+---------------------------------------------------------------------+ | LinuxSecurity.com Weekly Newsletter | | August 18th, 2003 Volume 4, Number 33n | | | | Editorial Team: Dave Wreski daveat_private | | Benjamin Thomas benat_private | +---------------------------------------------------------------------+ Thank you for reading the LinuxSecurity.com weekly security newsletter. The purpose of this document is to provide our readers with a quick summary of each week's most relevant Linux security headlines. This week, perhaps the most interesting articles include "2.6 Kernel Cures Some Security Shortcomings," "Honeypot Farms," "How Secure Is Your SAN," and "Advanced Encryption Standard by Example." LINUX ADVISORY WATCH: This week, advisories were released for lynx, zblast, perl, kernel, signal, iBCS2, ddskk, konquerer, man-db, xpcd, stunnel, postfix, and php. The distributors include Conectiva, Debian, FreeBSD, Gentoo, Red Hat, SuSe, Trustix, and TurboLinux. http://www.linuxsecurity.com/articles/forums_article-7798.html Basic Intrusion Prevention using Content-based Filtering This article will discuss a very useful but seemingly overlooked functionality of Netfilter, a firewall code widely used in Linux, that provides content matching and filtering capabilities. http://www.linuxsecurity.com/feature_stories/feature_story-148.html >> FREE Apache SSL Guide from Thawte << Are you worried about your web server security? Click here to get a FREE Thawte Apache SSL Guide and find the answers to all your Apache SSL security needs. Click Command: http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=vertad_thawteapache -------------------------------------------------------------------- Expert vs. Expertise: Computer Forensics and the Alternative OS No longer a dark and mysterious process, computer forensics have been significantly on the scene for more than five years now. Despite this, they have only recently gained the notoriety they deserve. http://www.linuxsecurity.com/feature_stories/feature_story-147.html --> Take advantage of the LinuxSecurity.com Quick Reference Card! --> http://www.linuxsecurity.com/docs/QuickRefCard.pdf +---------------------+ | Host Security News: | <<-----[ Articles This Week ]------------- +---------------------+ * NIST Security Certification and Accreditation Project August 15th, 2003 The second public draft of NIST Special Publication 800-37, Guide for the Security Certification and Accreditation of Federal Information Systems (.pdf file), has been completed and is available for public comment. This document is one of a series of security standards and guidelines being developed by NIST's Computer Security Division in response to the Federal Information Security Management Act of 2002. http://www.linuxsecurity.com/articles/documentation_article-7802.html * Detecting and Understading Rootkits August 14th, 2003 Well, well, well. You have installed the latest Linux distribution and stopped all unnecessary services. You also set-up a set of Netfilter rules that would make the Pentagon Security Department envy you. You drool with delight. But. http://www.linuxsecurity.com/articles/server_security_article-7793.html * 2.6 Kernel Cures Some Security Shortcomings August 11th, 2003 The technology exists today to create and manage reasonably secure environments for Linux enterprises. In the hands of a competent administrator, Linux is roughly as secure as the other operating systems. That's not to say that improvements aren't needed. [In] the next version of the kernel, we'll have significant security enhancements, particularly in the area of policies. So enterprise Linux security continues to improve. http://www.linuxsecurity.com/articles/security_sources_article-7775.html * Winning the War on Spam: Comparison of Bayesian SPAM Filters August 11th, 2003 Spam e-mail has become an ever increasing problem, and these days it is next to impossible to use e-mail without receiving it in large amounts. Various techniques exits to combat the problem; keyword-based filters, source blacklists, signature blacklists, source verification and combinations of these to name a few. http://www.linuxsecurity.com/articles/privacy_article-7774.html +------------------------+ | Network Security News: | +------------------------+ * Wireless Networking August 15th, 2003 How about a project that combines hardware construction, community building, network hacking and, of course, Linux and other free software? Best of all, the stuff you need to get started is cheap and standardized, and there's a great balance of helpful resources and unanswered questions. We're talking about wireless networks. http://www.linuxsecurity.com/articles/network_security_article-7804.html * Keeping Out The Intruders August 14th, 2003 A recent report from research group Gartner, Inc. caused a ruckus in the intrusion detection/intrusion prevention system market. In the Information Security Hype Cycle, Richard Stiennon, research vice president for Gartner, concluded that IDSs has failed to offer up any value to companies relative to their associated costs, and would fall away by 2005. http://www.linuxsecurity.com/articles/intrusion_detection_article-7796.html * Making the Right Connection August 14th, 2003 Choosing the ideal virtual private network is difficult enough for enterprise buyers, without the decision being complicated by rumblings that up-and-coming secure socket layer (SSL) VPNs will quickly overtake, and maybe replace, traditional internet protocal security virtual private networks (IPsec VPNs). http://www.linuxsecurity.com/articles/security_sources_article-7797.html * Honeypot Farms August 13th, 2003 For the past six months this series of papers has covered a breadth of honeypot topics. We have covered everything from what honeypots are, their value and different types, to common misconceptions and legal issues. However, one thing we have yet to discuss is deployment. How can you deploy honeypots in your environment? http://www.linuxsecurity.com/articles/intrusion_detection_article-7790.html * How Secure Is Your SAN August 13th, 2003 With all they've got to worry about these days, most IT executives don't lose a lot of sleep over whether the data stored on their companies' tape and disk devices is secure. Most have come to believe that data, particularly mission-critical data residing in the corporate data center, is capably guarded by the usual protections such as firewalls, user authentication, and intrusion-detection systems. http://www.linuxsecurity.com/articles/general_article-7791.html +------------------------+ | General Security News: | +------------------------+ * Spam fuels boom in secure content market August 15th, 2003 IDC predicts that anti-spam products will be a key driver for the secure content management (SCM) software market which it expects to grow by 19 per cent a year to reach $6.4 billion in 2007. http://www.linuxsecurity.com/articles/general_article-7805.html * Recovery firms respond to blackout August 15th, 2003 Thursday's power outage in the eastern United States led some companies to invoke their disaster-recovery services. But many businesses that have contracts with disaster-recovery providers appeared not to lose their data or applications, thanks to onsite power generators. SunGard, which has about 7,000 disaster-recovery clients in North America, said about 30 customers activated their service Thursday. http://www.linuxsecurity.com/articles/general_article-7800.html * Advanced Encryption Standard by Example August 13th, 2003 The following document provides a detailed and easy to understand explanation of the implementation of the AES (RIJNDAEL) encryption algorithm. The purpose of this paper is to give developers with little or no knowledge of cryptography the ability to implement AES. http://www.linuxsecurity.com/articles/cryptography_article-7788.html * Research Suggests New Way To Can Spam August 12th, 2003 Internet Service Providers (ISPs) should lower their monthly fees if they permit spam to reach their paying customers, say researchers at the University of Missouri in Columbia (UMC). In the brave new world of lower access fees in exchange for spam, satisfied consumers would pay less for Internet service, claim UMC associate professor of journalism Clyde Bentley and doctoral student Anca Micu. http://www.linuxsecurity.com/articles/privacy_article-7785.html ----- #### Concerned about the next threat? #### #### EnGarde is the undisputed winner! #### Hardened Linux Puts Hackers EnGarde! Winner of the Network Computing Editor's Choice Award, EnGarde "walked away with our Editor's Choice award thanks to the depth of its security strategy..." Find out what the other Linux vendors are not telling you. http://store.guardiandigital.com/html/eng/products/software/esp_overview.shtml ------------------------------------------------------------------------ Distributed by: Guardian Digital, Inc. LinuxSecurity.com To unsubscribe email newsletter-requestat_private with "unsubscribe" in the subject of the message. ------------------------------------------------------------------------ - ISN is currently hosted by Attrition.org To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY of the mail.
This archive was generated by hypermail 2b30 : Tue Aug 19 2003 - 11:34:29 PDT