Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

IT Security Audits: A Necessary Evil…

2010-06-28/0 Comments/in General Security/by admin

As I prepare to conduct my next IT security audit at a client’s site, I realize some things have not changed in the past few years. The client’s reaction towards the security audit is always amazing the day before the on-site visit as they exhibit a sense of fear. For the most part, it has […]

iPad Security

2010-06-22/0 Comments/in Mac OS X/by admin

Apple’s new iPad is set to be released on April 3rd and SecurityOrb.com a Washington D.C.-based information security media company has looked beyond the hype into the possible security matters consumers should be concerned about.

IT Security Audits: A Necessary Evil…

2010-06-28/0 Comments/in General Security/by admin

iPad Security

2010-06-22/0 Comments/in Mac OS X/by admin

Full Sized Blog Element (Big Preview Pic)

IT Security Audits: A Necessary Evil…

2010-06-28/0 Comments/in General Security/by admin

From my experiences, the client will start applying required security patches that should have been applied months ago the weekend before the audit. Sometimes, it works out fine, and as you may know, sometimes it does not and causes additional issues for the system administrators. Many times, the Security Point-of-Contact (SPOC) will use a security scanning tool such as Nessus to conduct their own network scan to get a view of how they fair up. Conducting your own security scans are fine, being proactive is a good thing, but the day before an audit may not the best time to do so. Then the disclaimers start rolling in from the client. “Well… We know of this issue and that issue.”

I guess I cannot blame their anxiety. It’s not a good feeling to have strangers (IT Security Auditors) come into your organization to review the controls and practices you put in place and possible tell you that you are doing it wrong.

However, IT Security Audits are a necessary process that needs to occur to ensure compliance to organizational and/or federal regulations. Some of the more notable regulatory compliances are FISMA, HIPAA and the Sarbanes-Oxley Act that specifies how organizations must deal with information.

Unfortunately, many organizations treat security and audit as an after thought rather then a process … Preparation is the key to successfully passing a security audit.

For a full detail review on security assessments and IT security audits, check out www.securityorb.com.

iPad Security

2010-06-22/0 Comments/in Mac OS X/by admin

Adrian Williams, a Lead IT Security Consultant at SecurityOrb.com stated, “The iPad will be subjected to many of the same security issues as other mobiledevices currently in the market, for example threats such as the wireless man-in-the-middle attack, shoulder surfing and theft are very common.”

In addition to Adrian’s concerns, many experts feel the iPad will inherit many of the same security issues of the iPhone. For example, weakness in the encryption function and malicious software are major concerns. If the iPad were to use the same encryption as the iPhone, sensitive personal data would be at risk of being captured and viewed. Also, the iPad will be at risk of obtaining malicious apps from the Apple AppStore. The screening process for the applications on the AppStore isn’t always the best.

Othniel Alphonse, the host of a Washington DC-based talk show titled “The Tech Talk Show”, brought up a topic often covered on his radio show. He stated,” The biggest risk pertaining to the iPad has nothing to do with the device itself. As covered on my radio show in the past. Hackers usually take these high value topics to implement “poison online searches” to malicious sites. We have seen it with the death of Michael Jackson, The Haiti Earth Quakes and countless other times.”

What Mr. Alphonse is referring to is a techniques hackers used called Search Engine Optimization (SEO) for malicious purposes. This ensures their sites show up when consumers conduct a search on the iPad to possibly infect their system with malware.

Personally, my biggest concern stems from Apple’s decision not to use Adobe flash player on its iPad devices. Flash player is a popular application used on a majority of website to play video and display content. Many hackers will take the opportunity to offer fake iPad Flash Player applications on the Internet for it to only be malware.

What are your thoughts on this?