Patch Counting: Horseshoes and Hand Grenades

Like the old saying goes, “Close only counts in horseshoes and hand grenades.” I’ve developed a corollary this week, “The ‘number of flaws’ only matters to vulnerability assessment scanners and journalists.” I’ve read many news stories this week talking about the record number of...

Twitter needs a top-down security rethink

Twitter co-founder Biz Stone says the company “takes security very seriously” but the details behind the micro-blogging site’s recent hack shows that Twitter is light years away from having the most basic security controls in place. French hacker gains access to Twitter’s admin panel Here’s the...

Microsoft to unveil patch management metrics project

Microsoft on Wednesday plans to launch a new research effort to determine the total cost of the patch-management cycle, from testing and distributing a fix to user deployment of the patch. The end result of the project, which will be completely open and transparent to outsiders, will be a full...

Inside the Conficker Working Group

From the Internet Storm Center The mere existence of the Conficker Working Group also known as the Conficker Cabal is something of a minor miracle. Security vendors do not have a long history of cooperating with each other, aside from the perhaps the antivirus companies sharing samples. But, as a...

Six months later, DNS still taking a hit

It’s been more than six months since Dan Kaminksy detailed the problems he had found lurking in the DNS system, and the coordinated patching effort that followed his discovery was nothing short of extraordinary. A huge percentage of the vulnerable servers were patched before the details of the fl...

FreeBSD-SA-00:64.global

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:64 Security Advisory FreeBSD, Inc. Topic: global port allows remote compromise through CGI script Category: ports Module: global Announced: 2000-11-06 Credits: Shigio...