Search

A security kernel is a software and hardware mechanism that enforces access controls within a computer system. The correctness of a security kernel on a PDP-11/45 is being proved. This paper describes the technique used to carry out the first step of the proof: validating a formal specification of the program with respect to axioms for a secure system. [ABSTRACT FROM AUTHOR]

The article reports on the launch of AVG Internet Security 8.0, the latest version of flagship suite for consumers, by AVG Technologies in the U.S. It is designed to deliver enhanced protection against the web-borne threats without sacrificing the product's signature efficiency. According to Karel Obluk, chief technical officer (CTO) of AVG, the AVG 8.0 bears solid, reliable protection versus sophisticated web-borne threats that can infect computers without the user even needing to click a link.

A list of the top computer viruses and worms as of July 2006 is presented. The viruses and worms listed include Brain, CIH, Melissa, Iloveyou,Code Red, SQL Slammer, Blaster, Bagle Sobig.F, MyDoom, Sasser. Information about the time the viruses and worms broke and their mechanism of action are provided.

The article reports that San Francisco, California-based Zone Labs Inc. has launched ZoneAlarm 6.0, the much-anticipated update to its award-winning Internet security product family. ZoneAlarm 6.0 offers consumers the most effective multi-layered protection against spyware, viruses and other insidious Internet security threats. ZoneAlarm 6.0 utilizes a unique new behavior-based strategy to block malware and spyware from ever gaining a foothold on a PC. Rather than intermittently scanning for spyware infections after the damage has been done, ZoneAlarm 6.0 offers the first new defense mechanism, called OSFirewall to guard the health of a PC at the core. This kernel-level firewall monitors suspicious activity affecting the operating system, programs and files, and disables destructive programs. The new OSFirewall combined with the existing award-winning firewall technologies create the Zone Labs "Triple Defense Firewall," a multi-faceted protection system with inbound, outbound and now internal filtering for zero-hour defense and seamless integration making ZoneAlarm 6.0 the most effective Internet security solution for everyday consumers.

The article reports on the availability of the SecurityReporterT, a new security event management (SEM) reporting solutions for both SidewinderR and snapGeaR appliances, from Secure Computing Corp. in the U.S. It is designed to deliver central monitoring and to identify real security threats from meaningless noise. It offers prompt action points to keep the enterprise or small-to mid-size business safer. It also furnishes evidence of regulatory compliance and proves the effectiveness and value of information technology (IT) security investment to management.

The article reports on the new product called McAfee Total Protection for Small Business launched by SecureMyCompany in the U.S. The product is an anti-spyware and anti-virus solution for Value-Added Resellers, Original Equipment Manufacturers and Managed Services Providers which is the industry's first truly integrated security solution and is also available as monthly subscription from the company. The total protection feature of the product is designed for companies that need desktop and server anti-spyware and anti-virus software, email protection, desktop firewall and more. Once viruses are detected, McAfee Network Operations Center will automatically send updates.

The article reports on the InterScan Gateway Security Appliance. The InterScan gateway Security Appliance is the latest addition to the portfolio of security solutions from Trend Micro Incorporated, which is the leader in network antivirus and content security software. The gateway security solutions provide choices to customers. The InterScan gateway Security Appliance is developed and patterned for mid-sized organizations, who are looking for an easy to install and easy to maintain content security solution.

The article introduces the topics dealt in the October 1997 issue of the journal "Communication of the ACM." As technologies and technical abilities evolve, so does the need for moving system architectures in the same direction. Easier said than done, since it's exceedingly difficult to create structures that can be upgraded, updated, or upended at every advancing step along the way. Therein lies the beauty of object-oriented application frameworks, a promising technology for reusing existing software designs to improve quality and cut costs. This month's special section focuses on the modular, reusable, and customizable features of frameworks technology. Their advantages are examined via real-life applications from experienced authors drawn into this project by Guest Editors Mohamed Fayad and Doug Schmidt. The articles detail the design principles underlying object oriented frameworks through a variety of applications. They illustrate economical face-lifts for classic architectures, and indicate the considerable role frameworks play in contemporary software development. Other articles in this issue touch on an eclectic array of topics. For instance, the possibilities of a computer-based immune system that could provide viral protection much like a biological system is the focus of a fascinating discussion.

This article discusses ways to create and filter events that are easy to use. Creating your own events and filtering events is still hard and error prone. Thus, the ability to create an easy and error-free manner require computer users to know the exact match between the arguments they pass to the event and how the arguments are processed in the event-handler function. However, this process is time consuming and prone to error. In addition, computer users can also get into trouble if some other event has the same ID. Therefore, the users should be able to define a dynamic event and it should return the same ID every time the function is called.

The article reports that after months spent testing a field of powerful deep-inspection Firewalls, the computer software company Juniper's NetScreen captured the crown, with Fortinet and Check Point trailing close behind. Historically, firewalls have been assigned blue-collar access-control duties while intrusion-detection systems take on the task of inspecting data traffie for signs of attack or anomalous packets. But over the past couple of years rebuilds in the firewall space reminiscent of old rods being retrofit with superchargers and nitrous oxide has been seen. Researchers thought the hard part would be building a test bed that could mimic an enterprise network and traffic load. But after a month and a half of testing, it was the third component, that came back to bite them. Problems ranged from misconfigured firewall rules to a demonically possessed switch that killed two days of testing before we finally replaced it. Researchers found that most vendors had problems configuring their firewalls in accordance with the required rule sets. INSETS: DEEP-INSPECTION FIREWALLS.;HOW WE TESTED DEEP-INSPECTION FIREWALLS..

Focuses on several ways to protect computer programs from viruses. Importance of keeping an anti-virus software updated; Discussion on building an attack plan; Details on several steps to avoid being infected by computer viruses. INSETS: What, Me Vulnerable?;Seven Ways to Stop Worms.

Focuses on the use of information rights management (IRM) in securing content collaboration. Discussion on computer and information security; Importance of IRM solutions in providing information insurance. INSET: IRM Tools To Take into Battle.

Discusses whether Intrusion Detection Systems (IDS) are better than Intrusion Prevention Systems (IPS) in providing computer security to corporations. Comparison between IDS and IPS; Detection methods employed by IPS and IDS to improve their ability to reduce false positives; Description of false positives. INSETS: Untitled;IDS and IPS Attack Response.

The article reports on the certification awarded to Panda Internet Security 2007, the newest security group from Panda Software Corp. in the Desktop/Server Anti-Virus Detection category from the International Computer Security Association (ICSA) Labs in the U.S. The certification gives confirmation on the quality and effectiveness of the new solution for Panda Software's 2007 consumer range. In addition, the product detected 100 percent of viruses from the list and all test samples from the ICSA Labs which includes detection of polymorphic viruses. Aside from the certified quality, it is also required that the product must include an administration interface that allows virus detection to be enable or disabled.

The article reports on how content-addressed storage (CAS) systems can help information technology managers bring their organizations into compliance with regulatory mandates. CAS is an intelligent repository used to store and preserve compliance-sensitive documents such as medical records, blueprints, invoices and e-mail messages. Each piece of data that is fed into CAS are being stored using identifiers, which ensures that sensitive business content is not altered and that the paper trail is preserved within the context of a paperless environment. It also has the ability to perform high-speed searches through the repository.

The article reports that Santa Clara, California-based Kerio Technologies Inc., a provider of Internet security software and messaging solutions, has announced Kerio MailServer 6.1, which adds Sender Policy Framework (SPF), Spam Repellent and dual anti-virus scanning to its existing arsenal of virus and spam-fighting tools. Designed primarily for small and medium-sized businesses, Kerio MailServer simplifies email, contact and group calendar management to provide improved collaboration for all types of organizations. In the new Kerio MailServer 6.1 the underlying email security technology has been significantly improved. Kerio has added SPF, a widely adopted method of email domain authentication, to augment the already included Caller ID, a similar technology developed by Microsoft. Kerio has also added dual anti-virus scanning so that mail administrators can use both the built-in McAfee Anti-virus and a third party anti-virus through a provided plug-in. The new Spam Repellent feature effectively fights off both spam and viruses by inserting a delay in the SMTP handshake, which causes a virus or spam-sending zombie to give up the connection attempt.

Presents letters to the editor related to the computer industry. Concerns over the quality costs of the computer software; Reasons for the un-acceptance of the passports and similar other products; Suggestions for improving the computer security systems.

Reports on spyware, a stand-alone computer program that gathers information from a targeted computer and relays it to another party. Increase in malicious code reported according to the "Symantec Internet Security Threat Report in 2003; Recommendations for preventing and controlling spyware.

The U.S. Internal Revenue Service (IRS) is as serious about auditing its computer systems as it is about tax returns. So when the W.32Blaster worm and subsequent attacks wreaked havoc on computer systems across the world, the federal agency was prepared: The IRS used autonomic computing software to distribute the appropriate Microsoft Corp. patch to more than 5,000 servers and 125,000 desktops and laptops across the nation. The project, which took a week, saved the IRS more than $1.5 million in tech staff labor costs, according to Jim Kennedy, program manager of IRS Enterprise Systems Management, in Austin, Texas.

The article discusses why it is wise to buy a Mac instead of a Windows personal computer (PC). It has been stated that Mac provides lots of great software with it, while one will have to purchase equivalent software separately for a Windows PC. It is also evident that there are currently no Mac viruses and there are only a few Mac malware programs, whereas one will have to buy softwares to protect Windows PC from viruses and other malware.

The article reports on the launch of the Trend Micro ProtectLink Gateway by Linksys Corp., a leading provider of VoIP, wireless and networking hardware for consumer and small business environments, and content security leader Trend Micro Incorporated in the U.S. The launching aims to select Linksys by Cisco Small Business routers. It is averred that the incorporated solution of Linksys and Trend Micro security service is projected to key employee productivity concerns of small business customers by an easy-to-deploy, services-based offering.

The article discusses the problem caused by the Google-backed stopbadware.org project as it struck the RealNetworks RealPlayer media player with problems such as disclosure and uninstallation. According to the article, RealPlayer 10.5 is a badware because it exposes the installation of an advertising software on the user's computer as well as Real Player 11 due to its installation of Rhapsody Player Engine software. In addition, it states that computer users are now to avoid installing the aforementioned versions until it is updated.

The article reflects on the development of the Web 2.0 bubble that analysts fear for another technology bubble burst. The author explains that all this talk about bubbles lets him think about the classic cycles of busts. He states that same progression from pure technology to pure marketing can be seen, when past technology bubbles are analyzed. Thus, he suggests to pay attention to the progression, to be able to tell when a bubble is getting big enough for its own good and will likely burst.

The article offers information on the governance, risk, and compliance (GRC) Application Suite from Oracle Corp. in the U.S. The GRC Application provides an integrated strength of heterogenous compliance and content management capabilities Oracle acquired from Stellent Inc. including the Oracle E-Business and PeopleSoft Enterprise suites. It was shown that Oracle's GRC Application Suite offers three elements including infrastructure, GRC process layer, and GRC intelligence layer. In addition, GRS also offers information security as well as provide customers with a foundation of sustainable, consistent and efficient risk and compliance management.

The article reports on the release of the latest version of the Mozilla Foundation's open-source Bugzilla projects to protect users from security risks in the U.S. Users should immediately upgrade to versions 2.18.6, 2.20.3, 2.22.1 or 2.23.3 to minimize the risk of malicious attacks, according to a warning from the Mozilla Foundation. Users of the software-defect-tracking product are at risk of cross-site scripting, data manipulation and data exposure attacks due to multiple security flaws in Bugzilla. Ximian, National Aeronautics and Space Administration and Id Software are included in the major companies and government agencies that use Bugzilla.

The article reports on Apple Computer Inc.'s new widget update mechanism called Dashboard Advisor. The new widget update mechanism has many demerits. It is not user-friendly as computer users often find difficulty to operate it. Apple Computer Inc. never unveiled user guides to this feature owing to spyware and security issues. Moreover, computer users also find difficulty in controlling it. The article also includes information on Apple Computer Inc.'s "iTunes MiniStore" feature which unlike Dashboard Advisor is easily accessible to computer users.

The article discusses the reason of the success of the Windows operating system by Microsoft Corp. and its security flaws. The Windows monoculture is considered the major factor in its success in the market, as it supports interoperability among users and across corporations. However, this culture is the same factor that put users and businesses at risk aside from security risk. Windows thrives in the market because of its presence everywhere. Microsoft addresses security flaws through its new version called Vista, and with its security initiatives like memory-address randomization. Meanwhile, corporations refuse software diversification, believing that the cost of risk is less than the cost of implementing new software.

The article focuses on the plan of Intel Corp. to use software to improve computer security. The company is currently contemplating a standard method for adding virtual virtual applications, purpose-built software applications running on top of their own miniature operating systems inside virtualized partitions, to personal computers. The technology could improve security, greater manageability, and improvements in applications such as voice over Internet Protocol, and developers can custom applications that live within virtual partition.

The article reports on the launch of EMC's entry-level, disk-based Clariion Disk Library. The DL210 will feature software utilities and wizards specifically designed to simplify disk-based backup for small and medium-size businesses and remote branch office users. It also comes with a virtual tape shredding functionality to allow customers to better meet regulatory requirements and to ensure that unwanted data is not compromised during or after backup processes carried out via connected virtual tape systems. It will also have a system support for the IBM System i platform, which will encompass large-scale backup applications for the AS400 market.

The article reports on the admission of Microsoft Corp. that it is silently fixing software vulnerabilities, which are discovered internally. Microsoft Security Response Center operations manager Mike Reavey says the company is documenting internally discovered software vulnerabilities, but is withholding full disclosure of every security-related product changes. It describes how withholding fix details affected Trend Micro, when it used a vulnerable code in its products. It advises businesses to use Microsoft's severity rating system to help with patch deployment timetables.

The article reports developments related to computer software industry in the U.S. Cameron Sturdevant and Andrew Garcia discuss the review of DesktopStandard's PolicyMaker Application Security 2.5, as well as the general effectiveness of group policy procedures when it comes to locking down employee systems. Peter Coffee looks at the opening of credit card computing on the Sun Grid. It offers information about the security of Radio Frequency Identification system from malware, worms, and viruses.

The article recommends the use of Acronis True Image 9 computer software to protect backups. A Web site where one can download the software is mentioned. It is also reported that Acronis has confirmed that backup software problems are just corrupted-archives errors.

The article comments on some issues on computer industry in the U.S. Bill Gates, head of the Microsoft Corp., on delivering his keynote on the topic trust ecosystem in the recent 2006 RSA Conference held in San Jose, California, in some ways had recast simply the comments made by once-archival Scott McNealy, chairman and CEO of Sun Microsystems Inc. With this, many cannot help but think Gates was sounding of a dreadful kind a lot like McNealy. Gates stressed about security technologies that enable isolation. Meanwhile, Microsoft has developed its own scanning analysis tools: PREfix and PREfast, AppVerifier, and others after leading the charge to revamp Microsoft's coding practices wherein automated scanning tools do no make code secure.

The article focuses on the computer security platforms and products being offered by companies such as Microsoft Corp. and Cisco Systems Inc. These giant companies are opt to be considered as overall computer security providers. Microsoft offers a total computer security platform including the access control, tokens and scanning software designed to make a computer system hack-free and virus-free. On the other hand, Cisco offers a total security platform based on a dominant network model that can search, isolate and thwart the passage of bad code before it rampages the computer system.

The article provides information about computer viruses and software. The author discusses the origin and the definition of the terms viruses, spyware, and malware. Spyware is software that monitors the user, and has also come to refer to software that subverts the computer's operation for the benefit of a third-party. He also mentions ways on how to avoid computer viruses.

The article offers an update of issues related to the computer industry in the U.S. as of December 2005. Microsoft released a Security Advisory warning about an unexpected behavior in Windows Firewall that could let a clever attacker who had broken into a user's PC leave a back door to the Web unlocked for next time. Panda Software identified a new worm that redirects the search requests of users to a phony Google site. The P21oad. A worm masquerades as a free Star Wars game. Possible causes of failure to get updates from the Microsoft Update or the Windows Update site include conflicts with third-party firewalls and problems with the update sites' addresses hard-coded into Windows' Hosts file.

The article informs that according to statistics released by vulnerability scanning company Qualys Inc., two of every three computers are running software that contains a critical security hole. The data, based on more than 32 million vulnerability scans, spans three years. In all, 21 million critical vulnerabilities were identified in that period, which could allow an attacker to take over a machine or get access to sensitive data, said Gerhard Eschelbeck, chief technology officer at Qualys.

The article reflects on the security problems associated with personal computers usage in the U.S. Various initiatives have been launched to deal with identity crime and cybercrime. Information on a proposed bill that will monitor multiple standard malware techniques is also provided here. This bill aims to halt the spread of spyware software. Although the computer industry has not rallied behind the bill, representatives are very eager to deal with electronic spying.

The article focuses on the announcement of the release of QRadar 5.0 by Q1 Labs Inc. The QRadar is deployed as an all-in-one appliance that collects and archives data feeds from different products and provides a management interface for the product. The company has increased the number of security events that QRadar recognizes and introduced Judicial System Logic which can tease specific threats out of correlated security events, vulnerability data and traffic flows. However, QRadar has limitations such that it only supports feeds from a few products out of the box, such as the open-source Nessus vulnerability scanner and products from nCircle Network Security Inc.