Linux Security Week - August 18th 2003

[InfoSec News <isn () c4i org>]

+---------------------------------------------------------------------+
|  LinuxSecurity.com                            Weekly Newsletter     |
|  August 18th, 2003                             Volume 4, Number 33n |
|                                                                     |
|  Editorial Team:  Dave Wreski             dave () linuxsecurity com    |
|                   Benjamin Thomas         ben () linuxsecurity com     |
+---------------------------------------------------------------------+

Thank you for reading the LinuxSecurity.com weekly security newsletter.
The purpose of this document is to provide our readers with a quick
summary of each week's most relevant Linux security headlines.

This week, perhaps the most interesting articles include "2.6 Kernel Cures
Some Security Shortcomings," "Honeypot Farms," "How Secure Is Your SAN,"
and "Advanced Encryption Standard by Example."

LINUX ADVISORY WATCH:
This week, advisories were released for lynx, zblast, perl, kernel,
signal, iBCS2, ddskk, konquerer, man-db, xpcd, stunnel, postfix, and php.
The distributors include Conectiva, Debian, FreeBSD, Gentoo, Red Hat,
SuSe, Trustix, and TurboLinux.

http://www.linuxsecurity.com/articles/forums_article-7798.html


Basic Intrusion Prevention using Content-based Filtering

This article will discuss a very useful but seemingly overlooked
functionality of Netfilter, a firewall code widely used in Linux, that
provides content matching and filtering capabilities.

http://www.linuxsecurity.com/feature_stories/feature_story-148.html

> > FREE Apache SSL Guide from Thawte <<
Are you worried about your web server security?  Click here to get a FREE
Thawte Apache SSL Guide and find the answers to all your Apache SSL
security needs.

 Click Command:
 http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=vertad_thawteapache

--------------------------------------------------------------------

Expert vs. Expertise: Computer Forensics and the Alternative OS

No longer a dark and mysterious process, computer forensics have been
significantly on the scene for more than five years now. Despite this,
they have only recently gained the notoriety they deserve.

http://www.linuxsecurity.com/feature_stories/feature_story-147.html


-->  Take advantage of the LinuxSecurity.com Quick Reference Card!
-->  http://www.linuxsecurity.com/docs/QuickRefCard.pdf

+---------------------+
| Host Security News: | <<-----[ Articles This Week ]-------------
+---------------------+

* NIST Security Certification and Accreditation            Project
August 15th, 2003

The second public draft of NIST Special Publication 800-37, Guide for the
Security Certification and Accreditation of Federal Information Systems
(.pdf file), has been completed and is available for public comment. This
document is one of a series of security standards and guidelines being
developed by NIST's Computer Security Division in response to the Federal
Information Security Management Act of 2002.

http://www.linuxsecurity.com/articles/documentation_article-7802.html


* Detecting and Understading Rootkits
August 14th, 2003

Well, well, well. You have installed the latest Linux distribution and
stopped all unnecessary services. You also set-up a set of Netfilter rules
that would make the Pentagon Security Department envy you. You drool with
delight. But.

http://www.linuxsecurity.com/articles/server_security_article-7793.html


* 2.6 Kernel Cures Some Security Shortcomings
August 11th, 2003

The technology exists today to create and manage reasonably secure
environments for Linux enterprises. In the hands of a competent
administrator, Linux is roughly as secure as the other operating systems.
That's not to say that improvements aren't needed. [In] the next version
of the kernel, we'll have significant security enhancements, particularly
in the area of policies. So enterprise Linux security continues to
improve.

http://www.linuxsecurity.com/articles/security_sources_article-7775.html


* Winning the War on Spam: Comparison of Bayesian SPAM Filters
August 11th, 2003

Spam e-mail has become an ever increasing problem, and these days it is
next to impossible to use e-mail without receiving it in large amounts.
Various techniques exits to combat the problem; keyword-based filters,
source blacklists, signature blacklists, source verification and
combinations of these to name a few.

http://www.linuxsecurity.com/articles/privacy_article-7774.html


+------------------------+
| Network Security News: |
+------------------------+

* Wireless Networking
August 15th, 2003

How about a project that combines hardware construction, community
building, network hacking and, of course, Linux and other free software?
Best of all, the stuff you need to get started is cheap and standardized,
and there's a great balance of helpful resources and unanswered questions.
We're talking about wireless networks.

http://www.linuxsecurity.com/articles/network_security_article-7804.html


* Keeping Out The Intruders
August 14th, 2003

A recent report from research group Gartner, Inc. caused a ruckus in the
intrusion detection/intrusion prevention system market. In the Information
Security Hype Cycle, Richard Stiennon, research vice president for
Gartner, concluded that IDSs has failed to offer up any value to companies
relative to their associated costs, and would fall away by 2005.

http://www.linuxsecurity.com/articles/intrusion_detection_article-7796.html


* Making the Right Connection
August 14th, 2003

Choosing the ideal virtual private network is difficult enough for
enterprise buyers, without the decision being complicated by rumblings
that up-and-coming secure socket layer (SSL) VPNs will quickly overtake,
and maybe replace, traditional internet protocal security virtual private
networks (IPsec VPNs).

http://www.linuxsecurity.com/articles/security_sources_article-7797.html


* Honeypot Farms
August 13th, 2003

For the past six months this series of papers has covered a breadth of
honeypot topics. We have covered everything from what honeypots are, their
value and different types, to common misconceptions and legal issues.
However, one thing we have yet to discuss is deployment. How can you
deploy honeypots in your environment?

http://www.linuxsecurity.com/articles/intrusion_detection_article-7790.html


* How Secure Is Your SAN
August 13th, 2003

With all they've got to worry about these days, most IT executives don't
lose a lot of sleep over whether the data stored on their companies' tape
and disk devices is secure. Most have come to believe that data,
particularly mission-critical data residing in the corporate data center,
is capably guarded by the usual protections such as firewalls, user
authentication, and intrusion-detection systems.

http://www.linuxsecurity.com/articles/general_article-7791.html


+------------------------+
| General Security News: |
+------------------------+

* Spam fuels boom in secure content market
August 15th, 2003

IDC predicts that anti-spam products will be a key driver for the secure
content management (SCM) software market which it expects to grow by 19
per cent a year to reach $6.4 billion in 2007.

http://www.linuxsecurity.com/articles/general_article-7805.html


* Recovery firms respond to blackout
August 15th, 2003

Thursday's power outage in the eastern United States led some companies to
invoke their disaster-recovery services.  But many businesses that have
contracts with disaster-recovery providers appeared not to lose their data
or applications, thanks to onsite power generators.  SunGard, which has
about 7,000 disaster-recovery clients in North America, said about 30
customers activated their service Thursday.

http://www.linuxsecurity.com/articles/general_article-7800.html


* Advanced Encryption Standard by Example
August 13th, 2003

The following document provides a detailed and easy to understand
explanation of the implementation of the AES (RIJNDAEL) encryption
algorithm. The purpose of this paper is to give developers with little or
no knowledge of cryptography the ability to implement AES.

http://www.linuxsecurity.com/articles/cryptography_article-7788.html


* Research Suggests New Way To Can Spam
August 12th, 2003

Internet Service Providers (ISPs) should lower their monthly fees if they
permit spam to reach their paying customers, say researchers at the
University of Missouri in Columbia (UMC).  In the brave new world of lower
access fees in exchange for spam, satisfied consumers would pay less for
Internet service, claim UMC associate professor of journalism Clyde
Bentley and doctoral student Anca Micu.

http://www.linuxsecurity.com/articles/privacy_article-7785.html

-----


 #### Concerned about the next threat?  ####
 #### EnGarde is the undisputed winner! ####

 Hardened Linux Puts Hackers EnGarde! Winner of the Network Computing
 Editor's Choice Award, EnGarde "walked away with our Editor's Choice
 award thanks to the depth of its security strategy..." Find out what the
 other Linux vendors are not telling you.

http://store.guardiandigital.com/html/eng/products/software/esp_overview.shtml

------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc.                LinuxSecurity.com

     To unsubscribe email newsletter-request () linuxsecurity com
         with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.