Achieve Continuous Security and Compliance with the CIS Critical Security Controls

For InfoSec pros, it’s easy to get overwhelmed by the constant noise from cybersecurity industry players — vendors, research firms, consultants, industry groups, government regulators and media outlets. A good antidote for this hyperactive chatter is to refocus on foundational InfoSec practices...

New National Vulnerability Database visualizations and feeds

Recently, the National Institute of Standards and Technology NIST introduced a new version of National Vulnerability Database NVD website.  I will not say that I liked this redesign: IMHO, old website with US flag was much prettier and useful: But the very fact that the site is developing, I...

ISO Rejects NSA Encryption Algorithms

The ISO has decided not to approve two NSA-designed block encryption algorithms: Speck and Simon. It's because the NSA is not trusted to put security ahead of surveillance: A number of them voiced their distrust in emails to one another, seen by Reuters, and in written comments that are part of t...

FAQ: Citrix Virtual Apps and Desktops Long Term Service Release (LTSR)

Table of Contents General LTSR Information LTSR upgrades Mixing LTSR, CR, and Cloud releases Support lifecycles LTSR compliance Citrix Workspace app LTSR Release timing Other considerations and resources General LTSR Information What’s new and what’s changed with the Citrix Virtual Apps and...

Is Your Mobile Carrier Your Weakest Link?

More online services than ever now offer two-step authentication -- requiring customers to complete a login using their phone or other mobile device after supplying a username and password. But with so many services relying on your mobile for that second factor, there has never been more riding o...

[SECURITY] Fedora 26 Update: cyrus-imapd-3.0.3-1.fc26

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contac ts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use fro...

[SECURITY] Fedora 25 Update: firefox-55.0-5.fc25

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Flash Player is Dead, Long Live Flash Player!

Adobe last week detailed plans to retire its Flash Player software, a cross-platform browser plugin so powerful and so packed with security holes that it has become the favorite target of malware developers. To help eradicate this ubiquitous liability, Adobe is enlisting the help of Apple,...

New IoT Bill Proposes Security Standards for Smart Devices

By this time, almost every one of you owns at least one internet-connected device—better known as the "Internet of things"—at your home, but how secure is your device? We have recently seen Car hacking that could risk anyone's life, Hoverboard hacking, even hacking of a so-called smart Gun and al...

New Bill Seeks Basic IoT Security Standards

Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government's purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceive...

Q&A: Conducting Cloud-Based Vendor Risk Audits With Qualys SAQ

Third-party security assessments drastically reduce your organization’s risk of suffering a data breach. When carried out properly, these assessments identify poor InfoSec and privacy practices among your vendors, partners, contractors, and other third parties with access to your IT systems and...

standards.incits.org XSS vulnerability

Vulnerable URL: https://standards.incits.org/apps/grouppublic/projects.php?endinyear=1"...

Legislation to Strengthen IoT Marketplace Transparency

Senator Ed Markey D-MA is poised to introduce legislation to develop a voluntary cybersecurity standards program for the Internet of Things IoT. The legislation, called the Cyber Shield Act, would enable IoT products that comply with the standards to display a label indicating a strong level of...

[SECURITY] Fedora 24 Update: firefox-54.0-2.fc24

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

[SECURITY] Fedora 26 Update: php-pear-PHP-CodeSniffer-3.0.1-1.fc26

PHPCodeSniffer provides functionality to verify that code conforms to certain standards, such as PEAR, or user-defined...

[SECURITY] Fedora 26 Update: firefox-54.0-2.fc26

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability...

Arbitrary shell execution

Security Advisory - This release contains a fix for a security advisory related to the improper handling of a shell command - A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option - All version 3 users are encouraged to upgrad...

BSA-2017-272

Security Advisory ID : BSA-2017-272 Component : OpenSSH Revision : 2.0: Final Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS11 modules by leveraging control over a forwarded agent-socket. Affected...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with commonly adhered to security standards and regulations. Qualys provides a wide range of policies, including many that have been certified by CIS as well as ones based on security guidelines from vendors such as Microsoft and VMware...

Meeting FedRAMP and Government Standards – Coalfire Securealities Report

Coalfire released the results of its first annual FedRAMP Marketplace report - Securing Your Cloud Solutions: Research and Analysis on meeting FedRAMP and Government Standards. The findings highlight many positives for cloud service providers and federal agencies, but also opportunities for both ...