Admin password security 'abysmal'
258317
Static passwords expose 'keys to the kingdom' says survey Half of all enterprises have more administrative passwords than those attached to ordinary user accounts. Many (42 per cent) of these privileged passwords are never changed, according to a survey.â¦
631605
Microsoft can't stop crowing about new Vista security features. But the system still has holes. Here's how to plug them.
574199
Secure transactions for the disabled I am not a security expert but I recognise that security is fundamental to the successful implementation of ICT solutions. Different security solutions are used in different environments; simple user-id and password solutions are still popular, because they are inexpensive to implement, but they are not very secure.â¦
81829
According to a Gartner survey, online shoppers are frustrated with the lack of security provided by online businesses, and they fear that passwords are no longer sufficient to secure their transactions.
176092
(Source: Symantec)  One common mistake that organizations make is by using Identity management solutions in isolation. Doing so risks access inflation, workarounds and coverage gaps. This white paper shows how comprehensive access management deploys identity management within a framework that includes disciplines for data protection, integration with hiring and promotion, and especially monitoring.
86222
In brief Exploit circulating for unpatched vuln
79424
Third time's the charm Punch drunk Fasthosts customers are set to be hit with a third compulsory password reset next week, as the budget web hosting company scrambles to cope with a major security breach.â¦
154551
KeePass is a free password manager which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master password or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. Databases are encrypted using a very secure encryption algorithm (AES/Rijndael).   KeePass 2.04 Alpha can be downloaded from: https://sourceforge.net/project/showfiles.php?group_id=95013&package_id=225106&release_id=566366  This is an Alpha version! It is intended only for testing! For details see http://keepass.info/download_v2_step.html  The complete changelog can be found here: https://sourceforge.net/project/shownotes.php?group_id=95013&release_id=566366  There are no translations available yet.
534739
KeePass is a free password manager which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key-disk. So you only have to remember one single master password or insert the key-disk to unlock the whole database. Databases are encrypted using very secure encryption algorithms (AES and Twofish).      KeePass Version 1.06 can be downloaded from here:   https://sourceforge.net/project/showfiles.php?group_id=95013&package_id=101217&release_id=455510    Updated translations and plugins can be downloaded from the KeePass homepage:  http://keepass.sourceforge.net/     Version 1.06 is a stable release. Additionally to the usual small feature additions and bugfixes, the password quality estimation algorithm and auto-type window focusing have been improved, automatic workspace locking has been enhanced.  The full changelog is available here:   https://sourceforge.net/project/shownotes.php?release_id=455510&group_id=95013
195493
BBC Click's Dan Simmons looks at the products offering our passwords protection from hackers.
743833
Passwords as we know them could be yesterday&#39;s news if two-factor authentication solutions from VeriSign Inc. and RSA Security Inc.
150897
The United Nations last week became the latest organization to warn computer users about the dangers of relying on just passwords to protect online bank accounts and e-commerce shopping carts, according to Reuters
444444
ON THE SCENE - During an updated version of one of the more popular sessions at TechEd each year, senior security engineer and Microsoft MVP Marcus Murray demonstrated the use of some very simple hacking tools that can enable not-so-knowledgeable people to work their way to revealing the passwords of domain administrators in as little as 15 minutes.
348960
The huge losses reported by French bank Soci?t? G?n?rale, apparently caused by a rogue trader with inside knowledge of the bank's procedures, don't necessarily point to an IT systems failure but rather to poor management of those systems, analysts say.The bank has accused 31-year-old employee Jerome Kerviel of creating a fraudulent trading position in the bank's computers that ultimately caused it to lose around ?4.9 billion ($7.3 billion).Kerviel achieved this by, among other things, misappropriating computer passwords, the bank said. It has revealed few other technical details of what caused the losses.Management of passwords, including rescinding the old passwords of employees who move to different positions within the bank, or modifying the level of access those passwords allow, is often a task given to the lowest-level IT worker."It's dull and routine 99 percent of the time, but a vital backstop," said Bob McDowall, senior analyst at the TowerGroup. Senior IT managers should conduct more frequent reviews of password policies, he said.In some cases, it may not have been the security of the passwords themselves that posed a problem, but rather the access those passwords allowed, said Ian Walden, professor of information and communications law at Queen Mary, University of London.Organizations tend to think of access as being binary in nature: you get access to it all, or you don't, Walden said. In reality, there are many more levels of access. "In modern, complicated systems, the granularity has to be much more sophisticated."To make the best use of systems with advanced access controls, the IT department must have a thorough understanding of how the business works and where there is risk.IT departments and business managers have yet to find a way to wrap security into business processes so it is not an impediment, Walden said."IT in a company is not given a sufficient status," Walden said. "What's shocking is you would have thought that the financial sector was more sophisticated than this, but it still tends to be the case that security is an add-on and a block, something you've got to live with but you don't have to like, rather than being viewed as an integral part of the business structure."Workers should be able to do their job without having to share passwords when someone goes on holiday, and the IT department should not make it harder for people to perform their duties, Walden said.In one extreme example at telecommunications company BT, one employee didn't have the right to use a computer at all, but he found it helped him do his job, Walden said."By the time he was found, he had 90 passwords of different employees," Walden said.It's possible that financial institutions could use biometric systems, such as fingerprint scanners, to provider an added layer of security, McDowall said. Those systems, however, are expensive. Also, the sometimes-finicky fingerprint scanners may not be appropriate in a frantic trading environment, McDowall said.Questions remain about how Kerviel's losses could be so high given his job as relatively low-level trader. But Kerviel's career progression in 2005 from the bank's back office to the front office -- where he would have had access to client accounts -- is also troubling since he would have gained greater knowledge on the bank's inner controls, McDowall said.As an arbitrage trader, Kerviel made money off price differences between different financial products. Soci?t? G?n?rale said Kerviel balanced real and fake trades in order to avoid setting off internal alarms.Kerviel has been described in some press reports as a computer genius. However, most attackers used unsophisticated methods for exploiting systemic vulnerabilities in applications, processes and procedures, according to the 2005 "Insider Threat Study" by Carnegie Mellon Software Engineering Institute.That report notes that sophisticated tools are also used in some attacks, which would demand that internal financial systems need to be designed on a more defensive footing.Programmers should code under the assumption that a hacker or employee will use every means in order to break in, said Ben Rothke, senior security consultant at BT's International Network Services."The underlying issue is that many systems are designed to stop honest people from making mistakes, but do not take into account those with malicious intent," Rothke said.It makes insider jobs one of the toughest to defend against. The psychological profile of an insider tends to be a disgruntled employee who feels wronged by the company, according to the Insider Threat Report.That in turn can lead to a suspicious behavior such as staying late at work, which paradoxically might only signal a committed employee."It's always the insider," Rothke said. "It's often harder to steal $10,000 from a bank than $10 million."
320458
Web servers may be vulnerable to attack, security company warns.
144979
More updates on the patch bandwagon Sys admins hoping to put their feet up after Microsoft's monthly update, which went far from smoothly, faced the problem of pushing out Java and Flash security updates issued at the tail end of last week.â¦
57790
DevShed is continuing their series on PHP security with this new tutorial focusing on the security surrounding user authentication.   So far we have covered security vulnerabilities that involve form data, databases and file systems. In this article we are going to look at authentication and the security issues around it. We will also look at some of the most common attacks in this field.   They start things off by describing two of the usual authentication methods - via a login form and through HTTP authentication. They start poking a few holes by looking at some of the common attacks for these approaches including two popular ones - brute force attacks and password sniffing.