Wireless Security

Symmetric Cryptography, One-Way Hash Functions, Public-Key Cryptography, Man-in-the-Middle Attack, Digital Certificates, S/MIME and Secure Mail.

ACSI 33 is intended to provide guidance to all Australian Government Departments, organizations and personnel in the task of protecting classified or unclassified computer information and equipment. Specifically, it describes the steps to be taken to plan and implement the computer security measures required by the Protective Security Manual. Includes Standards, Evaluated Products, Risk Management, Security Management, Emanations and Cabling Security, Media Security, System Access Control, Network Security, Cryptographic Systems, Web Security, Email Security, Malicious Software, Intrusion Detection, Physical Security

Improving WLAN security (2002) Security is one of the most pressing issues for WLANs, particularly for the 802.11b networks, also named WiFi, whose WEP (Wired Equivalent Protocol) security protocol has proven to be limited. Researchers have identified holes in WEP that allow hackers to learn the keys used to encrypt 802.11b, and use widely available hacking software to decode the WEP encryption.

Going up the wireless stack (12/01) When broadcasting your data through the air, watch out for the man in the middle. Think you've got a trusted wireless connection to a trusted party? Don't be too sure. Attackers can use a technique known as ARP spoofing to convince two machines that they are communicating with each other, when both are actually connected to a third computer under hostile control. Larry Loeb explains how crackers can implement such so-called man-in-the-middle attacks -- and how you can stop them.

Under the UK ITSEC scheme, the security features of IT systems and products are tested independently of suppliers to identify logical vulnerabilities. This type of testing is known as security evaluation and it is carried out against standardised criteria to a formalised methodology. The criteria lay down a number of degrees of rigour known as Assurance Levels. Certificates are issued by the Scheme for products meeting the requirements for a claimed level of assurance. United Kingdom certificates are recognised in many countries of the world.

Other Security Publications Various useful publications covering: Computer Security, Trusted Information Systems, Intrusion Detection, Computer Emergency Response and legal issues with regard to computer security.

October 2001 Security Newsletter  Wireless Security, Interesting Articles, Featured Events, Featured Research Reports, PGP Security Products, Virus Protection, From the Wireless Bookshop, Asia-Pacific Consultants.

Introduction To The Rainbow Series our fast-start guide to the Orange book and others in the Rainbow Series.

AS/NZS 7799.2:2000 (Previously known as 4444.2) Information security management - Specification for information security management systems. This Standard specifies requirements for establishing, implementing and documenting information security management systems (ISMSs). It specifies requirements for security controls to be implemented according to the needs of individual organizations.

PGP Attacks PGP is the most widely used hybrid cryptosystem around today. There have been MANY rumours regarding its security (or lack there of). These have ranged from one that PRZ was coerced by the Gov't into placing backdoors into PGP, to one the NSA has the ability to break RSA or IDEA in a reasonable amount of time, and so on. While I cannot confirm or deny these rumours with 100% certainty, I really doubt that either is true. This FAQ, while not in the 'traditional FAQ format', answers some questions about the security of PGP and should clear up some rumours...

Entrust.net Now issuing WAP server certificates.

Entrust/PKI for WAP Certificates.

Entrust/Toolkit allows customers to build a secure and trusted wireless bridge between the wired and wireless world. Joining the family of Entrust/Toolkit products is the Entrust/Toolkit for WTLS. This new toolkit is being developed to assist in building applications to secure business-to-business transactions, business-to-customer transactions and internal business transactions. In addition to supporting existing security protocols, Entrust/Toolkit for WTLS will support the new WAP security protocols.

PGPfire - Distributed Firewall and Personal Intrusion Detection Now remote and distributed users can benefit from the security of an enterprise ready distributed firewall. Includes personal firewall and intrusion detection system in one easy-to-use package.

PGP e-ppliance 5 Firewall & VPN  - Network Privacy PGP e-ppliance 5 combines Firewall and Virtual Private Networking (VPN) capabilities in a single, integrated software and hardware security system.

Risk Management: Tivoli Risk Manager, Tivoli Intrusion Manager

Identity Management: Tivoli User Administration, Tivoli Security Manager

White papers Authentication and PKI, Architecture for Securing your VPN, Building the Infrastructure for Secure Electronic Commerce, Certificate Revocation, Directories and PKI, Enterprise Key Management, Trusted Web Services, Managed Security Services

Recent Security Headlines

Network World SP 800-53 is essential for security in federal government IT systems
SP 800-53 (Appendix H) provides two-way mappings between security controls defined in SP 800-53 and security controls defined in international security standard ISO/IEC 27001, Information Security Management Systems

Network World 10 really cool university networking labs
10 really cool university networking labs featuring advances in wireless, cloud computing, security and more.

Network World Two start-ups, Egress and SafeMashups, make debut today
Two start-ups, Egress Software Technologies and SafeMashups, each make their debut today with security products that have a crypto-tech edge to make data flowing across the Internet safer.

Network World A Guide to Windows 7 Security
Until now, Windows Vista was the most secure version of the Windows operating system. Windows 7 picks up where Vista left off, and improves on that foundation to provide an even more secure computing experience. Microsoft also incorporated user feedback about Vista to enrich the user experience and to ensure that the security features are intuitive and user-friendly. Here's a look at some of the more significant security enhancements in Windows 7.

Network World The Art of Creating Strong Passwords
While security has never been more important than it is today, the fastest way for an IT professional to become the most despised person in the company is to start enforcing a strong password policy. A policy perceived as overbearing may cause people to write down their passwords on a sticky-note near their computers, circumventing its very purpose. Your policy will be ineffective if your users don't know how to create strong passwords that are easy to remember.

Network World Facebook, Twitter Provide Sensitive Info for Criminals
Social networking services like Facebook and Twitter foster a false sense of security and lead users to share information which can be used by cybercriminals and social engineers. The very concept of social networking is based on connecting and sharing, but with who?

Network World Verizon Business to Offer Risk-Based Security Service
Verizon Business announced on Wednesday a new risk-based suite of security tools that include cloud-and-premises-based services. Verizon's Next Generation Managed Security Services Platform is designed to compete with similar offerings from ArcSight and RSA.

Network World Protect Your PCs from Windows 7's Zero-Day Exploit
It was a notable accomplishment when Windows 7 was not impacted in any way by the vulnerabilities addressed in the six Security Bulletins released by Microsoft for the November Patch Tuesday. It would be even more impressive if Windows 7 proved invulnerable to the zero-day exploit that hit the next day.

Network World MS Provides Guidance on Windows 7 Zero-Day Vulnerability
Microsoft has acknowledged the Windows 7 zero-day vulnerability reported last week with a Security Advisory. The advisory from Microsoft provides some additional details about the scope and nature of the threat, as well as some steps you can take immediately to protect vulnerable systems.

ZDNet iTunes update fixes security flaw
A flaw in the music software could allow a hacker to take over Windows and Mac machines remotely

About our headline feed

Encryption News

ZDNet Wi-Fi firms put onus on users for hotspot security
Hotspot operators say it is up to customers to use encryption, after the BBC's Watchdog programme hacks into emails sent over public Wi-Fi

Rootsecure.net Slashdot: US Government Using PS3s To Break Encryption
 

Encryption News Zero-day flaw found in web encryption
A zero-day flaw in the TLS and SSL protocols, which are commonly used to encrypt web pages, has been made public. Security researchers Marsh Ray and Steve Dispensa unveiled the TLS (Transport Layer Security) flaw on Wednesday, following the disclosure of

Encryption News Ofcom stalls BBC’s HD encryption plan
The BBC’s aim to encrypt its upcoming high definition programmes on Freeview has been turned down by regulator Ofcom until objections have been given “further consideration

Encryption News Video Padlock
password. Playback of large files is instant thanks to a unique partial encryption feature. Try the demo and encrypt two files free

Encryption News A Peek At Transparent Database Encryption
There are several different ways to encrypt data stored within databases -- some residing inside the database, others outside. You can encrypt data programatically at the application layer or at the database layer, and automatically by the

FreeNewsFeed Auto-Updating Chrome OS Will Focus on Security
Google sketched out more details Thursday about its Chrome operating system, which is slated to become available before the end of next year. Google said the project's initial target is to get Chrome OS up and running on the computing devices that depend most on Internet connectivity. Chrome OS marks a radical departure from today's operating systems because all the applications and even the user's data will reside in the cloud, noted Google Vice President Sundar Pichai. "We are initially focused on netb...

FreshPatents.com Electric wiring system of a motor vehicle with replaceable cryptographic key and/or certificate
An electric wiring system of a motor vehicle with control devices that communicate with each other via a data bus, and with at least a first communication apparatus inside the vehicle for data exchange with a remote communication station outside the vehicle via a communication channel is provided. To make...

About our headline feed

Virus Alerts

Latest Vulnerabilities

Research Reports

AAA Radius and Diameter Server Market Shares, Strategies, and Forecasts, 2009 to 2015
Wintergreen Research, Jan 2009

Privacy in Telecom: WiMAX
Mind Commerce Publishing, Jan 2009

Encryption Systems and Digital Certificates
Global Industry Analysts, Jan 2009

Electronic Access Control Systems
Global Industry Analysts, Jan 2008

More Research Reports