Today’s threats are increasing with each passing day and I would go so far to say that many individuals do not understand nor take the time to properly address security. In fact the Software Engineering Institute at Carnegie Mellon states:

1. Many users have a tendency to click on links without considering the risks of their actions.
2. Web page addresses can be disguised or take you to an unexpected site.
3. Many web browsers are configured to provide increased functionality at the cost of decreased security.
4. New security vulnerabilities may have been discovered since the software was configured and packaged by the manufacturer.
5. Computer systems and software packages may be bundled with additional software, which increases the number of vulnerabilities that may be attacked.
6. Third-party software may not have a mechanism for receiving security updates.
7. Many web sites require that users enable certain features or install more software, putting the computer at additional risk.
8. Many users do not know how to configure their web browsers securely.
9. Many users are unwilling to enable or disable functionality as required to secure their web browser.

Each of these points demonstrate the need for a mechanism that the average person can utilize to reduce the risk across the internet. Going back to the example of online banking, what would you say if you could simply boot off a DVD into a Linux Operating system and protect you credentials? This is entirely possible with Lightweight Portable Security (LPS) which was developed by the United States Air Force.

LPS differs from traditional operating systems in that it isn’t continually patched. LPS is designed to run from read-only media and without any persistent storage. Any malware that might infect a computer can only run within that session.

LPS is updated on a regular basis (at least quarterly patch and maintenance releases). Update to the latest versions to have the latest protection.

For those that are not familiar with Linux there is nothing to fear. Go grab yourself a download of Lightweight Portable Security (LPS) and see for yourself just how easy LPS is and protect yourself at the same time.

Books and Whitepapers

Discover how to protect yourself from Firesheep and other Sidejacking attacks! The release of the Firesheep Wi-Fi attack tool has increased awareness among both users and attackers of the inherent insecurity of unprotected HTTP connections. Firesheep allows an attacker connected to the local network to monitor the web sessions of other users on that network. As experts proclaimed in reaction to Firesheep, the best solution to the problem is to use TLS/SSL for all connections to web sites, including the home page. Download ” Protecting Users From Firesheep and other Sidejacking Attacks with SSL” to learn how to avoid these attacks.

The Web Security Challenge: A Competitive Guide to Selecting Secure Web Gateways. In the search for reliable, comprehensive Web security, there is a clear leader. Third-party testing confirms that only Websense Web Security Gateway meets or exceeds industry analyst criteria across nine functional areas including malware protection, data loss prevention, and Web 2.0 threat detection accuracy when tested against competitive products.

This guide examines current information security threats to business and describes techniques for developing a security management strategy that leverages established best practices. Designed for IT professionals and business managers, this guide provides an overview of security threats, their impact on businesses, and, perhaps most importantly, practices and technologies for controlling security risks. The first chapter begins with a discussion of cybercrime and the business resources targeted by increasingly sophisticated and organized attackers. The second chapter moves to examine how common weaknesses in business processes, such as insufficient use of SSL, leave organizations vulnerable to data breaches and compromised systems. The final two chapters address how to create a high impact security strategy and implement best practices, including multiple uses of SSL technologies, to protect your business.

Request Now

A Prescription for Privacy: What You Need To Know About Security Requirements for Electronic Health Records

Learn the measures that organizations need to start taking right now to prepare for the upcoming changes in the healthcare industry. As organizations implement EHRs–or as they ramp up their existing systems to make them more robust–concerns about patient privacy will move to the forefront. This report looks at the challenges surrounding the new world of EHR technology, including the requirements that govern protecting confidential patient data online, as well as security breaches and other risks that come with storing and accessing that information with web-based systems.

Request Now

Beginners Guide to Digital SSL Certificates

Whether you are an individual or a company, you should approach online security in the same way that you would approach physical security for your home or business. This guide will de-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.

Request Now

Implementing Best Practices for Web 2.0 Security with the Websense Web Security Gateway

The way to address Web 2.0 threats that combine the best aspects of traditional security and control techniques is with new technology designed specifically to address the dynamic, real-time nature of Web 2.0. This paper describes how the Websense Web Security Gateway enables you to quickly and effectively implement a best practices approach to making Web 2.0 secure and effective.

Request Now

Mobile Device Management and Security

How to benefit business users with secure mobile access to corporate data systems and the solutions that work. The evolution of mobile networks and devices has changed the way we communicate, with people increasingly able to stay in touch through greater mobility and flexibility than ever before. This evolution is also changing the way people work. Time and money can both be saved when mobile employees have easy access to information and their corporate IT infrastructure. At the same time, the security of that information as well as the ability to manage access to it has never been more important. Learn about the fundamentals of security and device management and how you can provide secure mobile access to corporate data systems and benefit business users.

Request Now

Security: Security magazine reaches 35,000 security end-user and integrator subscribers in government, healthcare, education, airports, seaports, transportation, distribution, utilities, retail, industrial, financial, hospitality / entertainment, construction, industrial/manufacturing and other markets.

Security Source: From spyware to phishing attacks, security threats are growing more virulent as the promise of big payoffs increase. In its premier Winter 2007 issue, Security Source Magazine’s cover story is about keeping the network secure, from the gateway to the desktop.

Security on a Budget: How to Develop a Cost-Effective Security Program: Is it better to manage in-house or outsource some tasks to an MSSP? Do you have a complete view of all the “hidden” costs that are often not recognized until late in the process? This webinar provides an insider’s recommendation on how to get the most from your information security budget. Lance Wolrab shares his “lessons learned” about cost management as a CSO for a large healthcare organization and as a senior security engineer at Dell SecureWorks.

HackerProof: Your Guide to PC Security: The terms “PC security” or “computer security” are vague in the extreme. They tell you very little, like most general terms. This is because PC security is an incredibly diverse field. On the one hand you have professional and academic researchers who carefully try to find and fix security issues across a broad range of devices. On the other hand, there is also a community of inventive computer nerds who are technically amateurs (in the literal sense of the word – they’re unpaid and unsupported by any recognized institution or company) but are highly skilled and capable of providing useful input of their own.

Justifying IT Security: Managing Risk & Keeping Your Network Secure: This white paper discusses the management of Risk and how Vulnerability Management is one of the few counter-measures easily justified by its ability to optimize risk.

Securing & Optimizing Linux: The Hacking Solution (v.3.0): This 800+ page eBook is intended for a technical audience and system administrators who manage Linux servers, but it also includes material for home users and others. It discusses how to install and setup a Linux server with all the necessary security and optimization for a high performance Linux specific machine. It can also be applied with some minor changes to other Linux variants without difficulty.

7 Essential Steps to Achieve, Measure and Prove Optimal Security Risk Reduction: Rapid changes within technology and the evolving sophistication of attack methods used to infiltrate systems create the greatest set of challenges faced by IT administrators trying to keep their systems secure and within regulatory compliance. That’s why—whether protecting five servers or 5,000—measuring the security status of your infrastructure and your organization’s ability to rapidly mitigate emerging threats need to be continuously monitored and measured.

Lockdown: Secure Your Data With True Crypt: This manual will be talking about local file encryption – that is, encrypting files on a hard drive (or encrypting the entire hard drive; more on that later). The files are safe as long as they are kept in the encrypted area. TrueCrypt is a free, cross-platform program (meaning that it works in Windows, Mac OS X and Linux distributions including Ubuntu) that you can use to encrypt your data. It is classified as “On The Fly Encryption” (OTFE) software, which basically means that it encrypts and decrypts files as you access and modify them and that all files within the area of encryption are available as soon as you enter the key. Also with this free guide you will also receive daily updates on new cool websites and programs in your email for free courtesy of MakeUseOf.

The Top 10 Reports for Managing Vulnerabilities: New network vulnerabilities appear constantly and the ability for IT security professionals to handle new flaws, fix misconfigurations and protect against threats requires constant attention. However, with shrinking budgets and growing responsibilities, time and resources are at constrained. Therefore, sifting through pages of raw vulnerability information yields few results and makes it impossible to accurately measure your security posture.

The (VERY) Unofficial Guide To Facebook Privacy: As the service evolves, executives tend to favor our open access to information, meaning information you think is private will slowly become public, but that doesn’t mean you can be private if you want to. Facebook gives its users the option to lock things down, but users need to be aware of their controls, how to use them and how to prepare for future Facebook privacy changes. Facebook has not and will not make information obvious, and that’s where this guide comes in. With this free guide you will also receive daily updates on new cool websites and programs in your email for free courtesy of MakeUseOf.

Security Director News: Through its web site and weekly newswire, Security Director News delivers day-to-day facts and real business information that assist security directors in making the right decisions for the safety of their organizations. Security Director News presents a wide variety of viewpoints on important issues, including interviews with involved parties, analysts and experts from every industry segment.

Web Application Security; How to Minimize Prevalent Risk of Attacks: Stories about exploits that compromise sensitive data frequently mention culprits such as “cross-site scripting,” “SQL injection,” and “buffer overflow.” Vulnerabilities like these fall often outside the traditional expertise of network security managers.

Security Systems News: Security Systems News is a monthly business newspaper reaching over 28,000 security dealer/installers, systems integrators, product distributors, central stations, systems resellers as well as end users and security consultants. Editorial coverage focuses on breaking news in all major segments of the security industry such as market trends, new products, new technology introductions, and news about manufacturers and suppliers.

Open Source Security Tools: A Practical Guide to Security Applications: Written with the harried IT manager in mind, Open Source Security Tools is a practical, hands-on introduction to open source security tools. Seasoned security expert Tony Howlett has reviewed the overwhelming assortment of these free and low-cost solutions to provide you with the “best of breed” for all major areas of information security.

Securing Sensitive Data in File Shares: All companies invest in software and staff to ensure they are able to control access to critical information that’s stored in applications and databases because it’s part of standard business and IT operations. Despite those investments, companies don’t put the same amount of resources toward protecting unstructured stores like file shares. View the archive of this educational webinar to learn how your company can effectively manage access to data in file shares.

PC Security Handbook – 2nd Edition: This handbook is designed to help you find ways to protect your Windows XP/Vista/7 PC and ensure your data is safe. The author gets countless emails from site visitors who ask about the best anti-virus software, firewall program, backup utilities, etc., and there are often questions like this in the forums. He sets up PCs for companies, friends, and family; the advice he gives in this manual is what he uses when building any PC. His tips are tried and tested and have left hundreds of people satisfied with the way their computers work. He hopes you too can follow these instructions and enjoy an error-free, spyware-free, and speedy PC.

SY0-201 CompTIA Security+ Special Edition Practice Exam and Study Guide: CompTIA’s Security+ exam is a critical step for anyone interested in IT security. It’s a key component in the Department of Defense’s 8570.1 initiative that mandates federal IT workers and contractors gain security certifications to work with the federal government. The ExamForce SY0-201 CompTIA Security+ practice exam provides a unique triple testing mode to instantly set a baseline of your knowledge and focus your study where you need it most, while the 51 page Study Guide provides high quality reference material — a valuable companion to the practice exams.

Federal Computer Week: It provides information decision-makers need to run the business of their agencies and deliver on their missions through the deployment of information technology.

Introduction to MBSA

Microsoft Baseline Security Analyzer is an easy-to-use tool designed for the IT professional that helps small- and medium-sized businesses determine their security state in accordance with Microsoft security recommendations and offers specific remediation guidance. Improve your security management process by using MBSA to detect common security misconfigurations and missing security updates on your computer systems. A number of options include:

1. Administrative vulnerabilities
2. Week Passwords
3. IIS administrative vulnerabilities
4. SQL administrative vulnerabilities
5. File shares
6. … and more

Best of all Microsoft Baseline Security Analyzer it absolutely free from Microsoft!

Executing MSBA

Once you have downloaded and installed Microsoft Baseline Security Analyzer go ahead and run the application.

If you’re scanning a single computer then go ahead and click “scan a computer”. Once the next dialog has loaded, you will need to uncheck IIS and SQL administrative vulnerabilities unless of course you are running these two services.

The next step is to start the scan. Go ahead and click the button “start scan. The scan can take a few minutes so be patient. Once the scan has completed you are then presented a dialog that tells you exactly what was scanned, the score, issue, and the result. Reporting includes:

1. Microsoft Office Updates
2. Critical Updates or Patches
3. Weak Password Check
4. Services
5. Firewall
6. File Sharing

The scan resulted in a number of critical failures. The failures must be correctly properly secure you system and while you in the process address each line item to further fortify your operating system. Take for example the critical failure of local account password test. The result states user accounts have simple or no password which can lead to others being able to quickly determine your password.

If you’re not positive how to correct the problem then Microsoft has you covered here as well. Go ahead and click “how to correct this” and the issue is explained as well a solution with instructions is provided. Now it just cannot be any simpler and now you have no reason to not properly secure your operating system.

Conclusion

Microsoft Baseline Security Analyzer does a great job of pointing out the holes in security and by following the best practices and guidelines provided you will quickly find yourself on a path of security prosperity. Just remember, security is a never ending process and with that being said you may want to re-run the scan on a monthly or even a quarterly basis.

Have you used Microsoft Baseline Security Analyzer previously? If so what are you thoughts? Does this product provide a valuable tool set that helps in your security endeavors?

References

• Download Microsoft Baseline Security Analyzer

Credits

Featured image: Casey Serin

SQL Injection Cheat Sheet

The SQL Injection Cheat Sheet provides a summary of everything you need to know about SQL Injection. The SQL Injection Cheat Sheet contains the key concepts of SQL Injection and a SQL Injection example and tips for prevention of SQL Injection attacks. Note that you must register with Veracode in order to obtain these cheat sheets.

Download the FREE SQL Injection Cheat Sheet

Cross-Site Scripting (XSS) Cheat Sheet

The Cross-Site Scripting Cheat Sheet provides a summary of what you need to know about Cross-site Scripting. Our XSS cheat sheet details the different types of Cross-site Scripting and shows you how to protect against Cross-site Scripting vulnerabilities.

Download the FREE XSS Cheat Sheet

LDAP Injection Cheat Sheet

The LDAP Injection Cheat Sheet provides a summary of what you need to know about LDAP Injection. It contains a LDAP Injection example and details of how to protect against LDAP Injection vulnerabilities.

Download a FREE LDAP Injection Cheat Sheet

The interface on the iPad is exactly what one would expect. It is crisp and clean and extremely easy to navigate. Take a look for yourself.

There is a fairly good range on content available to include The DaVinci Code, Big Daddy, and Quarantine just to name a few of big ticket Hollywood movies. As a child I grew up watching television shows like Bewitched, I Dream of Jeannie, and of course Charlie’s Angels. Now all of with you can turn back the clock for yourself and watch these classic shows should you have never been so lucky.

You can download the app from iTunes and it’s free.

In the event you have not heard of the LaunchPad to be released within OSX Lion it is a nice feature that bring the iPad style of accessing your application to your MacBook. Apple says, “Launchpad gives you instant access to your apps — iPad style. Just click the Launchpad icon in your Dock. Your open windows fade away, replaced by an elegant, full-screen display of all the apps on your Mac. It takes just a swipe to see multiple pages of apps, and you can arrange them any way you like by dragging icons to different locations or by grouping apps in folders. And when you download an app from the Mac App Store, it automatically appears in Launchpad. Ready to blast off”.

In the event you want this capability today then you’re in luck. The Araelium Group has QuickLaunch available at a cost of $10.00 via their online store or the Apple App Store. I must say that I was pleasantly surprised at the ease of use and quick access. It’s great from the aspect that you can create pages and add shortcuts to applications and folders. You can configure QuickPick to either use the keyboard or a screen corner for quick activation. You can even have the application sit in your dock and the menu bar or any combination of.

Now if you have made it this far then I wanted to let you know that you can grab QuickPick for free from MacUpdate. Act fast because I’m not positive how long they will offer this app for free! So what do you think of QuickPick? Is it something you would spend $10 on or will you wait for OSX Lion?