Network Security
system security Linux network
system security Linux network The romanticized image of the digital nomad – a laptop on a sun-drenched balcony – rarely accounts for the actual friction of maintaining a professional development environment on the move. . The friction is amplified with Linux. We are looking for a setup that respects our kernel configurations, handles volatile network handovers, and maintains a strict security posture without the hand-holding of a consumer-grade OS – so, put simply, more than just a laptop and a sunny deck. The hardware is...
May 26, 2026
Server Securityopen-source Linux administration
open-source Linux administration Cron has existed in Unix and Linux environments for decades, handling backups, cleanup scripts, patching jobs, log rotation, monitoring tasks, and other maintenance work that administrators do not want to run manually. Most Linux servers rely on it constantly, which is exactly why attackers continue abusing it for persistence after a system has already been compromised. . Persistence through cron is not complicated. Attackers do not need a rootkit or advanced malware framework to maintain...
May 25, 2026
Vendors/Productssecurity breach linux
security breach linux A major internal repository breach at GitHub has exposed a critical and overlooked blind spot in Linux supply chain security. Kernel exploits, exposed SSH services, weak firewall rules, and vulnerable daemons dominated the Linux threat model for years, and in many environments, they still matter. But recent supply-chain incidents involving GitHub ecosystems, npm packages, and malicious developer tooling point somewhere else entirely: the developer workstation. . The breach matters because...
May 21, 2026
Security Trends access control multi-tenant
access control multi-tenant Linux administrators often face an ugly choice in the cloud: prioritize convenience and cost-efficiency by sharing infrastructure, or sacrifice those benefits for the sake of total isolation. Most modern Linux workloads don't live on their own private servers anymore. They live in shared environments like Kubernetes clusters, where multiple teams and services run side-by-side. It sounds efficient, and it usually is. . But cloud isolation isn't as ironclad as it looks on the diagram. If you...
May 21, 2026
Vendors/Productsincident response cloud security
incident response cloud security Managed Extended Detection and Response (MXDR) has become one of the most sought-after security services in the enterprise market — and with good reason. It promises the holy grail: broad visibility across endpoints, network, cloud, email, and identity, combined with the 24/7 human expertise most organizations simply cannot build in-house. . However, the rapid growth of the market has produced a wide range of providers whose capabilities vary considerably beneath the surface. Choosing the...
May 19, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security news
We found 23 articles for you...
82
cyber defenseinformation assuranceencryption policyExploring NSA Encryption Insights and Strategies for Collaboration
Does business really have anything to learn from government? I pondered this notion, listening to Margaret Salter, one of the top encryption policy experts at the National Security Agency, on IE Radio this week.. This normally secretive agency within the Department of Defense is flirting with more openness and a higher public profile. More than once I heard, "We don't generally do a lot of things like this" from NSA personnel while trying to arrange a time for Salter to appear on IE Radio. Salter is technical director of the vulnerability analysis and operations group within the NSA's Information Assurance Directorate. But since she also spoke at the RSA conference in San Francisco a few months ago, it's clear that agency personnel are getting out more, and that's good news because they have an interesting story to tell. And while not overly generous on details for obvious national security reasons, what they do choose to share may help government and industry learn from each other, as Salter stated this week. For instance, take the NSA insistence on two types of encryption on any communication, an article of faith in Agency orthodoxy. In a series of crypto-interoperability trials that Salter oversees, one uses Transport Layer Security (TLS) on both the client and browser, along with digital certificates; another uses a WPA2 client, using Extensible Authentication Protocol (EAP) TLS, passing X.509 certificates, with client devices running IPSec. The link for this article located at Internet Evolution is no longer available. . This normally secretive agency within the Department of Defense is flirting with more openness and a. business, really, anything, learn, government, pondered, notion, listening. . Alex
May 21, 2010
•
Government
77
security initiativeinformation assuranceprivacy managementCyber Security KTN Roadmap: Product Inception Security Strategy
The government-backed Cyber Security Knowledge Transfer Network (KTN) launched a new roadmap today intended to kick-start an international effort to engineer security into products from their inception. Building in Information Security, Privacy and Assurance (PDF) aims to overcome the siloed approach to security taken by many countries, according to Cyber Security KTN director Nigel Jones. Security at the core is extremely important. Trying to "bolt on" security, as so many distributions do, often leads to something less than really secure. Do you agree?. "We are trying to get international co-operation on building security in from the start, because the problem still remains and it is still unclear what the best way to do it is," he said. The roadmap covers how industry, governments and consumers can improve security and privacy, and includes a number of principal recommendations. The link for this article located at vnunet is no longer available. . Join a worldwide initiative to weave security into the foundational stages, promoting stronger privacy and trust.. Product Security, Information Assurance, Privacy Management, Security Initiative. . LinuxSecurity.com Team
Apr 30, 2009
•
Server Security
82
information assurancetraining complianceDOD directiveDOD Directive 8570.1: Training Standards For Contractors' Compliance
Contractors who are serious about getting Defense Department contracts should make sure now that their employees who have information assurance roles meet the standards set by DOD Directive 8570.1, according to panelists who spoke this morning at an Information Technology Association of America event. "There's not a downside to contractors being certified," said Phyllis Scott, president of training firm TTSC. Contracts will require it, and contractors who are already certified will have an immediate advantage, she said. . DOD approved the directive The link for this article located at Federal Computer Week is no longer available. . The Department of Defense's (DOD) security training requirements for contractors are critical for maintaining compliance and expanding business prospects.. DOD Security Training, Contractor Compliance, Information Assurance. . Brittany Day
Nov 17, 2006
•
Government
82
risk managementsecurity practicesinformation assuranceEssential Cyber Security Practices for Government Effectiveness
Ronald Reagan once famously said: "The nine most terrifying words in the English language are, 'I'm from the government and I'm here to help.'" Inside the government itself, the most terrifying words in the English language may be: "The information security office is here to facilitate your office's goals and objectives." . So says a new book, Larstan's The Black Book on Government Security (publication date October 2006), intended to introduce managers and IS professionals to the key cyber security challenges faced by all levels of government. The book notes that while awareness of the importance of cyber security is growing at all levels of government, awareness is one thing; action another. One of government's biggest challenges is to transition from a general awareness of cyber security to concrete implementation of good cyber security practices. Ensuring cyber security issues are championed by leadership, embraced by business managers, implemented by users and understood by all is like herding cats, it says, especially when cyber threats are very difficult to understand. . Larstan's "The Black Book on Government Security" delves into cyber security challenges for government entities, stressing adaptable risk management and proactive strategies.. Cyber Security Awareness, Government Strategies, Information Security Management, Risk Mitigation. . Brittany Day
Aug 29, 2006
•
Government
82
federal plancybersecurity researchR&D recommendationsFederal Cybersecurity Coordination Recommendations on R&D
The Bush administration has drafted a federal plan to improve cybersecurity research and development. Yesterday, the National Science and Technology Council, a Cabinet-level body that coordinates governmentwide science and technology policies, issued a preprint release of the “Federal Plan for Cyber Security and Information Assurance Research and Development.. In addressing gaps in the country’s current cybersecurity activities, the 121-page report recommends setting R&D priorities and strengthening coordination between agencies and the private sector. The plan also calls for implementing emerging technologies, road maps and metrics. It does not address specific funding levels or budgets. Industry officials and lawmakers had been urging the administration to improve federal cybersecurity and information assurance R&D. Officials are billing this plan as the first step toward developing a federal agenda. Members of more than 20 government organizations prepared the document as part of the Interagency Working Group on Cyber Security and Information Assurance. The link for this article located at Federal Computer Week is no longer available. . In addressing gaps in the country’s current cybersecurity activities, the 121-page report recommen. administration, drafted, federal, improve, cybersecurity, research, development. . Brittany Day
Apr 25, 2006
•
Government
82
open sourcetrusted computinginformation assuranceGovernment Initiatives in Secure Open Source for Remote Work
The Cabinet Office's Central Sponsor for Information Assurance, which co-ordinates information security projects across government, is investigating applications based around a highly secure open source operating system. The proof-of-concept systems being developed by the CSIA will use security enhanced Linux to support remote working and web services. Ministers were prompted to disclose details of the work following parliamentary questions tabled by Lord Harris of Haringey about the CSIA's activities in evaluating the security of open source software. . Responding on behalf of the Government, Lord Bassam said the unit was also sponsoring work at CESG, the Government's information assurance facility at GCHQ. "Among a range of IA capabilities being investigated is the future 'trusted computing platform'," he added The link for this article located at eGov Monitor is no longer available. . Responding on behalf of the Government, Lord Bassam said the unit was also sponsoring work at CESG, . information, cabinet, office's, central, sponsor, assurance, which, co-ordinates, secur. . Benjamin D. Thomas
Jun 24, 2005
•
Government
72
network securitysecurity measuresfirewallKey Firewall Security Insights for Effective Network Protection
A DMZ (Demilitarized Zone) is a combination of firewalls -- a perimeter network segment logically between internal and external networks. Also called a "screened subnet," its purpose is to enforce the internal network's IA policy for external information exchange and to provide external, untrusted sources with restricted access to releasable information while shielding internal networks from outside attacks. . . .. n the limited space available here, I cannot possibly address how to secure a firewall. Instead, I'll note the considerations that go into doing so and point you to some useful resources. CNSS Instruction No. 4009, revised May 2003, National Information Assurance (IA) Glossary defines a firewall as a "system designed to defend against unauthorized access to or from a private network." I prefer CERT's definition: "A combination of hardware and software used to implement a security policy governing the network traffic between two or more networks, some of which may be under your administrative control (e.g., your organization's networks) and some of which may be out of your control (e.g., the Internet)." A DMZ (Demilitarized Zone) is a combination of firewalls -- a perimeter network segment logically between internal and external networks. Also called a "screened subnet," its purpose is to enforce the internal network's IA policy for external information exchange and to provide external, untrusted sources with restricted access to releasable information while shielding internal networks from outside attacks. In some circles the DMZ is considered a part of the firewall, while other circles consider the DMZ the land of the sacrificial hosts. One way to think of a DMZ is as a group of hosts that are guided by a unique security policy. This policy balances some of the strictest controls against public access and availability requirements. The link for this article located at TechTarget.com is no longer available. . Robust firewall measures are crucial for cybersecurity, acting as barriers betweentrusted and untrusted networks while monitoring traffic with security rules. firewall security, DMZ, network protection, external threats. . Anthony Pell
Oct 28, 2004
•
Firewalls
67
authentication issueemail encryptionPGPExploring Email Encryption: Risks Of Trust And Impersonation
Gadi Evron, an information security researcher based in Israel, generally signs his posts to the list with his PGP signature, due to the fact that his email address is constantly used by spammers. Anyone who wants to verify an signed email is actually from the person claiming to send it, can do so. . . .. The trust that encryption generates can be deceptive, one researcher, a regular poster to the full-disclosure vulnerability mailing list, has discovered. Gadi Evron, an information security researcher based in Israel, generally signs his posts to the list with his PGP signature, due to the fact that his email address is constantly used by spammers. Anyone who wants to verify an signed email is actually from the person claiming to send it, can do so. What he did not reckon was that someone would try to use his PGP signature inside a spam email to impersonate him. . The trust that encryption generates can be deceptive, one researcher, a regular poster to the full-d. evron, information, security, researcher, based, israel, generally, signs, posts. . LinuxSecurity.com Team
Jun 01, 2004
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More