Providing security for software systems in the cloud [ Source: HP ]
May 2013-
The software industry has learned that putting fancy boxes on the network doesn't fix bad software, cloud converts must focus on the risks they bring along with the software they deploy. This paper details risks to software deployed in the cloud and what steps to take to mitigate that risk.
Sponsored by:
<...
Just Released! Hope is Not a Strategy [ Source: Neustar ]
April 2013- When DDoS attacks hit, companies go into crisis mode. It's all hands on deck until the danger passes. In February 2013, Neustar surveyed IT professionals across North America to see how companies are managing the crisis and measuring its bottom-line impact. The report compares 2012 results with survey findings from 2011, detailed in last year's Neustar report "When Businesses Go Dark."
The 451 Group Impact Report: Skybox Enters Vulnerability Management Space [ Source: Skybox Security ]
April 2013- New vulnerabilities are discovered at a rapid rate, so in order to discover and defend against them, companies conduct vulnerability scanning. However, the frequency and coverage of scans provide increasing challenges for some organizations. Active scanning can be disruptive if conducted excessively, and there are some parts of the network that companies don't feel comfortable scanning at all. In order to address this problem, Skybox Security has introduced what it refers to as its next-generation ...
The State of APT Preparedness [ Source: Lumension ]
March 2013- Many IT security professionals recognize that advanced persistent threats (APTs) pose a growing risk to their organizations. However, recent UBM Tech research discovered that only a few are taking the necessary steps to combat APTs and protect their organizations. In fact, many appear to have a misplaced sense of confidence in their ability to detect these attacks, even though few have developed strategies for dealing with them. This gap is particularly troubling since security experts ...
McAfee Vulnerability Manager Product Review by S3KUR3 Inc [ Source: McAfee ]
February 2013- Threats and vulnerabilities are a way of life for IT admins. This paper focuses on how McAfee's Vulnerability Manager and McAfee ePolicy Orchestrator provide IT Admins with powerful and effective tool for identifying and remediating vulnerable systems.
ESG Technology Brief: Real-Time Risk Management [ Source: McAfee ]
February 2013- Information security based on regulatory compliance stipulations cannot keep up with today's sophisticated and rapidly changing threat landscape. CISOs need to implement a new discipline that ESG calls, "Real-time Risk Management."
Miercom Lab Test Report - McAfee Risk Management Solution January 2011 [ Source: McAfee ]
February 2013- Taking a risk-based approach to vulnerability lifecycle management is becoming the norm for vulnerability assessment vendors. This paper reports on the findings when testing McAfee's Risk Management solution from a holistic risk management and vulnerability lifecycle management perspective.
Gartner MarketScope for Vulnerability Assessment Report [ Source: McAfee ]
February 2013- Vulnerability assessment vendors compete on management features, configuration assessment, price, reporting and integratin with other security products. Buyers must consider how VA will fit into their overal vulnerability management process when evaluatiing VA products and services.
Top 10 Reasons Your Company Does NOT Need McAfee Vulnerability Manager [ Source: McAfee ]
February 2013- Some IT and Security teams wonder if automated vulnerability management is important given the many pressing demands for other IT projects and investments they face. The purpose of this paper is to help these IT and Security professionals evaluate their security posture and risk.
Protect Critical Assets with Virtual Patching White Paper [ Source: McAfee ]
February 2013- As long as there is software, there will be software vulnerabilities. And wherever there are vulnerabilities, you will find malware and cybercriminals. This paper will examine that risk and provide a step by step process to protect your companies critical assets.
Discover. Evaluate. Act. White Paper [ Source: McAfee ]
February 2013- Up until now, your view of risk while monitoring your network has been incomplete. This white paper discusses a new, innovative approach to protecting your network through a combination of active and passive network discovery and monitoring, in real-time.
Using ADC's to Effectively Mitigate DDoS Attacks [ Source: F5 ]
February 2013- Companies are in high alert to fight off Distributed Denial of Services (DDoS) attacks that can halt business and amount to a costly burden on companies and customers. DDoS attacks are increasing in volume, frequency, and sophistication, and they are targeting every level in the data center. Smart organizations are moving to defend not only their network, session, and application layers, but also their business logic and database tiers as well. In defense, today's enterprises ...
Skybox Security Vulnerability Management Survey [ Source: Skybox Security ]
April 2013-
Survey reveals pitfalls of traditional vulnerability scanners
Learn what IT professionals had to say about vulnerability management programs at their organizations, including how often and what zones they scan, and the challenges they encounter.
The Skybox Security Vulnerability Management Survey 2012, conducted in conjunction with Osterman Research, polled more than 100 IT decision makers including security managers, and network and systems engineers involved in vulnerability management processes.
Among the findings:
<...
The State of DDoS Protection: Organizations Remain Unprepared for DDoS Attacks [ Source: Neustar ]
December 2012-
Distributed denial-of-service (DDoS) attacks continue to grow in size, complexity and danger. Witness the recent wave of attacks on major U.S. banks, which knocked websites offline, angered customers and took a grave toll on brand reputations. The lessons of those attacks echo the findings of this report: Previously successful DDoS mitigation solutions no longer work.
UBM Tech conducted research with IT professionals who have suffered DDoS attacks. The drastic changes in attack ...
Tolly Report: Anti-Virus Performance in VMWare ESX Virtual Environments [ Source: Symantec ]
October 2012- Symantec Corp. commissioned Tolly to benchmark the performance of its new Symantec Endpoint Protection (SEP) 12.1 within VMware ESXi 5 virtual environments vs. Trend Micro Deep Security 8. Specifically, this testing focused on the system resource requirements of each solution when performing on-demand and on-access scanning, and during distributed virus definition update
Dennis Technology Labs - Effectiveness in Virtual Environments [ Source: Symantec ]
October 2012- This report from Dennis Technology Labs compares the effectiveness of anti-malware products designed to run in virtual desktop environments. This test aims to compare the effectiveness of the most recent releases of anti-malware products designed to run in virtual desktop environments.
Cybersecurity in Action [ Source: Guidance Software ]
October 2012-
4 Days, 465 Systems, 3 continents
The Zeus Trojan virus was destructive enough, but the tech media are constantly alerting us to evolving threats to every industry. The good news is that you can transform the way your organization exposes, analyzes, and respond to advanced endpoint threats and errant sensitive data.
Here are seven quick case studies to prove it. Download these real-world examples of how customers in industries such as financial services, hospitality, ...
Achieving Compliance in Digital Investigations [ Source: Guidance Software ]
October 2012-
80% of organizations suffering payment card breaches had not achieved compliance with PCI DSS at the time of the breach. – Verizon 2011 Data Breach Investigation Report
As regulation and litigation increase, internal investigators must support an alphabet soup of compliance obligations: SOX, GLBA, FISMA, HIPAA, PCI DSS, regional privacy laws, and more. Although each regulation is different, these laws share common investigation requirements in three areas: policy, control infrastructure, and incident response.
This ...
How Three Cyber Threats Transform the Role of Incident Response [ Source: Guidance Software ]
October 2012-
“The theft began with an instant message sent to a Google employee in China who was using Microsoft’s Messenger program… Ultimately, the intruders were able to gain control of a software repository used by the development team.” - New York Times - Cyberattack on Google Said to Hit Password System
While we still use many of the same old names - viruses, Trojans, and worms - today’s malware enables potent multistage ...
Securing the Cloud [ Source: F5 ]
October 2012- Cloud computing has become another key resource for IT deployments, but there is still fear of securing applications and data in the cloud. These concerns include authentication, authorization, accounting (AAA) services; encryption; storage; security breaches; regulatory compliance; location of data and users; and other risks associated with isolating sensitive corporate data. Add to this array of concerns the potential loss of control over your data, and the cloud model starts to get a little scary. ...
The 5 Key Benefits of Application Control and How to Achieve Them [ Source: Sourcefire ]
September 2012-
Employees feel more empowered than ever to use any application they believe will help them do their job. And attackers are taking advantage of the sheer volume of applications, the Bring-Your-Own-Device (BYOD) trend, social media and other opportunities to glean information and penetrate networks.
How do you encourage productivity and minimize risks?
Application control is key.
Read "The Five Key Benefits of Application Control and How to Achieve Them," ...
SCADA Product Sheet [ Source: Norman ]
July 2012- SCADA (Supervisory Control and Data Acquisition) describes computerized industrial control systems that monitor and control industrial and infrastructure processes. With recent attacks, manufacturers, utilities and industries must now implement solutions to protect their SCADA systems. See the product sheet to learn how the Norman SCADA Protection system protects against cyber-attacks that target critical SCADA systems.
Automated Malware Analysis Whitepaper [ Source: Norman ]
July 2012- The risks of malware analysis are easily surmountable through the use of an automated dynamic malware analysis platform such as Norman's Malware Analyzer G2 (MAG2). MAG2 provides additional benefits to analysts in their fight against a constantly growing and maturing malware threat landscape. To learn more about Norman?s Malware Analyzer G2 defense-in-depth strategy see the Norman Automated Malware Analysis Whitepaper.
Four Keys to Effective Next-Generation Security [ Source: Sourcefire ]
July 2012-
Today's targeted threats are often multi-vectored and exploit unknown vulnerabilities - their sophistication defying typical signature-only based inspection. Whether APTs or client-side threats, they use evasive techniques to penetrate our organizations, often purporting to be or riding on applications and exploiting trust relationships with which we've grown all too comfortable with.
To make matters worse, attackers have realized the inadequacies of traditional signature-based approaches and have accelerated the pace of change and obfuscated ...
The Case for the Next-Generation IPS [ Source: Sourcefire ]
July 2012-
A Next-Generation IPS (NGIPS) offers a logical and essential progression of capabilities needed to protect networks from emerging threats. Pioneered by Sourcefire®, and now endorsed by Gartner, the NGIPS builds on typical IPS solutions by providing contextual awareness - about network activity, systems and applications, people, and more - to promptly assess threats, ensure a consistent and appropriate response, and reduce an organization?s security expenditures.
The purpose of this paper is:<...
Manage Identities and Access for Continuous Compliance and Reduced Risk [ Source: IBM ]
June 2012-
Controlling access to data and applications is vital considering escalating security and privacy concerns. Organizations must prove they have strong and consistent access controls. They also want to ensure that decisions made about user entitlements are in line with their business goals and policies. IBM identity and access management (IAM) governance provides the resources to manage business-specific user access requirements with greater accountability and transparency.
Learn more about our policy-driven approach and end-to-end ...