NASA reported 1,120 security incidents that have resulted in the installation of malicious software on its systems and unauthorized access to sensitive information in fiscal years 2007 and 2008, according to a report issued Thursday by the Government Accountability Office. And, the GAO reports, National Aeronautics and Space Administration systems remain vulnerable despite the establishment of a security operation center last year to deter such incidents.
"The control vulnerabilities and program shortfalls, which GAO identified, collectively increase the risk of unauthorized access to NASA's sensitive information, as well as inadvertent or deliberate disruption of its system operations and services," wrote Gregory Wilshusen, GAO's information security issues director, in a report cosigned by GAO Chief Technologist Nabajyoti Barkakati. "They make it possible for intruders, as well as government and contractor employees, to bypass or disable computer access controls and undertake a wide variety of inappropriate or malicious acts. As a result, increased and unnecessary risk exists that sensitive information is subject to unauthorized disclosure, modification, and destruction and that mission operations could be disrupted."
En el año 1988, la Association for Computing Machinery (ACM)
declaró al 30 de Noviembre como el “Día Internacional de la Seguridad Informática”, con el objetivo de concientizar respecto de las amenazas que atentan contra la seguridad de la información
Link relacionados:
- Las organizaciones siguen expuestas a riesgos de seguridad evitables
- La mayoría de las empresas siguen expuestas a retos de seguridad evitables
Visto en community.websense.com/blogs
Link relacionado:
- Websense Security Labs reporta un aumento de 671 por ciento de sitios web maliciosos
El 41 por ciento de las organizaciones que afirman haber implementado el estándar ISO27001 siguen manteniendo malas prácticas de gestión como compartir cuentas de usuarios privilegiados
Sample report: 2010 Global state of information security survey
- 2010 Global state of information security survey sample report (pdf, 69 KB)
- 2010 Global state of information security survey sample report (xls, 421 KB)
Today, in the middle of the worst economic downturn in thirty years, information security has an enormously important role to play.
What are the implications of these trends on how your business is addressing the challenges of the economic downturn? What expectations should you be placing on your information security function at this time? Which areas of focus offer the best opportunities for security to provide concrete business value—not just over the long run but right now, during an unusual economic period?
Download: Trial by fire - What global executives expect of information security—in the middle of the world’s worst economic downturn in thirty years.
El análisis del tráfico de red, junto con su contenido, es esencial para conocer qué uso se le ha dado a la red en un momento determinado.Imagináos un servidor infectado mediante un exploit lanzado de forma remota. O conocer a ciencia cierta que están robando información confidencial de la empresa. Gracias a la reconstrucción del tráfico de red, es posible que se puedan dar respuesta a un buen número de cuestiones....
Sophos Free Encryption es una aplicación que te permite proteger tus archivos de miradas curiosas. Ya sean documentos con información sensible, fotografías, respaldos de seguridad… todo lo que no te gustaría que nadie más viera.
No cuenta con una gran cantidad de características y funciones, pero gracias a esto resulta muy fácil de usar. Tan sólo tenemos que seleccionar los archivos que queramos proteger, configurar una contraseña, y Sophos Free Encryption se encarga de mantener a resguardo todos nuestros datos en un único archivo.
Ese archivo sólo puede ser abierto con la misma aplicación y con su respectiva clave. Así nos aseguramos de que nadie más pueda ver lo que no debería, o bien podemos compartir información con otras personas de una forma segura.
Sin duda una interesante solución para cifrar archivos fácilmente. Sophos Free Encryption es gratuito y es compatible con Windows 2000, XP, Vista y 7.
Visto en www.opensecurity.es
Download ASVS now, for free, here.
Web del proyecto
Post relacionado:
- Presentaciones: OWASP AppSec Europe 2009 - Poland
- - Sólo el 6% de los usuarios disponía de contraseña que combinaba números y letras
La clave más larga e 'lafaroleratropezoooooooooooooo', con 30 caracteres- - La contraseña mas usada es 123456
- - La segunda más habitual es '12345678'
An anonymous user posted usernames and passwords of over 10,000 Windows Live Hotmail accounts to a web site called PasteBin. PasteBin is currently down for maintenance but I managed to get a copy of the list, and quickly generated some statistics from these passwords.
My impression is that these passwords have been gathered using phishing kits. Even more, the phishing kit used most probably was badly designed, since it was one that didn’t further authenticated the users to the Hotmail/Live website. I think it just returned an error message after grabbing the credentials. I noticed this because some of the passwords are repeated once or twice (sometimes with different capitalization). What most probably happened, is that the users didn’t understand what was happening, and they tried to enter the same password again and again, thinking the password was wrong.
Bellow are the statistics:
Top 20 most common passwords:
Based on these passwords I think the phishing kit was targeted towards the Latino community.
Password length distribution:
As you can see from the list above, most of the passwords are between 6 and 9 characters long. Average password length is 8 characters.
What kind of passwords were in the list? :
As we can see and conclude from the list above, a big majority of users still use very poor passwords: 42 % (lower alpha only) and 19 % (numeric only), while only 6 % from all the passwords had passwords which use a selection of alpha numeric and other characters.
www.acunetix.com/blog/
