After years of discussion and waiting, Mozilla has finally added Content Security Policy 1.0, a defense against some common attacks such as XSS, to its Firefox browser. CSP already has been implemented in Google Chrome and Internet Explorer and there was a limited implementation of it in Firefox previously, beginning in 2011, but this is the first time the approved 1.0 specification has been implemented in Firefox.
Java is a security headache, not just for users and Oracle, its provider, but also for other software companies that have to deal with it, as well. Microsoft has taken steps to address this problem by releasing a FixIt tool that is designed to block all of the Web-based Java attack vectors in Internet Explorer, while still leaving the desktop Java functionality intact.
Google has one of the older bug bounty programs in existence, and the company often makes changes to its rules in an effort to stay current with the security landscape. The latest change is another increase in the rewards that the company will pay to researchers who report certain bugs, including cross-site scripting in sensitive Web properties, to $7,500.
Microsoft announced today in an advanced patch Tuesday notification that it will ship just five bulletins in the June edition of patch Tuesday.
The predominant narrative among U.S. officials and cybersecurity experts is that Chinese hackers, allegedly at the behest of their government, are thoroughly compromising the computer networks of American government, defense, and public sector organizations in order to steal any valuable data found within them on a daily basis. What you don’t hear so often, though we’d be remiss to ignore it and you’d be a fool not to believe it, is that the U.S. is doing the same exact thing to China.
The shift in the last few years to cyberespionage and online attacks against the nation’s critical infrastructure have left the United States government lagging behind, and “a day late and a dollar short”, the former director of the National Security Agency said.
LinkedIn is the latest Internet services company to move to two-factor authentication. Experts applaud the movement but caution there are challenges and situations where two-factor is not the best option.
As the anti-government protests in Turkey have escalated in the last few days, privacy activists and security experts have begun working on ways to help people inside Turkey get reliable access to the Internet and privacy tools such as Tor. A security researcher over the weekend released a new tool called Lahana that enables users […]
Cloud-based note taking software Evernote this week pushed out three new security features including two-factor authentication for some users’ accounts, in hopes of adding an extra layer of protection to accounts.
Motorola’s Regina Duggan suggested at the Wall Street Journal’s D11 conference that pills and tattoos could replace passwords as the solution to the perennial authentication problem.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
