Research

The concept of Data Centric Security is not new, but its advantages are only now becoming clear. As customers embrace disruptive technologies – cloud, mobile, NoSQL – where the availability and effectiveness of security controls are in question, Data Centric Security is an approach to securing data regardless of where it is moved. DCS is a way to leverage these new technologies without compromising data security, integrity, or compliance. This research was prompted by increasingly frequent inquiries about how to secure “big data” clusters. The cost, complexity, and lack of packaged solutions have left many people looking for options. You can compartmentalize NoSQL servers so only a select few people and applications can access them, but then you fail to fully leverage the investment – which makes isolation a non-starter in most scenarios. That is the potential of Data Centric Security: it focuses security controls on data rather than servers or supporting infrastructure. This way the database is securely available to everyone who can use it legitimately. This research delves into what Data Centric Security is, the challenges it addresses, and technologies to support customer use cases. We hope you find this research useful, and consider DCS as an alternative to traditional infrastructure security. I am incredibly happy to announce that Intel Services has agreed to license this research paper – which you can download here (PDF) or visit the research library landing page here – and that we will also present a webcast on Data Centric Security, tentatively scheduled for November 18th, 2014. Sign up if you are interested. Thanks again to Intel for their support of this research! Share:

Adrian is out, so Rich and Mike cover the latest Amazon Web Services news as their big re:Invent conference closes in. We start with the new Frankfurt datacenter, and how a court case involving Microsoft could kill off the future of all US-based cloud companies (it’s always the little things). Then we discuss directory services in the cloud, and how this indicates increasing cloud adoption and maturity at a pace we really haven’t ever seen before. The audio-only version is up too. Share:

Over the last couple months I have had many similar conversations on enterprise application security: customers identify gaps in their security program, are unaware of the availability of certain types of solutions, or simply don’t believe that certain solutions deliver their advertised value. But I expect issues when speaking to a company who wants to implement advanced security on a Hadoop database, where technology simply may not exist to deliver the security and performance required. It is altogether different when talking about SAP or Oracle financials. These are mature platforms, often in place for more than a decade, so you would expect every aspect to be covered. Surprisingly that is often not the case. There are many reasons for these security gaps. Companies often invest in generic assessment or configuration analysis tools, which don’t actually provide an in-depth view of application configuration settings or best practices. Perhaps they were told their SIEM would collect all application logs but they don’t contain the necessary information to evaluate user actions, or they are simply too verbose to collect. The application vendors all provide lists of security best practices, but don’t list anything they do not sell, nor advise customers to uninstall unneeded components to reduce attack surface. Security teams know little about how application platforms work so they cannot independently identify which deployment models would work, and IT staff is not likely to volunteer suggestions that will require them to do more work. Finally, the largest issue is that many approaches are simply unsuitable for large enterprise applications because they will break the application, limit usability, or degrade performance, none of which are acceptable. These issues contribute to security and compliance gaps at most firms. Supply chain management, customer relationship management, enterprise resource management, business analytics, and financial transaction management, are all multi-billion dollar application platforms unto themselves. We are beyond explaining why enterprise applications need security to protect these investments – it is well established that insiders and persistent adversaries target these applications. Companies invest heavily in these applications, hardware to run them, and teams to keep them up and running. They perform extensive risk analysis on their business implications and the costs of downtime. And in many cases their security investments are a byproduct of these risk profiles. Application security trends in the 1-2% range of total application investment, but I cannot say large enterprises don’t take security seriously – they spend millions and hire dedicate staff to protect these platforms. That said, their investments are not always optimal – enterprises may bet on solutions with limited effectiveness, without a complete understanding of the available options. It is time for a fresh look. To fill some of these gaps we are starting a new series on Building an Enterprise Application Security program. We spend a lot of time on advanced technologies on the Securosis blog: variants of monitoring, auditing, assessment, threat management, application security, and so on – but we have never pulled all these facets together for companies to assemble into an enterprise application security program. Or goal is to discuss specific security and compliance use cases for large enterprise applications, highlight gaps, and explain some application-specific tools to address these issues. This will not be an exhaustive examination of enterprise application security controls, nor an examination of generic security platforms – instead we will offer a focused summary of the most common deficiencies, with suggestions for what to do about them. The remainder of this series will cover the following: Needs: Use Cases Compliance (SOX, PCI, etc.) and internal audit reporting Transaction verification Use of sensitive information Security (insider and external threats) Change management & policy enforcement Gaps: What Works and What Doesn’t Why enterprise applications are different SAP: special issues with this poster child for enterprise applications Security and compliance gaps with IAM, encryption, and data encryption Inventory, discovery, and assessment Network monitoring deficiencies Conventional application and database layer protection Skills and priorities Program Elements Assessment: discovery and configuration analysis Patching and configuration management (environment, application, database, & modules) Application and database monitoring Management frameworks and policy enforcement Logging, auditing, and compliance reports Additional recommendations Our next post will discuss use cases and problems firms need to address, which we will use to frame our subsequent discussion of security gaps. Share:

Lots of folks talk lovingly about their first computers. Mine was a Timex Sinclair I ran through my 10” black-and-white TV. But that wasn’t the first computer I played with. My Dad was pretty early into the word processing world as part of his law practice. So when we went to the computer show down in NYC and checked out all the new wares, I was like a kid in a candy store. When he lugged home the Kaypro II, I thought it was the coolest thing ever. And evidently a significant productivity enhancer, especially hooked up to that old daisy wheel printer. You remember those, right? So when I saw Throwback Thursday: Kaypro II Stole My Heart on InformationWeek, it was a nostalgic moment. The Kaypro II, released in 1982, featured two 5¼-inch double-density floppy-disk drives, 64 KB of RAM, and ran Digital Research’s CP/M operating system. Weighing in at 29 pounds, it and other PCs like it were dubbed transportables or, more cheekily, luggables. Luggable LOL. Though I do remember my Dad lugging the Kaypro between his condo and the office, so I guess it was transportable. And mention of the 9” green (monochrome) CRT made me smile as well. Of course my kids will have no grasp of what the early days of personal computing were really like. They are bitching about their old iPod touches that won’t run iOS 8. And they are right – technology is moving so fast that a 5-year-old device is severely limited. But old folks (or at least survivors of that early computer age) like me remember. And we laugh. Because the progress we have seen over the past 30 years is really incredible. Yet it’s only beginning. I cannot even imagine what things will look like in another 30 years. Photo credit: “untitled” originally uploaded by Marcin Wichary Share:

Rich here. Last night I arrived home around 11pm from the totally awesome SecTor conference in Toronto. It took about 11 hours to wend my way home through the air system, which has a certain beauty. Yeah, I took it to 11. Before that I was home for a couple days, during one of which we took the kids to the local aquarium-in-the-outlet-mall to meet the Octonauts. Yes, we have one of those. Yes, if your kids are of a certain age, they know the Octonauts. And yes, the Octonauts have a totally awesome Star Trek TOS vibe, and I weirdly learn cool stuff – like how freaky vampire squids are – from watching it. I won’t link – I want you to have the pleasure of searching for “vampire squid” and then not sleeping. Before that I was in Amsterdam for 5 days. With my wife but without kids. I spent two of those days teaching the cloud security class for Black Hat, and the two free days touring around with her. Amsterdam reminds me of New Orleans in spots, which means it’s fun, and then it’s smelly. I have never been into the hedonistic stuff but I love cool historical cities. Especially without the kids. Assuming they have beer. Before that is a blur; it probably involved airplanes. Next week I head to Houston for Camp DevOps. I really like those events – so much so that I will spend 6 hours on a plane for what is normally an under-2-hour flight. One problem with traveling so much is that I struggle to find time to set up the next trip, so I got hammered with insane prices. I am unwilling to spend over $1K to fly from Phoenix to Houston, so I got a middle seat on Delta, routed through Salt Lake and Atlanta. Yay team. After that, I can’t talk about it, but the week after that is Amazon re:Invent. I’m not speaking there, but even if you use other cloud providers re:Invent is a must-attend event. Okay, it helps if you use AWS, but still, there is a ton of great info, some of it generalized. So there you have it. I am wicked jetlagged from too many time zones in too short a time, but when you work for yourself you can’t gripe too much about being busy. And, you know, 5 days in Amsterdam with my wife & my kids, so I should really just shut up and not complain. On a different note, you may have noticed some weirdness with our site recently. We had a conflict between our super-secure hosting architecture and an underlying component update we couldn’t totally nail down. It got so bad we moved to a slightly-less-secure host temporarily, which fixed the problem. I am actually rearchitecting the entire deployment (with our developer contractors) to take advantage of all the cloud security and DevOps research I have been working on, but that move will take a little time. We apologize sincerely, and at some point I will provide a more detailed writeup. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences eWeek covered Rich’s talk on DevOps at SecTor. Their writeup was great and really captured the core of the talk. eSecurity Planet covered the SecTor Fail Panel. That one also had Mr. Lewis and Mr. Arlen. Rich wrote up Spotlight Suggestions privacy for TidBITS. I guess this is why I didn’t post much on our own site. Need to work on that. Favorite Securosis Posts Adrian: Running Man. Mike. Running. Running distance !?! I … {head explode}. Rich: I guess I need to kneecap Mike. He’s stealing my thunder. I’ve done some half marathons, and no f###### way I will let him beat me to doing a marathon. Other Securosis Posts Hindsight is 20/20. Favorite Outside Posts Adrian: NSA Tech Director Explains Snowden Docs. I don’t know when this was published but it’s fascinating. I usually suspect disinformation attempts but this seems genuine. Mike: 6 Buddhist Principles That Will Help You Be A Better Boss. Yeah, I’m pimping some more mindfulness stuff. But these are good things to think about, regardless of how much time you spend being mindful… Research Reports and Presentations Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Analysis of the 2014 Open Source Development and Application Security Survey. Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Top News and Posts Updated Windows FTDI Drivers bricking chips Schneier on Crypto Wars II. Google Launches 2FA as part of FIDO Alliance NAT-PMP vuln puts 1.2 million routers at risk. Share:

There were always reasons I wasn’t a runner. I was too big and carried too much weight. I was prone to knee pain. I never had good endurance. I remember the struggle when I had to run 3 miles as a pledge back in college. I finished, but I was probably 10 minutes behind everyone else. Running just wasn’t for me. So I focused on other methods of exercise. I lifted weights until my joints let me know that wasn’t a very good idea. Then I spent a couple years doing too many 12-ounce curls and eating too many burritos. For the past few years I have been doing yoga and some other body weight training. But it was getting stale. I needed to shake things up a bit. So I figured I’d try running. I had no idea how it would go, given all my preconceived expectations that I couldn’t be a runner. I mentioned it to a friend and he suggested I start with a run/walk program espoused by Jeff Galloway. I got his 5K app and figured I’d work up to that distance over the summer. I started slowly during my beach vacation. Run 2 minutes, walk 1 minute. Then I ran 3 minutes, etc. Before I knew it, I had worked up to 3 miles. At some point my feet started hurting. I knew it was time to jettison my 5-year-old running shoes and get a real pair. I actually went to the running store with the boy and got fitted for shoes. It made a world of difference. I was running 3 days a week and doing yoga another 3 days. I was digging it. Though over the summer it wasn’t that hard. I’d get out early before it got too hot and just run. After conquering the 5K I figured I’d work up to a 10K, so I started another training program to build up to that distance. I made it to the 6-mile mark without a lot of fuss. Even better, I found myself in cool places for work and I’d run there. It’s pretty okay to start the day with a run along Boulder Creek or the Embarcadero. Life could be worse. I was routinely blowing past the suggested distance in the 10K program. I banged out almost 7 miles on one run and wasn’t totally spent. That’s when it hit me. Holy crap, I’m a runner. So I decided to run a half marathon in March. I figured that was plenty of time to get ready and a couple buddies committed to run with me. I did 8 miles and then 10 miles. Just to see if I could, and I could. Then I thought, what the hell am I waiting for? My sister-in-law is running a half in early November and she is just working up to 10 miles. I signed up to run a half this Thanksgiving. I even paid $15 for the race t-shirt (it’s a free race, so the shirt was extra). That’s in about a month and I’ll be ready. If there is one thing I have learned from this, it’s that who I was doesn’t dictate what I can accomplish. I can overcome my own perceptions and do lots of things I didn’t think I could, including running. –Mike Photo credit: “Day 89 – After the Run” originally uploaded by slgckgc The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. Security and Privacy on the Encrypted Network The Future is Encrypted Secure Agile Development Deployment Pipelines and DevOps Building a Security Tool Chain Process Adjustments Working with Development Agile and Agile Trends Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Newly Published Papers The Security Pro’s Guide to Cloud File Storage and Collaboration The 2015 Endpoint and Mobile Security Buyer’s Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Incite 4 U Attitude > technical chops: It seems every day someone bitches to me about the difficulty in finding good people to staff the security function. Thom Langford thinks a lot of folks are looking in the wrong places, and that good potential security folks may already be in your organization – just not doing security. Thom added an executive assistant to the security team and it has worked out well for him because of her attitude and understanding of how to get things done within the organization. “Technology and hard skills are things that can be taught in relatively short periods of time; attitude is something that takes a lot longer to learn, decades even.” Actually, a lot of

It won’t happen to you, right? After every breach you see all sorts of former employees and others crawl out from under their various rocks to talk about how screwed-up their former employer was. And how the breach was inevitable. It is a bit comical at this point. The latest example is a bunch of former Home Depot employees talking about their old shop. Yet five former staffers describe a work environment in which employee turnover, outdated software, and a stated preference for “C-level security” (as opposed to A-level or B-level) hampered the team’s effectiveness. Well, here is BREAKING news. Every big company is screwed up in some way. Every company – big or small – needs to make tough choices. Some companies consistently choose wrong. Others do a good job of making those decisions – or they get lucky, it doesn’t really matter. But the truth remains: they will all get breached… sooner or later. In the aftermath of a breach – or really any mistake – there are always things that could have been done differently. But most security folks need to toe the corporate line, which may be to deal with mediocre security. Job #1 is often not to disrupt business operations. As a security person such directives may make you sick. And if your shop consistently makes decisions like this, maybe you should work somewhere else. That’s always a choice. And sooner or later (likely sooner), you will get called by journalists looking for dirt. Then you can say you told them so and they didn’t listen. Good for you. Photo credit: “Black and white hindsight” originally uploaded by Tim J Keegan Share:

This is off topic, but this post from Daniel Miessler is a great example of how I want to reorient my world view. Basically, I’ve done most things I could have wanted to do in a life already. This doesn’t mean that I don’t have more to do. It doesn’t mean I don’t still have goals, because I do. What it means is that if things were to end suddenly tomorrow, and I had even the shortest time to reflect, I would smile knowing that there wasn’t some other big thing I needed to be happy. I already am happy. Anything past this point is just greedy. I’ve already lived a remarkable life, and now I want another 50 years of it? Seems rather selfish when you think about it. That is real gratitude. From where I sit, I still feel I have a lot to contribute and so much more to learn. And I’m not one to call my life to date ‘remarkable’, but I have done some cool stuff. I’m with Daniel – I don’t want to be greedy. This kind of gratitude is hard for a lot of us, as culture has us striving to move on to the next hill – before we are over the current one. In the rush to always get something else done, I find it helpful to sometimes just sit and appreciate where I have already been. That helps me get excited for whatever is to come. Both the positives and the negatives. Everything is a learning experience. Today I’m grateful for the opportunity to keep learning. Photo credit: “Gratitude changes the way we look at the world” originally uploaded by BK Share:

A few years ago I had to stop competing. The constant need to win – whatever that even meant – was making me unhappy. Even when things were going well, I found some reason to feel like a loser. So I got off the hamster wheel and put myself in positions where I wasn’t really competing against others. I am always trying to improve, but I stopped doing that in terms of others. Set a goal. Work toward it. Adjust as needed. The only time I even sort of compete now is my annual golf trip. Except for four rounds that weekend, I don’t play golf. It’s not that I don’t enjoy the game, but it just takes too much time. So every year 9-11 buddies and I go to a nice resort town and play a tournament Ryder Cup style. There is a draft and this year we used Potato Head dolls to represent the players. Mine was a riot, as you can see in the picture below. The captains negotiate handicaps and set the line-ups, and we play. The winners make some beer money and the losers… well, there aren’t actually any losers – we are hanging with buddies on a ridiculous beachfront property and playing golf every day. Since I’m not a good golfer, I am usually the high handicapper. But it’s not like that helps me much. At multiple points over four days, my game falls apart. I typically shoot between 120 and 130, usually losing the match. Except there are no losers, right? But this year was different. I missed last year’s trip so I hadn’t picked up my clubs in 2 years. I went to the new TopGolf near my house the day before the trip to hit some balls, and I was hitting solid and straight. But I entered the weekend with zero expectations about playing decent golf. Without those expectations I was calm on the course. I just enjoyed being outside in a beautiful place. I had a few beers. OK, maybe more than a few. I kept my ego in the bag and swung nice and easy – even as some of the gorillas in my group hit 50-60 yards past me. I shot pretty well the first day (111) and with my handicap we smoked the other team. Huh. The next day I was playing a heads-up match. I shot a 101 and closed out my opponent on the 13th hole, which is apparently pretty good. Strange. My game didn’t fall apart. What’s going on here? By this time I had a pretty sizable lead in the overall. The other guys on the trip started talking about how evidently I’m a golfer and wondering if I had secretly taken a crapload of lessons. Then I actually believed maybe I was a golfer, and I wanted to win. I started feeling bad when I hit a bad shot. Predictably my game fell apart and I shot 61 on the front. Then I remembered that I don’t need to win, I just want to be credible. That is the key. It’s about not getting attached to the outcome and just having fun instead. So that’s what I did. Suffice it to say I shot 44 on the back and had a grand old time. I finished up Sunday with a 117 and took home the overall. That means I will be one of the captains next year – a place I never thought I’d be. I lost the final day match, but my team won the cup as well. So I won by not needing to win. What was the difference? Without sounding corny, it’s all the mindfulness work I’m doing. I used body awareness and scanned my body for tension points before every swing to make sure I was relaxed. I visualized a good shot, not skulling the ball into the water hazard. I recognized that my increasing desire to win was causing tension, which resulted in bad shots. I had a short memory, so when I hit a bad shot I’d just let it go. Then I’d hit a good shot. Or not. I’d look up at the sky and be grateful that I was on the course. Then drink another beer. At some point during the trip I made the connection. Golf is mostly a mental game, as is most of life. The work I’m doing to be more mindful translates directly – even to my golf trip. Controlling my own self-imposed expectations and decreasing the pressure I put on myself allowed me to compete without stressing out. Being able to maintain that for four days was a real victory. Winning the golf trophy is besides the point. At least for me… –Mike Photo credit: Incite Potato Head uploaded by MSR The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. October 6 – Hulk Bash September 16 – Apple Pay August 18 – You Can’t Handle the Gartner July 22 – Hacker Summer Camp July 14 – China and Career Advancement June 30 – G Who Shall Not Be Named June 17 – Apple and Privacy May 19 – Wanted Posters and SleepyCon May 12 – Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 – There Is No SecDevOps Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS,

Ever tried to count to a billion? Don’t bother. The average human lifespan is about 2.5 billion seconds, so you’d waste half your life trying. But that may help put into perspective Databrick’s latest announcement that they were able to sort 10 trillion records in four hours with the Spark platform. That’s three times faster than the previous record, with one-tenth the number of server nodes. Or perhaps you noticed that Amazon added full JSON support to DynamoDB, so you can easily inject JSON directly into the cluster. Or maybe you saw that Data Torrent now supports analytics on the incoming data stream. Or perhaps you were pleased to see ParStream’s distributed approach specifically geared to the Internet of Things. None of these individual events is all that newsworthy. But the scale and pace of innovation across hundreds of different NoSQL platforms is. I hAve said many times here that NoSQL is the database of the future, but I don’t think I have stressed enough that no matter what you want to do with a database, there is a flavor of NoSQL designed for your use case. And even if it’s not a perfect match, the flexibility and customization possible with most NoSQL platforms can make it work. Size, scale, and speed – at cost unimaginable just a few years ago. What does this have to do with security? I no longer speak to customers with a single Hadoop installation of 20 or so nodes. The number of nodes is climbing, and the number of NoSQL databases running in parallel at customer sites is climbing as well. The size of these clusters is beginning to break our security recommendations from the last few years. In some cases security goals require an architectural shift. In other cases I am at a loss to provide recommendations – I am not certain that security controls exist to accommodate the size and velocity of some clusters. Hang on to your seats because it is getting interesting in the world of NoSQL security. Butterflies. Not that you care, but there are a lot of butterflies in Phoenix this year. And my wife and I have planted a huge number of shrubs that attract butterflies, so we are fortunate to have swarms of them in the yard the last three weeks. Yellow ones, green ones, black with patches of amber and brilliant blue dots, giant black and yellow ones, some orange, and others orange with black spots. Dozens or even hundreds of them in the back yard on any given day. Colors that match New England fall leaves, but this is living art with a delicacy hard to imagine until you see them defying the breeze. It is one of the most beautiful sites I have ever seen. If only I could capture it on video … On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Rich in TidBITS #1: You Are Apple’s Greatest Security Challenge. Rich in TidBITS #2: Apple and Google Spark Civil Rights Debate. Favorite Securosis Posts David Mortman: An Example of Gratitude. Adrian Lane: The photo in Mike’s post on Competing made coffee spurt through my nose, I laughed so hard, but my favorite this week is Rich’s post on Physicality because he totally nails my experience and tribulations with writing! Other Securosis Posts Incite 10/15/2014: Competing. Favorite Outside Posts Rich: Rethinking the Security “Con”. Great rant by Shack about security conferences. There are too many, saying the same stuff. I like his suggestions toward the end, especially having everyone share 5 things they learned. That would be awesome. Mike Rothman: Before the Startup. With so much money flowing into everything ‘cyber’ we have lots of folks who want to start companies. They should read this post. It is a different counterintuitive world. It’s like riding a roller coaster. Every day. That doesn’t mean don’t do it, but go in with your eyes open. David Mortman: Homebrew Incident Response. Adrian Lane: Wake up to a POODLE puddle. Kudos to Martin for coming up with a list of links of everything you need to know about POODLE attacks, and my favorite vulnerability logo for this issue! Research Reports and Presentations Leveraging Threat Intelligence in Incident Response/Management. Pragmatic WAF Management: Giving Web Apps a Fighting Chance. The Security Pro’s Guide to Cloud File Storage and Collaboration. The 2015 Endpoint and Mobile Security Buyer’s Guide. Analysis of the 2014 Open Source Development and Application Security Survey. Defending Against Network-based Distributed Denial of Service Attacks. Reducing Attack Surface with Application Control. Leveraging Threat Intelligence in Security Monitoring. The Future of Security: The Trends and Technologies Transforming Security. Security Analytics with Big Data. Top News and Posts Alleged Dropbox hack underlines danger of reusing passwords Laura Poitras on the Crypto Tools That Made Her Microsoft, Adobe Push Critical Security Fixes Government Set Up A Fake Facebook Page In This Woman’s Name What you need to know about POODLE/SSL 3.0 vulnerability Apple Pay Setup, Functionality Leaked in New Screenshots Blog Comment of the Week This week’s best comment goes to Anonymous, saying something about buying Viagra on the cheap. That’s great news – it means blog comments are working again. Thanks for testing, spammers! Share: