Infrastructure Security: Page

VMware firewall strategy to focus on ‘known good’ behavior

VMware is taking a different approach to firewalls by focusing on 'known good' behavior to better police east-west traffic within enterprise environments.

By Rob Wright • March 8, 2019

Should I worry about the Constrained Application Protocol?

The Constrained Application Protocol underpins IoT networks. But the protocol could allow a threat actor to launch an attack.

By Judith Myerson • March 8, 2019

Microsoft promotes zero-trust security over firewalls

Microsoft told RSA Conference attendees a zero-trust model is better than firewalls for protecting corporate data -- a stance that some said doesn't go far enough.

By Antone Gonsalves • March 7, 2019

The developer’s role in application security strategy

Developers often pay lip service about being integral to application security, but they usually don't consider vulnerabilities until much too late in the dev process.

By Kevin Beaver • March 4, 2019

Coinhive shutdown imminent after troubled cryptomining past

The Coinhive cryptominer is scheduled to be shut down following a troubled history and experts don't think the company gave the full story as to why the shutdown is happening.

By Michael Heller • March 1, 2019

Eclypsium: Bare-metal cloud servers vulnerable to firmware attacks

Eclypsium found IBM SoftLayer cloud services are vulnerable to what it calls Cloudborne, which allows threat actors to make small, but potentially deadly firmware changes.

By Mekhala Roy • Feb. 26, 2019

Android brings FIDO2 certification to 1 billion devices

The FIDO Alliance announced Android has received FIDO2 certification, which will bring the ability to sign into websites and apps with biometrics, rather than passwords.

By Michael Heller • Feb. 26, 2019

Palo Alto Networks to acquire SOAR vendor Demisto

Palo Alto Networks announced its plan of acquiring SOAR vendor Demisto for $560 million to accelerate its Application Framework strategy and beef up security operations automation.

By Mekhala Roy • Feb. 19, 2019

How to deploy deep packet inspection in the cloud

Despite privacy concerns about deep packet inspection, it can help improve cloud network security for enterprises. Expert Frank Siemons explains how to avoid potential pitfalls.

By Frank Siemons • Feb. 18, 2019

Should I use GitHub’s new private repositories?

Is GitHub's new private repositories service robust enough to serve the needs of enterprises? Nick Lewis examines what works -- and what doesn't.

By Nick Lewis • Feb. 18, 2019

Google Play security improved by targeting repeat offenders

Google this week attributed security improvements in Google Play to both automated processes and human reviewers. The improvements include stopping bad apps from being published.

By Michael Heller • Feb. 15, 2019

Vet third-party apps to reduce supply chain threats

Enterprises are more vulnerable than ever before to supply chain threats from third-party apps and modules. Last fall's compromised NPM package is one cautionary tale.

By Nick Lewis • Feb. 12, 2019

The security implications of serverless cloud computing

Cloudflare Workers is new for serverless cloud computing and introduces benefits and drawbacks for security professionals. Expert Ed Moyle discusses the security side of serverless.

By Ed Moyle • Feb. 7, 2019

Dell unveils endpoint security portfolio with CrowdStrike, Secureworks

Dell has teamed up with CrowdStrike and Secureworks for SafeGuard and Response, a portfolio of endpoint security technology and services, to tackle the shifting threat landscape.

By Mekhala Roy • Jan. 31, 2019

Steps to improve an application environment and fix flaws

Eliminating application security flaws from an enterprise's server can be a complex task. Learn steps to take in order to improve application security with expert Kevin Beaver.

By Kevin Beaver • Jan. 31, 2019

How a Windows antimalware tool helps endpoint security

The Windows Defender Antivirus program was updated to include sandbox network security. Learn why this is so important and why security professionals have been asking for it.

By Nick Lewis • Jan. 29, 2019

Will DNS Flag Day affect you? Infoblox’s Cricket Liu explains

What is DNS Flag Day? That's when old and broken DNS servers will stop working, improving DNS performance and safety for all. Infoblox's chief DNS architect Cricket Liu explains.

By Peter Loshin • Jan. 28, 2019

Infoblox’s Cricket Liu explains DNS over HTTPS security issues

Cricket Liu, chief DNS architect at Infoblox, explains how DNS over HTTPS and DNS over TLS improve security, as well as challenges the new protocols may soon raise for enterprises.

By Peter Loshin • Jan. 25, 2019

How to defend against malicious IP addresses in the cloud

Cybercriminals have found a way to use the cloud to mask their locations. Expert Rob Shapland looks at the options organizations have to deal with malicious IP addresses.

By Rob Shapland • Jan. 23, 2019

How does cross-site tracking increase security risks?

Mozilla's Firefox 63 automatically blocks tracking cookies and other site data from cross-site tracking. Learn what this is and what the benefits of blocking it are with Nick Lewis.

By Nick Lewis • Jan. 23, 2019

Network shaping: How does it enable BGP attacks to divert data?

The use of BGPsec protocols was found after looking into threat actors in China that controlled U.S. internet traffic. Discover how this technique works and how it can be mitigated.

By Judith Myerson • Jan. 16, 2019

Updating TLS? Use cryptographic entropy for more secure keys

Cryptographic entropy is necessary to secure session encryption keys in TLS 1.2, but RSA key transport is not supported in TLS 1.3. Discover the causes for concern with Judith Myerson.

By Judith Myerson • Jan. 15, 2019

How to block public access for AWS S3 bucket security

AWS S3 buckets leaked millions of files, including sensitive data, by enabling public access. Learn how to block public access with expert David Shackleford.

By Dave Shackleford • Jan. 9, 2019

NSA to release GHIDRA open source reverse engineering tool

The National Security Agency plans to release an open source version of its GHIDRA reverse engineering tool during RSA Conference in March, but details about the tool are scarce.

By Michael Heller • Jan. 8, 2019

The pros and cons of proxy-based security in the cloud

Is proxy-based security in the cloud right for you? Expert Ed Moyle looks at the benefits and drawbacks of using proxies for Office 365 and other cloud platforms.

By Ed Moyle • Jan. 2, 2019