to 2010 that they investigated on behalf of its clients, the typical “fraudster” is described as:

Categories:
Vulnerability Management
cloud

Mid-Market Security and Risk Management

Posted August 30, 2011    Morey Haber

I find it utterly amazing that security vendors believe that one size of product and solution can fit in any size organization. Some have had even major summer releases that address scalability and performance in this one-product- fits-all approach. Point and shoot scanners as standalone products can operate in any size environment, but without a…

Categories:
General
DeLorean-on-ebay

Why Back to the Future Doesn’t Help Corporate Security

Posted August 29, 2011    Peter McCalister

I was recently at a convention where the DeLorian (the real one from Back to the Future!) was on display. With the doors up and open, the lights flashing, and the radio blaring, it took me right back to the movie and how awesome it would be if we could do what Marty McFly did. Although inadvertently, he went back in time and was able to influence actions and decisions that significantly improved his future. It would be awesome to go back, alter some pivotal decisions in my life, nip some bad habits in the bud, and make my future that much better. But personal life aside, think of how impactful it would be if companies were allowed to do the same.

Categories:
Security Research
PBIS-resized-600

1999 Called, It Wants Its Morto Worm Back

Posted August 28, 2011    Marc Maiffret

I had to do a double take on my Google Alerts this weekend when I saw the first of discussions around a worm dubbed “Morto” infecting systems via weak password brute forcing of Windows accounts over the Remote Desktop Protocol (“RDP”). These automated worms take me back, to the old days of CodeRed, Slammer, Sasser,…

Categories:
Vulnerability Management
Tags:
, ,
i-see-dead-people

I See Dead People- and All Database Activity

Posted August 26, 2011    Peter McCalister

Remember The Sixth Sense, that movie where Haley Joel Osmond’s character can see ghosts are if they were living people? It’s an interesting premise to give a character such a unique and special capability- to see and communicate with ghosts, whether benign or hostile, is clearly something out of the ordinary. Knowledge is power, and…

Categories:
Vulnerability Management
android4.2

HP TouchPad Frenzy — Another Reason to Put Security in Context

Posted August 26, 2011    Marc Maiffret

I recently watched IT administrator mailing lists buzzing with conversations about where everyone could buy an HP TouchPad – with the almost free price, now that HP has discontinued the product. It was not only IT people looking to cash in on the sweet deal, but consumers also, which means employees (maybe at your company!), who…

Categories:
Vulnerability Management
cloud sec

2 Reasons Not To Build New Cloud Security Infrastructure

Posted August 25, 2011    Peter McCalister

Last week I talked about the challenges of managing privileged identities in the cloud. As I have highlighted in an earlier post the recent report by the Ponemon Institute on the Security of Cloud Computing Providers shows that when it comes to security cloud providers are “least confident in their ability to restrict privileged user access to sensitive data”.

Categories:
Vulnerability Management