The new open-source browser release patches 16 different security advisories as the 64-bit Windows edition debuts.
Mozilla came out today with its open-source Firefox 43 browser release, giving users a number of security enhancements and patching vulnerabilities. The Firefox 43 release is likely the last Mozilla Firefox release for 2015 and follows the Firefox 42 release that debuted on Nov. 2.
A key feature that debuted in the Firefox 42 release is Tracking Protection, which is being further enhanced in the new Firefox 43 release. In Firefox 42, Tracking Protection blocked some forms of tracking content that came from advertising and analytics platforms. With Firefox 43, Tracking Protection is now being extended to block trackers that are found in embedded content such as video and photos.
"We're seeing early positive feedback [on the Tracking Protection feature] and will continue to gather input as we develop the feature," Denelle Dixon-Thayer, chief legal and business officer at Mozilla, told eWEEK.
Tracking Protection isn't the only area of security hardening in Firefox 43. There is a also a patch that supports what is known as Subresource Integrity (SRI), which is a technology that allows Websites to ensure that their dependencies can't attack their users.
"Without SRI, if a page on Site A includes a script from another Site B, the page expects Site B to send the legitimate script, but it has no guarantee—Site B could just as well provide a malicious script," Richard Barnes, Firefox security lead at Mozilla, told eWEEK. "SRI allows Site A to ensure that only legitimate content will be accepted from Site B."
Mozilla is also issuing 16 different security advisories alongside the Firefox 43 release, but only three of them are rated critical. Among the critical security advisories is MFSA-2015-134, which patches two separate memory safety vulnerabilities (CVE-2015-2015-7201 and CVE-2015-2015-7202).
The second critical security advisory in Firefox 43 is for privilege-escalation vulnerabilities in Mozilla's WebExtension API that are identified as CVE-2015-7223. There is also a critical advisory for a use-after-free (UAF) memory flaw in Firefox's WebRTC (Real Time Communications) support, identified as CVE-2015-7210.
"Mozilla developer Kris Maglione reported a mechanism where WebExtension APIs could be used to escalate privilege," Mozilla warns in its advisory. "Depending on the privileges of the extension used, this could result in personal information theft and cross-site scripting (XSS) attacks, including theft of browser cookies."
The final critical advisory for Firefox 43 is for CVE-2015-7214, which Mozilla describes as a cross-site reading attack through data and view-source URIs.
While security is a big part of the Firefox 43 release, the new Mozilla browser is also noteworthy in that it is the first time that a 64-bit build is being made available for Windows operating system users. "64-bit versions of Firefox were already available for MacOS X and Linux," Fabio Rios, Firefox product marketing manager at Mozilla, told eWEEK. "We rolled out a 64-bit Firefox for Windows to our general audience when our high standards were met."
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
Mozilla Ups Security, Tracking Protection in Firefox 43
↧
↧
Ipswitch Survey Reveals IT Teams Expect ‘A Nightmare Before Christmas’
Over half of IT professionals report they’re worried their network will suffer a data breach at the hands of a careless celebrationLondon, UK, 16th December, 2015 – Dealing with potential data loss will be the number one headache confronting IT professionals in the run up to the 2015 holiday season. According to the third annual “Happy Holidays?” survey from Ipswitch*, over one-third of IT professionals in the UK (36%) confirm they have had an IT user report the loss of a device holding company data following holiday celebrations in a pub, restaurant, or at a party. A further one-in-five (19%) go on to say they have had to manage the fallout that results from a user leaving their phone, tablet or laptop in the back of a taxi or on public transport during the holiday season.“Time and again throughout the festivities, IT professionals will be called upon to deal with the potential consequences of a device accidently falling into the wrong hands,” says Michael Hack, Senior Vice President of EMEA Operations, Ipswitch. “In such scenarios, information security is the primary concern and that’s why it’s always a good idea to have security measures in place – so that even if an employee’s laptop or phone is lost or stolen, there’s not sensitive data or apps available to anyone in possession of the device.”Coping with the Nightmare before ChristmasWhile IT users are partying away, the IT team is left to tackle the consequences that can result from the festive cheer of their corporate colleagues. Indeed, over half of IT professionals (57%) surveyed this year report being worried that their network could suffer a data breach at the hands of a careless celebration this year.Respondents also confirm they will be kept hard at work throughout the holidays, thanks to the demands of today’s non-stop connected world of business. Over a quarter (27%) say they are either on call or working on Christmas Eve, with one-in-ten (10%) on call on Christmas Day and 13 per cent also expecting to work on New Year’s Eve.“Today’s network and server monitoring performance solutions can help IT professionals to take some well deserved time out - just like everyone else in the business,” continues Michael Hack. “Real-time alerts and notifications delivered via email or text make it easy to remotely monitor network performance and proactively respond to problems before they impact users, applications or the business.”The Holiday Horrors ContinueWith the run up to Christmas over, there’s still no let up in sight for the IT team. Over one quarter (26%) of IT professionals say they expect up to half (50%) of their company’s workforce will work from home during the holidays. Typically, these users can be inexperienced at remote working and frequently encounter problems that result in the IT team being called into action to deliver a fast resolution. Survey respondents confirm that the issues they’re typically asked to tackle during the holidays include a user’s laptop not working (39%), problems accessing the network remotely (36%), poor application performance (28%) and security related issues (21%).Christmas Wish ListWhile survey respondents anticipate limited opportunities to relax and unwind this holiday season, they are hoping for some high end gifts from Santa. This year wearable technology, such as Fitness bands and Smart Watches, are the ‘must have’ gadgets that over one-third (34%) of IT professionals say is top of their gift request list to Santa.New Year’s Resolutions for 2016IT professionals are already ahead of the game when it comes to preparing their New Year Resolutions. Increasing the level of network security was the number one priority for over half of respondents (53%), followed by more budget and resources (19%) and improved internal communications and customer satisfaction (18%).“This year’s survey highlights how data security and keeping the network safe beyond the holiday season is a major concern for the IT department,” concludes Michael Hack.“User mishaps at this time of year represent a significant risk to the business, placing additional unwelcome demands on the IT team who have to fix the problem. Now, more than at any time of year, IT leaders should take time to gently remind users of security policies and procedures so that, should untoward events occur, the enterprise is not compromised – and IT Pros get to sleep well at night.”Ipswitch 2015 “Happy Holidays?” Survey ResourcesFull survey results: http://bit.ly/HolidaySurveyUK Infographic: http://bit.ly/HolidayInfographicUK *The Ipswitch 2015 “Happy Holidays?” online survey was conducted among 165 IT professionals from the United Kingdom in December 2015.About IpswitchIpswitch helps solve complex IT problems with simple solutions. The company’s software has been installed on more than 150,000 networks spanning 168 countries to monitor networks, applications and servers, and securely transfer files between systems, business partners and customers. Ipswitch was founded in 1991 and is based in Lexington, Massachusetts with offices throughout the U.S., Europe, Asia and Latin America. For more information, visit www.ipswitch.com.ENDS Source: RealWire
↧
Organisations struggling to align Hybrid Cloud deployments with business needs
Survey finds Hybrid Cloud adoption is high but mixed messages and disruptive technologies mean IT decision-makers are suffering from clouded vision 16 December 2015, Sandwich, Kent: The Bunker, a trusted partner for compliant and secure outsourced infrastructure and data storage, has published a new report providing compelling insight into Hybrid Cloud adoption, the key factors dictating whether Cloud migrations are successful or not, and the challenges CIOs and IT decision-makers face when setting and executing on their vision for Hybrid Cloud.The report ‘Completing the Hybrid Cloud puzzle’ is based on research carried out by Vanson Bourne, which interviewed 100 IT decision-makers from private enterprise organisations (1,000+ employees) in the UK. Key findings of the research include:90% of organisations are currently implementing some kind of Hybrid Cloud infrastructure; while 96% expect to migrate applications or data to Cloud Infrastructure within the next 5 yearsAlmost 60% of organisations implementing Hybrid Cloud are doing so to realise greater cost efficiency, flexibility and scalability; with 40% looking to lower total cost of ownership (TCO); and 38% transitioning from a Capex to Opex model55% identify a mixture of in-house and outsourced IT infrastructure using private and/or public cloud, either on-premise and/or off-premise where appropriate as their ideal model for future IT service deliveryHowever, of the 94% of organisations that had already migrated applications or data to Cloud Infrastructure, 70% had experienced some kind of failure – whether in terms of a failed or stalled project, or a failure to realise the business benefits anticipated. Moreover, despite confirming a good level of engagement both internally and externally for decisions concerning IT strategy, planning and execution, just over half of respondents (54%) are yet to identify the optimum technical solution to address their business requirement.“The business benefits of Cloud technologies may be compelling, but organisations continue to struggle when it comes to delivering on them,” states Phil Bindley, Chief Technology Officer (CTO) at The Bunker. “Whilst it is clear CIOs and IT decision-makers recognise the importance of aligning IT and business strategy, our research shows that many are unable to translate into technology what the business is trying to achieve.”According to the report, only a fifth of respondents (21%) rated their organisation's ability to execute on their vision for IT service delivery as ‘excellent’, while just under a third (29%) rated it as ‘fair’, with some external assistance required to address gaps in knowledge. Overall the top three factors contributing to a failed or stalled Cloud migration were identified as: a lack of in-house skills (49%); confusing, biased or incorrect advice (44%); and lack of integration of Cloud Infrastructure and non-Cloud resources (41%).“CIOs and IT decision-makers do not appear to be getting the advice or support they need,” continues Bindley. “The disconnect that exists between the skills and knowledge available internally and the advice received externally from consultancies and key suppliers demonstrates the importance of working with the right partners to develop a Hybrid Cloud strategy that is both deliverable and properly aligned with the needs of the business.”The Bunker commissioned Vanson Bourne to interview mid-market (1,000-3,000 employees) and large organisations (more than 3,000 employees) in the financial services; manufacturing; retail, distribution and transport; and ‘other commercial’ sectors. A copy of the report is available for download here; http://www.thebunker.net/hybrid-cloud-survey-report/.-ENDS-About The Bunker The Bunker is a trusted partner for compliant and secure outsourced infrastructure and data storage. With fully owned UK data centres outside the M25 yet within easy reach of London, we provide Managed Hosting, Colocation, and Cloud Infrastructure and Storage to businesses that value the confidentiality, integrity and availability of their applications and data.At The Bunker, we believe that Information Security should enable businesses to be more competitive, manage risk, protect brand and allow innovation in a controlled manner. We’ve adhered to this philosophy for more than a decade, keeping some of the most demanding businesses compliant, secure and available. Our data centres are former nuclear bunkers upgraded with millions of pounds of investment in networking infrastructure, fire suppression, power and cooling. We are service led, compliant, and secure by design.For more information on The Bunker please visit: www.thebunker.netMedia contactsTo arrange an interview with The Bunker’s CTO, Phil Bindley, please contact:Graham Thatcher07933 673240 / 020 3542 6644graham@hitfirstbase.com Source: RealWire
↧
Dimension Data Releases Its Annual List Of IT Predictions
UK, London, 16 December 2015 – Dimension Data, the global solutions and services provider, today released its IT predications for the next 12 months, and digital transformation is high on the corporate agenda because it’s already reshaping the competitive landscape.According to Ettienne Reinecke, Dimension Data’s Group Chief Technology Officer, social, mobile, cloud, analytics, Internet of Things, and bimodal IT are all hot topics in the IT industry which divide IT functions and teams in organisations worldwide. But, he says, where do organisations prioritise their budgets and resources.“All of these trends and technologies serve a larger purpose, because they enable the transformation of an organisation to become a digital enterprise. In other words, the business uses IT to respond faster to market opportunities and threats, and prioritises the experience of the people it works with, whether they’re customers, employees, or business partners.”Reinecke said the digital transformation conversations that Dimension Data’s teams are having with organisations revolve around four themes: data at the core of the transformation, hybrid cloud as mechanism for agility, workspaces for tomorrow, and cybersecurity.Digital Infrastructure: It’s all about understanding your data … and how to exploit itThe role of data has fundamentally changed. For many years, data centre professionals would concentrate much of their time and energy on things like storage drives and backups, and how best to perform tasks such as replication and de-duplication. Then, the primary focus was reducing the cost of managing data. Now, that’s all changed. Today it’s all about honing your ability to exploit data and finding ways to turn it into business value.Hybrid Cloud: Private cloud adoption will increase in 2016The next twelve months will see an increase in private cloud adoption, as savvy IT decision-makers with a ‘cloud first’ strategy move to adopt new managed private cloud offerings with consumption-based commercial models. Workspaces for Tomorrow: Work behaviours will be shaped more radically by social media in 2016Much of social collaboration is enabled by consumer-focused tools. Technologies such as Facebook, Twitter, LinkedIn, Foursquare, and many others have given rise to robust and business-oriented counterparts that offer audio, video, file-sharing, and workflow integration. These include applications such as Cisco’s ‘team-rooming’ solution Spark, Microsoft’s Yammer and Skype for Business, Viber, WhatsApp, Slack, and many others. These technologies encourage the creation of communities; living, working, shopping, and interacting ‘out loud’; sharing ideas; easily finding people and information; collaboration; and faster decision-making. These behaviours will make their way into more and more organisations in 2016, allowing end users to work together seamlessly from different geographies, and at different times of the day.Cybersecurity: High profile security breaches are set to continue in 2016, and more executives will become the targets of hackersThe slew of high-profile security breaches that took place in 2015 are set to continue in 2016. And the disturbing new trend of ‘whaling’ will see hackers target senior executives with ransomware, demanding money or using their information fraudulently. In addition, forensics will play a major role in the cybersecurity space in the next 12 months.-ENDS-About Dimension DataFounded in 1983, Dimension Data plc is an ICT services and solutions provider that uses its technology expertise, global service delivery capability, and entrepreneurial spirit to accelerate the business ambitions of its clients. Dimension Data is a member of the NTT Group. www.dimensiondata.com.For further information:Matthew Watkins or Jonathan MathiasFinn PartnersDimensionData@FinnPartners.com+44 20 3217 7060Source: RealWire
↧
ProtonMail: what we learned from being the victim of Europe’s biggest DDoS attack
After going public about the DDoS attack that took it down, encrypted email provider is hit by another massive surge in traffic
↧
↧
Digital Guardian Raises $66M to Expand DLP Technology
CEO Ken Levine discusses what the new funding will be used for and what the next frontier is for data loss prevention.
Data loss prevention security vendor Digital Guardian has raised $66 million in a Series D round of new funding, bringing total funding to date to $126 million.
The new funding comes from multiple investors, including GE Pension Trust (advised by GE Asset Management), Fairhaven Capital Partners, Loring Wolcott & Coolidge, Special Situation Funds, Brookline Venture Partners, LLR Partners and Mass Mutual Ventures LLC.
"We ended up raising more money than we had originally thought, as a result of a combination of the availability and opportunity for the extra cash," Ken Levine, CEO of Digital Guardian, told eWEEK.
Levine has an eye on growing the company and on achieving profitability by the end of 2016. Digital Guardian will generate approximately $50 million in revenue in 2015, with a forecast to hit $75 million in revenue for 2016, he said.
Digital Guardian has been expanding its data loss prevention (DLP) technology capabilities both organically and by way of acquisition. In October, Digital Guardian acquired Code Green Networks to expand its protection capabilities.
"Part of this new round of funding will be used to help us integrate the Code Green platform into Digital Guardian," Levine said. "Our goal is to have a single platform, with a single policy engine to be able to control and protect data, regardless of where the data lays."
In addition, Digital Guardian will be investing in developing advanced machine learning technologies to make even better use of all the data that the platform is able to collect.
When it comes to data breaches, Levine said that in many cases it is user error that leads to unintended information disclosure. Digital Guardian's endpoint agent technology sees the traffic that is coming in and out of an endpoint and can provide prompts to warn users about clicking on potentially malicious items, he said. The Digital Guardian platform also has automated protection capabilities to reduce the risk of unintended information disclosure.
"If we see an HR [human resources] file going outside the company, we can automatically block that from happening," Levine said. "We're making sure that your data isn't going where it should not be going."
The key challenge for Levine in the year ahead is to make sure that Digital Guardian is executing on its operational and go-to-market plans effectively. According to Levine, building innovative technology on its own is not enough to succeed in the modern IT landscape.
"We have tons of great ideas. The challenge is more about making sure we deliver technology that is consistent across all the different operating systems and making the technology easy to deploy and maintain," he said.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
↧
MacKeeper Leak Highlights Danger of Misconfigured Databases
The Shodan port-scanning service finds at least 35,000 MongoDB databases accessible without a password.
A security researcher gained access to a database holding information on millions of users of the often-criticized MacKeeper Mac OS X utility program, after a simple Internet search highlighted the developer's misconfigured MongoDB server, developer Kromtech acknowledged on Dec. 14.
Researcher Chris Vickery notified the firm after he used the Shodan port-scanning service to find MongoDB servers with unsecured ports. Kromtech's database was among the identified insecure servers. The database stores customers' names, purchased products, license information and user credentials, including hashed passwords, Kromtech stated in a blog post on its MacKeeper site.
Kromtech thanked Vickery for privately disclosing the issue, and locked down the port
"We fixed this error within hours of the discovery," the company said in the alert about the issue. "Analysis of our data storage system shows only one individual gained access … [an act] performed by the security researcher himself."
Vickery searched for the default port used by MondoDB using the Shodan service and then identified the owners of the IP addresses. Shodan regularly scans the Internet for open ports, signs that a program is waiting to communicate with the outside world. Unsophisticated users, or misconfigured servers, can often expose insecure ports to the Internet.
The dead-simple breach highlights the danger posed by databases directly connected to the Internet, among them tens of thousands of MongoDB databases. Anyone knowing the databases' Internet addresses can gain access to more than 680 terabytes of data on 35,000 servers, according to an analysis by Shodan founder John Matherly. Digital Ocean and Amazon host the large numbers of vulnerable MongoDB servers according to the analysis.
Previously, "it looked like the misconfiguration problem might solve itself due to the new defaults that MongoDB started shipping with," he wrote. "That doesn't appear to be the case based on the new information. It could be that users are upgrading their instances but using their existing, insecure configuration files."
Matherly stressed that the misconfiguration issue does not just affect MongoDB servers but also many other types of databases.
Security firm Rapid7, which has found a plethora of insecure devices by scanning the Internet, agreed that database servers should be cordoned off from the Internet. At the very least, administrators should block the communications port used by MongoDB from being accessed from the Internet, Tod Beardsley, security research manager at Rapid7, told eWEEK.
"The lesson is don't expose your databases to the Internet," he said. "There is not a whole lot of utility for it, and I cannot think of any legitimate reason to do it."
Kromtech assured customers that the data exposed by the misconfigured database did not include financial details.
"All customer credit card and payment information is processed by a third party merchant and was never at risk," the company stated. "Billing information is not transmitted or stored on any of our servers."
MacKeeper is a system cleaning and maintenance application that has garnered a great deal of criticism over the years for causing instability and for the developer's marketing tactics. In a previous interview, however, Jeremiah Fowler, a spokesperson for Kromtech, has argued that the product has been the target of smear campaigns.
↧
Skyscape Embraces The Festive Season With Donations To Great Ormond Street Hospital Children’s Charity And Royal Brompton & Harefield Hospitals Charity
London – December 17, 2015 – Skyscape Cloud Services Limited, the easy to adopt, easy to use and easy to leave assured cloud services company has donated £10,000 apiece to the Great Ormond Street Hospital Children’s Charity and Royal Brompton & Harefield Hospitals Charity from the Skyscape Foundation. “We are thrilled to support both the Great Ormond Street Hospital Children’s Charity and Royal Brompton & Harefield Hospitals Charity, both of which provide such vital care and equipment to so many,” said Simon Hansford, CEO of Skyscape Cloud Services. “As a socially responsible organisation, we strive to always do the right thing and part of this means we have committed to sharing our profits with our community by providing much needed financial assistance to worthy organisations.”Skyscape recently announced the launch of the Skyscape Foundation, an initiative dedicated to supporting charitable causes, through which an annual donation of two percent of net profits is made to charities selected by the company and its employees. Skyscape’s core values include serving the wider society by actively encouraging staff to support their personal charities or ones close to them, as well as the company’s chosen charities.“It certainly is a refreshing change for such a substantial donation to come from a private sector organisation,” said Gill Raikes, Chief Executive at Royal Brompton & Harefield Hospitals Charity. “Skyscape’s commitment to supporting charitable causes should be a leading example for all businesses to give back to their communities wherever possible.”With the growing need for healthcare providers to deliver more efficient services to patients whilst reducing costs, adoption of cloud computing is on the rise. As an enterprise dedicated to providing the most cost-effective and agile ICT solutions to the public sector, Skyscape’s contribution will help both the Great Ormond Street Children’s Charity and the Royal Brompton & Harefield Hospitals Charity with purchasing equipment, funding research, re-development of the hospitals’ buildings and support services.“Contributions in any form make the world of difference for the many children and families that we support,” said Nikki Judd, Business Development Executive at the Great Ormond Street Hospital Children’s Charity. “The charity could not continue to support the work of the hospital without the generous support of corporate donors like Skyscape Cloud Services.”The Skyscape team recently dedicated the official Children in Need appeal day on Friday 13th November to a number of fundraising activities in aid of the charity, with the whole company taking part in fancy dress, raising £25,000. About Skyscape Cloud ServicesSkyscape’s assured cloud solutions have been specifically designed to meet the needs of the UK public sector, delivering UK sovereign services that are easy to adopt, easy to use and easy to leave, with genuine pay-by-the-hour consumption models. As a UK SME, Skyscape has won a number of high-profile contracts via the G-Cloud Framework and through its large number of channel partners that embed Skyscape’s cloud platform in their solutions.Skyscape’s full range of services are Pan Government Accredited (PGA) up to IL3, hence suitable for all data at OFFICIAL (including OFFICIAL-SENSITIVE) and connected to government networks including the Public Services Network (PSN), the N3 health network and others. Its services are delivered with leading technologies from the Skyscape Cloud Alliance Partners: QinetiQ, VMware, Cisco, EMC and Ark Data Centres. Skyscape has been named a “Cool Vendor” by analyst firm, Gartner. To learn more about Skyscape, visit www.skyscapecloud.com or follow on twitter @skyscapecloudMedia ContactsCharlotte Martin/Stacey NardozziFinn Partners +44 (0)20 3217 7060SkyscapeTeam@finnpartners.com Source: RealWire
↧
Unisys predicts entirely new classes of cyberthreats will require fresh countermeasures in 2016
Rogue intelligence officers, machine-controlled physical attacks, and the rise of quantum computing will demand new approaches such as micro-segmentation and quantum encryptionLondon, UK, December 17, 2015 – Following a year of damaging security incidents at organisations ranging from the U.S. Office of Personnel Management to the Ashley Madison web site, security experts at Unisys Corporation (NYSE: UIS) predict that leading security professionals around the world will adopt a new mindset in 2016, embracing advanced approaches such as micro-segmentation to counter increasingly sophisticated attacks by cyber criminals.“Corporate and government leaders understand that as their enterprises have grown beyond their four walls and threats have moved from concept to reality, their whole approach to security must change now,” said Tom Patterson, vice president of global security, Unisys. “In 2016, corporate leaders will take the actions needed to protect themselves in this new reality.”Consequently, Patterson predicted the rise of a new security approach that embraces micro-segmentation, which allows enterprises to easily and economically divide their physical networks into hundreds or thousands of logical micro-networks, or microsegments. Such an approach understands that adversaries will ultimately infiltrate an organisation, but limits the damage they can do once they’re in, making the difference between a routine cyber incident and a business catastrophe. Patterson predicted additional new developments in 2016, including new security threats from rogue intelligence officers; cyberattacks that result in physical destruction; and the rise of quantum computing threatening encryption-based defenses.Prediction: Rogue intelligence officers will use government-owned spy capabilities for their own purposes. Many of the state-sponsored attacks that have been attributed to governments around the world are actually executed by state employees motivated by their own ideological issues without government authorisation. In 2016, Unisys predicts that rogue intelligence officers will emerge as a separate threat category that business and government organisations will need to monitor and control in a different way than they would for a state-sponsored attack.Prediction: Cyberattacks meet the physical world – with potentially fatal results. Up until now, the worst thing that could happen to a machine under cyberattack would be “the blue screen of death.” Now, attackers can control machines, which means they can crash your car, stop someone’s heart, black-out your city, or destroy public infrastructure. With many of these devices built on old open systems, integration of modern security is critical to our lives and livelihood. Unisys predicts that enterprises will see the real world results of this in 2016 as digital and physical worlds collide.Prediction: Expect a massive ramp-up in the arms race around quantum encryption. Today’s cyber criminals looking to circumvent encrypted communications are limited by the inability of modern computers to calculate a long encryption key. But with the impending advent of quantum computers, able to break down encryption in seconds, enterprises will need more advanced encryption approaches to thwart criminals. In 2016, Unisys predicts a significant increase in enterprise funding and R&D investments in developing quantum encryption as a means to counteract the advent of quantum computers.“Although many threats loom in 2016, security professionals also have an arsenal of new countermeasures like micro-segmentation,” Patterson said. “This will be the year we start changing the playing field and shifting the advantage back to the good guys.”About UnisysUnisys is a global information technology company that works with many of the world's largest companies and government organisations to solve their most pressing IT and business challenges. Unisys specialises in providing integrated, leading-edge solutions to clients in the government, financial services and commercial markets. With more than 20,000 employees serving clients around the world, Unisys offerings include cloud and infrastructure services, application services, security solutions, and high-end server technology. For more information, visit www.unisys.com.Follow Unisys on Twitter and LinkedIn. Contacts: Alex Brooks Octopus Group for Unisys, D: 0203 837 3702 / M: 07900 205 460Alex.Brooks@weareoctopusgroup.netNick Miles, Unisys, 07808-391-543nick.miles@unisys.com ###Unisys and other Unisys products and services mentioned herein, as well as their respective logos, are trademarks or registered trademarks of Unisys Corporation. Any other brand or product referenced herein is acknowledged to be a trademark or registered trademark of its respective holder.Source: RealWire
↧
↧
Amount of MongoDB data publicly exposed on the internet grows to 685TB
Couchbase, Cassandra, Redis and Riak are equally impacted, says Shodan founder John Matherly
↧
Cybersecurity, digitisation and agility: 2016’s key tech concerns for law firms
Cybersecurity, agility and digitisation of the courts will be the top IT concerns for law firms in 2016.Converge Technology Specialists (Converge TS), the country’s only dedicated Cloud computing provider for law firms and Zylpha, the UK’s leading legal systems innovator, spoke to a range of clients who collectively predict that:Agility will become increasingly important as location becomes less important. Clients are demanding that law firms are able to provide them with access to legal services anytime, anywhere. As firms seek to boost profits and meet client demands, more will move to agile working to enable them to work at client sites, work from remote locations at times to suit clients and also to optimise fee-earners’ downtime when travelling or out of the office. “Many clients don’t particularly need to see their lawyer very often, and remote accessibility is becoming as important as a physical presence,” says Andy Reilly, IT Director at Genus Law.Stacey Parkin, Operations Manager at Poole Alcock agrees: “We introduced hot-desking and remote working to streamline staff costs and offer employees greater flexibility about how and where they work. Clients have seen a difference, as staff now have better access to emails and case management systems, which are accessible from mobile devices.” Matthew Claughton, Managing Director of criminal defence firm Olliers, sees the cuts to Legal Aid opening up opportunities for criminal defence firms who can “stay ahead of the game and find new and innovative ways of working. Working remotely, in an agile manner, with a single back office is an exciting way of delivering the service.”Increased digitisation and the growth of online services. Firms expect to see further improvements in processes and accessibility to case management files with more systems becoming electronic and digital in 2016. Again client expectation will drive this efficiency as they demand access to services outside of regular working hours, whether for a case update, to view documents, or to be able to work remotely themselves.The government’s £700m investment in the Autumn Statement in November will modernise the courts and justice system. Law firms will need to ensure they have the right technology in place to be able to operate in the new world, although questions remain about whether it is the courts or firms who will be ‘catching up’ in the brave new world. The South London Legal Partnership has this year successfully launched digital court hearings with the elimination of paper bundles in the West London Family Court. “We have been able to pilot an easy to use solution that everyone is behind and which doesn’t require vast amounts of technology or training to get it to work smoothly,” says its Legal Practice Manager Paul Phelan. Seventy cases have so far been heard and the pilot is now being shared with other local authorities so that they can adopt digital courtrooms.David Aird IT Director at DAC Beachcroft says a challenge in 2016 will be balancing how to be ‘always on’ with clients. Andy Reilly from Genus Law agreed, saying: “For everything other than legal services, our clients are used to being serviced over the internet, and so we are looking to products to help this transition.” Other firms echoed this, predicting that the next generation of solicitors will demand change within their organisations as their careers progress and as popular technology advances further outside the workplace. Firms re-examine risk as cybersecurity takes centre stage. Securing data and systems from cybercrime will be a major issue for law firms in 2016. High profile cybercrimes in 2015 highlighted that no business is safe. Law firms hold a huge amount of client data and they are obliged to protect this by the Solicitors Regulatory Authority (SRA) and the Information Commissioner’s Office. As the SRA continues to flag various scams, firms must tighten up security or face fines and loss of reputation. Having a good disaster recovery plan in place will be key to protecting data and securing systems but it will also provide a competitive advantage. Poole Alcock has prioritised this and says: “Panels are asking for evidence of disaster recovery in place. We have this and it’s a proven advantage over competitors.” Technology linked to ROI with IT becoming a ‘proactive function’. Continuous innovation will be demanded but only where there is demonstrable return on investment (ROI). Robert Hastie, Finance Director at Total Conveyancing Services, says: “Any ICT solution must bring benefit to the business as a whole and deliver more streamlined and speedier process but without reducing the quality of work and the service we deliver…technology has to evolve with your business.”Firms also see IT becoming a proactive function, which will be integrated across legal teams and other service delivery functions. Paul Harker, Head of IT at Anthony Collins, says: “More firms will be trying to be lean and adopt formal processes to achieve this, further driving greater efficiencies and differentiating themselves from competition.”Zylpha’s Head of Marketing David Chapman says: “2016 could herald a marked departure in the status quo of IT. As firms begin to grasp the opportunities afforded to them by getting IT right and digitising processes, a new window may be opened to greater efficiency, opportunity and profitability.” Converge TS’s Technical Director Andrew Taylor says: “2016 will be a definitive year for law firm technology. The move to agility will be spurned by client demands, improvements to IT security will be far greater as firms seek to offer enhanced data security to win more contracts, and the move to ‘IT as a service’ will signal a change in the future IT team with many viewing it as an operational cost rather than capital expenditure. ‘Paying per user’ could become a more cost effective way of running technology as firms look to scale it up or down in line with business strategy and objectives.” A joint report called ‘Legal Landscape 2016’ which looks at the issues affecting law firms’ IT and case management experience, will be published in January 2016.ENDSFor further information on Converge please contact: Clare Rice, Black Letter Communications on 020 3567 1208, email: clare.rice@blackletterpr.co.uk For Further information on Zylpha please contact: Leigh Richards, The Right Image on 0844 561 7586 / 07758 372527: leigh.richards@therightimage.co.ukNotes to editors: About Zylpha Headquartered in Southampton Zylpha is an innovative specialist offering tools for the legal profession including:Secure electronic document production and delivery. Court Bundling.Integration with the MOJ Portal.Links to agencies for AML and Identity Verification.The company, which was founded by Tim Long its CEO, has won widespread acclaim in both the legal and local government sectors for its systems that transform secure communications for court and case management bundles. Zylpha has recently been approved for G-Cloud 7.www.zylpha.comAbout Converge Technology SpecialistsFounded in 2006, Converge Technology Specialists (Converge TS) is the country’s only dedicated Cloud computing provider for law firms. Converge TS’s hosted and managed IT services are used by innovative law firms to drive productivity, enable flexible working and boost growth.http://convergets.co.uk/ Source: RealWire
↧
Eight reasons why trust is broken online
What you need to know about commercial certificate authorities and why the SSL certificate system needs to be reformed, according to Miracl CEO Brian Sp...
↧
IT Europa Predictions for 2016 – Cloud, Security, IoT and Data Analytics set to advance in the face of continued economic uncertainty
[London – 17 December 2015] 2016 will be a difficult year to call for the European IT businesses – any of the usual linear progress in the IT industry in 2015 as a result of more powerful technologies was distorted by special factors such as cloud, security and the economic situation and its impact on dollar/euro pricing.Talking to experts in European IT, IT Europa has compiled a unique 18-page report which is aimed at those IT strategists trying to map a path through the issues of cloud, security, data analytics and how the channels, especially distribution adapt to new models and new patterns of customer behaviour. It is available for free download here http://www.iteuropa.com/?q=it-europa-2016-predictionsThe report concludes that 2016 will see further major changes in vendors and channels, with legacy vendors facing a bleak future unless they take major steps. As IDC has already indicated. Customers want more, be it in data and analysis, security, cloud apps or guidance. Channels may struggle to keep up. As one expert puts it: “The channel’s ability to pivot its business models to work with a wider range of technologies and commercial delivery models limits the way it can meet this demand.”Some firms may leave the business completely, under pressure from the new demands placed on them, while others look for dramatic growth through acquisition. Consolidation in the channel will continue, with some signs that firms are getting a clearer understanding of what the M&A market needs to help put a price on their businesses.With Software-Defined-Everything (SDE) storming across the industry, companies, already under the hammer from customer’s existing demands, will find key resources in short supply. Performance, security and staff recruitment and retention are identified as the three main headaches for the IT industry in 2016.Some key predictions:As economies recover, IT spending will rise, but this may get diverted into aspects regarded as essential such as security.Security issues will make headline news, so expect customers’ concerns to continue.EU legislation is moving at a snail's pace; we don't hold out much hope for changeChannels will consolidate – driven by the need to raise capital to invest, lack of available skills, plus the wall of new money looking for a home through IPOs etc.Expect distribution to continue to expand its portfolios, especially in security, while fulfilling its role of recruitment and providing cloud management and contracts.Big Data will start to affect everyone, not just the obvious big data users and vendors; there is a real shortage of expertise here, howeverWatch for smaller IoT projects: While large transformative Internet of Things (IoT) projects grab headlines, an increasing number of IoT projects are smaller in scale, less expensive and less risky, says TBR. Wearables might finally come through as part of IoT.Analytics and big data will drive the market: Today, only 1% of all apps use cognitive services; by 2018, half will, say researchers. Essentially, analytics will be embedded in every application, used to facilitate functionality or convenience.Predictive Analytics will be big, but means high demand for IT-based business specialists able to define the rules which can encode the modelsSoftware-defined everything means hardware continues to be standardised, especially in data centres, while software creation, APIs, embedded systems and mobile will set the pace. For an update on the situation among Europe's software businesses and who is winning this race, attend the European Software and Solutions Summit 2016 in April in London - www.EUSSS.com.As a result of software-defined everything and the enterprise move to the cloud, Managed Services will become the accepted model for many businesses and organisations. Who best provides these, with which management tools and administration, is a question that will remain open in 2016. For some of the answers sign up for Managed Services and Hosting Summit 2016, in London in September - www.mshsummit.com.About IT EuropaIT Europa is the leading provider of strategic business intelligence, news and analysis on the European IT marketplace and the primary channels that serve it. It publishes European channel publications, such as the IT Europa, ISVEuropa and MSPEuropa newsletters, markets a range of database reports and organises European conferences and events for the IT and Telecoms sectors. For further details visit: www.iteuropa.comFor further information contact:Alan NormanTel: +44 (0) 1895 454 604Email: alan.norman@iteuropa.comSource: RealWire
↧
↧
POS Malware Tool Emerges to Exploit Retailers
Pro POS is designed to be a professional tool for enabling an attacker to exploit point-of-sale systems.
Point-of-sale (POS) malware has been a concern for retailers for several years now, especially following...
↧
BitTorrent in Corporate Networks a Sign of Breaches: BitSight
While Bittorrent is not a direct cause of malware, networks that use the peer-to-peer service are much more likely to have botnets and other compromised systems.
Companies that have BitTorrent running inside their networks are more likely to have systems infected with malware and other signs of a breach, according to a study of more than 30,000 companies conducted by security firm BitSight.
BitTorrent is not the cause of the issues although applications and games downloaded through the service often carry malware, the company said in its report. Instead, the 23 percent of companies that have BitTorrent running on at least one system in their networks also had a lower security rating and were more likely to have signs of a botnet or other compromise, Jay Jacobs, senior data scientist at BitSight, told eWEEK.
The link suggests that companies should review their security policies, in general, and their peer-to-peer networking policies, in particular, he said.
"Unless you can justify a legitimate use of BitTorrent, unless you are in that tiny population of use cases, you should block BitTorrent activity and have a policy against it," Jacobs said.
The study highlights the continued controversy surrounding peer-to-peer networking. In legitimate applications, the technology allows data to be distributed among the client computers and delivered by the closest node, helping spread out the bandwidth load. In cases such as the Tor network, peer-to-peer routing can offer additional benefits, such as anonymity.
However, online criminals have used peer-to-peer networks to make their infrastructure harder to dismantle and protect their command-and-control capabilities. People who pirate digital media and software often use peer-to-peer networks for similar reasons.
The study suggests that companies that are exposed by BitTorent use have a less mature security program. While slightly less than a quarter of the 30,700 companies studied had BitTorrent running in their networks, the peer-to-peer technology was much more common in some industries. Unsurprisingly, BitTorrent is common at educational institutions, with almost 60 percent showing signs of the peer-to-peer technology. The next-highest user, tourism and hospitality, had a much smaller rate of about 36 percent.
BitSight found that companies exposing peer-to-peer file sharing to the public Internet had much lower security ratings. Financial firms with no signs of peer-to-peer file sharing typically have the highest rating. Yet financial firms using BitTorrent have a security rating nearly 150 points lower, on BitSight's 800-point scale.
The firm stressed that the connection between BitTorrent is not causal: The networking technology does not cause breaches, but evidence that BitTorrent is running inside a corporate network is often a sign that the company has lax policies and a less mature security program, Jacobs said. The companies that allow the peer-to-peer service—or do not actively block it—are much more likely to have botnets and other compromised systems running inside the network, the company stated.
"If you don't have a policy around BitTorrent and peer-to-peer file sharing, you probably should put one in place," he said.
The peer-to-peer software also has a more direct link to compromises, according to the report. BitSight found that 43 percent of the applications, and 39 percent of the games, available on BitTorrent carried malware.
↧
Japanese Police Get Dedicated Drone Takedown Squad
Nuisance drones could soon find their rotors clipped after Japanese police create a dedicated drone takedown squad.
By Tom Jowitt
Growing awareness of the security risks posed by airborne drones has prompted police in Japan to create a dedicated drone squad.
The drone squad is equipped with a specialized drone that can intercept nuisance drones using a net to disable the target drone.
Nuisance Drones
According to the BBC, the police drone squad will be deployed to protect important buildings and presumably certain public events.
It seems that once a suspect drone has been detected, the drone operator will be warned (via loudspeakers). If the operator fails to heed the warning, the police will launch their own drone interceptor that will capture the target drone in a net.
A video of the interceptor drone in action can be found here.
"Terrorist attacks using drones carrying explosives are a possibility," a senior member of the police department's security bureau told the Asahi Shimbun Website. "We hope to defend the nation's functions with the worst-case scenario in mind."
Japan has had cause for concern about drones, and the unmanned aircraft are banned in a number of locations including airports, power plants, roads, and certain parks.
Earlier this year, in April, a drone landed on the roof of the Japanese prime minister's office. It was carrying a small amount of radioactive material, and although no one was hurt, a man was later arrested over the matter.
Security Threat
In September, a British drone enthusiast was banned from his hobby in the United Kingdom's first conviction for flying an unmanned vehicle unlawfully.
Nigel Wilson from Nottingham was originally arrested back in March after he was caught flying a drone over Manchester City's Etihad Stadium, but he also flew his drone over the Houses of Parliament, and Buckingham Palace.
He was banned from owning or operating a drone and fined a total of £1,800 for nine offences.
Currently, drones only can be used in the United Kingdom within sight of the operator and with permission of the Civil Aviation Authority (CAA).
The University of Birmingham recently highlighted the security risks of drones, especially as the aircraft could possibly be used by terror groups to attack public events.
Earlier this year, a drone crash-landed into stands during a match at the U.S. Open tennis tournament.
New York's JFK airport also recently reported that two flights had narrowly avoided colliding with drones recently, with the vehicles coming dangerously close to commercial planes.
Pop star Enrique Iglesias was left bloodied and bruised following a run-in with a drone in front of a crowd of 12,000 fans at a concert in Tijuana, Mexico as part of his 'Sex and Love' world tour.
↧
European Space Agency Breach Leaks Security Details
Hacker collective Anonymous said it carried out the attack as a Christmas prank.
By Matthew Broersma
Hackers have released thousands of login credentials and other data from the Web servers of the European Sp...
↧
↧
Juniper Patches Firewall Backdoor Risk
Older-model Juniper ScreenOS-based firewalls are patched for vulnerabilities that could leave organizations exposed to risk.
Networking vendor Juniper reported on Dec. 17 that it discovered multiple security issues in its ScreenOS network security operating system, including backdoor access code.
“During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker who can monitor VPN [virtual private network] traffic to decrypt that traffic," Juniper wrote in a statement emailed to eWEEK. "Once we identified these vulnerabilities, we launched an investigation and worked to develop and issue patched releases for the impacted devices."
Juniper also noted in its statement that the company has already reached out to affected customers, strongly recommending that they update their systems and apply the patched releases with the highest priority. For Juniper customers that may be impacted by the ScreenOS issue, Tod Beardsley, security research manager at Rapid7, recommends that, in addition to updating the firmware immediately, organizations also change passwords and investigate their own networks for potential compromises.
The backdoor issue is identified as CVE-2015-7755 and, according to Juniper's advisory, exploitation of the vulnerability can lead to complete compromise of a system.
"Upon exploitation of this vulnerability, the log file would contain an entry that system had logged on, followed by password authentication for a username," Juniper's advisory states.
Juniper is actually patching ScreenOS for a second security vulnerability as well. Juniper noted that there is a Secure Shell (SSH) bug in ScreenOS that could allow an attacker to conduct denial-of-service (DoS) attacks against ScreenOS devices. SSH is a commonly used technology to get administrative remote access to a system.
"The second issue may allow a knowledgeable attacker who can monitor VPN traffic to decrypt that traffic," Juniper's advisory states. "It is independent of the first issue."
A Juniper spokesperson told eWEEK that at this time the company is not sharing any additional information beyond that which is in the advisory. The advisory notes that Juniper's Security Incident Response Team (SIRT) is not aware of the vulnerabilities being exploited.
The purpose of network security devices such as firewalls is to defend the perimeter of a network from attack and to permit the secure traversal of data with VPN connections. ScreenOS is the primary operating system that runs on Juniper's Netscreen class of firewall devices, which is an older product group that has been superseded in recent years by Juniper's SRX firewall products. Unlike the Netscreen devices, the SRX firewalls are powered by Juniper's Junos operating system. According to Juniper, the newly found vulnerabilities are specific to ScreenOS and do not impact SRX. Juniper has recently announced a new strategy for a disaggregated Junos to enable a more flexible software-defined networking (SDN) approach.
The specific versions of ScreenOS that are impacted by the issue are ScreenOS 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20. ScreenOS 6.2.0r15 was first made available in September 2012, meaning that potentially an enterprise might have been exposed to the risk for three years.
Perhaps coincidentally, documents publicly posted December 2013 in Der Spiegel, from National Security Agency (NSA) whistleblower Edward Snowden, list Juniper's firewalls as devices that can be infiltrated. The Juniper firewalls were among a large list of items impacted by the operations of the NSA unit known as the Tailored Operations Unit, or TAO, which conducts operations that enable it to gain access to user PCs and computer networks in a number of ways.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
↧
What Flap Over Reporting Instagram Flaw to Facebook Teaches Us
NEWS ANALYSIS: In a public spat, a security researcher lashes out at Facebook about a reported Instagram bug, and Facebook's chief security officer responds.
In a perfect world, security researchers would be able to find bugs in software, report them to vendors, get paid for their efforts and everyone would be happy. While that's precisely how security reporting works in some cases, the information security world is far from perfect as an incident this week with Facebook's Instagram unit clearly illustrates.
Security researcher Wesley Wineberg publicly posted an extended rant about a vulnerability he reported to Facebook regarding remote code execution (RCE) flaws with Instagram. Wineberg responsibly reported the initial RCE flaw to Facebook's white-hat security program on Oct. 21. After that point is where this incident goes off the beaten path.
Facebook acknowledged Wineberg's report, for which he was awarded $2,500 on Nov. 16. However, Wineberg alleges that he found other issues that allowed broad access to Instagram.
"To say that I had gained access to basically all of Instagram's secret key material would probably be a fair statement," Wineberg wrote in a blog post. "With the keys I obtained, I could now easily impersonate Instagram, or impersonate any valid user or staff member."
Wineberg alerted Facebook that he intended to publicly write up his findings, which the company didn't take lightly. According to Wineberg, Facebook's Chief Security Officer Alex Stamos contacted the CEO of Synack, where Wineberg is a contract worker. Wineberg alleges that Stamos warned of possible legal repercussions if he were to publish his research about the Instagram risk.
To his credit, Stamos publicly responded with a Facebook note, detailing his view of the situation. Stamos agrees that Wineberg did, in fact, find and report an RCE flaw on Instagram for which Facebook awarded a bug bounty of $2,500.
The other issue alleged by Wineberg is where there is a disagreement. Stamos noted that using the RCE flaw, Wineberg found Amazon API keys and then used those keys to gain access to an Amazon S3 storage bucket that contained Instagram technical and system data.
"The fact that AWS keys can be used to access S3 is expected behavior and would not be considered a security flaw in itself," Stamos wrote. "Intentional exfiltration of data is not authorized by our bug bounty program, is not useful in understanding and addressing the core issue, and was not ethical behavior by Wes [Wineberg]."
In terms of the alleged legal threat, Stamos admitted that he contacted Jay Kaplan, CEO of Synack, and told him that legitimate bug research does not include exfiltrating unnecessary data.
"I did not threaten legal action against Synack or Wes, nor did I ask for Wes to be fired," Stamos wrote. "I did say that Wes's behavior reflected poorly on him and on Synack, and that it was in our common best interests to focus on the legitimate RCE report and not the unnecessary pivot into S3 and downloading of data."
Looking at both sides of this incident, there is a lot to be learned. First of all, Wineberg should be commended for his initial research and responsibly disclosing it to Facebook. Stamos' quick response to Wineberg's allegations that Facebook didn't properly address the issues should also be applauded.
Security researchers should be free to responsibly report and then disclose information about vulnerabilities; that's what makes us all safer. Security by obscurity just doesn't work. That said, there are boundaries and there is no need to cross those boundaries in order to actually improve security.
What Stamos has done with this incident is to clearly explain where the boundary exists.
This is not the first time that Stamos has refuted the claims of a security researcher. Stamos officially joined Facebook in June, after being the chief information security officer at Yahoo. While at Yahoo, in October 2014, Stamos admitted that Yahoo was the victim of a breach, though not by way of the Shellshock bug, as a security researcher had alleged.
Details matter, and sometimes there is a tendency in information security to generalize complicated issues. The concern with the Wineberg allegation was that somehow Facebook wasn't playing by the rules and was trying to silence a security researcher. As Stamos' detailed account of the situation claims, that wasn't the case.
"I strongly believe that security researchers should have the freedom to find and report flaws for the betterment of humanity," Stamos wrote.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.
↧
Juniper silent on claims that China was the source of compromise in ScreenOS
“Unauthorised code” in firewall operating system maintained in China
↧
More Pages to Explore .....
