STE WILLIAMS

As we reported recently, Facebook has been asking its users whether they think it is trustworthy (whatever that means), but it’s not actually sharing the results.

So we ran our own poll of how many people trust Facebook and hereby present the results.

(NB: to be clear, we once again hereby define “people” as being “our readers.”)

As of 15 January, out of 3,468 Naked Security-reading respondents, 0.52%, or 18 readers, reported that they find Facebook “extremely trustworthy”.

One commenter on the poll was curious as to the poll demographics.

Or, rather, as “Ghostie Withpurplehair” clarified, s/he was “mostly curious as to who actually voted for ‘Extremely trustworthy'” and whether they might be interested in real estate proposals:

Do they work for facebook, or should I start working on some deeds to the Brooklyn Bridge?

Here are the full poll results:

How trustworthy is Facebook overall?

• Not at all trustworthy 72.96% (2,530 votes)
• Slightly trustworthy 20.01% (694 votes)
• Somewhat trustworthy 5.62% (195 votes)
• Very trustworthy 0.89% (31 votes)
• Extremely trustworthy 0.52% (18 votes)
• Total Votes: 3,468

As many story commenters pointed out, the results of this poll are utterly skewed.

One such, “empp”, had this to say:

People who are concerned about security are much more likely to view articles on this site and less likely to trust any site blindly. The results are definitely skewed. I would be interested in how people have responded to the poll on facebook since the demands of that situation are different and regular users may not be as likely to express their skepticism there. I would suspect it is not as positive as they would like, otherwise they might be more inclined to release them.

Empp, I too would be interested in seeing the results of Facebook’s inquiry.

I’d be particularly interested to see how large is the discrepancy between the general Facebook user population and a population that takes the time to read about Facebook’s and other companies’ security lapses and such companies’ approaches to user privacy.

Those who don’t read security blogs such as Naked Security are, one assumes, far less likely to read about Facebook’s transgressions, such as when the service has revealed things such as someone’s friends list even if it’s set to private, for example.

Would it be wrong to assume that people who actually read about security know what they’re talking when they report that they find Facebook untrustworthy? I don’t think so.

Your thoughts? Please share in the comments section below.

Follow @LisaVaas

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8Z3Yt1zmuEg/

Last week a cluster of surveys were released, showing some contrasting views of the main sources of IT security risk, and some revealing overlaps.

The studies all asked professional IT workers what their main worry points were, and who they thought were the main causes of security incidents in their organisations.

The biggest study was conducted by forensics and risk management firm Stroz Friedberg. They covered businesses across the US, and found that most were pretty worried about cyber dangers.

Their main highlight was the risky behaviour of senior management. 87% of top brass send work files to personal email or cloud accounts so they can work on them from home or the road, while 58% have sent sensitive data to the wrong person and more than half admit taking company files or data with them when leaving a post.

60% of those questioned gave their firm a “C” grade or worse when asked how well they were prepared to combat cyber threats.

Stroz Friedberg provide an executive summary of the survey’s findings, plus an infographic-style full report.

A second study, this time from Osterman Research and again speaking mainly to mid-sized businesses (averaging 10,000 users) across the US, also found high levels of anxiety about how people behave on their work computers.

Employees introducing malware into company networks was cited as a serious concern by more than half of respondents – 58% for web browsing and 56% for personal webmail use. 74% said their company networks had been penetrated by malware introduced via surfing, and 64% through email, in just the last 12 months.

Backing this up is another study conducted by SecureData, which found that 60% of those questioned thought the biggest risk to their firm’s security was simple employee carelessness.

It also found security matters were given a worryingly low priority in some organisations, with 44% saying the main responsibility for security decision-making rested on the shoulders of junior IT managers.

This all cycles back in to the Stroz Friedberg stats, in which around half of C-level management admitted they themselves should be taking more of a leading role in pushing for better security, while a similar level of lower-grade employees thought the responsibility really lay with specialist IT security staff rather than themselves or their corporate leaders.

As always with mass studies, the sample size is pretty important, and all of these are on the small side – 764 people were questioned for the Stroz Friedberg report, 157 for the Osterman study and just 110 for the SecureData survey.

The choice of questions is also a major factor in surveys, as answers can vary wildly with just a minor tweak in wording.

But despite these opportunities for inaccuracy and bias, these overlapping studies all seem to be coming to similar conclusions. We’re all very concerned about malware and other security risks, but for the most part we tend to hand off responsibility for avoiding them to others, and continue to indulge in risky behaviours ourselves.

People just aren’t getting the message and understanding how risky it can be to do personal stuff on our work systems, or to take sensitive work files home to our own, less well secured machines.

We’re not being cautious enough with our web browsing, email and social sharing, with phishing continuing to be a problem despite years of alerts and user education.

This is especially true with sensitive accounts some people have to use in their jobs – as the ongoing success of the Syrian Electronic Army in embarrassing the social media arms of large firms shows.

Even after multiple breaches all over the place, which you’d think would put most people in similar positions on their guard, it’s still possible to fool people into handing their login details over.

So perhaps it’s time to stop worrying about who’s the most to blame and who needs to take charge, and face up to the fact that IT security only works if we all do our bit.

We can’t rely on software or policies to combat our own stupidity, laziness or desires – we need to take some responsibility, pay some attention and put some more effort into making sure we’re not the weakest link.

Follow @VirusBtn
Follow @NakedSecurity

Image of people and mouse on mousetrap courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/oErNJ7essX0/

I don’t know about you, but every time I open a newspaper I see an advertisement (or three) for the latest, greatest tablet, laptop or smartphone – each superior to last month’s model.

Such rapid development in computing devices has its advantages of course, allowing us to work in new and more productive ways, as well as allowing for a huge amount of entertainment possibilities on the go.

But there is always a dark side. Unless you have been living under a rock, we’re now all too aware of various entities taking advantage of the latest and greatest technology to get into every facet of our lives. Security agencies can intercept and read emails as well as track web surfing habits, and social networking sites know more about us than our best friends.

Fortunately, though, we can jump in our cars and drive off into the sunset without fear of being spied on. Right?

No, of course not. Many countries now have cameras on the roadside which can follow us wherever we go and now, on-board navigational systems are posing questions about driver privacy too.

Speaking at the North American International Auto Show in Detroit on Monday US Secretary of State for Transportation, Anthony Foxx, said that there needs to be a balance found between enhancing drivers’ convenience and safety and their expectations of privacy, telling reporters:

The technology that’s emerging raises questions, and we’re going to be responsive to those questions.

But each technology is different, and each application of it is different, and we want to make sure that we’re striking the right balance between helping folks be safe but also making sure that their expectations of privacy are also weighed carefully.

Foxx’s comments come a month after a US Government Accountability Office (GAO) report highlighted how car makers and GPS manufacturers have been collecting information about drivers’ whereabouts via on-board navigational aids and then storing that data for varying lengths of time.

According to the report, companies can:

…track where consumers are, which can in turn be used to steal their identity, stalk them, or monitor them without their knowledge.

In addition, location data can be used to infer other sensitive information about individuals such as their religious affiliation or political activities.

The GAO pointed out that all the companies within its report disclosed that they collect and share location data, but nine of them worded the disclosure statements in such a way as to be vague enough that consumers may have their data collected or shared in ways they were not expecting.

The report also highlighted that if motorists asked for their own travel data to be destroyed, they may be left disappointed as the companies concerned had no requirement to do so.

It also found that law enforcement agencies sometimes used information from these sources as part of crime investigation and that insurance companies could use owner-agreed black box data in order to determine blame after an accident.

In a statement Senator Al Franken, who requested the report, said that federal government needs to make it harder for web and car makers to collect drivers’ location data:

Modern technology now allows drivers to get turn-by-turn directions in a matter of seconds, but our privacy laws haven’t kept pace with these enormous advances.

Companies providing in-car location services are taking their customers’ privacy seriously – but this report shows that Minnesotans and people across the country need much more information about how the data are being collected, what they’re being used for, and how they’re being shared with third parties.

Based upon its findings the GAO said that, “practices state that companies should safeguard location data, in part, by de-identifying them; that companies should not keep location data longer than needed; and that such data should be deleted after a specific amount of time.”

Follow @Security_FAQs
Follow @NakedSecurity

Image of car driving courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/1LRqzWwhlSU/

5 DNS security risks that keep you up at night

The notorious hacktivists of the Syrian Electronic Army have received an unwelcome dose of their own medicine, after their official website was defaced by a Turkish hacking crew.

TurkGuvenligi compromised the Syrian Electronic Army’s official sea.sy website after the pro-Assad group’s hosting firm was breached. It’s unclear whether TurkGuvenligi used attacks based on phishing, weak passwords or software vulnerabilities (three examples of possible mechanisms) to gain illicit access to the SEA’s website.

The SEA is notorious for a long run of attacks, the most high profile of which have involved taking over the blogs and social media profiles of media organisations (AP, National Public Radio, Al Jazeera, The Daily Telegraph, The Washington Post, The Onion etc.) as well more recent high profile attacks along the same lines against Microsoft and Skype over recent days.

The SEA’s normal modus operandi for hijacking accounts involves multi-stage phishing attacks. At first they aim to trick workers within a targeted organisation into handing over their email passwords before targeting those in charge of maintaining social media accounts with secondary attacks that take advantage of already compromised internal email accounts.

The SEA has also turned its hand to website defacement and hacking since 2011, when it first came to widespread notice.

TurkGuvenligi sprayed digital graffiti on the SEA’s homepage which chastised the Syrian Electronic Army (extract below) for their activities.

You imbecils [sic] will attack our country with fake phishing emails and we’ll accept your lies and dont [sic] do anything? That is the end you deserve

The SEA’s website remains offline at the time of writing on Wednesday afternoon. A screencap of the defacement, along with related commentary, can be found in a blog post by veteran security industry expert Graham Cluley here.

TurkGuvenligi has form for these sort of shenanigans. In late December the Turks defaced the official OpenSSL website, leaving a message which read “TurkGuvenligiTurkSec Was Here @turkguvenligi + we love openssl”. OpenSSL blamed the defacement on “insecure passwords at the hosting provider”.

“The source repositories were audited and they were not affected,” OpenSSL reassured users in a statement issued in the immediate aftermath of the defacement.

“Other than the modification to the index.html page no changes to the website were made. No vulnerability in the OS or OpenSSL applications was used to perform this defacement. Steps have been taken to protect against this means of attack in future.” ®

The Road to Enterprise PaaS

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2014/01/15/sea_own_website_pwned/

With security expertise continuing to be in short supply, managed and cloud services will play a greater role in securing companies in 2014.

Benefiting from the knowledge of managed security service providers–or the built-in expertise in existing cloud security services–can help non-technical companies build the infrastructure needed to stay secure. For more security-savvy companies, service providers can take over the day-to-day security drudge work, and allow internal security teams to focus on bigger security issues that may be affecting the company, says Neil MacDonald, a vice president and fellow at business-intelligence firm Gartner.

“If I’m an organization with limited resources, I would rather free up my security team’s time to focus on more advanced threats rather than the more routine things like log monitoring, firewall management and vulnerability management,” he says.

Whether a company pursues a managed security service, a cloud security service, or some hybrid with their existing capabilities, depends largely on their own expertise and whether the organization already uses the cloud for existing business processes, says Rob Ayoub, research director for NSS Labs, a security consultancy.

“A lot of it depends on how they are using the cloud,” he says. “Are they using the cloud as an extension of their existing infrastructure? Or are they using the cloud and consuming services from the cloud as a way to expand their security capabilities or maybe because they do not have the in-house expertise.”

Whichever may be the case for your company, the following services could be in your future this year.

1. Cloud asset control
Most companies do not know how much they rely on the cloud, frequently underestimating the number of cloud services being used by employees. From its own customer data, for example, cloud-management provider Skyhigh Networks has found that the average firm uses approximately 550 cloud services.

In the past few years, a number of startups–such as CloudPassage, Netskope and Skyhigh Networks–have focused on the problem of taming the wild and varied adoption of cloud services. These cloud-application visibility services allow companies to discover what services they are using, the risk those services pose and then manage the threat, says Jim Reavis, co-founder and CEO of the Cloud Security Alliance.

“These types of services give you a pretty good visibility into what cloud services are in use, and allow companies to take the next step and implement controls,” he says.

2. Log management to incident detection
Many companies already use a service provider to collect and manage logs, archiving the data for compliance purposes. With an increasing focus on network and business visibility, companies need to turn those logs into information on what is happening in the network.

The category actually covers a spectrum of services, from log management to security information and event management (SIEM) systems to Big Data analytics. Once companies have their log monitoring in the cloud, there is no reason not to look at analyzing the data, says Gartner’s MacDonald.

“They can essentially tell you if you have been compromised,” he says. “That can be intensely interesting, especially if you are a smaller organization and you don’t have the resources to build a security operations center.”

[Companies need cloud providers to delineate responsibilities for the security of data, provide better security information, and encrypt data everywhere. See 5 Ways Cloud Services Can Soothe Security Fears In 2014.]

Eventually, a focus on detection will turn into a focus on response and shutting down attackers, making incident-response services–such as what may come from FireEye’s purchase of Mandiant–likely to significantly grow over the next few years

3. Identity Management
As companies rely on an increasing number of cloud providers, managing access to those services has become more complex. Identity and access management in the cloud makes a lot of sense for firms who use a large number of cloud services, says CSA’s Reavis.

“There is a real risk that employees duplicate their identities out on the Internet, and that raises the risk of a lateral attack, where a breach at one provider allows attacker to breach the employee’s other accounts,” he says.

4. Encryption
The revelations that the U.S. National Security Agency is collecting massive amounts of data from the Internet has caused more companies to pay attention to how their data is secured in the cloud. While locking down data at rest with encryption is a good idea, especially when it is outside the firewall, many companies had been relying on the security of their storage providers to protect the data.

While a number of cloud services focus on encrypting data in cloud services, CipherCloud and Voltage Security, the market is still nascent. That will likely change this year, as cloud services focusing on encryption and access-management grow, says NSS Labs’ Ayoub.

“I think identity and encryption are the two areas where were we will see a lot of adoption this year,” says Ayoub. “We need to focus on protecting who’s accessing the data, and we need to focus on protecting the data.”

5. Security testing in the cloud
Many companies have to focus on securing their software, not just their networks, whether the software is internally developed or comes from third parties. Outsourced application testing or application-testing in the cloud are able to find the most common bugs, can help train developers, and hold third-party software firms to a standard security assessment.

“Application security testing is more difficult work, but it is becoming better understood,” he says. “By using one of these vendors to test their applications or require that their supply-chain partners to test their applications, they can enhance their security.”

A number of companies offer application testing and assessment services in the cloud, including Cenzic, Cigital, Veracode, and Whitehat Security.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/services/5-security-services-to-consider-in-2014/240165414

By Dr. Robert Statica, Cofounder and CTO

January 14, 2014

Wickr is looking to recruit the best hackers in the world in a continuous effort to protect our users. Starting today, we are offering generous amounts of money for critical security bugs found in our app and responsibly disclosed.

Wickr will pay as much as US $100,000 for a vulnerability that substantially affects the confidentiality or integrity of user data. We will also consider paying the same amount for defense techniques and novel approaches to eliminating the vulnerability that are submitted at the same time. Our goal is to make this the most generous and successful bounty program in the world.

Beyond making lots of money, you can feel good about helping Wickr because we were founded to protect the basic human right of private correspondence. Private correspondence is extremely important to a free society. People all over the world depend on Wickr. Please help us with this mission.

To submit a bug, please contact us via email at [email protected]. The program specifics are on the following pages.

Engaging Hackers

Beyond the Bug Bounty Program, Wickr engages with the best security firms in the world for code review and penetration testing. Veracode gave Wickr a perfect score on its first review. Furthermore, Wickr had the honor to be the target of a presentation at DEF CON 21 conducted by experts from Stroz Friedberg, one of the largest forensics companies in the world. The researchers analyzed Wickr, Snapchat and Facebook Poke to determine that while Snapchat and Facebook revealed personal information, Wickr indeed left no trace. We expect finding critical vulnerabilities in Wickr to be difficult and are honored to work with those that do.

About Wickr

The Wickr team is made up of security and privacy experts who strongly believe online communications should be untraceable by default. Wickr is a free app enabling anyone to to send text, audio, picture and video messages that self-destruct because they are private, secure and anonymous. Unlike any other messaging app, Wickr binds each message to your device, clears metadata from files and permanently shreds deleted files from your device.

Since the launch in June 2012, Wickr has seen an exponential growth and 5-star reviews in the App Store. As a top ranked free social app in the U.S., China, India, Israel, Spain, South Africa and Brazil, we have served millions of secure messages. Wickr is headquartered in San Francisco, CA. More information is available at https://www.mywickr.com.

Wickr Bug Bounty Program

Program Statement

The Wickr Bug Bounty Program is designed to encourage responsible security research in Wickr software. It is impossible to overstate the importance of the role the security research community plays in securing modern software. White-hats, academics, security engineers and evangelists have been responsible for some of the most cutting-edge, eye-opening security revelations to date. Their research speeds the pace of advancing security to the benefit of all. With this program and partnership, we pledge to drive constant improvement relating to the security interests of our users, with the goal of keeping Wickr the most trusted messaging platform in the world.

Terms and Conditions

Wickr will issue rewards in return for qualifying security bugs. A qualifying security bug is any previously unreported design or implementation issue that substantially affects the confidentiality or integrity of user data.

Kids Welcome

Any age is welcome to participate. Wickr Android was first beta tested with the r00tz kids at DEF CON.

Submission Process

To submit a bug, please contact us via email at [email protected].

Judging

Judging will be done based on the severity of the exploits, the conditions in which it was possible to have that exploit, the impact the exploit had on the user’s messages, the app’s availability proper functioning, on the routing of the messages, server storage availability and functionality, as well as on the quality and feasibility of the solution provided by the person discovering the exploit. At the request of Wickr, the person submitting the exploit must provide all the tools, procedures and algorithms used available for study by Wickr engineers.

Responsible Disclosure

We believe in responsible disclosure of security vulnerabilities. To allow sufficient time for internal review and remediation, and to qualify for reward, qualifying security bugs submitted under this program cannot be disclosed or reported to any third party within three (3) months of the date of submission without our written permission.

Rewards

Rewards range from $10,000 to $100,000, depending on our assessment of severity as calculated by likelihood and impact. Reward amounts are set entirely at the discretion of Wickr, and all determinations are final. The payments are in US dollars the beneficiary is responsible for all applicable taxes, fees and tariffs in the country of residence. Team submissions must split the reward.

The prize payment cannot be made anonymously and personal identifiable information (PII) must be provided to Wickr before payment can be made. The PII might contain the legal name, address, phone number and financial information like bank account number, etc.

All prizes and their money value are established by Wickr Inc and payable after all the requirements have been met and a solution to the exploit has been implemented and deployed.

Prohibitions

The scope of this program is limited to technical security vulnerabilities in Wickr software. Under no circumstances should your testing affect the availability of Wickr services, disrupt or compromise any data that is not your own, or violate any law or our Terms of Service.

Restrictions

To be eligible for the program, you must not:

• Be a resident of, or make your submission from, a country against which the United States has issued export sanctions or other trade restrictions (e.g., Cuba, Iran, North Korea, Sudan and Syria);

• Be employed by Wickr, Inc. or its subsidiaries

• Be an immediate family member of a person employed by Wickr, Inc. or its subsidiaries

Legal

You are responsible for any tax implications depending on your country of residency and citizenship. There may be additional restrictions on your ability to enter depending upon your local law and age. We reserve the right to cancel the program at any time and the decision as to whether or not to pay a reward is entirely at our discretion. Void where prohibited by law.

Article source: http://www.darkreading.com/end-user/wickr-announces-bug-bounty-program-100/240165415

SAN FRANCISCO, Jan. 15, 2014 /PRNewswire/ — Today, Black Hat, the world’s leading family of information security events, announced the extensive lineup of selected content for Black Hat Asia 2014. Here the world’s brightest information security professionals and researchers will reveal vulnerabilities that impact everything from the “Internet of Things” and our popular consumer devices to the most critical commercial and international infrastructure. Black Hat Asia will take place March 25-28, 2014 at the Marina Bay Sands in Singapore. For more information and to take advantage of early registration prices by January 24 please visit: http://www.blackhat.com/asia-14/.

(Logo: http://photos.prnewswire.com/prnh/20140115/SF44705LOGO)

Some of the highlights of the Black Hat Asia 2014 Briefings include:

Exposing vulnerabilities within our homes and cars from abusing the “Internet of Things” to spy from baby monitors and orchestrate blackouts to taking over the CAN (controller area network) bus at the heart of most modern cars with a device constructed for only $20, allowing an attacker to control it remotely.

Preventing attacks on critical infrastructure with talks around Automatic Identification Systems (AIS) hacks, the mandatory tracking system used worldwide on commercial ships for identifying and locating vessels, and the exploitation of access control and facility management systems in modern corporate office and utility buildings.

Analyzing targeted international attacks looking at vulnerabilities with Open Government Systems and Open Data Laws that reveal confidential political and personal information, as well as examining the range of attacks being carried out on journalists as the newest target for sensitive information including the meltdown in South Korea as a result of the “Wiper” malware in 2013.

These world class Briefings will come after two days of high intensity and deeply technical Training courses taught by the industry’s most renowned instructors. These separate technical deep-dives will cover topics ranging from the latest in penetration testing to exploiting web applications and even defending and building SCADA systems. For information on course pricing and registration, please check the individual Training pages here: http://www.blackhat.com/asia-14/training/index.html.

For more information and to register before early registration pricing ends January 24, please visit: http://www.blackhat.com/asia-14/registration.html.

Sponsors of Black Hat Asia 2014 include Diamond Sponsor: Juniper Networks, Platinum Sponsors: Tenable Network Security and Netpoleon Solutions and Gold Sponsors: HP Singapore and Qualys

Future Black Hat Dates and Events

Black Hat Asia 2014, Singapore, March 25-28, 2014

Black Hat USA 2014, Las Vegas, Nevada, August 2-7, 2014

Black Hat Europe 2014, Amsterdam, The Netherlands, October 14-17, 2014

Connect with Black Hat

Twitter: https://twitter.com/BlackHatEvents – hashtag #BlackHat

Facebook: http://www.facebook.com/blackhat

LinkedIn Group: http://www.linkedin.com/groups?home=gid=37658

Flickr: http://www.flickr.com/photos/blackhatevents/

About Black Hat

For more than 16 years, Black Hat has provided attendees with the very latest in information security research, development, and trends. These high-profile global events and trainings are driven by the needs of the security community, striving to bring together the best minds in the industry. Black Hat inspires professionals at all career levels, encouraging growth and collaboration among academia, world-class researchers, and leaders in the public and private sectors. Black Hat Briefings and Trainings are held annually in the United States, Europe and Asia, and are produced by UBM Tech. More information is available at: http://www.blackhat.com.

About UBM Tech

UBM Tech is a global media business that brings together the world’s technology communities through live events, online properties and custom services. UBM Tech’s community-focused approach provides it’s users and clients with expertly curated research, education, training, community advocacy, user-generated content and peer-to-peer engagement opportunities that serve the Electronics, Security, Enterprise Communications, Network Infrastructure and Applications, Game and App Developers, and Tech Marketing communities. UBM Tech’s brands include Black Hat, DesignCon, EE Times, Enterprise Connect, Game Developers Conference (GDC), HDI, InformationWeek, Interop, and Light Reading. Create, a UBM Tech full range marketing services division, includes custom events, content marketing solutions, community development and demand generation programs based on its content and technology market expertise. UBM Tech is a part of UBM (UBM.L), a global provider of media and information services with a market capitalization of more than $2.5 billion. For more information, go to http://tech.ubm.com; follow us on Twitter at @UBMTech.

Article source: http://www.darkreading.com/vulnerability/black-hat-asia-2014-to-expose-vulnerabil/240165434

Santa Clara, Calif., Jan 14, 2014 – Palo Alto Networks (NYSE: PANW), the leader in enterprise security, today announced enhancements to its enterprise security platform that increase advanced threat detection and prevention capabilities for its customers worldwide. Most significantly, this includes enhancements to the Palo Alto Networks WildFiretrade service that enable quick discovery and elimination of previously unknown malware, zero-day exploits, and advanced persistent threats (APTs).

Cyber criminals are employing new stealth methods to evade traditional security measures, such as stateful firewalls, intrusion prevention systems and anti-virus (AV) systems. These legacy approaches often address only a single threat vector across a limited range of network traffic, resulting in a higher attack penetration rate and costly human incident response.

To better detect sophisticated attacks, a highly automated and scalable “closed loop” approach is required. One that begins with positive security controls to reduce the attack surface; inspects all traffic, ports, and protocols to block all known threats; rapidly detects unknown threats; then, automatically employs new protections back to the front line to ensure previously unknown threats are known to all and blocked.

The Palo Alto Networks enterprise security platform is pioneering this approach; it starts with its next-generation firewall as the core enforcement vehicle within the network, and is extended by the advanced detection and analysis capabilities delivered by the WildFire service, which is now used by more than 2,500 customers worldwide. New advancements include:

Extended file visibility – all common file types, including PDFs, Office documents, Java, and APKs, operating systems, and applications (encrypted or not) are now seen and filtered.

Zero-day exploit detection – using behavioral analysis, this signature independent capability in the WildFire cloud quickly identifies exploits in common applications and operating systems and distributes the intelligence to subscribing customers in as little as 30 minutes to prevent future attacks.

Discovery of malicious domains – blocks the critical command-and-control phase of an advanced attack by building a global database of compromised domains and infrastructure.

Single “pane of glass” view into incident response data – in a single view, security administrators have access to a wealth of information on malware, its behavior, compromised hosts, and more, so that incident response teams can quickly address threats and build proactive controls.

These advancements increase unknown threat detection capabilities at each step in the attack lifecycle. Combined with automated blocking and in-line enforcement, the new capabilities can dramatically reduce the number of threats that penetrate an organization and require human incident response. And, in the unlikely event a threat does penetrate an organization, incident response teams have relevant data in a single view to take quick action.

QUOTES

“The Palo Alto Networks security platform with WildFire gives us an extra layer of security we didn’t have before – extra inspection and comfort that we can stay ahead of breaches by not just detecting them, but also by easily blocking them. By having our firewall, URL filtering, threat prevention natively integrated and managed from a single dashboard – instead of multiple niche products, we have a clearer picture of our threat landscape. Ultimately, the platform gives us what we need to effectively detect, analyze, block, and, more importantly, quickly remediate issues.”

– Phil Cummings, Security Administrator, Health Information Technology Services (HITS-NS)

“Quickly detecting and eliminating previously unknown threats across all applications is key to protecting an organization from today’s advanced threats; only Palo Alto Networks offers its customers the closed loop capabilities to most efficiently and effectively stop sophisticated threats.”

– Lee Klarich, senior vice president of product management, Palo Alto Networks

Availability

The enhancements are accessible via Palo Alto Networks PAN-OStrade version 6.0 – the operating system that is the heart of the Palo Alto Networks platform, which will be available for all Palo Alto Networks customers with valid support contracts. These new advancements will also be spotlighted at the Palo Alto Networks Ignite user conference, March 31 – April 2, Las Vegas, NV; to register, visit: https://www.paloaltonetworks.com/content/campaigns/ignite/ignite-2014/home.html.

To learn more about Palo Alto Networks security platform and WildFire service, visit: https://www.paloaltonetworks.com/products/features/apt-prevention.html.

ABOUT PALO ALTO NETWORKS

Palo Alto Networks is leading a new era in cybersecurity by protecting thousands of enterprise, government, and service provider networks from cyber threats. Unlike fragmented legacy products, our security platform safely enables business operations and delivers protection based on what matters most in today’s dynamic computing environments: applications, users, and content. Find out more at www.paloaltonetworks.com.

Article source: http://www.darkreading.com/management/palo-alto-networks-unveils-evolution-to/240165437

Google just spent $3.2 billion on a fancy thermostat and smoke alarm maker called Nest.

That might not sound exciting, so let’s put it another way: Google has just bought itself a company that can serve as its hardware entrance into the internet of all things, which means that Big Google Brother will be able to know even more intimate things about us than it already does, such as, potentially, whether we’re home or not.

Google’s latest acquisition makes thermostats that learn, tracking customers’ daily usage to automatically set heating and cooling temperatures and thereby save on energy costs.

In addition, Nest’s smoke alarms communicate with the company’s other devices or with your smartphone or tablet via WiFi. If your smoke or carbon monoxide alarm goes off, you’ll get a message, wherever you are.

Privacy advocates are worried about Google getting its hands on data that could include such things as whether we’re home or not, which it could easily connect with our mobile phone data to form ever-more-deep portraits of us for ever-more-targeted advertising or other profit-rich ventures.

The concern comes in spite of Nest’s insistence that its customer data will be used only to improve its services.

To echo Brian Fung, writing for The Washington Post, we should ask, what will happen to Nest’s user data after the acquisition?

Nest’s data is now handled by Amazon Web Services, The New York Times’s Quentin Hardy reports, but buckle in: Google might well move to get the data onto its Compute Engine public cloud lickety-split.

And after all, surely Nest is in no position to rule out sharing its data with Google, given that Google could simply rewrite Nest’s privacy policy, pointed out David Jacobs, a consumer protection lawyer at the Electronic Privacy Information Center (EPIC).

In talking to the Washington Post, Jacobs noted that Google’s done it before:

Google has made several changes to its privacy policies and its business practices. Whenever it does, the message to consumers is, ‘You accept the changes or you use something else.’ There’s nothing really stopping the companies from changing their mind down the road and deciding to use it for advertising or something else.

And what will happen to existing Nest users? Will they be allowed to opt-out of sharing their information with Google, or will they have no choice?

Matt Rogers, Nest’s founder and vice president of engineering, blogged reassuringly to customers, saying that the company has “always taken privacy seriously and this will not change.”

Well, that would be nice. But remember who we’re talking about.

Google already has our personal data, and now it’s getting the chance to get at our home data – when we’re away, when we’ve had a fire and what our power bills amount to.

Follow @LisaVaas

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Mdiu9_GRE0o/

As we reported recently, Facebook has been asking its users whether they think it is trustworthy (whatever that means), but it’s not actually sharing the results.

So we ran our own poll of how many people trust Facebook and hereby present the results.

(NB: to be clear, we once again hereby define “people” as being “our readers.”)

As of 15 January, out of 3,468 Naked Security-reading respondents, 0.52%, or 18 readers, reported that they find Facebook “extremely trustworthy”.

One commenter on the poll was curious as to the poll demographics.

Or, rather, as “Ghostie Withpurplehair” clarified, s/he was “mostly curious as to who actually voted for ‘Extremely trustworthy'” and whether they might be interested in real estate proposals:

Do they work for facebook, or should I start working on some deeds to the Brooklyn Bridge?

Here are the full poll results:

How trustworthy is Facebook overall?

• Not at all trustworthy 72.96% (2,530 votes)
• Slightly trustworthy 20.01% (694 votes)
• Somewhat trustworthy 5.62% (195 votes)
• Very trustworthy 0.89% (31 votes)
• Extremely trustworthy 0.52% (18 votes)
• Total Votes: 3,468

As many story commenters pointed out, the results of this poll are utterly skewed.

One such, “empp”, had this to say:

People who are concerned about security are much more likely to view articles on this site and less likely to trust any site blindly. The results are definitely skewed. I would be interested in how people have responded to the poll on facebook since the demands of that situation are different and regular users may not be as likely to express their skepticism there. I would suspect it is not as positive as they would like, otherwise they might be more inclined to release them.

Empp, I too would be interested in seeing the results of Facebook’s inquiry.

I’d be particularly interested to see how large is the discrepancy between the general Facebook user population and a population that takes the time to read about Facebook’s and other companies’ security lapses and such companies’ approaches to user privacy.

Those who don’t read security blogs such as Naked Security are, one assumes, far less likely to read about Facebook’s transgressions, such as when the service has revealed things such as someone’s friends list even if it’s set to private, for example.

Would it be wrong to assume that people who actually read about security know what they’re talking when they report that they find Facebook untrustworthy? I don’t think so.

Your thoughts? Please share in the comments section below.

Follow @LisaVaas

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/6B-A4DiExQg/