Organizations are faced with providing security for employees that are rapidly adopting new technology in their personal and professional lives and expect their work environments and employers to do the same. As the data from the new Cisco 2011 Annual Security Report and the Cisco Connected World Technology Report Chapter 3 show, organizations that do not or cannot provide that type of environment are at risk of losing the ability to compete for those employees and business opportunities. If employers attempt to block, deny, or forbid mobile devices, social networks, instant communications, and new technologies in the work place employees will likely ignore the policies or, even worse, find ways around them that open your environment to unrealized risks.
As a new father and a security professional, it terrifies me to think of my daughter roaming freely around the Internet. However, I feel like restricting her completely will cut off a valuable avenue for education.
Recently, it seems in the media there has been a push to move websites that contain adult content into the .xxx sponsored top level domain (sTLD) in order to easily classify them. While I understand the reasoning for this, there is definitely a large spectrum of additional content which, in my opinion, is unsuitable for children and disallowing access to this sTLD would not provide an adequately restricted environment.
It’s happening every day. People are inadvertently sharing one of the most personal and private pieces of information, the infamous social security number (SSN). For Jonathan Barnett, the unbelievable became a reality when he discovered that nearly 50 names were connected to his SSN. The irony is that his credit report and social security earnings records are clean. The nation’s creditors, employers, and many others depend on this identity system predicated on SSNs.
The Cyber Risk Report for November 7 through 13 covered the second consecutive Social Engineering Capture the Flag event that was organized by Defcon 19 (a prominent industry “underground” security conference). The event proposes a challenge to competitors with the focus of leveraging social engineering tactics to successfully obtain key company information from a list of prospective companies, with the ultimate goal (based on the past two years) of raising awareness of the threat impact social engineering has on organizations. Furthermore, the competition highlights the common tactics and aspects that social engineers employ. As this year’s competition drew to a close, the Social Engineering CTF Results Report (which provides a debrief of the event, outcomes, and lessons learned) puts an emphasis on the techniques utilized, and the reasons why the respective techniques ultimately succeeded or failed.
Black holes, from a network security perspective, are placed in the network where traffic is forwarded and dropped. When an attack has been detected, black-holing can be used to drop all attack traffic at the edge of an Internet service provider (ISP) network, based on either destination or source IP addresses. Remotely triggered black hole (RTBH) filtering is a technique that uses routing protocol updates to manipulate route tables at the network edge or anywhere else in the network to specifically drop undesirable traffic before it enters the service provider network.