EnGarde Secure Community 3.0.22 Security Threats Report Summary

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.22 (Version 3.0, Release 22). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

Like you, I have also read many articles covering small business security, the authors of which have made up various lists of "top X threats" or "this year's biggest vulnerabilities," etc. So I thought it would be interesting to dig into a sampling of the data breach reports and collect some real data on causes of breaches and other security incidents in SMBs.

For years the Pirate Bay file-sharing index portal has skated on legally thin ice, but now the site's search engine popularity has ironically been hijacked by typo-squatting hackers.

Just as software is everywhere, flaws in most of that software are everywhere too. Flaws in software can threaten the security and safety of the very systems on which they operate. The best way to prevent such vulnerabilities in software is to proactively incorporate security and other non-functional requirements into all phases of Software Development Lifecycle (SDLC).

Two of the three hackers who disrupted the website Comcast Corp. maintains for its Internet customers were sentenced to 18 months in prison Friday by a federal judge in Philadelphia.

Though database security best practices have circulated the conference circuit for years now and existing database security tools are now mature, today's typical enterprise is still far behind in shoring up its most sensitive stores of data.

On Friday, in the Bethel Methodist Chapel in Angelsey, the funeral was held of Gareth Williams. In life, he was a mathematician and an encryption specialist so highly regarded that he was seconded from GCHQ in Cheltenham to work at MI6 in London.

I've said it before, use upper and lower case, use number and letter combinations and when possible, if the website allows it, use special characters. It has been documented that "Adding just one capital letter and one asterisk would change the processing time for an 8 character password from 2.4 days to 2.1 centuries."

How confident are you that your computer is safe from an online attack? Chances are you rely on vendors like Microsoft and Apple to let you know when a security update is ready to be installed. (Google updates systems automatically.)

Developers of Samba have warned that every edition of Samba has severe vulnerability, which cyber-criminals can abuse without difficulty. The flaw makes all Samba versions till as early as 3.0 vulnerable. Incidentally, the 3.0 version was launched over 5 years back.

Preconceptions that some operating systems are safer than others are misguided, a security expert has claimed. In reality all systems have their flaws which hackers will attempt to exploit and, despite some people's belief Linux and Mac users are safer, all are vulnerable, said David Jacoby, a senior security researcher at Kaspersky.

The emerging OAuth 2.0 web API authorisation protocol, already deployed by Facebook, Salesforce.com and others, is coming under increased criticism for being too easy to use, and therefore to spoof by malicious hackers.

It infected thousands of Twitter accounts, even reaching the White House itself. But the virus that caused havoc on the microblogging site was not started by a shadowy group of hackers - it was discovered by a 17-year-old schoolboy.

Although cyber scamming is nothing new, the way thieves use the data is constantly changing, and social media is a gateway to the latest scams. Identity theft experts fear that by sharing seemingly mundane personal details and preferences on social networking sites, people might be giving the bad guys clues about their security codes.

They say that some things last forever, like diamonds or true love or Twinkies. But should browser cookies used for tracking be added to that list?

The latest hacker to hit Twitter this week unleashed a smutty bit of code that redirected unwitting users to a porn site. Such hacks are certainly unwelcome, but they resemble the not-for-profit pranks pulled by hackers of a bygone era. Nowadays, black-hat hacking is big business. Will malware writers soon see more financial opportunities in attacking Twitter?

Linux is well-known for its security advantages over many other operating systems, but that doesn't mean it's immune to problems. A Linux kernel flaw first discovered earlier this month, for example, gives hackers a way to not just gain root privileges in 64-bit Linux operating systems but also to leave a "back door" open for further exploitation later.

The more apps companies deploy, the more complicated vulnerability management becomes. In the rush to find every security hole and seal it off from potential hackers, it's easy to let something important slip through. That's especially true if you're an IT administrator juggling several tasks of which security is one.

The past week in security saw the HDCP master key get exposed, HP's deal to purchase ArcSight and revelations about the Stuxnet worm targeting industrial systems.

Typically, implementing two factor authentication means buying tokens or smart cards for all of your users. This can be expensive (from what I have seen $50/user is typical in smaller deployments) and it is only manageable for users with whom you have an existing relationship (employees, in some cases customers).

Corporate video conferences can still be easily hacked by insiders using a freeware tool that allows attackers to monitor calls in real-time and record them in files suitable for posting on YouTube.

Attackers have used a freely available exploit to target a number of 64-bit Linux machines, according to a Linux patch management software firm.

Malicious hackers are preying on iPhone users who want to jail-break their devices, exploiting the increased interest around jail-breaking tools to launch malware attacks.

Caterpillars, roaches and worms crawl on a computer, which represents an infected computer, next to a clean one, in a display that illustrates computer safety at Hacktivity, in Budapest. The major hackers' conference wrapped up in Hungary Sunday after higlighting protection against increasingly sophisticated computer piracy as the Internet becomes ever more present in daily life.

The denizens of 4chan launched a series of distributed denial of service attacks against entertainment industry websites over the weekend, protesting legal actions against torrent tracker website the Pirate Bay.

Away from the elegance of Budapest's historic centre, a dingy rock venue has been turned into a geek's paradise. The laptop screens glow in the dim light as fingers flicker quickly over keyboards. Lines of code, incomprehensible to all but the cognoscenti, are typed out.

"Two-factor authentication" may be the least sexy-sounding feature I've ever written about. But if you've ever worried about being phished or having your password hacked, it could be your best friend -- because it makes it much, much harder for a hacker to break into your account.