Manufacturing

RSA confirms Lockheed hack linked to SecurID breach

By

Security giant RSA has confirmed that hackers leveraged stolen information about its SecurID two-factor authentication offerings in a recent attack on U.S. defense contractor Lockheed Martin.

Data belonging to Honda customers in Canada stolen

By

The personal data belonging to Honda and Acura customers in Canada was stolen after attackers accessed the information off the companies' e-commerce sites.

"Stars" worm targets systems in Iran, official says

By

On the heels of the Stuxnet worm, Iran officials say they have discovered a new piece of malware also designed to sabotage government systems.

BP "leaks" data of 13,000 Gulf oil spill victims

By

A BP employee lost a laptop containing the personal information of thousands of Louisiana residents who filed compensation claims after last year's devastating oil spill in the Gulf of Mexico.

Newly discovered Zeus spinoff botnet has wide impact

By

The "Kneber" botnet is made up of 74,126 machines from nearly 2,500 organizations that were infected with a variant of Zeus, according to researchers at a network security firm.

Two charged with hacking

By

Two men were indicted this week on charges of hacking into the computer systems belonging to Stens Corp., a Jasper, Ind.-based provider of parts for outdoor power equipment. According to the U.S. attorney's office in Indianapolis, Scott Burgess, 45, of Jasper and Walter Puckett, 39, of Williamstown, Ky. accessed the company's network 12 times without authorization with "the purpose of gaining commercial and personal financial benefit." The pair worked for a competitor, authorities said. Both face up to five years in prison and a $250,000 fine. -- DK

Black Hat: Vulnerability mitigation is working, sort of

By

Efforts to reduce security vulnerabilities seem to be paying off, but IT administrators are not paying enough attention to application bugs, a CTO said Wednesday at the Black Hat conference in Las Vegas.

Symantec, McAfee settle with New York state

By

Symantec and McAfee agreed to pay a combined $750,000 to settle charges that their subscription renewal process was deceptive to home users.

Microsoft releases SDL tool

By

Microsoft on Tuesday released a free tool to help application developers better secure their programs. The SDL (Secure Development Lifecycle) Process Template for Visual Studio Team System provides a framework -- including auditable requirements -- for building security into applications. The offering complements previous Microsoft SDL releases: Optimization Model, Pro Network and Threat Modeling Tool. Microsoft developed SDL in 2004 to address security vulnerabilities in its software. The program is credited with reducing vulnerabilities in Vista and SQL Server. — DK

Insecure smart grid technology could result in utility attacks

By

Development of the smart grid faces a number of uphill climbs -- such as customer adoption and interoperability -- but security could prove of the most difficult tasks.

IT contractor indicted over oil company computer intrusion

By

A federal grand jury this week indicted a disgruntled IT contractor on charges he disrupted a computer system used, among other purposes, to notify an energy company if its oil properties are leaking.

ATM malware appears, Diebold issues security update

By

Diebold, which has fielded recent criticism over the reported insecurity of its voting machines, is now fighting off news that its ATMs also can be compromised.

Web malware, more advanced and targeted than ever

By

The prevalence of web-based malware massively rose last year -- and the state of the economy is likely a big reason, according to an annual threat report from ScanSafe.

Analyst firm expects security budgets to rise in 2009

By

Despite the ongoing financial crisis, IT security spending is expected to grow this year, according to two reports from Forrester.

IT-GRC: Agiliance

IT-GRC: Agiliance

By

And so we reach the end of this year's batch of innovators. But, as we look at this subcategory, we find that it wraps the whole shebang into a neat package, defining what needs to be done to secure the enterprise (and prove it) and why.

Policy management: LanDesk (Avocent)

Policy management: LanDesk (Avocent)

By

All of us old-timers remember LanDesk from its days as part of Intel. It always was a solid suite of products. Now that it is part of Avocent, its promise as a hybrid of network and security policy management is being realized. The notion of managing the desktop and evolving that into security policy management makes a lot of sense.

Content management: Finjan

Content management: Finjan

By

The views of the visionary I spoke with from this veteran anti-malware company took the conversation in directions I had not expected. He started out by asking, "Why, if I have done everything I can to secure my enterprise, is my data still being compromised?"

Data leakage/extrusion prevention: Trend Micro

Data leakage/extrusion prevention: Trend Micro

By

I don't recall the first time I heard the term "extrusion prevention system." It was, I think, an effort on the part of some marketer to tie the notion of preventing data from unauthorized exit (extrusion) from the enterprise to the notion of unauthorized entry (intrusion). Very clever.

Encryption: PGP

Encryption: PGP

By

No matter how much things change, they stay the same. As I have pointed out, there have been massive changes in security drivers over the past 12 months. The changes have generated a new set of challenges, but, even though our encryption innovator has done a first-rate job of addressing them over the past year, the new issues are generating a sort of déjà vu picture of the encryption market.

Email security: Tumbleweed Communications (Axway)

Email security: Tumbleweed Communications (Axway)

By

The big question I had for Tumbleweed was, "What is email security?" Over the past two years, as we have passed products through SC Labs, I have noticed that the vendor public relations folks who we talk to seem to have a hard time differentiating between the many aspects of threats associated with email.

Wireless Security: AirMagnet

Wireless Security: AirMagnet

By

Wireless, is it? Everything is going wireless - well almost everything. That, in itself, poses a challenge for a wireless security company, such as this innovator. It also offers big opportunities and AirMagnet has identified and addressed them.

IPS: Top Layer Security

IPS: Top Layer Security

By

If you thought the UTM market was crowded, take a look at the intrusion prevention systems (IPS) market. We bluntly asked our innovator in this product space why they thought that they were innovators in such a commoditized market. The answer was immediate and unambiguous: "When a product category becomes mainstream, there are big opportunities, but you must innovate to take advantage of them."

UTM: Global DataGuard

UTM: Global DataGuard

By

Sometimes a different approach is needed. The notion of the UTM was developed from the need to consolidate point solutions. There are a lot of problems, of course. They cost more to buy and manage, they use more power and they need a sophisticated staff to manage them.

Forensic tools: Mandiant

Forensic tools: Mandiant

By

Sometimes you run across a company that just deserves to be selected as an innova­tor. You look them over and won­der why you didn't pick up on them before. Mandiant is one of those companies. There is a reason, of course. Mandiant started as a services company providing forensics, litigation support and incident response. So if you were in the product purchasing mood, you would not have run across these folks.

SIEM: ArcSight

SIEM: ArcSight

By

ArcSight gets a lot of play among security experts in the security event management (SEM)/security information manager (SIM) game.

Threat analysis: NitroSecurity

Threat analysis: NitroSecurity

By

How do you differentiate a product that keeps getting mixed up with a commod­itized market, but really doesn't belong there? What differentiators do you look for that can keep you from being included in a herd where you don't belong?

Penetration testing: Core Security

Penetration testing: Core Security

By

I just love these folks. Take the best open source pen testing tool you can think of, put it on steroids, give it a user interface that makes it simple and fast to pen test in a production environ­ment without losing the granularity of manual testing if you need it, and you have Core Impact. Well, almost. Every year I say that I am going to find a better tool, and I actually do comb the market -- unsuccessfully.

Vulnerability analysis: Mu Dynamics

Vulnerability analysis: Mu Dynamics

By

When your price starts at $50,000 and you are unique in your marketplace, you'd better have a good product. For Mu Dynamics, that is just where the story starts. When I first met the Mu folks, they were Mu Security. A new name later, they still are the innovators they were a couple of years ago. My conversation with a Mu visionary was an eye-opener.

Access magagement: AppGate Network Security

Access magagement: AppGate Network Security

By

This Swedish company will, I predict, set the benchmark here in the United States for how access to applications should be controlled. AppGate has helped shape the direction of network infrastructure security in Europe for some years, and now this innovator is bringing its unique thoughts to the States.

Multifactor authentication:TriCipher

Multifactor authentication:TriCipher

By

What sets these guys apart from the multifactor herd? In a word, vision. From the start, TriCipher has had the vision of evolving into a full identity management provider. That is a pretty heady ambition for a developer of multifactor authentication tools. So how does this innovator plan to make the trip from providing a piece of the puzzle to offering the whole thing, already assembled, framed and hung on the wall?

Sign up to our newsletters

POLL