Tips

Tips

• Defending against RAM scraper malware in the enterprise

  A new type of malware attack, RAM scraper, may pose a serious threat to enterprise security. Learn what a RAM scraper attack is, and how you can defend your organization from this potentially damaging new malware attack.  Continue Reading

• How to properly implement firewall egress filtering

  Deploying outbound rules on a firewall can be a tricky task; if not done properly, it can lead to business interruptions. Scott Floyd reviews best practices for avoiding mistakes when blocking outbound network traffic.  Continue Reading

• Server Message Block Version 2 security in question: Disable or patch?

  Nick Lewis reviews the recent vulnerability discovered in a popular Windows file-sharing and printing protocol. Yes, there's a patch, but should you deploy it, or simply disable SMBv2?  Continue Reading

• What to do with network penetration test results

  It takes a lot of time and effort to plan and conduct an enterprise network penetration test, but the work doesn't stop there. Contributor David Meier explains how to conduct an analysis of pen testing results.  Continue Reading

• Considerations for buying and implementing DLP solutions

  Financial institutions are looking to data loss prevention solutions to prevent costly data security breaches. In this tip, Dave Shackleford explains key issues to weigh before buying and installing a DLP product.  Continue Reading

• Preparing for future security threats, evolving malware

  Security expert Nick Lewis predicts how infosec threats will evolve in 2010. Luckily, enterprise defenses will evolve, too.  Continue Reading

• Prevent cross-site scripting hacks with tools, testing

  In this tutorial, learn how to prevent cross-site scripting (XSS) attacks, how to avoid a hack, and how to fix vulnerabilities and issues with cross-site scripting prevention tools, system and application testing and several other defense and ...  Continue Reading

• Preventing and stopping SQL injection hack attacks

  In this tip, which is a part of our Web Application Attack Security Guide, you will learn methods, tools and best practices for preventing, avoiding and stopping SQL injection hack attacks.  Continue Reading

• Distributed denial-of-service protection: How to stop DDoS attacks

  In this tip, which is a part of our Web Application Attacks Security Guide, you will learn what a distributed denial-of service (DDoS) attack is, and learn how to stop and prevent DDoS attacks by using intrusion prevention technologies and products.  Continue Reading

• PuTTY configuration tips: How to connect to remote network systems

  Peter Giannoulis reviews PuTTY and explains how to use the Windows-based program as an SSH, telnet and rlogin client.  Continue Reading

• How to prevent memory dump attacks

  Because databases are often encrypted, some attackers have switched to memory dump attacks. Michael Cobb explains how to protect your unencrypted transactions.  Continue Reading

• Weighing the pros and cons of end-to-end encryption and tokenization

  With PCI DSS and other compliance requirements, organizations are looking for surefire solutions to protect payment card and other sensitive data. Tokenization and end-to-end encryption have emerged as promising technologies, but as Dave Shackleford...  Continue Reading

• Using unique device identification for bank website security

  Almost everyone has been asked a password challenge question on a website. Learn how to prevent identity fraud with unique device identification.  Continue Reading

• Risk-based multifactor authentication implementation best practices

  A multifactor authentication implementation can be a hard sell to enterprise executives and users alike. In this tip, learn four key strategies to ensure that both groups understand and support the project.  Continue Reading

• A guide to internal and external network security auditing

  Contributor Stephen Cobb reviews the baseline network audit processes that a security professional should absolutely conduct regularly.  Continue Reading

• Benefits of ISO 27001 and ISO 27002 certification for your enterprise

  If your enterprise is considering becoming ISO 27001 and 27002 certified, there are several important questions to ask. Learn about the potential benefits of ISO 27001 and 27002 certification with this expert advice.  Continue Reading

• Identity lifecycle management for security and compliance

  Enterprise identities and their associated roles need to be provisioned for access to a variety of services and systems around the organization. In many cases, the entitlements provided to these various entities have a significant effect on ...  Continue Reading

• How to detect malicious insiders by monitoring antivirus log files

  Antivirus logs can be a low-cost, low-effort approach for resource-strapped companies to look for threats posed by malicious insiders.  Continue Reading

• Black box and white box testing: Which is best?

  There's no question that testing application security is essential for enterprises, but which is better: black box security testing or white box security testing? Learn more in this expert tip.  Continue Reading

• Cut down on calls to help desk with cybersecurity awareness training

  It's no secret that human error accounts for many security blunders. But what's the best way to implement cybersecurity awareness training in your enterprise to keep employees from clicking on phishing links or downloading viruses? In this tip, ...  Continue Reading

• Multifactor authentication options to secure online banking

  Banks are required to deploy multifactor authentication to secure online banking and meet FFIEC requirements. In this tip, Dave Shackleford describes some of the pros and cons associated with traditional forms of multifactor authentication as well ...  Continue Reading

• How to examine a DD image on Windows or Linux

  A slew of open source and commercial tools will help you examine a DD image on either Windows or Linux.  Continue Reading

• How to detect software tampering

  In their book Surreptitious Software, authors Christian Collberg and Jasvir Nasvir reveals how to tamperproof your software and make sure it executes as intended.  Continue Reading

• Preventing SQL injection attacks: A network admin's perspective

  Your database administrators and application developers should certainly be following best practices to avoid SQL injections, but Michael Cobb explains how network admins can do their part to fight those security exploits.  Continue Reading

• Security benefits of virtual desktop infrastructures

  In a highly regulated industry where security is critical, financial-services firms are turning to virtual desktop infrastructures. In this tip, Eric Ogren explains the security benefits of virtualized desktops and virtual workspace projects, ...  Continue Reading

• Screencast: How to launch an OpenVAS scan

  In this screencast, Peter Giannoulis demonstrates the OpenVAS Linux/Unix-based assessment and penetration testing tool.  Continue Reading

• Wireless network guidelines for PCI DSS compliance

  The PCI Security Standards Council recently released additional guidance for WLANs, but do they make the compliance process easier? Contributor Ben Rothke examines the key points of the new guidelines and offers additional advice for organizations ...  Continue Reading

• How to prevent phishing attacks with social engineering tests

  Is your enterprise capable of withstanding today's phishing attacks? Sherri Davidoff reviews how you can test your employees.  Continue Reading

• Creating a personal brand in information security

  In this month's Information Security Career Advisor column, experts Lee Kushner and Mike Murray explain how security pros can better demonstrate their abilities and stand out from the crowd.  Continue Reading

• Determine your Microsoft Windows patch level

  A handful of patch management tools from Microsoft and third -parties can help your organization determine your Windows patch level and identify missing security patches.  Continue Reading

• Automating Microsoft Windows patch management with WSUS

  Microsoft offers Windows Server Update Services (WSUS) as a free download, but there are installation and agent-related issues to contend with.  Continue Reading

• How SSL-encrypted Web connections are intercepted

  Enterprises and attackers alike have found ways to sniff private Web traffic, even when it's encrypted. Sherri Davidoff reviews how encrypted Web connections can be sniffed, and ways that users can reduce their risk.  Continue Reading

• PCI DSS compliance requirements: Ensuring data integrity

  Want to make sure you have secure data for PCI DSS? One of the first steps is making sure the data you're trying to secure is the right data. Security management expert David Mortman explains how to ascertain and maintain data integrity.  Continue Reading

• Vendor risk management: process and documentation

  As part of the vendor risk management process, regulators expect information security officers will document vendor relationships and have proper vendor documentation.  Continue Reading

• How to prepare for an information security job interview

  Lee Kushner and Mike Murray offer tips on how to impress possible employers after finally nailing down an information security job interview.  Continue Reading

• Understanding PCI DSS compliance requirements for log management

  Proper PCI DSS compliance requires effective event log management, but many enterprises fail to not only gather all the relevant data, but also analyze and remediate the results. Forrester Research Senior Analyst John Kindervag offers best practices...  Continue Reading

• Are 'strong authentication' methods strong enough for compliance?

  If multifactor authentication is so great, why hasn't it replaced the password? Michael Cobb reviews the hype surrounding strong authentication. There are more drawbacks than you think.  Continue Reading

• Monitoring program data and internal controls for risk management

  It's sad but true: Some employees are going to leak or even steal sensitive data. But what are the best ways to mitigate that risk? Learn the best ways to create internal controls for risk management in order to keep your data where it belongs.  Continue Reading

• Remote phone lock and GPS tracking counter smartphone security risks

  Lost or stolen smartphones pose serious security risks to data, but remote device lock technology and GPS tracking can help mitigate those risks. This is the first of two parts.  Continue Reading

• An introduction to Information Security Career Advisor

  SearchSecurity.com is pleased to partner with infosec career experts Lee Kushner and Mike Murray to bring you a new monthly column on information security careers. In their debut article, they explain why information security career coaching is ...  Continue Reading

• How to use Excel for security log data analysis

  Microsoft Excel can be an inexpensive and effective option for firewall, antivirus and server log analysis.  Continue Reading

• Checklist: Three firewall configuration tips

  If you are revisiting your firewall configurations, consider these three tips to help you monitor and manage your network traffic.  Continue Reading

• Acceptable use policy for Internet usage helps data protection efforts

  Acceptable use policies are an inexpensive, yet effective, control in limiting exposure to data breaches.  Continue Reading

• Making the case for enterprise IAM centralized access control

  Central access to multiple applications and systems can raise the level of security while getting rid of lots of red tape, so how do you go about creating central access management? In this tip, IAM expert David Griffeth explains the steps.  Continue Reading

• How to defend against rogue DHCP server malware

  Rogue DHCP server malware is a new twist on an old concept. The good news is that effective threat mitigation strategies exist; the bad news is that many organizations haven't bothered to deploy them.  Continue Reading

• How to use Kerberos and Credential manager for Windows single sign-on

  Windows administrators can avoid the expense of third-party single sign-on software and use Windows Kerberos in Windows Server 2003 and Credential Manager in Windows XP and Vista for client-side SSO.  Continue Reading

• Firewall rule management best practices

  Given the growing complexity of firewalls, organizations often have hundreds, even thousands, of rules to review and manage. But configuration doesn't have to be overly complicated. Michael Cobb offers best practices that can allow you to make ...  Continue Reading

• When BIOS updates become malware attacks

  Most security pros don't give the system BIOS a second thought, or even a first one, but today's BIOS types are highly susceptible to malicious hackers. Information security threats expert Sherri Davidoff explains how attackers can plant BIOS ...  Continue Reading

• The basics of enterprise GRC project management

  Implementing an enterprise GRC project requires not only the right technology and training, it also requires cooperation with the executives and employees whose systems and daily work functions may change as a result of the implementation. In this ...  Continue Reading

• Best practices for a privileged access policy to secure user accounts

  Enterprises need to secure accounts belonging to actual users by reviewing and monitoring their privileged access.  Continue Reading

• How to align an information security framework to your business model

  CISOs should consider blending traditional business models with information security frameworks, and not rely solely on regulations to drive security programs.  Continue Reading

• Rootkit Hunter demo: Detect and remove Linux rootkits

  Peter Giannoulis of The Academy Home and The Academy Pro demonstrates how to install and use Rootkit Hunter, a free rootkit scanner for Linux and BSD distributions.  Continue Reading

• Best practices: How to implement and maintain enterprise user roles

  Effective enterprise role management is essential for properly managing user access rights and enforcing access policies, but the implementation process can be challenging. In this tip, Forrester Research Principal Analyst Andras Cser offers a ...  Continue Reading

• How to find and stop automated SQL injection attacks

  Automated SQL injection worms use search engines to filter through vulnerable Web servers. In this tip, Patrick Szeto explains how to keep your website off of the malware's radar.  Continue Reading

• How to fill patch management gaps using Microsoft MBSA

  Microsoft Baseline Security Analyzer examines and quantitatively summarizes the state of your organization's Windows security.  Continue Reading

• An inside look at security log management forensics investigations

  David Strom provides some examples of log data that provided key clues to enterprise data breaches.  Continue Reading

• How to find sensitive information on the endpoint

  Worried that your enterprise endpoints may be harboring sensitive information like credit card numbers or Social Security numbers? Fear not. Mike Chapple offers algorithms and tools to conduct a search and advice on dealing with the results.  Continue Reading

• Five steps to eliminate rogue wireless access

  Unauthorized wireless access points aren't always malicious. Learn how to distinguish between them and mitigate threats posed by rogue APs.  Continue Reading

• When to use open source security tools over commercial products

  When budgets are cut and open networks still need securing, it may be helpful to try open source security tools as a sufficient and affordable alternative to pricey commercial products.  Continue Reading

• How to spot attacks through Apache Web server log analysis

  Log analysis requires refined search skills that will help you ferret out security issues. Brad Causey explains how to sift through log data and find the relevant security information.  Continue Reading

• Kerberos configuration as an authentication system for single sign-on

  Looking to implement single sign-on in your enterprise, but have a lot of custom applications that don't seem compatible? In this tip, IAM expert David Griffeth takes a look at Kerberos, a non-proprietary IAM tool, as a solution to network ...  Continue Reading

• Data security best practices for PCI DSS compliance

  The glut of recent data breaches, such as the one at Heartland Payment Systems Inc., leaves some security pros wondering if PCI DSS is doing its job. Is it worth all the effort to become PCI compliant if breaches still seem inevitable? In this ...  Continue Reading

• Vulnerability test methods for application security assessments

  Learn what to do when you have a huge portfolio of potentially insecure applications, limited resources and an overwhelming sense of urgency.  Continue Reading

• How to clear out anonymous Web proxy servers in the workplace

  Enterprises may use Web filtering software to limit Internet use, but some employees may respond right back with easily available anonymizing proxies. John Strand explains how to keep your users from bypassing content filters.  Continue Reading

• How to use (almost) free tools to find sensitive data

  No matter how much security awareness training employees get, some of them will still store sensitive data in insecure places. As a security manager, finding that data becomes of paramount importance -- but how to do it? In this tip, John Soltys ...  Continue Reading

• How to integrate the security of both physical and virtual machines

  According to a recent Gartner Inc. research report, 60% of virtual machines will be less secure than their physical counterparts through 2009. Michael Cobb explores the challenges of securing a mixed infrastructure of physical and virtual machines.  Continue Reading

• How many firewalls do you need?

  Whether your organizations needs multiple sets of firewalls depends on whether they will protect clients, servers or both and what kind of traffic they will monitor.  Continue Reading

• From the gateway to the application: Effective access control strategies

  Organizations need to strike a balance between so-called front-door access control and more fine grained controls established within an application itself. This article discusses the difference between products designed to set access at the gateway ...  Continue Reading

• Recovering lost passwords with Cain & Abel

  In his latest screencast, Peter Giannoulis of The AcademyPro.com demonstrates how to use the Cain & Abel tool to decipher or track down lost passwords..  Continue Reading

• What are common (and uncommon) unified threat management features?

  Unified threat management products have gained popularity because they bring multiple security tools together into one appliance. In this SearchSecurity.com Q&A, Michael Cobb reviews just what those security tools are.  Continue Reading

• Strategies for email archiving and meeting compliance regulations

  According to a recent study, 29% of surveyed IT professionals archive their email for compliance reasons. Michael Cobb reviews compliance regulations that demand email archiving and how such products can ease some of the pain that comes with the ...  Continue Reading

• Understanding the FFIEC remote deposit capture guidance

  Federal banking regulators recently released guidance for assessing and managing risks associated with remote deposit capture. In this tip, Dan Fisher explains the key components of the guidance, including its definition of RDC and how it emphasizes...  Continue Reading

• Are wireless networks inherently insecure?

  Wireless access protection and WPA2 are both good ways to keep networks secure, though nothing's perfect. Network security expert Mike Chapple expounds.  Continue Reading

• How should a company's security program define roles and responsibilities?

  In many organizations, it's not uncommon for physical, legal and information security departments to step on each other's toes. In this expert Q&A, security management pro Shon Harris reveals how a CSO can bring these teams together and implement a ...  Continue Reading

• What are the benefits of employee security awareness training?

  In this Q&A, security management expert Mike Rothman discusses the short-term and long-term benefits of employee security awareness training.  Continue Reading

• How should multiple firewall rules be managed?

  Even with a change management system, firewall rule bases can become a nightmare for administrators. In this Q&A, network security expert Mike Chapple points out incorrect, overlapping and unused rules that can ruin your firewall.  Continue Reading

• What are ways to measure security risks, threats and vulnerabilities?

  In this Q&A, security management expert Mike Rothman offers advice on the most effective ways to manage and access security risks, threats and vulnerabilities within an enterprise.  Continue Reading

• What are the risks associated with outsourcing security services?

  In this expert Q&A, security management pro Mike Rothman discusses why outsourcing security services could be a bad idea.  Continue Reading

• Should a firewall ever be placed before the router?

  In terms of unit cost, it's generally much cheaper for a router to handle a packet than for a firewall to analyze it. But as network security expert Mike Chapple explains, one does not necessarily have to be placed before the other.  Continue Reading

• File format vulnerabilities: Protecting your applications

  From WMF to the latest Excel file exploits, it's clear that attacks targeting file format vulnerabilities are on the rise. In this tip, network security expert Mike Chapple examines why files have become a tempting vector, and explores what can be ...  Continue Reading

• IPsec tunneling: Exploring the security risks

  As part of his monthly responses to readers, Mike Chapple reveals some information about VPNs that many may not want to hear.  Continue Reading

• How to conduct firewall configuration reviews

  As any firewall administrator knows, it's all too easy for a rule base to become convoluted over time, containing rules that may be outdated or simply incorrect. In this SearchSecurity.com Q&A, network security expert Mike Chapple reveals how to ...  Continue Reading

• How to perform a network device audit

  From unauthorized applications to rogue devices like data-slurping USB sticks, enterprise networks face a growing number of security risks. For financial-services firms, the data loss or network intrusions that can result from unauthorized network ...  Continue Reading

• End-user Compliance: Creating a security awareness training program

  Security awareness training is a must, but what's the best way to create a successful program, and what are the tell-tale signs that it's working? In this tip, security management expert David Mortman explains how to create general as well as ...  Continue Reading

• How to prevent clickjacking attacks with security policy, not technology

  Clickjacking, an emerging hacker technique similar to cross-site scripting, tricks a user into executing malicious commands on a seemingly legitimate or innocent website. John Strand reviews how the attack works, how it compares to ...  Continue Reading

• Deleting user accounts: How to manage users during a layoff

  When budgets get cut across the enterprise, it's likely that employees will get cut, too. So what's the best way to handle a large number of user account modifications or deletions? IAM expert David Griffeth offers a step-by-step process for ...  Continue Reading

• Writing Wireshark network traffic filters

  The freely available Wireshark tool can provide valuable analysis of network traffic, but capturing packets can often lead to an overload of data. Mike Chapple explains how to use Wireshark's traffic filters to zero in on the precise information ...  Continue Reading

• The 100-day plan: Achieving success as a new security manager

  One of the top priorities of any newly minted information security manager is to implement a new enterprise security strategy. In this tip, security management expert Mike Rothman explains what needs to happen in the first 100 days of a security ...  Continue Reading

• Review system event logs with Splunk

  Splunk is a free tool that provides log review and management. From parsing files to triggering alerts and scripts, Splunk can greatly reduce the amount of time security teams spend on logs.  Continue Reading

• Cloud compliance: How to manage SaaS risk

  While Software as a Service (SaaS) can cut costs, there are definite security concerns to be aware of, including compliance issues. What's the best way to make sure that data is safe and audit-ready on the provider's server? Expert Joel Dubin gives ...  Continue Reading

• How to implement and enforce a social networking security policy

  For a new generation of employees entering the workforce, social networking isn't a luxury, it's a necessity. Yet not all enterprises understand that failing to consider social networking security can lead to unfortunate consequences. David Sherry ...  Continue Reading

• The value of application whitelists

  Although some may find Windows Vista's User Account Control feature annoying, it is really a variation of a security mechanism that is now re-emerging: the application whitelist. Michael Cobb explores application whitelist benefits and drawbacks, ...  Continue Reading

• PKI and digital certificates: Security, authentication and implementation

  Get more information about PKI and digital certificates, such as how to implement PKI, how to ensure security and available implementation. Also learn about digital certificates, signatures and achieving authentication through a certificate ...  Continue Reading

• ID and password authentication: Keeping data safe with management and policies

  Learn how to improve authentication and avoid password hacking with management policies that enforce password expiration, length and complexity requirements.  Continue Reading

• Security token and smart card authentication

  Get advice on how to mitigate data theft from hackers with security token and smart card authentication technology, smart card readers and software.  Continue Reading

• Biometric authentication know-how: Devices, systems and implementation

  Discover the pros and cons of multiple biometric authentication devices and techniques, such as iris pattern or fingerprint scans, voice recognition and keystroke dynamics. Also get advice on biometric implementation best practices.  Continue Reading

• Lessons learned: The Countrywide Financial breach

  The data breach at Countrywide Financial Corp. seems like something out of a TV crime drama: Two men regularly copied customer data and secretly sold it as leads to other mortgage brokers. The tale suggests that data theft is, more often than not, ...  Continue Reading

• FISMA compliance made easier with OpenFISMA

  Scott Sidel examines the open source security tool OpenFISMA, a compliance tool that assists government agencies and their contractors in meeting FISMA's requirements.  Continue Reading

• Workstation hard drive encryption: Overdue or overkill?

  In an age of high-profile data breaches and insider risks, encryption is an important defense mechanism for enterprises. The question is: how much encryption is necessary? Many security pros have gone to great lengths to protect data on network ...  Continue Reading

• Recovering stolen laptops one step at a time

  When a student's laptop was stolen last year on a university campus, police and IT investigators went to work, recovering it within a matter of weeks. Neil Spellman, one of the investigators on the case, offers some best practices on what to do if a...  Continue Reading