RSA Security Blog: A Blog for Security Professiona

RSS Feed Homepage

Articles: 1, 2, 3, 4, 5, 6, 7

Speaking of Security Podcast #141
2009-03-17 01:00:00
Click to Download/Listen (9:50) This week's Speaking of Security podcast features an update from Washington, DC on cyber security issues and pending legislation.
More About: Podcast

What Cisco's UCS means to RSA
2009-03-17 01:00:00
So Cisco launched their Unified Computing System this morning. This has some big implications for EMC, and Chuck Hollis has gone into great detail on this. In a nutshell, Unified Computing System looks to create a single, virtualized  architecture for the data center, managed from top to bottom by a single set of tools. Sounds cool, eh? But what does that mean for us lowly security folks?

PCI Compliance: SIEM
2009-03-09 01:00:00
During a recent customer meeting, I was asked to highlight key capabilities necessary to satisfy PCI’s Security Information and Event Management (SEIM) requirements.  I explained to the customer that if their goal was merely to meet PCI Requirement 10, the solution used here – either purchased, outsourced or home grown – must posses a modest set of baseline capabilities.  Some of these include enabling audit trails, reconstructing simple events, and securely storing audit trails for at least a year.
More About: Compliance

Speaking of Security Podcast #140
2009-03-09 01:00:00
Click to Download/Listen (7:23) The week's Speaking of Security podcast discusses the release of RSA enVision 4.0, the premier platform for Secuity Information and Event Management/Log Management.
More About: Podcast

enVision 4.0 goes live
2009-03-06 01:00:00
We’re pretty pumped here at RSA, since today we’re releasing our latest and greatest version of RSA enVision. RSA enVision 4.0 has some really cool new features, and should be a boon for anyone trying to get a better handle on using log data to deal with any bad stuff that may be going on in their IT environment.
More About: Live

PCI Compliance: A Prioritized Approach
2009-03-04 01:00:00
On March 3, 2009 the PCI Security Standards Council announced a new resource to promote adoption of the PCI DSS.  According to the Council, the “Prioritized Approach” provides six security milestones that will help merchants and other organizations incrementally protect against the highest risk factors and escalating threats while on the road to PCI DSS compliance.  As I previously mentioned, this announcement has been anticipated since the 2008 Council Meetings.
More About: Compliance

Using a SIEM to identify the *really* important stuff
2009-03-02 01:00:00
Many people buy a SIEM system looking for a tool that will spot things they might not on their own, or things that a single data source might not. Here’s an example of correlation that will work - given the right input, an analytic engine and some expert knowledge.
More About: Stuff

Fraudsters Exploit eCommerce Website to Check if Stolen Credit Cards are Va
2009-02-23 01:00:00
The RSA FraudAction Research Lab has recently traced a new tool designed by criminals that validates compromised payment cards (e.g. credit cards) that are illegally obtained through the underground fraud supply chain. Fraudsters usually test the viability of illegally obtained payment cards before they are used, and to this end, they use a variety of "card checkers" – which are fraudster services or tools that enable them to check the accuracy of compromised payment card data.
More About: Credit Cards , Website , Credit , Ecommerce , Exploit

Speaking of Security Podcast #139
2009-02-23 01:00:00
Click to Download/Listen (7:29) RSA Conference '09 is fast approaching. This week's Speaking of Security podcast provides an update on what to expect at this year's event.
More About: Podcast

Speaking of Security Podcast #138
2009-02-10 01:00:00
Click to Download/Listen (8:37) This week's Speaking of Security podcast features a discussion with Roland Cloutier, VP and CSO of EMC on the release of the new Security for Business Innovation Council report examing the information security challenges created by the current economic crisis.
More About: Podcast

PCI Compliance: The end game or just a starting point?
2009-02-09 01:00:00
As I am sure many of you have heard, Heartland Payment Systems recently disclosed that it suffered a credit and debit card data breach in 2008.  At this point, little is known beyond the  announcement that “after being alerted by Visa® and MasterCard® of suspicious activity surrounding processed card transactions, Heartland enlisted the help of several forensic auditors to conduct a thorough investigation into the matter...
More About: Game , Point , Compliance

There's No Business Like Snow Business
2009-02-05 01:00:00
For those of you who live in colder climes you must have had a little chuckle to yourselves watching us over here in the UK trying to deal with a few inches of snow  recently! The transport network pretty much ground to a halt, the Federation of Small Business es estimated that 20% of the UK's working population, or 6.4 million people, around the country would not make it to work.
More About: Snow

Speaking of Security Podcast #137
2009-02-03 01:00:00
Click to Download/Listen (8:45)This week RSA takes a deeper look into the RSA/Microsoft partnership and explores how the value of building security into business applications can create flexible, consistent and adaptable information security for today's organizations.
More About: Security , Podcast , Speaking

Skip Hindsight, Prepare Ahead of Time
2009-01-30 01:00:00
When dealing with Data Loss Prevention (DLP) issues, much has been made of the very real importance of true positives and false positives. As important as these are, less quantifiable is the status of false negatives, or those elements that should have been caught by software, but for some reason or another are not. This false negative element exists in all fields of knowledge work: it’s the element “not considered.” Or, to paraphrase a former Secretary of Defense, it’s the “we don’t know what we don’t know.”
More About: Time , Ahead

Why content is king when it comes to SIEM
2009-01-28 01:00:00
There are two big parts to a SIEM or log management system. Both are really important - but most people choosing a SIEM have a tendency to look carefully at one while giving the other scant attention.
More About: Content , King

Speaking of Security Podcast #136
2009-01-27 01:00:00
Click to Download/Listen (9:38)Ari Juels from RSA Labs has written a new suspense novel that presents a collision between ideas in the world of cryptology and the world of ancient Greece. Hear all about it on this week's Speaking of Security podcast.
More About: Podcast

Speaking of Security Podcast #135
2009-01-19 01:00:00
Click to Download/Listen (10:08)This week's Speaking of Security podcast features a discussion on data protection and security event management issues with a principal from Deloitte & Touche, one of RSA's key alliance partners.
More About: Podcast

The three big buckets of compliance, and why SIEM is important to all of th
2009-01-12 01:00:00
Too often we vendors go to clients and talk about compliance, and then throw up a slide showing an alphabet soup of regulations and standards, with no context about what they mean or how their product can help. Not only is it confusing, it shows a lack of understanding to customers, who are generally well educated about what these regulations and standards mean. I know this is basic stuff, but it's useful to recap once in a while.
More About: Compliance

Online Fraudsters Prey Upon the Media and Public Interest in Current Events
2009-01-08 01:00:00
Yesterday morning, the RSA FraudAction Research Lab discovered a social engineering scam designed to lure people, via an email spam attack, to a fake news website designed to look like CNN.com. This “Cease-Fire Trojan Attack” attempts to bait readers leveraging recent news and “graphic and striking” images regarding the Israel-Hamas conflict in Gaza. Today, RSA is initiating the shutdown process to take down this attack.
More About: Media , Events , The Media , Public , Current Events

PCI Compliance: Customer's frequently asked questions
2009-01-07 01:00:00
Over the past few weeks multiple merchants, banks and service providers have asked me the following three questions.  Since there seems to be some confusion, I figured I’d post a short FAQ...
More About: Questions , Compliance

Speaking of Security Podcast #134
2009-01-07 01:00:00
Click to Download/Listen (10:26) The first Speaking of Security podcast of 2009 features Jon Oltsik from the Enterprise Strategy Group. Jon shares his perspective on trends in information security for the new year.
More About: Podcast

New Phishing Kits Hit the Market: Trojan HTML Injections Now for Sale
2009-01-06 01:00:00
The economic lifecycle of the underground fraud community functions very similarly to the world of legitimate business. Online fraudsters have supply chains, third-party outsourcers, vendors, and online forums where people with skills and people with opportunities to commit fraud can find each other. The underground fraud supply chain is becoming more technically and operationally sophisticated, and we’ve coined this “Fraud-as-a-Service” or “FaaS”. FaaS consists of services for advanced hosting, Trojan infection kits and cashout services – all for sale within the fraudster underground.
More About: For Sale , Market , Phishing , Kits

Five Steps Congress May Take on Information Security in 2009
2009-01-05 01:00:00
Well, it’s that time of year again: lots of prognosticators making predictions for 2009 as they take a look at 2008 in the rearview mirror and try to figure out what’s in front of us in the New Year. So, I’ll join the legions of IT experts guessing what may be in store in the coming months as we raise our glasses to 08 and toast 09 with anticipation, hope and given the current economic climate, with consternation as well. Since I am a creature of Washington and have the opportunity to work with the U.S. Congress , I’ll focus on what steps we might expect our national legislature to take in 2009 as it relates to information security and privacy issues.
More About: Security , Information , Information Security , Steps

Taking the Pain out of Secret Writing
2009-01-05 01:00:00
Encryption is one security control that's showing up a lot more frequently these days; in many cases the choice to implement encryption isn't optional. PCI requires it, state PII protection laws are starting to demand it, and many other government and industry regulations imply it as a requirement. The other thing that's changing the way we look at encryption is that it's becoming ubiquitous - many of the hardware and software products we buy that touch information now have encryption built in. All of these factors are combining to make encryption one of the fastest growing areas of security. So what's the downside?
More About: Writing , Pain , Secret , Taking

A Real New Year's Hash
2009-01-01 01:00:00
The New Year has just arrived and I'm reminded how, globally, we are all connected in ways that would have been impossible 20 years ago: it's almost hackneyed to say it again, but thanks to an amazing combination of infrastructure and technology, we can live, work and play from Mumbai to London and from Tokyo to New York City as one world in real-time. Of course, a lot of this is dependent on some of the basic building blocks we use being sound, and in the last few days one of these building blocks has come under attack: MD5 is on its last legs as a tool in the cryptographic toolbox.
More About: Real

Securing Your Enterprise in an Insecure Economy
2008-12-22 01:00:00
As companies everywhere seek to reduce capital and operational expenses in a troubled economy, they ask themselves, How can we spend as little as necessary today to minimize additional costs throughout the next year? IT and security professionals relate to this as their goal is to never have to withdraw from the Contingency Reserves (or similar) budget item. Contingency Reserves is finance-speak for the allocation you must set aside to accommodate potential financial ramifications resulting from IT security breaches. These breaches occur when sensitive information leaks into the wrong hands, most frequently as a result of inadvertent internal error.
More About: Economy , Enterprise

Locard's Exchange Principle, Applied to eCrime
2008-12-22 01:00:00
I love crime shows: Law & Order SVU, Inspector Morse, CSI:, the occasional episode of Monk, and others. (OK – I’ll admit I like some of these for the drama as well!).  I also love a really good “Who Dunnit?” novel – usually with a good twist or two, of which Jeffrey Deaver is quite the modern master. 
More About: Exchange , Applied

PCI DSS: How to Do More With Less
2008-12-18 01:00:00
My colleague, Paul Stamp, recently shared his thoughts on the global economic downturn and the fact that it is making many organizations concerned that their IT security budgets will be cut.  Echoing Paul’s observations, almost all the customers I’ve spoken with have not seen their PCI budgets cut, but that is not to say they aren’t concerned.  Many have expressed a desire to stretch their dollars further, asking the question, “When it comes to PCI and my other security and compliance initiatives, how can I do more with less?”

Speaking of Security Podcast #133
2008-12-17 01:00:00
Click to Download/Listen (15:01)This week's Speaking of Security podcast features part two of an interesting discussion with Uri Rivner, Head of New Technologies for RSA. Uri talks about what organizations can do to combat fraudsters. Through a layered security approach, organizations can stay one step ahead to mitigate the risk of fraudsters targeting their business.
More About: Podcast

Budgets seem to be holding up, but more justification needed
2008-12-11 01:00:00
Also at the IANS conference, we talked extensively about enterprises' budgets. Apart from a few notable exceptions, most agreed that budgets hadn't been significantly cut...yet. It stands to reason – nobody buys security because it’s cool, or because they have extra cash in their pockets. On the other hand, few thought their budgets’ were immune to being cut in the near future either, though. Either way, just about everyone was finding that they needed extra justification for their security purchases.
More About: Holding , Justification , Budgets