Well my wife is out this week so maybe I’ll try and do some golfing in between book reviews and home lab work 🙂

Here’s the list:

Cisco IPS – Support of ‘minreq-‘ Style Signature Updates has Ended – Thought I’d put this out there in case you’re still using the old style signatures 🙂

Beginning with S288, customers must be running IPS version 5.1-5-E1 or later to install signature updates. Signature updates on sensors running IPS versions older than 5.1-5-E1 (i.e. sensors using the nomenclature ‘IPS-sig-S2XX-minreq-5.1-4’) are no longer supported.

The E1 Engine update for IPS Version 5.1(5) is available for download on Cisco.com. This release includes the E1 engine update package and the 5.1(5)E1 Service Pack and System/Recovery images which replace the 5.1(5) Service Pack and System/Recovery images.

nCircle buys compliance vendor Cambia – Sounds like a logical aquisition for nCircle to bolster their VA offerings.

Software vendor nCircle Network Security Inc. has acquired Cambia Security Inc., a provider of risk and compliance management software.

Cambia, based in Alpharetta, Georgia, sells a product called Cambia CM, which can be used to audit the configuration of computers on a network and help determine if they are in compliance with company policy or government regulations.

Cisco MIBs updated – Wow, great resource!

We recently updated the Cisco MIB package ZIP file for Unbrowse SNMP. You can download it for free here. (28.9 MB). The new MIB package contains all the latest MIBs released by Cisco on their public website. This package contains 1024 MIB Modules, and over 68,000 unique objects.

Google Launches Online Security & Malware Blog – I’ll have to add this to my watch list 🙂

Online security is an important topic for Google, our users, and anyone who uses the Internet. The related issues are complex and dynamic and we’ve been looking for a way to foster discussion on the topic and keep users informed. Thus, we’ve started this blog where we hope to periodically provide updates on recent trends, interesting findings, and efforts related to online security. Among the issues we’ll tackle is malware, which is the subject of our inaugural post.

Fresh From CEIC2007: Updated Presentations! – I’ll have to check these out.

CEIC 2007 NTFS AttributeId

CEIC 2007 NTFS Object IDS

CEIC 2007 NTFS Initialized Size

CEIC 2007 BitLocker

CEIC 2007 Vista

“Defeating” Whole Disk Encryption – Part 1 – I can’t wait for part 2.

An issue that we are going to continue to encounter is computers with whole disk encryption (WDE). I’m going to post a couple of techniques that have worked for me, and hopefully they’ll be of use to someone else out there. In this post, we will look at PGP’s WDE, although the techniques outlined here should be easily applied to other encryption schemes.

All I Need to Know About Security Programs I Learned from the Pawn – Well written post with an interesting take on security.

The foundation of the game is the chess board. The board can be compared to the business itself, with alternating colored boxes, some black and some white representing elements and challenges of the business. Rows and columns can be divisions or groups as well as levels of management and project silos. The capabilities of the pieces contrast nicely with the personality types found in management. Rooks can move straight up a vertical, taking a bottom up or a top down approach. Bishops can move diagonally across silos, touching upon varying verticals and management levels. Knights are the often coveted consultants, jumping between silos and levels in an attempt to address everyone and everything. Finally, King and Queen are two great examples of security leadership. The King is all-powerful, but chooses to stay within his local area, while the Queen moves all around.

These positions address the bigger picture. However, when an information security group with limited resources spends too much time building top heavy organizations, insecure applications and weak architectures slip through the cracks. It has been my experience that the pawn’s gradual, forward movement is what makes security work in the trenches. Assessment frameworks and complicated review processes work great, but sometimes, it is the basic approach that needs to be developed first. I have developed a simple, four step process that I use every day to manage the tidal wave of security decisions that flood my inbox.

Using VMware for malware analysis – If your organization is constantly fighting malware outbreaks then why not build a virtual lab to get familiar with handling the incidents?

Even if malware analysis is not your primary occupation, once in a while you may find yourself wondering about the nature of an unfamiliar malicious executable that crosses your desk. Starting your investigation with behavioral analysis — an observation of how the specimen interacts with the file system, the registry and the network — can rapidly produce useful results. Virtualization software such as VMware is incredibly helpful in this process.