6 C
London
Wednesday, November 22, 2017
Home Tags Risk Assessment

Tag: Risk Assessment

Op-ed: Devices like Amazon Key put too much risk assessment on users; bad decisions follow.
Mimecast's Steve Malone discusses the latest findings from the company's Email Security Risk Assessment report, and how cloud-based email services can help.
Weak risk assessments have gotten a pass up until now, but that may be changing.
Former CEO of virtualization security vendor Bromium launches new startup that makes use of machine learning techniques to help detect and predict risk.
MyLife Digital is delighted to announce its successful certification for the ISO 27001 information security standard.Audited by LRQA, MyLife Digital ran various early initiatives as part of the robust requirements for certification.
It also implemented a rigorous staff training and awareness programme for information security, as well as running effective risk assessment and risk treatment activities.John Hall, CEO of MyLife Digital, commenting on the achievement, says, “As an organisation handling the personal data of millions... Source: RealWire
At RSA, Mimecast cyber security strategy Bob Adams discusses graduating from basic filtering to true email security risk assessment.
IBM adds new risk management capabilities to its security portfolio in a bid to further strengthen the security immune system. IBM announced on Jan. 23 its intent to acquire privately-held Agile 3 Solutions, in an effort to further improve IBM Security's risk management capabilities.

Financial terms of the deal are not being publicly disclosed.Agile 3 Solutions is an IT risk management vendor with several different products and services.

Among Agile 3's products is a service called Business Exposure and Risk Management (BERM), which aims to help provide visibility into potential security risks that could impact a business.

The Business Program Management and Compliance (BPMC) service from Agile 3, provides a management dashboard for organization to track metrics that are aligned with compliance efforts.

The Agile 3 Business GRC: iDNA is a platform that helps organizations to map potential threats against business assets.Gregg Barrow, Partner, Global Competency Leader, Data and Application Security Services at IBM Security explained that Agile 3 Solutions provides specific technology that is able to harvest information about risks and exposures to sensitive data across an organization. He noted that in addition to collecting and analyzing business risk information, the Agile 3 technology provides an intuitive, graphical user dashboard that is designed specifically for executive-level use."The Agile 3 dashboard provides Line of Business-level detail that helps executives understand what pieces of data are at risk, how significant the risk is, which Line of Business is responsible for the data, and more items," Barrow told eWEEK. "Agile 3's technology is able to collect its own business-level risk data and can also be fed data from data security and other products to collect, analyze and present a single business-level view of business risk to data." While Agile 3 does provides capabilities that can fit into the Governance, Risk and Compliance (GRC) market, Barrow commented that Agile 3 does not directly compete with GRC tools. Rather he noted that Agile 3 is focused on providing a data security risk assessment of the enterprise data, how to remediate risk and communicate the risk posture to the business. "Agile 3 Solutions integrates with IBM Security Guardium capabilities to remediate data security concerns," Barrow said.In terms of where the Agile 3 technology will fit into the IBM Security product portfolio, Barrow said that it will augment the existing data security capabilities from IBM Security Guardium and IBM Data and Application Security Services. He noted that Agile 3 recently partnered with the Guardium team to engage with clients, and jointly perform proof of concepts."Agile 3 has the ability to apply its technology broadly across the IBM Security portfolio," Barrow said. "In the coming months, IBM Security will be exploring ways to further integrate Agile 3 technology and leverage it across areas of the portfolio."IBM calls its approach to layering and embedding security across an organization, the 'security immune system.' The basic idea is that by layering security across the entire 'body' of an organization, technology can fight threats in a way similar to how antibodies fight disease.

The Agile 3 technology is set to become another element in the growing IBM security immune system."By having a broad set of tightly integrated security capabilities woven throughout a company’s infrastructure, these systems can work together to proactive detect and combat various threats throughout the multiple stages of an attack's lifecycle," Barrow said.Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com.

Follow him on Twitter @TechJournalist.
2017-01 Security Bulletin: Junos: Denial of Service vulnerability in RPD (CVE-2017-2302)Product Affected:This issue can affect any product or platform running Junos OS. Problem: On Junos OS devices where the BGP add-path feature is enabled with 'send' ...
2017-01 Security Bulletin: Network and Security Manager (NSM): Multiple OpenSSH vulnerabilities affect NSM Appliance OS.Product Affected:NSM Appliances (NSM3000, NSM4000 and NSMExpress). Problem: Multiple OpenSSH software vulnerabilities affect NSM App...
2017-01 Security Bulletin: Junos: RPD crash while processing RIP advertisements (CVE-2017-2303)Product Affected:This issue can affect any product or platform running Junos OS where RIP is enabled. Problem: Certain RIP advertisements received by the rou...
2017-01 Security Bulletin: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600: 'Etherleak' memory disclosure in Ethernet padding data (CVE-2017-2304)Product Affected:This issue affects QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices. Problem: QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets.

This issue is also known as 'Etherleak' and often detected as CVE-2003-0001. Juniper SIRT is not aware of any malicious exploitation of this vulnerability. This issue has been assigned CVE-2017-2304. Solution: The following software releases have been updated to resolve this specific issue: Junos OS 14.1X53-D40, 15.1X53-D40, 15.1R2  and all subsequent releases. This issue is being tracked as PR 1063645 and is visible on the Customer Support website. KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies. Workaround: There are no known workarounds to prevent the information leak in Ethernet packets. It is a good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the QFX device only from trusted, administrative networks or hosts. Implementation: Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version.
In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame.

For these cases, Service Releases are made available in order to be more timely.
Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release.

Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request. Modification History: 2017-01-11: Initial release. Related Links:CVSS Score:4.3 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Risk Level:Low Risk Assessment:Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."
2017-01 Security Bulletin: Junos: SRX Series denial of service vulnerability in flowd due to crafted multicast packets (CVE-2017-2300)Product Affected:This issue affects any SRX Series Services Gateway chassis cluster Problem:The flowd daemon on the primary node of an SRX Series chassis cluster may crash and restart when attempting to synchronize a multicast session created via crafted multicast packets.  Upon the flowd crash, data plane redundancy groups will fail over to the secondary node in the chassis cluster while flowd on the primary node restarts.This issue only occurs in chassis cluster configurations that process transit multicast traffic.  Transit multicast traffic is processed on an SRX services gateway by enabling PIM in normal Flow Mode, or via security policies permitting transit multicast traffic in L2/Transparent Mode.Juniper SIRT is not aware of any malicious exploitation of this vulnerability.No other Juniper Networks products or platforms are affected by this issue.This issue has been assigned CVE-2017-2300. Solution:The following software releases have been updated to resolve this specific issue: Junos OS 12.1X46-D65, 12.3X48-D40, 15.1X49-D60, and all subsequent releases.This issue is being tracked as PR 1188853 and is visible on the Customer Support website.KB16765 - "In which releases are vulnerabilities fixed?" describes which release vulnerabilities are fixed as per our End of Engineering and End of Life support policies. Workaround:Disallow transit multicast traffic, or isolate/disable the secondary node of the chassis cluster until an upgrade can be performed. For SRXs running in Transparent Mode, any security policies permitting transit multicast traffic should be disabled (default policy is deny-all). For SRXs running in normal Flow Mode, transit multicast traffic can also be stopped by disabling PIM protocol. Implementation:How to obtain fixed software:Security vulnerabilities in Junos are fixed in the next available Maintenance Release of each supported Junos version.
In some cases, a Maintenance Release is not planned to be available in an appropriate time-frame.

For these cases, Service Releases are made available in order to be more timely.
Security Advisory and Security Notices will indicate which Maintenance and Service Releases contain fixes for the issues described. Upon request to JTAC, customers will be provided download instructions for a Service Release.

Although Juniper does not provide formal Release Note documentation for a Service Release, a list of "PRs fixed" can be provided on request.Modification History: 2017-01-11: Initial publication2017-01-18: Devices with security policies permitting transit multicast traffic in Transparent Mode are also vulnerable Related Links:CVSS Score:6.5 (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Risk Level:Medium Risk Assessment:Information for how Juniper Networks uses CVSS can be found at KB 16446 "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."