Problem solve
Get help with specific problems with your technologies, process and projects.
Problem solve
Get help with specific problems with your technologies, process and projects.
XSSer demo: How to use open source penetration testing tools
In this video demo, learn how to use XSSer, open source penetration testing tools for detecting various Web application flaws and exploiting cross-site scripting (XSS) vulnerabilities against applications. Continue Reading
How to refine an enterprise database security policy
Noel Yuhanna of Forrester Research outlines what should be covered in a successful enterprise database security policy, including foundational security, preventative measures and intrusion detection. Continue Reading
Adobe Flash alternatives: The best way to avoid Adobe Flash malware?
It's no secret that Adobe Flash is plagued with malware, so, do enterprises really need it? In this expert response, Nick Lewis discusses how you can weigh the importance of functionality and security when it comes to Flash. Continue Reading
-
Web 2.0 security threats and how to defend against them
The collaborative nature of Web 2.0 introduces myriad threats to data that must be proactively countered. Continue Reading
Self-service user identity management: Pitfalls and processes
While it might seem that self-service user identity management can save time and money, as well as keep information more current, there are a number of potential pitfalls. In this expert tip, Randall Gamby explains how to avoid these issues. Continue Reading
A PCI compliance network testing checklist to limit PCI DSS scope
Network security pros may not realize it, but they may inadvertently be on the hook regarding PCI DSS compliance if card data is inadvertently spread across the network. Ed Moyle discusses how this happens and how to make sure the network falls out ...Continue Reading
Identity management federation best practices
Outsourcing is necessary in the financial industry, but establishing secure partner communications can be difficult. Learn some best practices for implementing identity management federation.Continue Reading
How to use NeXpose: Free enterprise vulnerability management tools
Learn how to use NeXpose Community Edition, a free collection of vulnerability management tools that offers pre-defined scan templates, and the ability to scan networks, OSes, desktops and databases.Continue Reading
What does the Stuxnet worm mean for SCADA systems security?
SCADA systems have been highlighted in recent months for their insecurities, perhaps most notably with the release of the Stuxnet worm targeting them directly. But is the Stuxnet worm unique, or simply a sign of SCADA insecurity? Learn more in this ...Continue Reading
Unmasking data masking techniques in the enterprise
Patch-testing and development environments can't use live data and keep it secure. That's where data masking comes in. Michael Cobb examines the principles behind data masking and why security pros should endorse its use in order to keep production ...Continue Reading
-
Creating a third-party security policy to prevent a software exploit
Third-party software vulnerabilities are one of the most likely attack vectors in the information security landscape today. In this expert response, Nick Lewis discusses how to prevent these vulnerabilities from becoming exploits.Continue Reading
How to find a keylogger on your computers
If a hardware or software keylogger made it on to one of your organization's machines, it would be a security pro's worst nightmare. Learn how to detect and defend against the malware.Continue Reading
Prevent a privilege escalation attack with database security policy
Privilege escalation attacks are dangerous wherever they occur, but can be particularly harmful if run in a database. Learn more from threats expert Nick Lewis.Continue Reading
Monitoring strategies for insider threat detection
Insider threat detection is a vital part of the security of any enterprise organization. In this tip, part of the SearchSecurity.com Insider Threats Security School lesson, learn about the best insider threat detection strategies.Continue Reading
Mobile banking risks and mitigation measures
Mobile banking is taking off, but can financial firms keep up with the risks? Learn about steps Wells Fargo and Bank of America are taking to ensure mobile banking security.Continue Reading
Fake antivirus pop-up scams: Forming a security awareness training plan
Rogue antimalware programs have been around for a while, and, according to a recent Google report, are more prominent and more difficult to detect than ever before. In this expert tip, Michael Cobb explains how to train employees to deal with these ...Continue Reading
Role-based access control: Pros of an open source RBAC implementation
There are many advantages to an open source RBAC implementation. However, it's important to know the context in which such a product will work best. In this tip, expert Randall Gamby discusses how to determine if open source RBAC is right for you.Continue Reading
Email, website and IP spoofing: How to prevent a spoofing attack
Find out how to prevent spoofing attacks, including IP spoofing, email and website spoofing.Continue Reading
Operating system comparison: The Windows OS security debate
The security debate between Linux, Mac OS X and Windows got even more heated when Google ended its internal use of Windows. Tom Chmielarski explains when an organization may (or may not) be ready for a change in operating systems.Continue Reading
Data masking best practices for protecting sensitive information
Protection of customer data is critical for financial services firms but encryption isn't the only option. Learn key considerations for data masking.Continue Reading
FTP security best practices for the enterprise
FTP is easy and commonly used in the enterprise, but is it secure? Anand Sastry discusses its security shortcomings, best practices for securing FTP in the enterprise and FTP alternatives that may be even more secure.Continue Reading
Managing remote workers: Musts for setting up a secure home network
Is it the enterprise's responsibility to ensure that remote workers' home networks are secure? And, if so, how should they do it? Get expert advice from Nick Lewis.Continue Reading
Database application security: Balancing encryption, access control
Database applications are often the epicenter of a company's sensitive data, so security is paramount, but maintaining a balance between security and business use can be tricky. In this tip, Andreas Antonopoulos discusses encryption strategies for ...Continue Reading
How to avoid attacks that exploit a Web browser vulnerability
Beyond patching, Tom Chmielarski explains what you'll need to do to avoid application exploits caused by Web browser vulnerabilities.Continue Reading
How to use Wget commands and PHP cURL options for URL retrieval
When TCP or HTTP connections aren't behaving as expected, free tools like Wget and cURL can help with URL retrieval. Learn more in this expert response from Anand Sastry.Continue Reading
How to use Windows Group Policy to secure and restrict USB devices
Learn how to use Windows GPOs take control of USB devices in your organization.Continue Reading
How to use a PDF redaction tool with a redacted document policy
It may seem rudimentary, but sensitive data commonly leaks out of corporate networks in plain sight in the form of un-redacted documents. Such files -- those still containing hidden data or Microsoft "Track Changes" data -- can potentially lead to ...Continue Reading
Alternatives to password-reset questions tackle social networking cons
With so much personal information available on the Internet, finding the answers to someone's password-reset questions can be quite easy. In this tip, learn about alternatives to the password-reset question option that can lead to more secure ...Continue Reading
Utilizing a hash function algorithm to help secure data
Learn how a hash function algorithm -- specifically a one-way hash function of the Dynamic SHA-2 algorithm -- can help protect important documents using a variety of hashes to confuse malicious code.Continue Reading
Why it's important to turn on DEP and ASLR Windows security features
In the quest for application security, many developers are disabling or incorrectly implementing two important Windows security features. In this expert response, Michael Cobb explains why ASLR and DEP should always be turned on.Continue Reading
What to include in a remote access audit
When conducting a remote access audit, there are specific questions you should be sure to ask to make sure everything is secure. In this expert response, Randall Gamby describes what to look for.Continue Reading
Will biometric authentication devices integrate with in-house software?
Biometric devices may provide an added level of security, but how much effort is required to integrate them with existing software and systems, particularly those systems custom made for an organization? Learn more in this expert response from ...Continue Reading
Web 2.0 widgets: Enterprise protection for Web add-ons
Web 2.0 widgets represent a threat vector that should not be overlooked at any enterprise organization. In this tip, Nick Lewis explains what a Web 2.0 widget is, and how companies can protect against them.Continue Reading
HIPAA covered entity and business associate agreement requirements
Under HITECH, both "covered entities" and "business associates" must comply with HIPAA data protection mandates, but, as a covered entity, what's the best way both to maintain compliance for your organization, and make sure all your BAs are ...Continue Reading
Free port scan: How to use Angry IP scanner
Scanning IP ports is a critical part of maintaining enterprise information security. In this screencast, Peter Giannoulis explains how to use the free tool Angry IP scanner for these port scans.Continue Reading
Buying an IPS: Decide which applications and protocols your IPS will protect
Application and protocol coverage varies in signature-, rate- and behavior-based intrusion prevention systems. Understanding the differences is crucial to your IPS investments. This is the third in a seven-part series.Continue Reading
How to test Windows operating system patches
Windows patch testing may be easy when it comes to applications like Outlook. Tom Chmielarski reviews how to test more difficult updates to the operating system.Continue Reading
How to set up Apache Web server access control
If you're hoping to allow or deny Apache Web server access based on IP address, check out this expert response from Randall Gamby.Continue Reading
Evaluating tools for online bank security
Criminals are hijacking online bank accounts with sophisticated bank Trojans but a variety of technologies promise online bank security. In this tip, Dave Shackleford examines the pros and cons of tools designed to thwart online banking fraud.Continue Reading
How to block port scan attempts on a public wireless network
Network security expert Anand Sastry explains how to block port scan attempts on a public wireless network at the host level.Continue Reading
Zeus botnet analysis: Past, present and future threats
The Zeus botnet isn't showing signs of fading. In fact, it now threatens a wider scope of organizations beyond the banking industry. Expert Nick Lewis offers a Zeus botnet analysis, looking at why it's been so effective, what it's doing now and how ...Continue Reading
Choosing smartphone encryption software for mobile smartphone security
If your enterprise users have smartphones, then your enterprise may need smartphone encryption. In this tip, expert Dave Shackleford describes what to look for in smartphone encryption software, from cost to management capabilities.Continue Reading
Endpoint fingerprinting: How to improve NAC security for 'dumb devices'
Many enterprises underestimate the potential security problems posed by "dumb devices" like network printers or IP phones. Forrester Research analyst Usman Sindhu explains how endpoint fingerprinting can be used as a NAC add-on to identify and ...Continue Reading
Your USB port management options
When it comes to managing USB ports, the choice is yours. Mike Chapple reviews your three best options.Continue Reading
How to perform an Active Directory security audit
As a security professional, you depend on Active Directory to provision users, but how secure is your implementation of AD itself? Learn how to perform an Active Directory security audit in this expert tip.Continue Reading
Secure OpenVPN config with PAM
Network security expert Anand Sastry explains the relationship between OpenVPN and TLS, and points out where to learn about using OpenVPN and PAM.Continue Reading
Enterprise PDF attack prevention best practices
Malicious PDF exploits are at an all-time high. Should enterprises dump PDFs altogether? Expert Michael Cobb answers that question and offers his key enterprise PDF attack prevention tactics.Continue Reading
OpenLDAP migration: OpenLDAP from an Active Directory schema
While integrating user provisioning products may seem like a lot of work, there are strategies to make it go smoothly. In this expert response, Randall Gamby describes how to incorporate OpenLDAP into an Active Directory schema.Continue Reading
The pros and cons of automated user provisioning software
Automated user provisioning software can offer many benefits to enterprises, but its high cost and labor-intensive implementation may mean it's not right for yours. IAM expert Randall Gamby addresses the topic.Continue Reading
Secure DMZ Web server setup advice
Network security expert Anand Sastry describes how to ensure a secure DMZ Web server setup involving network attached storage (NAS).Continue Reading
Identity management SSO security: Hardening single sign-on systems
Get information on how to harden single sign-on systems for greater security in this response from IAM expert Randall Gamby.Continue Reading
Biometric security technology: The safest types of biometric devices
Expert Randall Gamby explains which biometrics devices are most secure, and which could work best in your enterprise.Continue Reading
Static source code analysis tools: Pros and cons
Static source code analysis tools can greatly improve application security, but it takes knowledge and expertise to use them correctly. Expert Michael Cobb explains why.Continue Reading
Creating a security risk management plan format
Enterprises without a codified risk management plan are much more susceptible to threats. In this expert response from Ernie Hayden, learn how to create a risk management plan that covers all the bases.Continue Reading
What controls should be used to block social networking sites?
Find out what controls companies can use to block social networking sites.Continue Reading
Tips on how to remove malware manually
In this expert response, Nick Lewis explains how to remove malware manually, step by step.Continue Reading
Should black-box, white-box testing be used together?
Learn why black-box, white-box testing should be used together when searching for Web application code vulnerabilities.Continue Reading
Database activity monitoring (DAM) software deployment issues to avoid
Database activity monitoring software deployments can have their shortcomings. For example, issues with network monitoring and policy overload can impact compliance audits and database performance.Continue Reading
Which tools will help in validating form input in a website?
Find out how to validate form input in a website.Continue Reading
How to defend against a sync flood attack
Nick Lewis explains how to protect your organization from sync flood attacks.Continue Reading
MD5 security: Time to migrate to SHA-1 hash algorithm?
Many organizations have been replacing the MD5 hash algorithm with the SHA-1 hash function, but can the MD5 hash algorithm still be used securely?Continue Reading
FFIEC security requirements: Physical security management and logging
In this expert response from Ernie Hayden, learn about FFIEC security requirements for creating physical security logs.Continue Reading
How to manage compliance as Chief Information Security Officer (CISO)
When it comes to IT compliance management, creating an effective compliance program is one of many jobs of a Chief Information Security Officer (CISO). In this tip from security management expert Ernie Hayden, learn how to create such a program.Continue Reading
Penetration test methodology: Creating a network pen testing agreement
Network pen testing can be very useful when it comes to detecting vulnerabilities, but it's important to work with the IT department to prevent network downtime. In this expert response, learn how to draw up pen testing rules of engagement for ...Continue Reading
Using fuzzing for internal application security testing
Superstar security researchers often use fuzzing to find flaws in major vendors' applications, and you can use fuzzers to find vulnerabilities during internal software development. Expert Michael Cobb explains how.Continue Reading
Using a digital signature, electronic signature and digital certificate
While they may seem similar, a digital signature, electronic signature and digital certificate all have unique functions. In this IAM expert response from Randall Gamby, learn the differences and how each is used.Continue Reading
Conducting a user access review with a small information security staff
Has there been cutbacks on your company's information security staff? It would be easy for certain security tasks to fall through the cracks. Learn how to keep access controls tight without spending a lot of time or energy.Continue Reading
Privacy laws in the workplace: Creating employee privacy policies
Are your employees aware of their workplace privacy rights? More specifically, are they aware of what privacy rights they don't retain? Learn how to create effective employee privacy policies in this expert response.Continue Reading
HTML 5 features present new security risks
Find out why new HTML 5 features are going to represent a new opportunity for malware writers.Continue Reading
Create a data breach response plan in 10 easy steps
Having a solid data breach response plan in place can make the threat of a security breach less intimidating. In this tip, learn 10 steps to take that will lead to an effective data breach response plan.Continue Reading
Detecting kernel intrusion attacks through network monitoring
Learn how to detect kernel intrusion attacks by monitoring your network closely and thoroughly.Continue Reading
How to determine the net value of an asset for risk impact analysis
Asset valuation and impact analysis are two different but equally important aspects of risk analysis. Expert Ernie Hayden explains.Continue Reading
Employee compliance: Creating a compliance-focused workforce
If your security team is low on time and money, one of the best things you can do is recruit more people: an entire enterprise worth's. In this tip, learn how to engage corporate employees to be secure themselves and to help enforce compliance best ...Continue Reading
Proxy server security: Defending against DoS and other attacks
In this expert response, find out how to boost proxy server security in the enterprise.Continue Reading
Is the 3DES encryption algorithm the best choice for S/MIME protocol?
The triple DES encryption algorithm was originally designed for the S/MIME protocol, but is it still the best choice for encryption? In this expert response, Randall Gamby describes the advantages and disadvantages to using 3DES.Continue Reading
Creating a user account management policy to delete old accounts
If you're not deleting orphaned accounts, you may be leaving the door wide open to attackers. In this expert response from Randall Gamby, learn how to create an effective user account management policy for getting rid of old accounts.Continue Reading
Performing a security risk analysis to assess acceptable level of risk
No organization is ever completely without risk, but there are steps that can be taken to establish an acceptable level of risk that can be appropriately mitigated. In this tip, Michael Cobb explains how to perform a security risk analysis to help ...Continue Reading
Is an SMTP TLS certificate the same as an FTP SSL certificate?
Are all security transportation-level certificates (TLSes) the same, or are there different certificates for different protocols? In this expert response, Randall Gamby discusses SMTP and FTP certificates.Continue Reading
Is a touchscreen virtual keyboard good for keeping passwords secure?
Recently, touchscreen virtual keyboards have been showing up on sites as an added security measure. What are the pros and cons of these virtual keyboards, and are they capable of stopping keylogging?Continue Reading
SMS two-factor authentication for electronic identity verification
Tokens are no longer the only choice when it comes to OTPs and electronic identity verification. Learn about new two-factor authentication options involving SMS and mobile phones.Continue Reading
The difference between a digital signature and digital certificate
A digital signature and a digital certificate, while both security measures, are different in the ways they are implemented and what they are implemented for. In this expert response, Randall Gamby explains the difference.Continue Reading
Gap analysis methodology for IT security and compliance
If your enterprise is faced with multiple-standard compliance, having a set gap analysis methodology can save a lot of time and effort. Learn more in this expert response from Ernie Hayden.Continue Reading
How to configure IIS authorization and manager permissions
David Shackleford reviews authorization rules that will help you secure your IIS 7 Web server.Continue Reading
Operation Aurora: Tips for thwarting zero-day attacks, unknown malware
In December 2009, Google, Adobe and other companies were the victims of a damaging cyberattack called Operation Aurora. In this tip, expert Nick Lewis outlines the lessons learned from this attack, and how companies can avoid falling victim to ...Continue Reading
Using Windows software restriction policies to stop executable code
Software restriction policies are one way to prevent known malware and file-sharing applications from taking control of your network.Continue Reading
Creating a proactive enterprise security incident response program
Every organization should develop a proactive security incident response program to ensure that when an incident does occur, it can be handled quickly and efficiently. Contributor Marcos Christodonte II explains how.Continue Reading
Separation of duties: Internal user account controls
If your user account administration is dispersed among different departments, you might be looking into centralizing it. This can work, provided you have a trustworthy administrator and separation of duties controls.Continue Reading
SANS Top 25 programming errors: Application security best practices
Learn the SANS Top 25 programming errors and the best practices for application security.Continue Reading
DBMS security: Data warehouse advantages
Are there data warehouse advantages in regard to security? Without question. Michael Cobb explains.Continue Reading
OpenOffice security: Concerns when moving from Microsoft Office
What are the major OpenOffice security concerns when transitioning from Microsoft Office? Security expert Michael Cobb explains the potential vulnerabilities between open source and commercial software.Continue Reading
How to decode a cipher: Identifying a cryptographic hash algorithm
While it is possible to identify a cryptographic algorithm by way of cipher bit sequences, it can be difficult, and is sometimes illegal. IAM expert Randall Gamby gives advice and a warning.Continue Reading
How risk management standards can work for enterprise IT
Every organization should be able to articulate how IT threats can harm a business. Forrester Research Analyst Chris McClean explains how a five-step risk management strategy, based on a risk management standard like ISO 31000, makes it easier to ...Continue Reading
How to buy an IPS: Features, testing and review
If you're considering IPS for your enterprise, make sure you know what to look for in the products you're reviewing. In this tip, network security expert David Meier describes how to conduct an IPS comparison and review of various features, ...Continue Reading
The benefits of application proxy firewalls
Michael Cobb explains the benefits of application proxy firewalls as compared to other firewall technologies including packet filtering firewalls and stateful inspection firewalls or circuit-level gateways.Continue Reading
How to use COBIT for compliance
While the COBIT framework has been around for a long time, it can still be very useful in terms of understanding goals and benchmarks for a security program that can, in turn, aid compliance with many regulations.Continue Reading
How to update a disaster recovery, contingency planning strategy
Have your disaster recovery plans fallen woefully behind the current state of your business? In this expert response, Ernie Hayden discusses how to conduct tabletop exercises to get your plans back on track.Continue Reading
Advanced Encryption Standard and AES ciphers: Can they be cracked?
No encryption standard is unbreakable, but Advanced Encryption Standard may come close. Michael Cobb discusses why AES ciphers are so tough to beat.Continue Reading
Digital signature implementation: How to verify email addresses
When implementing digital signatures in Outlook, learn what pitfalls to avoid and how to verify the email addresses and digital signatures of the senders.Continue Reading
Scapy tutorial: How to use Scapy to test Snort rules
When creating Snort rules, it's often difficult to test them before they go live. In this Scapy tutorial, Judy Novak explains how to use Scapy, a tool that simplifies packet crafting, to test new Snort rules.Continue Reading
Clientless SSL VPN vulnerability and Web browser protection
In a recent US-CERT advisory, clientless SSL VPN vulnerabilities were listed as posing serious threats to Web browser security. In this tip, learn possible actions to take for Web browser protection.Continue Reading