This week, perhaps the most interested articles include "Problems with Penetration Testing," "Access Remote Network Services with SSH Tools," and "Protecting a Web Application Against Attacks Through HTML Shared Files."

Earn your MS in Info Assurance online

Norwich University's Master of Science in Information Assurance (MSIA) program, designated by the National Security Agency as providing academically excellent education in Information Assurance, provides you with the skills to manage and lead an organization-wide information security program and the tools to fluently communicate the intricacies of information security at an executive level. Learn more

LinuxSecurity.com Feature Extras:

A Secure Nagios Server - Nagios is a monitoring software designed to let you know about problems on your hosts and networks quickly. You can configure it to be used on any network. Setting up a Nagios server on any Linux distribution is a very quick process however to make it a secure setup it takes some work. This article will not show you how to install Nagios since there are tons of them out there but it will show you in detail ways to improve your Nagios security.

Never Installed a Firewall on Ubuntu? Try Firestarter - When I typed on Google "Do I really need a firewall?" 695,000 results came across. And I'm pretty sure they must be saying "Hell yeah!". In my opinion, no one would ever recommend anyone to sit naked on the internet keeping in mind the insecurity internet carries these days, unless you really know what you are doing.

Read on for more information on Firestarter.

Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headline.

EnGarde Secure Community 3.0.21 Now Available (Oct 7)

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.21 (Version 3.0, Release 21). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database, e-mail security and even e-commerce.
Problems with Penetration Testing (Nov 14)

Penetration testing is as popular as ever, yet it continues to miss the mark. As a means of validating the security of an application system, it fails miserably on several counts.

I continue to find organizations that make extensive use of penetration testing as their primary means of security testing systems before they go live, or periodically while they are in production. There are a myriad of problems with this approach, but I'd like to address one particular here that you likely haven't considered.

This article looks at some of the issues with doing penetration testing. Do you do penetration testing on your applications?
Samurai - Web Application Security LiveCD (Nov 12)

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test.

This article looks at the web testing framework live CD called Samurai. It has some interesting features so, check it out. Do you use any other Linux security live CD's?
Access Remote Network Services with SSH Tools (Nov 11)

You probably rely on the services on your own private network -- wikis, mail servers, Web sites, and other applications you've installed. What happens when you have to leave the friendly confines of your network? With minimum exposure and few simple tools, you can get all of the comforts of home anywhere you can find an Internet connection.

Do you want to learn how to use SSH tools to access services on a remote private network securely? Read on to find out about some of the features of SSH which you may not be familiar with.

news/network-security/access-remote-network-services-with-ssh-tools
Protecting a Web Application Against Attacks Through HTML Shared Files (Nov 10)

"Many Web applications have a file-sharing feature that allows Web users to share files by uploading them to, and downloading them from, a Web-accessible file repository. Shared files may include HTML files and other files containing scripts that are executed by the browser in the security context of the user that downloads the file. This opens the door to a range of crossuser attacks, including attacks by former users and even attacks by a user of a virtual application instance against a different virtual instance of the same application. Such attacks are in essence XSS attacks, but the usual defenses against XSS are typically not available, because shared files cannot be sanitized."

The title of this article caught my eye. This article looks at ways to protect your Web applications against attacks through HTML shared files. Read on for more information....

news/network-security/protecting-a-web-application-against-attacks-through-html-shared-files