Online Security Training

Link Here

1. Ethical Hacking and Penetration Testing
2. Footprinting and Reconnaissance
3. TCP/IP Basics and Scanning
4. Enumeration and Verification
5. Hacking and Defending Wireless/Modems
6. Hacking and Defending Web Servers
7. Hacking and Defending Web Applications
8. Sniffers and Session Hijacking
9. Hacking and Defending Windows Systems
10. Hacking and Defending Unix Systems
11. Rootkits, Backdoors, Trojans and Tunnels
12. Denial of Service and Botnets
13. Automated Penetration Testing Tools
14. Intrusion Detection Systems
15. Firewalls
16. Honeypots and Honeynets
17. Ethics and Legal Issues

Securing Critical Infrastructure in the Age of Stuxnet

DHS Review

Be careful those that sit next to you on the plane...

Interesting imposter case link hereLink to pdf

The First Annual Cost of Cyber Crime Study by Ponemon Institute

Link

Threat Site - Simple but useful

Link Here

PCI DSS v2.0 is finally out

PCI DSS v2.0

Session Hijacking Tool for Dummies

Impressive No Skills Needed Tool

Linkedin Fake Email - Password Stealing SPAM

Starting this morning, Monday 9/26, at 10am GMT, cyber criminals sent spam email messages targeting the LinkedIn social media community.

Victims are emailed an alert link with a fictitious social media contact request. These messages accounted for as much as 24% of all spam sent within a 15-minute interval. Clicking the link, victims are taken to a web page that says "PLEASE WAITING.... 4 SECONDS" and redirects them to Google. During those four seconds, the victim's PC is infected with the ZeuS data theft malware by a drive-by download. ZeuS embeds itself in the victim's web browser and captures personal information, such as online banking credentials, and is widely used by criminals to pilfer commercial bank accounts.

Organizations should encourage individuals to delete such requests, especially if they do not know the name of the contact. This is the second spam attack this month, preceded by the "Here You Have" email worm a few weeks ago. Cisco expects to see more spam messages containing malware sent to organizations to collect personal information.

Evercookie....why would you "ever" want this...Privacy other concerns

Link Here


evercookie is a javascript API available that produces
extremely persistent cookies in a browser. Its goal
is to identify a client even after they've removed standard
cookies, Flash cookies (Local Shared Objects or LSOs), and
others.

evercookie accomplishes this by storing the cookie data in
several types of storage mechanisms that are available on
the local browser. Additionally, if evercookie has found the
user has removed any of the types of cookies in question, it
recreates them using each mechanism available.

Microsoft Seeks Privacy Law to Aid Cloud Computing

Link Here

HP to buy Arcsight Security Company

Link Here

DNSSEC - Reading

Its been out a while, but a good doc to read concerning DNSSEC
Link Here

Panda Security Global Report - July 2010

Link Here

Latest Zeus 3 Banking Trojan - Whitepaper

Link to M86 Whitepaper

CISCO Mid Year 2010 Report

Link Here

Microsoft Out of Band Patch - Monday Aug, 2

Microsoft is planning to release an out of band patch addressing the "Shortcut" vulnerability. The patch is scheduled for release on Monday, August 2nd, at 10am PDT.

The need for State CISO's

A very Well Written Paper

RSA's Best Practices for Preventing Enterprise Data Loss

Link Here

Protecting Cyberspace as a National Asset Act

Link Here

AWOL Aghans on Facebook

You gotta be kidding...

Link

Amazon Cloud Service uses Fedex to ship data vs internet

Link Here

CBS Sports Scoreboards

US Cyber Command - DOD - Web Content

Link Here to Latest

Google's Security Tool - Skipfish

Tool Link Here

Roving Bugnet: Distributed Surveillance Threat and Mitigation

Link here

Microsoft Intune

Link here

Oracle releases April 2010 Patches

Link here

Info-scrubbing algorithm unveiled to protect patient privacy

Link

IAM Reading

There are three volumes for this series and they are written very well!!.

I am listing volume III which i recently completed a review of.

IAM Success Tips: Volume III: Identity Access Management Design and Architecture Tips (Volume 3) (Paperback)

Break out the "Old School" scanner

SSA - Security System Analyzer

OVAL based security checking toolset

Link here

Research: An interesting tool that monitors employee Twitter, Facebook, Linkedin

Read more here

For those of us who use "free Antivirus" at home, on our kids machines, here is a comparison

Link here to comparative data...

Einstein 3

Link

Cenzic - Web Trends Report

Cenzic Web Trends Report 2009

Google Security Blog

A link to my friends at "Google" and their security activities

Link here

FBI reports online crime losses double in 2009

Link Here

IT Risk 101

Things to ask during problem/incident/risk management:

1. What is the issue?
2. What is the impact?
3. What is probability of this occurring once or repeating?
4. How can this be fixed?
5. Who is going to fix it?
6. How much is it going to cost?
7. How long is it going to take?
8. How is the fix going to be lined up with the overall long term strategy and architecture?

Zscaler - Just one of many Security as a Service Solutions

Cloud based filtering inbound and outbound.

Link

Cloud Security Alliance - Threat Report

Cloud Security Alliance Report Link

Smart Grid Security Draft - Sept. 2009

A little dated, but worth a read.

Link

Article and Podcast - Assessing threat of cyberterrorism

An interview with James Lewis

Iphone Password Recovery Tool

Elcomsoft releases iphone tool

Link here

SMB : Tips for Avoiding Data Stealing Malware

Create an internet use policy
Train employees
Implement a web content filter
Keep anti-virus solutions updated
Reduce privileges
Deploy application whitelisting and heuristic detection
Consider dedicating a PC only for online banking, not for surfing or email

Source: CyberPatrol/FBI

Cloud UTM - An example toolset

Link

US Navy IAAS Testing

Link