Opinions & Analysis

When Gartner coined the phrase "Next Generation Firewall (NGFW)” in 2003, it captured a then-nascent approach to traffic classification and control.   Combining traditional packet filtering, with some application control and IPS layered on top, today’s “legacy” NGFWs do pretty much what they say on the tin.   However, whilst NGFWs continue to be a vital part of an organisation’s protection, they were designed for a time before advanced targeted threats started attacking our enterprises...

More than six months after Heartbleed captured the internet security industry's attention, another major bug is making the headlines.   Affecting UNIX and Linux servers, Bash is a serious issue and one that will not be easy to fix. Although some are calling it the next Heartbleed, here is what some of the industry's finest minds are saying.     Ben Johnson Chief Security Researcher for Bit9 + Carbon Black   “The tricky aspect of this vulnerability...

The national news will be dominated by a four letter word for the next few days and, until yesterday, it is not one we would usually use.   Call it Shellshock or Bash, the flaw has been described as being as bad as Heartbleed, or even not as bad, depending on who you listen to. Essentially, the flaw affects UNIX and Linux users and, therefore, the underlying internet infrastructure. If you can get administrator control of...

This week we have seen two breaches of payment card data reported in 24 hours.   The first regarded Texan clothing retailer Sheplers, who suffered a breach of names, credit and debit card account numbers and expiration dates after payment systems were affected between June 11th and September 4th.   The second revealed that Viator, a partner of travel website TripAdvisor, had customer credit cards used for fraudulent purposes. It warned users who had created a Viator account...

The 2012 audits conducted by the Office for Civil Rights (OCR), the governing body that enforces HIPAA regulations, revealed an egregious lack of compliance across the healthcare industry. With the next round of audits scheduled to begin soon, it’s hard to say how forgiving the OCR will be. One thing is for sure: The OCR expects healthcare organisations to monitor themselves. Even so, many companies have yet to initiate a thorough internal audit of their...

Recent research by AKJ Associates found that of 500 UK adults, 76 per cent were concerned about the security of data in a call centre. Of those surveyed, 35.8 per cent said that they were ‘very concerned’ about how personal and credit card information might be protected at call centres from hackers and rogue staff. The research apparently came in the wake of warnings from security researchers that fraudsters are preying on contact centres, using...

Google has called the dumping of user credentials “one of the unfortunate realities of the Internet today”   In a blog post by Borbala Benko, Elie Bursztein, Tadek Pietraszek and Mark Risher at the Google Spam and Abuse Team, it acknowledged a dumping of data, but said that fewer than two per cent of the username and password combinations might have worked, and those would have mostly been blocked by its automated anti-hijacking systems.  ...

At the end of the first day of the Gartner Security and Risk Management summit in London, I had the opportunity to catch one of the distinguished analysts looking at the state of security in terms of the top ten technologies. Presenting in the final session at the event, Neil McDonald, vice president, distinguished analyst and Gartner Fellow in Gartner Research presented on the “top ten technologies for information security”, where Gartner's 60 security analysts from around the world...

Throughout the conversations I have had this year, there has been one recurring theme – automation.   Hardly a new concept; I was writing about the benefits of automation over the past few years, but it seems that 2014 has brought this back to the forefront.   Look at the examples: Oxford University’s Sadie Creese said that we as humans “are good as spotting shapes and patterns”, but we automate as much as possible so...

Last night security blogger Brian Krebs reported that US retailer Home Depot had suffered a major breach of credit and debit card data that may stretch back to late April or early May of this year.   Alerted by banks, after a massive new batch of stolen credit and debit cards went on sale on the dark web, a Home Depot spokesperson Paula Drake confirmed that the company is investigating. Krebs said that there are signs that the perpetrators of...