Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

SAINT 7.9 Product Release

2011-07-22/0 Comments/in Vulnerability Assessment/by SecurityOrb_Staff

Key New Features in SAINT 7.9

Vulnerability Scanner

Microsoft Patch Tuesday scan policy – This scan policy checks for the latest published Microsoft Patch Tuesday vulnerabilities (2nd Tuesday of each month)

New Vulnerability Check Type Coverage now includes –

Blind SQL injection

Security Innovation Introduces Software Security Summer Series

2011-07-19/0 Comments/in Training/by SecurityOrb_Staff

Security Innovation today introduced its inaugural Software Security Summer Series, where the company will offer six free eLearning courses from its industry-leading curriculum over the next six weeks. The courses are part of TeamProfessorTM, the company’s computer-based training library with an emphasis on the software development lifecycle and defensive coding techniques. The courses were developed to train developers, architects, designers and group managers on how to build security into the core, fixing the systemic issues of insecure software.

SAINT 7.9 Product Release

2011-07-22/0 Comments/in Vulnerability Assessment/by SecurityOrb_Staff

Key New Features in SAINT 7.9

Vulnerability Scanner

Microsoft Patch Tuesday scan policy – This scan policy checks for the latest published Microsoft Patch Tuesday vulnerabilities (2nd Tuesday of each month)

New Vulnerability Check Type Coverage now includes –

Blind SQL injection

Security Innovation Introduces Software Security Summer Series

2011-07-19/0 Comments/in Training/by SecurityOrb_Staff

Full Sized Blog Element (Big Preview Pic)

SAINT 7.9 Product Release

2011-07-22/0 Comments/in Vulnerability Assessment/by SecurityOrb_Staff

From Saint Newletter:

Key New Features in SAINT 7.9

Vulnerability Scanner

Microsoft Patch Tuesday scan policy – This scan policy checks for the latest published Microsoft Patch Tuesday vulnerabilities (2nd Tuesday of each month)

New Vulnerability Check Type Coverage now includes –

Blind SQL injection

Flash application –

Flash application allows object access from all domains
Flash application contains database connection string
Flash application debugging output
Flash application FlashVars cross-site scripting
Flash application cross-site scripting via GET request to javascript
Flash application LocalConnection cross-site scripting
Flash application contains MD5 hash
Flash application contains SHA-0 or SHA-1 hash
Flash application text field cross-site scripting

PCI Special Notes for the PCI Executive report format (Part 3b) can be customized

Multitasking improvements –

Increased scanning threads from 10 to 20
Compute optimal number of concurrent processes in every iteration
New formula uses more granular CPU speed benchmark and takes process size and available swap space into account

Check Login button – Instantly reports whether the provided Windows authentication credentials are correct

Improved host type fingerprinting – Uses Nmap in conjunction with full port scan for the best possible fingerprint

Nmap Progress bar – Displays Nmap progress in the control panel during long Nmap runs

Ability to simultaneously select/deselect all scheduled scans (including scans set up as part of a scan window) on the scan schedule page that are related to the same scan

Custom email “display name” for email alerts of scans

Run local Unix/Linux/Mac checks using successfully guessed SSH login/password pairs

Penetration Testing

Mac Camera Image Capture Exploit Tool – This tool attempts to retrieve an image file captured by an iSight camera such as the one built into a MacBook. If it is successful, the picture is displayed.

Mac OS support in Download Connection exploit tool

Phishing improvements –

Ability to automatically replicate a real site
Ability to customize the message which is displayed after form submission

Easier, more intuitive exploit setup – Mouse over any input option on the exploit setup form to see hints.

SAINTmanager®

Load-balanced Discovery – Added support for the discovery portion of load balanced scans to also be load balanced.

SCAP/OVAL/XCCDF

Added support for file behaviors

Added OVAL detail report that provides the following details –

Why a vulnerability was found
Why a patch was not found
Why a configuration check was not compliant
List of non-evaluated and erroneous definitions
List of definitions found not to be vulnerable, or being compliant

Added an OVAL definition detail viewer that allows users to see what checks will be run for the selected definition file, also provides details as to what each definition checks for on the target system

Added support for two more OVAL Operations (XOR, ONE, AND, OR are all now supported)

Added support for CPE-OVAL and CPE-DICTIONARY files contained in scap-data-streams (e.g., Vista system no longer scanned by XP benchmark)

ZIP files containing multiple data-streams can now be imported (e.g., USGCB-Win7)

Added XCCDF multi-target summary reports

Added new easier to use more organized XCCDF/OVAL results view page

Removed duplicates in system_characteristics output and added some other disk space saving features

Added OVAL multi-target report that provides below information –

ratio of hosts with no vulnerabilities to the number of hosts and the non-vulnerable host list
definitions with vulnerabilities and the hosts list who have these definitions
ratio of 100% compliant hosts to the number of hosts and which hosts they are
definitions with non-compliance and the host list who have these definitions
only 3 defintion classes are considered: compliance, vulverability, and patch

SAINTwriter®

Phishing Assessment Report improvements (View sample report) –

state what the parameters of the phishing test were
a pie chart that shows the total number of addresses targeted with the test and the number of addresses that executed on the phishing attempt.
details show who was targeted and identify which one is executed (PASS/FAIL).

Security Innovation Introduces Software Security Summer Series

2011-07-19/0 Comments/in Training/by SecurityOrb_Staff

WILMINGTON, Mass. – July 12, 2011 — Security Innovation today introduced its inaugural Software Security Summer Series, where the company will offer six free eLearning courses from its industry-leading curriculum over the next six weeks. The courses are part of TeamProfessor^TM, the company’s computer-based training library with an emphasis on the software development lifecycle and defensive coding techniques. The courses were developed to train developers, architects, designers and group managers on how to build security into the core, fixing the systemic issues of insecure software.

By making portions of the industry’s largest application security training curriculum available for free, Security Innovation is delivering on its corporate strategy to be the authority on application security. The company firmly believes that providing the expertise and knowledge around how to identify and remediate software vulnerabilities, that this will help drive organizations to shift their strategy from reactive to proactive with the ultimate goal of eliminating software vulnerabilities in the development phase.

Courses will be available beginning Wednesday, July 20, when users will have 24-hour access to one of TeamProfessor’s eLearning courses. The series will continue every Wednesday for six weeks. Interested parties can register for access for up to six courses on the Security Innovation website (www.securityinnovation.com). The course titles and schedule follow:

July 20: Fundamentals of Application Security
July 26: Fundamentals of Secure Development
August 3: How to Perform a Security Code Review
August 10: How to Test for the OWASP Top Ten
August 17: SDLC Gap Analysis & Remediation Techniques
August 24: Architecture Risk Analysis

“We’re declaring 2011 as the first Summer of Software Security. Offering free access to some of our most popular courses is our way helping the software world be a more secure place, ” said Fred Pinkett, Vice President of Product Management at Security Innovation. “We feel that extending these courses to developers, architects, designers, group managers and even security teams will drive home the need for building security in as an integral component throughout development process.”

More than 100,000 Security Innovation users from the industry’s largest financial services, energy and technology Fortune 500 organizations leverage TeamProfessor to build internal security expertise. By educating developers on how to code defensively, Security Innovation is helping enterprises and government entities protect critical data and cut costs. Security Innovation has the industry’s largest application security training curriculum with more than 40 courses and 65 hours of computer-based training content.

About Security Innovation

Security Innovation is an established leader in the application security and cryptography space. For over a decade the company has provided products, training and consulting services to help organizations build and deploy more secure systems and improve the process by which their applications are built.

Security Innovation built upon its core competencies in application security with the acquisition of NTRU CryptoSystems in 2009, a company that developed proprietary, standardized algorithms. This resulted in the strongest and fastest public key cryptography available and the means to overcome historical performance barriers that have plagued the encryption industry. With these core strengths intact, Security Innovation is in a position to help organizations protect their data at two critical points: while applications are accessing it and during transmission. The company’s flagship products include TeamProfessor, the industry’s largest library of application eLearning courses; and TeamMentor, a web-based secure development methodologies product.

Security Innovation is privately held and is headquartered in Wilmington, MA USA.

Note to Editors: Security Innovation, NTRUEncrypt, TeamMentor, TeamProfessor and the Security Innovation logo are trademarks of Security Innovation. All other brand names may be trademarks of their respective owners.