Security Best Practices: Archive: October 2002

Putting 2,400 Security Experts In A Box

A unit of Ernst & Young is migrating its security vulnerability scanning service to a product format, with an appliance that can alert users to systems and applications that are subject to exploitation by known vulnerabilities.

META Paints (Relatively) Rosy Security Spending Picture

While companies decreased overall IT spending by an average of just over 3% in 2002 compared to 2001, they increased expenditures for security software, according to a META Group study.

Holey Microsoft!

Redmond issues three security alerts to spackle holes in its Point-to-Point Tunneling Protocol, Windows 2000 platform and versions of the Internet Information Server.

Pressure Grows For IT Security Pros

IT and security administrators have a big job ahead of them in 2003, with analysts predicting they'll have to stay on top of system patches and merge their technical efforts with straight-up business thinking -- all under the tight constraints of a flat IT budget.

NIST Releases Draft Security Guidelines

Plan seeks to give U.S. agencies a 'sound, risk-based' system for complying with OMB policy.

DoS Bug Found in Oracle9i App Server

Security consultants @stake has discovered a vulnerability in the Oracle9i Application Server that could lead to Denial of Service (DoS) scenarios.

Spam Law Foe Reverses Direction

After testifying against anti-spam legislation, Direct Marketing Association now wants help from Washington.

Mapping the Lack of Security

Look both ways when crossing the streets this week: the second WorldWide WarDrive is going on in major cities around the world as WLAN security activists drive around to expose the large number of unencrypted access points.

Viruses, Worms Up The Ante

Security analysts are warning corporate administrators to stay vigilant and keep their software patched and up-to-date as viruses and worms continue to grow in sophistication and potential for damage.

Massive DDoS Attack Hit DNS Root Servers

The 'ping-flooding' attack interrupted Web traffic on nine of the 13 DNS root servers but experts dismissed the overall threat as 'minimal.'

Another 9 Exploits Found in IE

A week after finding a serious flaw in Internet Explorer versions 5.5 and 6, GreyMagic found another vulnerability, this time in the browser's caching object script.

Web Vandalism on the Rise

The danger, according to the Web site tracking defacements around the world, is that hackers who have access to the Web page likely have access to a company's entire network.

SQL Server Privilege Level Flaw Fixed

UPDATE: An intruder could use the flaw to elevate privilege levels and make unauthorized changes; Two other patches are issued for flaws in MS Word, MS Excel and Windows XP.

Firm Reports New Internet Explorer Flaw

UPDATE: GreyMagic Software details an Internet Explorer browser flaw that lets attackers steal cookies from any site, forge content, read local files and execute arbitrary programs.

Outlook Express Bug; MSN IM Worm Detected

Microsoft issues a fix for a flaw in the Outlook Express S/MIME parsing functions.

3Com Rolls Out NIC-based Firewall For Laptops

3Com Corp. announces a new version of its embedded firewall for laptop and notebook PCs, and enhancement of its existing desktop and server versions with virtual private network support.

CERT: Sendmail Hacked

Copies of the Sendmail source code have been hacked and now contain a Trojan horse.

Privacy Groups Gun For Amazon...Again

Twelve state Attorneys General are being asked to force a change to e-commerce giant's controversial privacy policy.

Verisign, IBM Web Services Security Pact Bears Fruit

UPDATE: The technology firms launch their first set of security services and software for electronic business.

Apache Fixes Bugs in Server Upgrade

Fixes to three security vulnerabilities and several new features have been added to the latest release of the Apache HTTP Server.

Should You Hack Your Own Network?

Whether it's a hacker on the outside, or the Bugbear virus inside, your network is constantly being probed for vulnerabilities. If there are holes in your security, you should find them -- before the bad guys do.

Information Theft Reaches Estimated $59 Billion

A new report shows that U.S. corporations lost $59 billion in proprietary information and intellectual property in the past year, though experts say that number is 'very conservative.'

Two New Epidemics Wreck Havoc On PCs

Watch out for new viruses, 'Opasoft' and 'Tanatos', which have been wrecking havoc on PCs since early this week.

Network Vulnerabilities Surge In Q3

There was a 65% increase in network vulnerabilities in the third quarter of this year compared to the same time last year, according to a new study from Internet Security Systems.

'Critical' Windows Help, SQL Flaws Patched

Microsoft plugs 'critical' security holes in the Windows HTML Help facility and the SQL Server products.

New List Of Network Dangers A Useful Tool

Security experts are hoping the just-released list of top network vulnerabilities will help corporate administrators besieged and overwhelmed by the weekly deluge of risks and vulnerabilities.

Washington to Host Open Source Security Summit

Gathering to examine critical enterprise security issues and open source solutions.

Bugbear/Tanatos E-mail Worm Detected

A mass-mailing worm with keylogging and potentially dangerous backdoor capabilities is squirming in the wild.