InfoQ Homepage Security Content on InfoQ
-
Mobile Security and Team Collaboration: How to Combine It
Mobile devices often contain both personal and corporate data. When these devices use cloud services with an "always on" internet connection the risk of security breaches increases says Jeff Crume. An interview on mobile security threats, increasing adherence to security policies, using mobile devices to collaborate efficiently, effectively and secure, and deploying enterprise mobile security.
-
Amazon releases AWS Key Management Service
At their re:invent 2014 show Amazon launched AWS Key Management Service (KMS), “a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses Hardware Security Modules (HSMs) to protect the security of your keys”. At launch the service supported EBS, S3 and Redshift. Additional support for Elastic Transcoder was added in late November.
-
Google Uses Machine Learning to Simplify CAPTCHA
Google has announced a new CAPTCHA API which provides a No CAPTHA experience for most users.
-
Java EE 8 Security JSR will have Cloud Improvements
The Java Community Process published details of JSR 375, a redesigned Java EE Security API that includes improvements for implementing security in a cloud environment.
-
Netflix Releases Open Source Message Security Layer
Netflix have announced the release of the Message Security Layer protocol (MSL), which they describe as ‘A Modern Take on Securing Communication’. The project is available on github under the Apache 2.0 license, with implementations in Java and JavaScript.
-
Microsoft, Adobe Release Critical Security Updates
Microsoft has released secruity improvements to Internet Explorer, fixing a vulnerablity that could allow an attacker to take control of a user's system. But according to Robert Freeman, manager of IBM X-Force Research, the issue was reported to Microsoft with a working proof-of-concept back in May 2014 -- and the issue is far older.
-
Embedding Security Testing in Development Workflow
Stephen de Vries, ContinuumSecurity founder, promoted the idea of continuous and visible security at Velocity Europe 2014. Stephen argued that the same kind of processes and tools that embedded QA in the whole workflow of an agile development process can be applied to security. BDD-Security is a security testing framework that follows the Given-When-Then approach and is built on top of JBehave.
-
AWS Releases CloudTrail Processing Library
Amazon Web Services (AWS) recently released the AWS CloudTrail Processing Library (CPL), a "Java client library that makes it easy to build an application that reads and processes CloudTrail log files in a fault tolerant and highly scalable manner".
-
Amazon CloudWatch Gains Log Monitoring and Storage
Amazon CloudWatch recently gained log file monitoring and storage for application, operating system and custom logs and meanwhile enhanced support for Microsoft Windows Server to cover a wider variety of log sources.
-
Vormetric Partners with DataStax to Deliver Enhanced Data-at-Rest Security in Apache Cassandra
Vormetric, a data security solutions provider has announced a partnership with DataStax, the company behind Apache Cassandra, to enhance the enterprise-class security features in the platform. The two companies will work together to enhance data-at-rest security that includes encryption, enhanced access controls and security intelligence in Apache Cassandra.
-
Mixing Agile with Waterfall for Code Quality
The 2014 CAST Research on Application Software Health (CRASH) report states that enterprise software built using a mixture of agile and waterfall methods will result in more robust and secure applications than those built using either agile or waterfall methods alone. InfoQ interviewed Bill Curtis about structural quality factors, and mixing agile and waterfall methods.
-
Using Logs to Detect User-Based Threats
A common theme at the Splunk user conference is the idea that the users are the greatest threat. Even in a well-regulated enterprise where no one has more privileges than what’s needed to do their job, a typical user has more than enough ability to steal massive amounts of data or cause widespread problems. Fortscale seeks to address this issue by using the data that you are already collecting.
-
Proactively Monitor Configuration Changes with Tripwire
Most companies still manually track configuration changes using a wiki or spreadsheet. Only the most basic information such as IP addresses are included, as recording everything is just too tedious. Even knowing basic information such as who made the change is difficult and time consuming. Tripwire seeks to eliminate this problem by proactively monitoring configuration changes.
-
Discover What Malware is Really Doing with FireEye
Traditional signature based anti-virus/malware software is suitable for home users, but not for corporations. As seen repeatedly in the news, targeted attacks against specific companies are becoming more and more common. To combat this threat, advanced threat detection techniques are needed.
-
CloudFlare Universal SSL - Free Web Security for All
CloudFlare have made SSL available to all free subscribers to its content delivery network (CDN) with Universal SSL. The move addresses both cost and complexity issues that have previously confronted web site and application owners wanting to deploy SSL. CloudFlare takes care of issuing a certificate at no cost to the end user, and enabling SSL becomes a selection from a dropdown menu.