Infrastructure Security: Page

How does Android Protected Confirmation provide security for users?

Android P integrates Android Protected Confirmation, which provides sufficient trust in the authentication process. Learn more about this new feature with expert Michael Cobb.

By Michael Cobb • Sept. 12, 2018

Misconfigured Tor sites leave public IP addresses exposed

The anonymity of Tor is once again under scrutiny, as a researcher finds misconfigured Tor sites can expose the public IP address connected to a dark web site.

By Michael Heller • Sept. 7, 2018

How the STARTTLS Everywhere initiative will affect surveillance

The EFF's STARTTLS Everywhere initiative encrypts email during delivery and aims to prevent mass email surveillance. Expert Michael Cobb explains how STARTTLS works.

By Michael Cobb • Sept. 6, 2018

How does Google’s new detection model find bad Android apps?

Malicious apps have been a consistent problem for the Google Play Store, so a new detection model has been released to help clean it up. Learn how this system works with Nick Lewis.

By Nick Lewis • Aug. 27, 2018

Network reconnaissance: How to use SI6 Networks’ IPv6 toolkit

SI6 Networks' IPv6 toolkit can do network reconnaissance using search engines and the Certificate Transparency framework. Learn how to use IPv6 toolkits from expert Fernando Gont.

By Fernando Gont • Aug. 23, 2018

How can a 13-year-old configuration flaw affect SAP systems?

Cybersecurity vendor Onapsis found a 13-year-old flaw that affects nine out of 10 SAP NetWeaver systems. Learn how the flaw affects SAP systems with expert Judith Myerson.

By Judith Myerson • Aug. 23, 2018

Why container orchestration platforms risk data exposure

Container orchestration platforms expose interfaces and create the risk of data exposure and unauthorized access. Expert Dave Shackleford explains why these risks exist in enterprises.

By Dave Shackleford • Aug. 22, 2018

My Cloud EX2: How can this device expose unauthorized data?

SpiderLabs discovered My Cloud EX2 backup devices exposing unauthorized HTTP requests. Join Judith Myerson as she explains how this happens, as well as the impact on DLNA devices.

By Judith Myerson • Aug. 22, 2018

LG network: How can attackers use preauthenticated commands?

A vulnerability was found in the LG network involving remote preauthenticated commands. Learn how researchers created a malicious password to show how it issue can be abused.

By Judith Myerson • Aug. 21, 2018

How does an IMSI catcher exploit SS7 vulnerabilities?

A warning was issued by the Department of Homeland Security regarding the exploitation of SS7 vulnerabilities by IMSI catchers. Learn how this puts mobile communication at risk.

By Judith Myerson • Aug. 20, 2018

ICS security fails the Black Hat test

Industrial control systems hit the mainstream at Black Hat this year, with over two dozen program sessions tackling different angles of the subject. The takeaway: Vendors still aren't really trying.

By Robert Richardson • Aug. 17, 2018

Finalized TLS 1.3 update has been published at last

The finalized TLS 1.3 update has been published after a four-year process. The new protocol promises to be faster and more secure than its predecessor, TLS 1.2.

By Madelyn Bacon • Aug. 16, 2018

How do SDKs for ad networks cause data leaks?

SDKs made user data susceptible to security vulnerabilities in mobile apps. Expert Michael Cobb explains how this security vulnerability put user data at risk.

By Michael Cobb • Aug. 8, 2018

What to do when IPv4 and IPv6 policies disagree

Unfortunately for enterprises, IPv4 and IPv6 policies don't always agree. Fernando Gont examines the differences between these two security policies, as well as some filtering rules.

By Fernando Gont • Aug. 7, 2018

What does the expansion of MANRS mean for BGP security?

The Internet Society expanded MANRS to crack down on BGP security. Expert Michael Cobb explains what MANRS is and its implications for BGP server security.

By Michael Cobb • Aug. 7, 2018

Tom Van Vleck on the Multics operating system, security decisions

Time-sharing systems got a lot right from a security standpoint. "We aimed toward a completely lights-out, 'no chance for mistakes' interface," says the security researcher.

By Marcus Ranum • Aug. 1, 2018

Test your knowledge of secure software architecture

Domain 4 of the CCSP exam covers the fundamentals of cloud application security. Take this practice quiz to see how well you've absorbed key concepts and vocabulary.

By (ISC) 2 • July 31, 2018

Cybersecurity and physical security: Key for ‘smart’ venues

With sustainability being a huge driver of modern business development, protecting consumers' cyber- and physical security is an essential element when designing smart cities and venues.

By Ben Cole • July 27, 2018

Powerhammering: Can a power cable be used in air-gapped attacks?

Air-gapped computers subject to PowerHammer attack: Proof-of-concept attack enables data exfiltration through control of current flow over power cables.

By Judith Myerson • July 27, 2018

SaaS activity alerts can mitigate manual misconfigurations

SaaS activity management is becoming more important for infosec teams to combat issues of insider theft and unintentional exposure of sensitive data, BetterCloud's David Politis says.

By Michael Heller • July 20, 2018

NSS Labs ranks next-gen firewalls, with some surprises

Researchers used individual test reports and comparison data to determine the value of investments in next-generation firewall technology.

By Kathleen Richards • July 19, 2018

Security in Network Functions Virtualization

In this excerpt of chapter 4 of Security in Network Functions Virtualization, authors Zonghua Zhang and Ahmed Meddahi discuss Identity and Access Management in NFV.

By SearchSecurity and Syngress • July 19, 2018

Port Cybersecurity

In this excerpt from chapter 3 of Port Cybersecurity, author Nineta Polemi discusses Security of Ports' Critical Information Infrastructures.

By SearchSecurity and Syngress • July 19, 2018

The risks of container image repositories compared to GitHub

As container use rises, so does the use of container image repositories. Expert Dave Shackleford discusses the risks associated with them and how they compare to other registries.

By Dave Shackleford • July 18, 2018

Seeking the Truth from Mobile Evidence

In this excerpt from chapter 19 of Seeking the Truth from Mobile Evidence, author John Bair discusses Android user enabled security in terms of passwords and gestures.

By SearchSecurity and Syngress • July 16, 2018