Microsoft Security Compliance Manager - Review

The Microsoft Security Compliance Manager provides basic security features centralized management, a reference portfolio, adaptability and flexibility to export basic security to accelerate your organization's ability to effectively manage the process safety and compliance for Microsoft technologies most widely used.

Key Features and Benefits
• Central management of portfolio and benchmark: The central management console Security Compliance Manager provides a consistent user experience from beginning to end plan to design and security baselines for export. The tool gives you full access to a wide range of recommended baselines for Windows ® client and server operating systems and Microsoft applications. The Security Compliance Manager, you can quickly update the latest versions of Microsoft Basic and take advantage of version control base.

• Baseline Security Customization: Customization, comparing, merging, and reviewing baselines you never been easier. Now you can adapt the new ways of Security Compliance Manager one of the baselines, duplicate recommended by Microsoft for the Windows client and server operating systems and Microsoft applications quickly and change security settings to meet the environmental standards of your organization.

• Capacity to export multiple baselines for export to formats such as XLS, Policy Object (GPO), the desired configuration management (DCM), or packages Security Content Automation Protocol (SCAP) for automating the deployment and compliance tracking database.

• The baseline of security for Windows Server 2008 R2, Windows Server 2008, Windows Server 2003 Hyper-V, Windows 7, Windows Vista, Windows XP, the BitLocker Drive Encryption, Windows Internet Explorer 8, Microsoft Office 2010 and Microsoft Office 2007 SP2

• The recruitment pack for Windows 7, Internet Explorer 8

System Requirements
• Supported operating systems: Windows 7, Windows Vista Service Pack 2

• This toolkit is designed to work with System Center Configuration Manager 2007 and Desired Configuration Management (DCM) function.

• Microsoft Office Compatibility Pack for Word, Excel file formats, and PowerPoint (free download) can be used to open, edit and save documents, workbooks, and presentations in the file formats new to Microsoft Office 2007.

• Microsoft Word or Microsoft Word Viewer (free download) can be used to view Word documents.

The Security Compliance Manager-Start Guide is available on the official Microsoft site. Download this guide in order to adapt quickly and Security Compliance Manager (SCM) tool. The guide also includes a brief tutorial on using the CMS tool to implement and monitor security, the basis for the last server and client operating systems from Microsoft.

Web Security Threats To Look Out For

Is your network is properly protected against web threats? Do you weigh in a false sense of security?

The pirates are changing their habits and use of new methods, web, dynamic in nature and usually hidden in legitimate sites. The end user remains the weakest link in the Web security as malware writers exploit this weakness to launch their attacks, hunting human interest, and curiosity behavior. Social networks are "trusted" and users rely on their IT administrators to protect and lulls all into a false sense of security.

Exploiting news events - Hackers use stories as to trick users
Barely 24 hours after the announcement was the death of Qaddafi, we released that targeted malware that exploit the curiosity to see the history of big news began to be transmitted. Cybercriminals use human interest - and big news stories of the world as they generate a huge amount of hedging activities and the Internet. The same thing happened when bin Laden is dead, and when the royal wedding took place - and the trend will continue. The same trick is Halloween and other seasonal stories used, we saw many of these occur on social networking sites and others. Social engineering attacks to convince users to download content to the alleged event that is infected with new strains of malware related. Any event that is of interest and the interest generated is used to spread malware scams, fraud and other.

 Insecurity browsers and plug-ins - only with Windows Update is not enough
Although your favorite web browser and operating system can be saved and corrected, the reality is that most people do not update plug-ins. Java, Adobe Flash and Adobe Reader plug-ins are often outdated and there are Web exploits that use this weakness to infect networks. Web exploits that specifically target this vulnerability (such as the Black Hole exploit kit) are increasingly popular in the cyber-criminals.

Compromised high profile Webs and "drive-by downloads"
So how to distribute these vulnerabilities? The first method is "fast flux" sites, sites that are created solely for the purpose of distributing malware for a short time. The second way is to compromise a site level and the injection of a "drive-by download" - a piece of code that infects a user when they have a website (there is no need of anything, click here - just visit the site of infection is the user's computer - so that drive-by). Usps.gov the site and the site were exposed to mysql.org these two types of attacks.

There is a third method of spreading these infections. Instead of using a website, send a malware authors content on Web advertising companies infected. This content is then passed on thousands of websites with these promotional affiliates, and each site hosting the ads is to spread malware, and this code is detected. The London Stock Exchange was a website that exposed to these types of attacks this year, even though it was by far not the only way.

Search Engine Poisoning
End users have become accustomed to rely on search engines. They (wrongly) believe that the well-known search engine like Google or Bing would never directly on a website that is infected with malicious software. But search engines do not really make a difference between sites, the search results according to their ranking algorithms. As a result of malware authors are flooding search results with links to the pages of bait to take the user to download malicious websites, malicious software on their computers. As users became more suspicious you are certain types of links, this type of search image search now, the most difficult to avoid are moved.


Evolve as Internet threats, it is more difficult to ignore exposed to the threat posed by the user browsing the Internet, and further develop as an attack, you must ensure that your Web browsing activity n ' is not so expect more than you.

maybe we should blame the victim

pardon my iconoclasm, but a twitter conversation with jerome segura and maxim weinstein got me thinking about this. it was sparked by maxim's blog post "stop blaming the victims" where he argued that we shouldn't be blaming people for failing to follow security best practices (such as keeping web servers up to date). personally i consider this to be a form of infantilization. i've argued against coddling users before but i want to expand on the idea here.

the principle and practice of not blaming the users basically sends them the message that they're OK, they didn't do anything wrong, and they can keep doing things the way they have been. this is a marked departure from many of the other messages we send users trying to get them to be more aware of security and to make better decisions in security contexts. that makes the "don't blame the victim" dogma a substantially mixed message. have they really done nothing wrong? often times there are things they could/should have done differently, things they've been told about in the past but still failed to consider. can they be entirely free from responsibility for what happens to them in such a circumstance? i don't believe so. do we really want to send the message that they did nothing wrong and don't have to change? how will we ever get people to take better care of their security if we do that? many people are poorly adapted to the realities of the modern world and if there's no force giving them pushes in the right direction they'll never improve.

more fundamental than that is the fact that victims are victims of the word "victim". by acknowledging someone as a victim we accept and embrace the notion of powerlessness that the word engenders. recognizing people as victims gives them a license to be victims and to remain victims. when someone is taken advantage of we shouldn't be treating them as some helpless and fragile thing, we should be helping them to become empowered so that they don't get taken advantage of again and again and again. by telling them they're helpless victims we rob them of the opportunity to better master their fates and gain confidence in their abilities. perpetuating the notion of the victim keeps the lay-person down.

therefore, not only do i think we should hold people at least partially responsible for the consequences of their actions or inactions (to blame the victim in normal parlance), but i also think we should blame the people who say "don't blame the victim". their well-meaning but ultimately misplaced mollycoddling holds people back and stymies our collective growth and advancement. we can never adapt if we're taught that we can't change our fates.

security small talk

[i'm republishing this secmeme post here because, although the topic is more fitting for secmeme, the intended audience is better addressed here - and if you're like me, you probably hate being directed to some outside site when you're going through your RSS feed.]

pursuant to a brief discussion i had with @diami03 (aka michelle k.) on twitter earlier today, some thoughts popped into my head.

specifically, with regards to how well known the concept of the nigerian 419 scam is, i said

she was not happy with that. admittedly it was a rather crass way of expressing the principles i had in mind, but i stand by them (even if i also find them disappointing).

put differently there are two things in play. the first (and probably the one most are familiar with) is that people often prefer to be entertained rather than informed. if i'm being totally honest, i feel the same way sometimes.

the second is that (at least to my mind) a good indicator of how well our culture has assimilated a particular piece of information is how easily/frequently that information finds it's way into everyday chatter (i.e. small talk).

now normally my memetic ramblings are intended for the broadest audience i can manage, but this is a special case. injecting security into small talk logically must start with the people who are security aware. many security geeks probably already do this to a certain extent - after all, if people can talk about the weather or last night's game, why not security topics too?

now i'm not the best person to advise on how to engage in small talk (far from it in fact) but there are a few things i think are self-evident. first and foremost is that this is not an opportunity to give a lecture, or to talk like you're presenting at a conference. most people don't want to go back to school and if you start sounding like a teacher they're going to tune you out. so how can you shoot the breeze about security with non-security folks? here's a few strategies:

1. everybody loves a spectacle so keep your eye out for them and use them opportunistically. database breaches aren't sexy or interesting, but sony's loss of over 100 million private records breaks the boredom barrier by sheer size alone. so much so, in fact that you may well find that people have already heard about it in the mainstream media. that's a bonus, it means you can talk about something they've already heard about.
2. if they're really your friends then it stands to reason that they have at least a modicum of interest in how your day was. did you see a nigerian 419 scam in your email today? great, mention that in passing. did you see two or more of them in the same day? even better. after all, how many dead princes (or whatever) can there really be out there? if wealth and death are as strongly correlated as those scam emails suggest then i think i'd rather stay poor.
3. when you mention things that you think might directly affect them, you're showing concern about them, you're showing an interest in their well-being. everyone wants their friends to be interested in them in some way so that display of interest should make them perk up their ears and take notice. i used this strategy myself with the epsilon breach, sending links to to the list of affected merchants to some of my friends so that they could look over the list and see if the breach was likely to affect them personally.

if you're concerned about the quality of information that is passing from person to person, it's up to you to help put better information into the mix. don't be afraid to throw in a few security topics when chatting with friends. they probably already know you're a security geek so they'll understand why you're interested in it, and if you can make it even a little bit interesting for them then they might pass it along.

why the epsilon breach shouldn't be an issue

the epsilon breach (where an email marketing company that does business with a veritable who's who of big name corporate brands and financial institutions lost the names and email addresses of the customers of those companies) seems to be on everyone's mind recently, and to tell the truth i find that kind of strange.

it's not as though i'm under any illusion about it not being able to affect me. a colleague of mine at work got a notification about the breach affecting him so while i haven't received one yet myself, the possibility of receiving one certainly exists. yet i find myself completely unconcerned about the possibility. why? because i took steps to protect myself proactively (steps my colleague knew he should have taken such that now wishes he'd been more vigilant).

i have been using disposable email addresses since the fall of 2004. with them i've managed to keep any email accounts i created after that point completely spam free for the past 6 1/2 years, i've come up with a sender authentication protocol to foil phishing, and as it happens i've recovered from email breaches in the past in mere moments.

and that's the reason a breach like epsilon is a non-issue to me. not only is it old hat, recovering is as simple as logging into the disposable email provider and clicking disable or delete (depending on the provider) for each compromised address, and then going on about the rest of your day.

it's dead simple to recover from the breach of something when that something happens to be disposable - you simply dispose of it. what i don't understand is, why aren't more people and especially more security practitioners doing the same thing? why hand out your real personal contact information like candy on halloween if you don't have to (and believe me, you don't have to)?  even if you decide you still want to do business with these companies who saw fit to hand your contact information over to a marketing company (hey, you're already their customer, why do they need to keep trying so hard to sell to you), it's a heck of a lot easier to make a replacement disposable email address than it is to make a replacement real email address. just a couple of clicks and some random typing (or just mash keys if you prefer); no captcha, no verifcation, no profile info, you filled that all out when you created an account at the disposable email provider in the first place.

cory doctorow gave a short talk about kids and privacy and he mentioned that they're being trained to not value their privacy, in part by over protective parents who prevent them from learning how to protect themselves. i don't think kids are the only ones who've been so trained. one of the most regrettable schools of thought that i've seen displayed from users all the way up to security pros is the one that says 'they are (or are supposed to be) protecting me'. there is a profound absence of self-reliance in favour of letting protection be the responsibility of someone else.

most people wouldn't hand their phone number out to every tom, dick, or harry they meet on the street, but when it comes to email addresses somehow people think the rules are different. they trust everyone who asks for it and expect everyone to protect it for them instead of protecting it themselves. this is an absurd position to take, but authorities (ie. people who are supposed to know better) have groomed the masses to systematically take just that position when it comes to anything that has to do with online protection.

i'm not holding my breath but, considering the scope of the epsilon breach, maybe some people will start to think

well if you're going to protect me from the bad guys, who's going to protect me from you?

i know, i'm probably being too optimistic, but surely some people out there will see this incident and realize how truly pervasive the mishandling of personal information is by the people we entrust it to. dozens of companies handed that data over to one completely unnecessary entity which then became a single point of failure, and because most people weren't protecting themselves from those companies (either their intentional bad acts or their ineptitude) many people are now at much greater risk of falling victim to targeted phishing and other related attacks.

a clever reader would probably realize that entrusting your real email address to a disposable email provider is still expecting that provider to protect it for you. the thing is, instead of trusting many entities with your data, under this model you're only trusting one. you also don't have to trust them with the same address you use for personal correspondence (which would be the hardest kind of address to change); i certainly don't.

Free lightweight antivirus program

Why We Need ONLY lightweight antivirus program?

Which anti virus software is the best in protecting our computer and lap top at the same time has the most light weight and consumes less system resources?yeah,this question been asked numerous times! anyway,The other question asks for free. Lightweight and free are not necessarily the same thing.

Good anti virus software that has function like real time scanning and protection ,less power and resources consumption on lap top.Having a nice interface AND ease of us.

When it come to discussion,everyone has difference opinion and experience.If you ask why would we need antivirus software in the fist place?Naturally no one should get unapproved access to your computer since you do have firewall installed on you PC.If you are not connected to internet,you probably doesn't need it. If you are internet user,same thing if you download some installation package from a dodgy web site OR e-mail ,YOU GET INFECTED. 
 
There are always free antivirus around,as well as paid version. MOST performs better if it is commercial ones. You can get a commercial version with extra features, so we can only guess that it is great. 

Why we a lightweight antiviral software which has active protection.Because,it eats a lot of performance from your computer, and writing/downloading files to the hard drive takes forever since every file has to be scanned, it needs to constantly update its definitions etc you need to have those watch dog running all the time to protect you files and Pc.

Most talk about :Everyone has their own light-weight antivirus program !!

Stay Tuned FOR SOFTWARE review.
AVG Anti-Virus Free Edition download