Author Archives: Mary Rose Maguire

About Mary Rose Maguire

Mary Rose Maguire was the Marketing Communication Specialist for MicroSolved, Inc. and the content curator for the State of Security blog, MSI's website, and social media.

Official Press Release: MicroSolved Releases HoneyPoint Security Server Console 3.00

Posted on by
Reply

COLUMBUS, Ohio August 19, 2009 – MicroSolved, Inc. is pleased to announce their latest HoneyPoint Security Server Console 3.00 is available for organizations, offering faster performance and more detailed reporting.

HoneyPoint Security Server Console 3.00 provides cleaner performance and stability,superior memory handling, optimized database, and faster, more enhanced reporting. HoneyPoint Security Server Agent will also experience an upgrade and version 3.00 will be available in the Fall. Current users can upgrade via the FTP site or call support for assistance.

“The 3.00 release continues the tradition of evolution for the HoneyPoint family,” said Brent Huston, CEO and Security Visionary for MicroSolved. “It clearly reinforces the value and capability of applying bleeding-edge thinking to the information security problem.”

Huston developed HoneyPoint Security Server three years ago, motivated by a keen desire to break the attacker cycle. Huston concludes, “Attackers like to scan for security holes. HoneyPoint lies in wait and traps the attacker in the act!”

If youʼd like more information about this topic, or would like to schedule an interview Brent Huston, please email Mary Rose Maguire at mmaguire@microsolved.com

Book Review: VMware vSphere and Virtual Infrastructure Security

Posted on by
Reply

VMwarevSphereandVirtualInfrastructureSecurity
VMware vSphere and Virtual In!astructure Security: Securing the Virtual Environment (Prentice Hall) is written by Edward L. Haletky with the assistance of our friend, Tim Pierson. Another friend, Christofer Hoff, wrote the Forward. Pierson is currently working with us to integrate the power of HPSS in his security courses. (Very cool!) Hoff is a forward thinking security professional who is respected among his peers. The book immediately confronts the security issue with VMware. Chapter 2 presents the “anatomy of an attack.” Attack perspectives are from a Pentester, a hacker, a script kiddie, and a disgruntled employee.

Chapters 6, 7, and 8 focus on deployment, management, operations and virtual machine security. Some common operational issues are discussed to protect and audit your environment. Chapter 9 is especially useful, posing real-world questions discussed on the VMware VMTN Communities forums. The latter part of the book features a patch for Linux, a security hardening script, and an assessment script output. A reading list and links are included in the final section. A great addition to your IT library from Amazon for $40.56.

MicroSolved’s “Best Of” Security News July 10, 2009

Posted on by
Reply

What an interesting week! South Korea and the United States experienced attacks on computers with a nasty virus that supposedly today, erased data from computers that had not been updated with anti-virus software.

Korea DDOS virus mission shifts to destroying, erasing data

IBM researches rolled out new technology to mask sensitive data. Their approach differs from others in that it doesn’t make copies of the data and removes certain elements of it depending on who will be viewing it and their user rights to the data. The masking is done “on the fly.”

IBM Researchers Unveil New Data-Masking Technology

Apple is pretty quiet regarding all this issues that are starting to pop up with their brand spankin’ new iPhone 3GS. Everything from a shorter battery life to phones heating up, customers have been more than disappointed by all the hype regarding this latest version of the popular tech gadget. Security vulnerability sent up a red flag. (And I’m sure @lbhuston is very grateful now that he didn’t purchase the 3GS. As for me, I just signed a two-year contract in January, so I’m not budging, either.)

As Three Big iPhone Troubles Surface, Apple Dinged for Secrecy

What were some of the infosec stories this past week that caught your eye?

Security Guard Charged With Hacking Hospital Systems

Posted on by
Reply

I came upon this story today, which should remind every hospital guard administrator of Pogo’s wry observation, “We have met the enemy and he is US.”

On Friday the federal authorities arrested Jesse William McGraw on a charge of felony computer intrusion, saying he intended to use the botnet to launch a massive distributed denial of service (DDOS) attack on July 4, the day after he was set to stop working there. He’d nicknamed the day “Devil’s Day.”

He worked for a Dallas security company called United Protection Services, on the 11 p.m. to 7 a.m. shift at the clinic.

McGraw, who went by the hacker name GhostExodus, allegedly installed malicious software all over the Carrell Clinic, including systems that contained confidential information, and others that managed the building’s climate-control systems, authorities said Tuesday.

The hacker could have harmed patients or damaged drugs if he had turned off air conditioning during Texas’s hot summer months, authorities said.

Rest of article

It would seem he was itching to prove his mad hacking skilz by donning a hoodie while riding an elevator, looking into the camera and while the theme from “Mission: Impossible” played, said, “You’re on a mission with me: Infiltration.” As brilliant as he thought he was, he earned a major FAIL by typing on a keyboard and then putting gloves on to mask his fingerprints. Also he posted the ubiquitous YouTube videos to explain said brilliance. (And yet he can play the violin pretty well.)

All the more reason to pay attention to who’s wandering down your hallways. Not only would this guy have attacked the hospital’s network system, but they could easily have been sued for negligence when Uncle Bob suddenly keeled over because his room became an oven.

MicroSolved’s CEO and Security Evangelist Interview With [IN]SECURE Magazine

Posted on by
Reply

issue-main-21

[IN]SECURE Magazine, the fresh and innovative online magazine from Help Net Security (HNS), interviewed Brent for their June issue. Mirko Zorz, Editor-In-Chief, caught up with Brent to pose some great questions that allow the readers a glimpse into a “different kind” of CEO. Brent shares his insights about his role within MSI, future security threats, and developments within the information security field.

You may download the interview here.

Help Net Security is an online portal that covers all the major information security happenings. The portal has been online since 1998 and caters a large number of Information Technology readers specifically interested in computer security. For the entire June issue of [IN]SECURE Magazine, you can download it here. Great reading!

Book Review: Computer Security and Cryptography

Posted on by
Reply

fsecuritym444a6d61

Computer Security and Cryptography (Wiley) by Alan G. Konheim, is a great resource to understand and implement data security systems. Chapters are organized to help develop technical skills, describe a cryptosystem and method of analysis, and provide problems to test your grasp of the material and ability to implement practical solutions.

The book begins with the history of cryptography and moves into the theory of symmetric and public-key cryptography. Chapter 18 focuses on cryptography application. Included is Unix password encipherment, password cracking and protecting ATM transactions.

With consumers becoming increasingly wary of identity theft and companies struggling to develop safe, secure systems, this book is essential reading for professionals in e-commerce and information technology. Written by a professor who teaches cryptography, it is also ideal for students. Available at Amazon for $90.00.

HoneyPoint Helps You Do More With Less

Posted on by
Reply

audit-advice

We all know the economy is struggling right now. Budgets are tighter than ever and many companies are forced to find ways to do more with less. Even though cybercrime is on the rise, it doesn’t mean your organization has to suffer. Here are two ways HoneyPoint Products can help you increase efficiency in an economical way.

1) Avoid heavy customization tools – HoneyPoint comes “ready-to-go.” It can be customized but it isn’t necessary for it to work. It’s a great “plug-and-play” product. Once the HoneyPoint Security Server is deployed, attacks are tracked. The HoneyPoint strategy is simple, yet powerfully effective. HoneyPoints are flexible pseudo-server applications that are able to emulate thousands of real services such as web, email, database systems and others. Since these pseudo-services are not real applications, there is no reason for anyone to interact with them in any way. Thus, once deployed, any activity to a HoneyPoint is, by default, suspicious. Since attackers do their work by scanning for and examining services looking for vulnerabilities, the HoneyPoints lie in wait, trapping the attacker in the act of doing the exact thing that attackers seek to do – find vulnerable services!

2) Allow others to do the heavy lifting – Certain security tasks can be outsourced or automated. Sometimes an organization can decrease the total cost of ownership by having someone else do it. Why not allow MicroSolved, Inc. handle some of these security functions such as vulnerability assessment and penetration testing? Our experts can assess your policies, processes and network infrastructure against a variety of baselines including PCI DSS, FFIEC/NCUA/FDIC, NIST, ISO and other industry standard best practices. We routinely provide deep level penetration testing for clients who wish to get a real world view of their IT, network and physical security mechanisms. From blue team assessments to red team testing leveraging the latest techniques in social engineering and simulated attack, MSI’s experience and capabilities clearly separate us from our competition.

With a little creativity, we can all work smarter to not just survive, but thrive during these challenging days!