Ryan Naraine

Security holes in the Apache Geronimo Application Server and SAP cFolders headline a list of five serious Web app vulnerabilities that demand immediate attention.
According to Mark Painter from the HP Security Laboratory, the Geronimo flaws expose users to a variety of attack vectors that could lead to the theft of sensitive information and cookie-based authentication credentials.  Here’s the top-five list [zdnet.com]

From CIO (Joan Goodchild)

The pickings are slim in the job market and the time line of interviewing and then hiring new people is slow. But there are positions available in the security field, according to three veteran security recruiters that we spoke with recently.

If you get a call that you’ve got a shot at a job interview, every move counts. How can you have an edge over other candidates angling for the same position? Our experts weigh in on important steps to excel when you get your chance to wow a possible new employer.  Read the full story [cio.com]

From the Windows Security Blog (Paul Cooke)
RSA was great last week – security was clearly top of mind for the attendees, and I fielded a number of different questions last week about how Microsoft protects our customers. Some are pretty straightforward around how the various Windows 7 security technologies work, but many have focused on how we actually deliver protection to customers on an ongoing basis.
One question that comes up more than I would have ever expected is: Who gets security updates? Read the full blog entry [windowsteamblog.com]

From IDG News Service (Jeremy Kirk)
A study from security vendor Qualys has found that companies are patching just a hair faster than they were five years ago. 

From Network World (Kristy Westphal)

Data leakage has become a hot topic in information security. But what if you can’t afford the tools that are specifically designed to keep employees from intentionally or mistakenly leaking private or valuable corporate data to the outside? It turns out there are some creative ways to use what you have (or can easily get) to tackle the problem.  Read the full story [cio.com]

In direct response to Conficker and an increased wave of malware attacks targeting the Windows AutoRun feature, Microsoft today announced significant changes to the way the operating system operates when USB drives are used.

The changes, detailed on Redmond’s Security Research & Defense blog, have been built into Windows 7 will be back-ported to Windows Vista and Windows XP in the near future. Read the full story [zdnet.com]  Also see the Microsoft SR&D blog [technet.com]

From IDG News Service (Jeremy Kirk)
A Dutch university has landed a European Research Council grant to continue work on a Unix-type operating system that aims to be more reliable and secure than Linux or Microsoft Windows. The €2.5 million (US$3.3 million) grant will fund three researchers and two programmers, said Andrew S. Tanenbaum, a computer science professor at Vrije Universiteit in the Netherlands.
Tanenbaum developed Minix [minix3.org], an operating system based somewhat on Unix that has a small code base and implements strong security controls. Read the full story [itworld.com]