Researchers from Kaspersky Lab have released information about a large-scale cyber espionage campaign called Operation Red October (otherwise known as Rocra). The report has garnered the attention of multiple news agencies and generated many published articles since the Kaspersky report has claimed that attackers were targeting hundreds of diplomatic, governmental, and scientific organizations in numerous countries.
These reports indicate that the command-and-control (C&C) infrastructure that is used on these attacks receives stolen information using more than 60 domain names to hide its identity. Furthermore, this information appears to be funneled into a second tier of proxy servers. These are very clever attacks that many are now claiming have been taking place for more than five years! Red October is being compared with other malware that has been associated with cyber espionage such as Duqu, Flame, and Gauss.
Are you in the market for a new car in this year? Automotive retailers compete for your business in one of the most competitive industries, so reducing infrastructure and operating costs is key to selling you a car at the price you want.
Hendrick Automotive Group is the second largest privately held automotive retailer in the US, with 7,000 employees and 80 dealerships. Watch the 3:39 minute video for more information on how Hendrick is running every mission critical application on UCS, saving more than $100,000 annually, and helping the IT department become a profit center while offering superior service to both their employees and customers.
What’s been your experience with consolidation and virtualization in your data center? Are planning to use UCS in your data center? Join the conversation.
>> Interested in reading UCS customer success stories in your region? Read more at Data Center Case Studies
I have been coaching youth sports for the past seven plus years now and one of my common mantras when speaking to the girls and boys each season is that “we will win as a team and lose as a team.” In other words, I will never tolerate one player acting selfishly enough to think he or she is above everyone else on the team. I strive to instill the objective that we will collectively pool our talents for the betterment of the team. We use this approach because each boy and girl, believe it or not, brings with himself or herself a unique set of abilities and strengths with which the entire team will benefit.
So why should you care about my coaching philosophies? Read More »
Create community. Drive cross company collaboration. Raise the corporate security consciousness. Educate! These were the major themes present at the synergistic 5th annual Cisco SecCon held December 5-6, 2012, at Cisco’s corporate headquarters in San Jose, CA. The senior leadership team in the Security and Government Group had a clear and present message for the Cisco Engineering community: Security is the differentiator for Cisco! Building and developing our corporate security awareness and driving it into our DNA is part of what makes Cisco—a company dedicated to continuous improvement—unique as a top industry leader.
The message is clear: security must be pervasive in every aspect of every product we design, develop, and deploy. It’s what our customers expect, and SecCon is one of the major delivery vehicles for creating a unified front within the engineering community as part of Cisco’s evolution towards the Internet of Everything. The more the world becomes interconnected, the more important it is that product designers, developers, testers, and implementers are aware and educated about the importance of the security mindset. How we think about security dictates how we act. This is something the Cisco leadership team is keenly aware of, and their intent to mature security capabilities and features into our entire product line is evident as they work to bring together industry security advocates to drive change and continuous improvement at the annual SecCon conference. Read More »
Secure software is a hot topic these days and many people have ideas about what should be done to achieve it. For years, the focus of many software vendors was on security features. Add a firewall. Add SSL to secure data flows. Positive security features are great, but they don’t do much to address every potential security issue that result from insecure code.
At this year’s Cisco SecCon conference, Bryan Sullivan, Microsoft’s Security Program Manager, addressed the issue of writing secure code with a diagram like the following:
His point is that there is much more work to do in securing all the features of a product than simply writing the security features. Writing security features, although important, is only 10% of the workload of creating secure code. The other 90% of the coding work is meant to ensure that all non-security codebase is secure. This includes input validation, output encoding, and overflow defense.
These practices are part of software quality, and they don’t usually appear on a feature list and often fail to appear on customer requirements lists. Customers don’t often ask for things such as:
This product should be free of cross-site scripting vulnerabilities
This product shouldn’t have client-side security validation that can be bypassed by a determined attacker
This product shouldn’t store my passwords or key data in plain text files might be leaked
