Web Security

By Sarah Blankinship, Microsoft

CanSecWest, in beautiful Vancouver BC, is one of my favorite conferences each year. It’s a cozy little security con that brings together security researchers from all parts of the security ecosystem. Like a PhNeutral or a BlueHat, one never quite knows what to expect out of a CanSecWest, but we do know that Microsoft products and engineers will play a prominent role. We’ll be presenting new security innovations and new tools, we’ll be watching Pwn2Own closely for possible hacks, and we’ll be happy to discuss our industry best practices in the hallway track.

We recently conducted a project focused on confidential data security [enterprisestrategygroup.com] that will be published soon. However, here are some interesting advance results that support this venerable security dictum. ESG asked 308 North American and European security professionals from large organizations (i.e. 1,000 employees or more) a number of questions about data security risks, policies, and technology safeguards. When asked to define the most important measures for protecting confidential data, nearly half of all respondents said, “communicating and training users on confidential data security policies.” This was the top response followed by, “physical security,” and “access controls for private data.”

Clickjacking: Ryan and Roel tackle browser-threat hype – Tue, October 21, 2008

The cross-browser clickjacking threat, malware on new Asus EEE machines, phishing and the elections/financial crisis, the iPhone security mess, Microsoft Patch Tuesday and the exploding fraudware/rogueware problems.

Welcome to the Show – Mon, October 20 2008

In this show, we introduce ourselves and recap the Virus Bulletin 2008 conference. We talk about the MBR Trojan (bootkit), the controversy surrounding anti-virus testing standards, information on the blackmarket for online gaming passwords and some data from Microsoft’s malicious software removal tool (MSRT).
(Download)

It’s a departure from the stance that most people are taking these days when it comes to issues of social networking and security, but some industry players are pitching the idea [eweek.com] that the ever-more-popular communications applications could someday replace more traditional messaging platforms based on their ability to be more centrally protected from attacks.

In an ironic twist, Kevin Mitnick, a social engineering master who went to jail for impersonating others to get information to access computer networks without authorization, couldn’t access his own Facebook account for weeks because administrators at the social networking site didn’t believe he was who he said he was.

In this Network World interview at SOURCE Boston, well-known hardware hacker Joe ‘Kingpin’ Grand talks about lessons rom the “Prototype This” show, the changing face of security research and his upcoming vulnerability assessment work.  The video also includes an interview with Dan Kaminsky about his DNS vulnerability.