Tag Archives: computer forensics training

Stopping Breaches with Agile Security

Posted on by
Reply

It is very important for the network security to improve so that they can address the rapidly changing environment they are in. Unfortunately, many companies suffered damaging and also embarrassing attacks on their network. It has also dealt a devastating blow to the security industry because it has exposed their technologies, systems, services and procedures, which most people rely on. Nowadays, the traditional in IT security is not enough in protecting the IT network.

The traditional security measures and tools we used to have are made to deal with a slow changing setting. In fact, they weren’t built to deal with the fast changing resources, applications as well as systems that are now too common nowadays. They weren’t built to quickly react against the changing attacks. Computer forensics believes that there are hundreds of millions of new malware in the Web each day and many of these can be seen attempting to breach security systems of companies. These fast evolving threats means that the defense are slowly getting left behind.

As the reality has shown, traditional security tools lose their edge and capabilities to protect the systems quickly. Thus it is important for security to evolve so that they can react to the fast changing environment. It is safe to say that the security must become more mature and agile. Agile security can deliver a much better and effective protection because of the four core elements.

Unlike traditional security that is blind to the changing attacks and environment, agile security can see much better. Because of it, agile security can provide better access to all the unprecedented amount of information; they yield more visibility on the assets of the network, the operating systems, the applications, protocols, users, services, network behavior and also network attacks like viruses and malware.

Since there is visibility, it thus generates data. With data, security can make effective decisions, which requires learning. The learning of security includes the application of data that is generated both locally and from larger communities. Agile security will correlate the events with the knowledge they have gathered, which is an important avenue to understand and make decisions, thus enabling prioritized, informed and automated response.

The only constant thing in the world is change and it also applies in network security. Networks, targets and attacks will change and security must respond to that by changing as well. Agile security can automatically adapt and modify its defenses to provide better protection in the changing environment.

The most important responsibility of security systems is protecting the sensitive data and assets of companies or individuals. Security systems must have policies on allowed applications, prohibited activities and supported devices. Suspicious events must be prioritized and must be reported to security officials like digital computer forensics. Agile security must be flexible in responding to events, risk prioritizing and distributing threat intelligence to deliver the best possible protection and solution.

Agile security’s four important elements, seeing, learning, adapting and acting will deliver a much more effective protection because these elements provides the ability of responding to the continues change in the environment.

Nowadays, if you want to see if the security solutions you have can really adapt to the changing environment in the world, you have to look for these important features or essential functions that are built into the agile security.

Agile security must have defense optimization or the ability to tune their security policies automatically to keep with the changes in their environment. No guesswork, but instead an optimized and ensured protection. Agile security must be able to enforce policy compliance and the ability to lock or support networks; preventing undesirable or unauthorized changes, thus reducing the available vulnerabilities in the system. Last but not the least, agile security must have an open structure, which makes it able to support customization as well as modification in their capabilities, but it has to be done only by experts in security or individuals who have completed computer forensics training.

It is important for organizations to have agile security that has the capabilities to adapt to their environment to ensure better protection for their assets and data. Indeed, traditional defenses have been refined and improved to do well today, but they are still nothing compared to agile security.

The International Council of E-Commerce Consultants (EC-Council) is a member-based organization that certifies individuals in cybersecurity and e-commerce. It is the owner and developer of 20 security certifications. EC-Council has trained over 90,000 security professionals and certified more than 40,000 members. These certifications are recognized worldwide and have received endorsements from various government agencies. They also offer trainings in computer forensics.

More information about EC-Council is available at www.eccouncil.org.

The Mac Malware Is Back

Posted on by
Reply

This year is probably one of the busiest years according to researchers, cyber security experts and computer forensics when asked about the Mac malware. So why do you think these people point that out? The reason is pretty simple really; it is the report from Apple, one of the leaders in the IT industry.

This report has opened a new update regarding a list of malware that is known to invade many desktops and devices with Mac operating systems. Among those malware is the Trojan dropper experts’ call as Revir and including in the report is the new Trojan they call as Flashback. If Revir disguises itself as some sort of PDF file, the Flashback will cloak itself as some sort of update for the Flash Player. Intego, the security firm of Mac believes that the Trojan Flashback was not as widespread at start, but now there has been an increase in number of incidences and reports of Flashback infections.

Experts from Intego believe that this Trojan is slowly spreading its terror across different systems and it is spread through many malicious Websites. Whenever internet users visit the malicious websites, they will suddenly notice a particular message saying that their plug-in has crashed and that there are suspected errors in the plug-in. After these false messages, a screen will suddenly pop-up offering the user to fix the problem by installing the Adobe Flash installer. Unknown to the user, this installer is not an Adobe Flash installer but an installer for a Trojan horse, the Flashback. And if the user’s browser is in Safari mode, then their computer will automatically download the said “safe” downloadable and a window for the installer will automatically open.

In the event that the user will install the said “safe” software, the Trojan horse Flashback will automatically deactivate the software needed for network security. The code in this particular malware will deactivate some security software only like Little Snitch, and luckily it has no effect in software like Intego VirusBarrierX6. Once the package has been installed, it will automatically delete the installation package. This malware will also automatically install a dynamic loader or dyld library and also an auto-launch code that allows the malware to inject its code into any applications the user will launch. This malware will also install a backdoor in the system where it will try to communicate to a remote server where it will send all the data it has stolen and this data will be in an RC4 encryption.

Experts who have completed cyber security training and computer forensics training believe that this malware infection is a fruit of genius social engineering. Most Mac users aren’t easily fooled by this method because an installer for Mac will never appear this way. Unfortunately, there are two things that make this approach believable. Devices with Mac OS X Lion does not come in with a Flash Player package, so if they want to view Flash content found on the Internet they must install the software themselves. Second reason is that their Flash Player must have been set to automatically update itself and this might look like an update alert. These two reasons could easily trick or fool Mac users; they would unwittingly download a malicious malware that would compromise their important data.

However, the report did not mention how Internet users are being drawn into these malicious websites. But according to some experts who have completed computer forensic course, it is easy to imagine how the users are drawn to these sites. One example is creating viral videos and spreading them like wildfire. Crooks may use these viral videos like a video about a trending topic or a scandalous video or nude video of an artist or any known person. When Internet users will try to view the video, they are prompted to install a fake Adobe Flash update – a false update that is instead an installation of the said Trojan. In fact, this method has worked well in many Windows as well as Mac users for the past years.

Indeed, there are more malware that is written and intended for Windows users compared to Mac OS X. Still it doesn’t mean that Mac computers and devices should be left unprotected.

The International Council of E-Commerce Consultants (EC-Council) is a member-based organization that certifies individuals in cybersecurity and e-commerce. It is the owner and developer of 20 security certifications. EC-Council has trained over 90,000 security professionals and certified more than 40,000 members. These certifications are recognized worldwide and have received endorsements from various government agencies. They also offer trainings in computer forensics.

More information about EC-Council is available at www.eccouncil.org.