Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Website Security Solutions
Showing posts in English
Andy Horbury | 29 May 2013 | 0 comments


Tightly targeted cyber-espionage attacks designed to steal intellectual property are hitting the manufacturing sector and small businesses with ever greater venom, with the latter, highly vulnerable, organisations the target of 31% of such attacks – a threefold increase on 2011.

Meanwhile, targeted attacks overall have seen a massive 42% surge during 2012, compared to the previous year.

These are just some of the worrying statistics revealed by Symantec in its forthcoming ‘Website Security Threat Report’.

Why small businesses? Because they are seen as the path of least resistance. Cybercriminals are enticed by their bank account information, customer data and intellectual property – and the often...

Brad | 29 May 2013 | 0 comments

HTTP session hijacking, better known as “sidejacking”, poses a major threat to all internet users. This is due to the common use of Wi-Fi networks, which are inherently unsecure, but also because of the wide-spread misplaced trust in the safety of internet use on phones and perceived secure connections. It has been demonstrated that wired networks are also not necessarily safe from sidejacking attempts and even your interactions in an App store can be at risk as well.

If you are logging into Facebook using the open Wi-Fi network at your local watering hole, an individual with a simple tool such as Firesheep can gain access to your account, change your password, and then potentially take advantage of other programs linked to that account. These sidejacking attacks can be done without any programming knowledge and the problem isn’t simply limited to the unencrypted Wi-Fi networks we are...

Belinda Charleson | 21 May 2013 | 1 comment

It’s time to stop and take a moment to consider cyber security, says the Australian Government. Once a year, the government gets together in partnerships with industry, the community, and consumer organisations to help make people aware of basic steps they can and should do to protect their personal and financial information.

This year’s theme on their Website is “Our Shared Responsibility”. I encourage you all to go out and look at their website, where they help distill a lot of activities down to the basic 10. (With commentary by me.)

  1. Install and update your security software and set it to scan regularly. If you’re broke, there are free A/V options from Microsoft, AVG, and Avast. Install one of these at minimum! Then as soon as you can, upgrade to a top-rated A/V like Norton.
  2. Turn on...
Andy Horbury | 20 May 2013 | 0 comments

The public sector has a somewhat mixed record when it comes to staving off security breaches within its walls. In the UK, for example, the hugely embarrassing data losses at HMRC (Inland Revenue/Taxation services) – when the personal details of 25 million people were heavily compromised, due to what were described as "serious institutional deficiencies" – still linger in the mind a few years down the line.

On the plus side, the UK government has been heavily engaged in getting its own house in order, identifying information security as a key priority for 2013 and beyond. In recent months, new initiatives to address growing cyber security threats have been announced, with a cyber security ‘fusion cell’ established for cross-sector threat information sharing. The intention is to put government, industry and information security analysts side-by-side for the first time. The analysts will be joined by members of intelligence agencies,...

Andy Horbury | 14 May 2013 | 0 comments

Nearly a quarter of IT managers don’t know how secure their website is.

2011’s security breach at Sony’s PlayStation Network, thought to be the largest data security leakage ever, was so damaging its effects are still being felt today. After an infection of 10 of its servers, over 75 million global customer account details were stolen. Questions were raised in parliaments worldwide, lawsuits were launched and user access to games was blocked for over a month.


This was a very significant and public security failing and resultant loss of trust, but according to the results of a new survey, similar vulnerabilities could exist right across the web. The problem is that most companies just don’t...

Andy Horbury | 10 May 2013 | 0 comments

I hope by now that you are aware that the Certificate Authority/Browser Forum has mandated that Certificate Authorities stop supporting 1024-bit key length RSA certificates for both SSL and code signing by the end of this year (2013). To learn more about these changes please read the CA/Browser Forum’s paper on the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates

What do you need to do?

Any Symantec customers with certificates expiring this year (2013) will need to renew by generating a Certificate Signing Request (CSR) of 2048 bits or higher. Any Symantec customers with certificates expiring in 2014 or later will need to replace and upgrade all 1024-bit certificates with 2048-bit RSA/DSA or 256-bit ECC certificates by 1st October 2013. All existing 1024-bit...

Belinda Charleson | 09 May 2013 | 1 comment

This year’s ISTR illustrates more clearly than ever before that the path of least secure resistance is going to be the path taken by hackers.

In years past, the profile of a hacker was an idle college kid or ‘script kiddie’, and accounted for most of the damage seen on the internet. Security measures rose, and more basic tools became available to secure the network at more reasonable prices. But when the going gets tough, the tough turn pro. Zeus, SpyEye, and other Trojans can now be ordered online in Full setup packages or piecemeal the same way you can buy shoes or books online. I suppose it was inevitable – in the end, everything is going to be for sale.

And who is being targeted? Sure, we still hear about the major breaches suffered by big credit cards and banks. But what about the little companies? Symantec’s...

Jeannie Warner | 06 May 2013 | 0 comments

What is the Financial industry thinking about these days? Symantec sponsored a lunch at Net.Finance, where we invited attendees to have lunch and talk about how to increase traffic to and usage of eCommerce as a way of doing business and conducting transactions. In attendance were a variety of guests ranging from very large commercial banks to small vendors working on new transactional solutions as a service. We posed a few set questions to open up the floor for discussion, with some thoughtful responses.

 For an opener, and because it’s always most fun to start with current challenges to get people talking, we asked our guests about their obstacles to convincing customers to use online services. Demographics were the first point that came up instantly: Users over 50 are slow to embrace new technology and slow to trust unfamiliar new ideas. There was some laughter at my table, as a...

Brian Wall | 01 May 2013 | 0 comments

How and when to use self-signed SSL Certificates

SSL – Secure Socket Layer – is a vital weapon in the armory of any organisation intent on ensuring its systems are safe. It is the standard behind ensuring secure communication on the Internet, integrating data cryptography into the protocol.

On your travels through the security world, you may also have come across the best-known open library for secure communication: OpenSSL (OpenSecure Socket Layer). You may even use it within your business – but that’s probably the extent of your knowledge of its inner workings. As Steve Marquess of the OpenSSL Software Foundation himself told me recently: “It is very difficult to describe [such] cryptography succinctly for laymen”, and anyone delving into OpenSSL would no doubt swiftly agree! After all, you don’t have to understand a tool fully to use it properly. Still, more information about when to use this tool can be very helpful.

Brian Wall | 01 May 2013 | 0 comments

Transported to a more secure environment

Virtual private networks (VPNs) are a real boon when it comes to reducing the cost of business communication, while at the same time extending secure remote access to teleworkers, travellers and mobile professionals. But deploying and managing a secure VPN can be challenging, to say the least. So, what are your options, if you want to be really safe?

Transport Layer Security (TLS) – successor to Secure Sockets Layer (SSL) – should certainly be high in your thoughts. For those not too familiar with the technology, this is a point-to-point communication encryption mechanism that can be used in a variety of applications for securing traffic (HTTPS, SMTPS, POP3S etc). A TLS-based VPN enables otherwise non-encrypted traffic to travel down an encrypted path. The upshot is the safeguarding of sensitive data on websites, intranets and extranets.

A VPN can be configured to only route secure traffic,...