NetSec
  corner   



HOME

LINUX

CYBERLAW

VIRTUALIZATION

Bugtraq

Packetstorm

FD

GrokLaw


RSS Feed


Netsec, comsec, infosec and IA news, research and trends

 

12.30.2006

 
"Merry Christmas themed malware"; by F-Secure



12.28.2006

 
"IP subnetting made easy"



12.26.2006

 
"Test Piracy: The Darker Side of Certification"



12.25.2006

 
""Surprise Microsoft Vista has Security Flaws""
http://money.cnn.com/2006/12/25/technology/microsoft_vista_flaws/index.htm?cnn=yes

 
MERRY CHRISTMAS!!!



12.22.2006

 
"Microsoft Hands Out 16,000 SUSE Linux Subscriptions"



12.21.2006

 
"Employers to seek more security talent in '07"

 
Wireless Network Head-to-Head: Cisco Vs. Meru - from Ed



12.20.2006

 
Banking on Security



12.19.2006

 
Skpe Worm in the Wild



12.18.2006

 
An Ominous Milestone: 100 Million Data Leaks



12.16.2006

 
Worm Alert: Big Yellow Affects Symantec AV



12.14.2006

 
Senator Leahy: "Expect data privacy and patent law rewrite" by Anne Broache



12.13.2006

 
CATO Report on Data Mining and Terrorism

Though data mining has many valuable uses, it is not well suited to the terrorist discovery problem. It would be unfortunate if data mining for terrorism discovery had currency within national security, law enforcement, and technology circles because pursuing this use of data mining would waste taxpayer dollars, needlessly infringe on privacy and civil liberties, and misdirect the valuable time and energy of the men and women in the national security community.

 
Nessus flaw scanner groks SCADA

 
The Ten Most Important Security Trends of the Coming Year

 
UCLA Now Top-Ranked School for Identity Theft

 
"Congress and tech: Little to show" by Declan McCullagh

 
"Slipping tech laws in via the back door" by Declan McCullagh



12.12.2006

 
Forensic Discovery by Dan Farmer and Wietse Venema is now online for free but you should buy it anyway.

 
Holiday Gathering - Thursday, Dec. 14th 7pm - 438 High St - RSVP

 
Shmoocon Tickets on Sale - Early bird $75 Tickets for December Sold Out - Next Round of Cheap Seats Goes On Sale Jan 1st

 
CFP: Seventeenth Conference on Computers, Freedom, and Privacy (CFP2007) - Montreal, May 1-4, 2007

 
Paper: IDENTIFICATION OF SOURCES OF FAILURES AND THEIR PROPAGATION IN CRITICAL INFRASTRUCTURES FROM 12 YEARS OF PUBLIC FAILURE REPORTS by H. A. Rahman, K. Beznosov, J. R. MartĂ­

 
Yet Another Word 0-day Vulnerability

 
The Square Root of Terrorist Intent

 
"Hacker" attack at UCLA affects 800,000 people



12.11.2006

 
IAAC - Directors and Corporate Advisors’ Guide to Digital Investigations and Evidence

 
You might be infected with spyware if...



12.10.2006

 
Free Book - Handbook of Applied Cryptography from Rob F



12.08.2006

 
TiVoToGo DRM cracked

 
Dead musicians lobby for copyright term extensions

 
Ohio U. names interim CIO to replace William Sams following security lapses that led to the firing of two IT workers - Malware wars: Are hackers on top? - From Andy



12.07.2006

 

U.S. outlines privacy safeguards - and reveals plans to mine personal data. "The government is preparing to give millions of law-abiding citizens 'risk assessment' scores that will follow them throughout their lives...none of us will have the ability to know our own score, or to challenge it..."

government of the government, for the government, by the government. The terrorists have won, Im moving to Gaferut...

 
A Critical Look at the Regulation of Cybercrime

 
RIAA wants to pay artists less royalties for their content.

 
CFP2: 2007 International Workshop on Autonomous Intelligent Systems -- Agents and Data Mining



12.06.2006

 
Enterprise Incident Response - Network and Disk Analysis

 
Podcast: Defense by Offensive Hacking - Vulnerability researcher Dave Aitel talks about simulated hacking attacks, penetration testing tools and techniques, the resiliency of Vista, and his unique take on the vulnerability disclosure debate



12.05.2006

 
FBI taps cell phone mic as eavesdropping tool

 
FBI computer system short on funds - MySpace building sex offender database - Hackers hit Naval War College computer network - From Tom

 
Security Of Electronic Voting Is Condemned

 
Cat and mouse, on the web

 
Amendments to the Federal Rules of Evidence, Federal Rules of Civil Procedure, and Federal Rules of Criminal Procedure took effect Friday. There seems to be a lot of misinformation out there which is typical when non-lawyers try to make sense of the law. Being a non-lawyer myself, I shall endeavor to add to the noise!

In short, the new rules state that organizations must track data collected and, should they become aware of pending legal action, endeavor to preserve all relevant data. The outcome is that all organizations need to have document retention and destruction policies in place. These policies must be adhered to in a consistent manner in order to avoid the appearance of impropriety. Documents (like email) may be safely destroyed in a manner consistent with this policy. However, once an organization becomes aware of a lawsuit that may affect these records, the organization must endeavor to preserve all relevant evidence in order to avoid the appearance of impropriety. This requires that the organization be aware of what sort of records they have. This is a good reason for organizations to limit what data is collected and retained as a systematic part of managing corporate liability.

The history of this clarification is in the Enron case. Arthur Andersen had document destruction policies in place but failed to follow them. When served with a subpoena in the Enron case, AA officials suddenly "followed" their policy by shredding tons of documents and by deleting email. Deleting a file NEVER really deletes it so many of the emails were later recovered. This created the appearance of impropriety and doomed them before the court. AA is no longer allowed to even practice accounting as a result. Lesson learned: If they had adhered to their policies in a consistent manner, they still would have been "wrong" in the big picture sense but they would have been within their rights under the law.

Certain records like financial statements, medical data, etc. have legal retention periods. Ensure that any policy created adheres with these requirements. Email Retention Policy (sample policy): Specify an online retention period of roughly 3-6 months, an of roughly 12-24 months. The time interval is going to vary widely based upon the organizational goals, objectives and liabilities. This type of decision making should really flow from the top but the hard part is that "the top" may be a group of people with diverse backgrounds and little understanding of the importance of such policies in terms of managing legal liabilities.

Document Retention and Destruction Post-Arthur Andersen: What Can You Destroy? - Perfecting the Document Destruction Policy - A Brave New World

Note: I am not an attorney. This is not legal advice. If you require legal advice, please consult with an attorney.

 
E-Mail Retention: The High Cost of Digging Up Data



12.04.2006

 
VoIP Security - Does it exist? by Sheran Gunasekera

 
What's on Tap for IT Pros in 2007? By Deborah Rothberg



12.03.2006

 
Tools from last week's labs - tcpxtract is a tool for extracting files from network traffic based on file signatures. tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging.

 
Wi-Fi Liability: Potential Legal Risks in Accessing and Operating Wireless Internet by Robert Hale II



12.02.2006

 
College B-ball team scores 201 points in game - I wonder how their opponents felt?

 
MPAA and their utter genius at it again.



12.01.2006

 
The leader of a hacking group called "WhiteHat Team Victor Faur, 26, of Arad, Romania, was charged with nine counts of computer intrusion and one count of conspiracy.

http://www.cnn.com/2006/TECH/12/01/hacker.charged.ap/index.htm

 
The Seoul of a New Machine - Can you say Skynet?

 
The irony of it... "Naval War College Computers Taken Off-line, Network Attack Attributed to China"

 
Can the RIAA call your boss?

 
Internet Archive gets DMCA exemption

"The Internet Archive has successfully lobbied for a DMCA exemption for the Software Archive. The IA keeps out-of-date programs, games and other random craziness for future programmers to savor. At the rapid pace of software development, this makes sure that we can create a history for us to remember and wonder at the programming of early games."

From Slashdot





This page is powered by Blogger.


Site Meter Locations of visitors to this page