Vmware vsphere achieves eal 4+ certification

http://virtualization.info/en/news/2010/11/vmware-vsphere-4-0-receives-common-criteria-eal4-certification.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Virtualization_info+%28virtualization.info%29

Interesting comment at end of article on what is not included

Because the vendor itself specifies the Security Target document, it’s really interesting to know what isn’t included, especially when you want to compare the product with comparable products which are also EAL4+ certified.

For ESX/ESXi functionalities not included in the Security Target are:

Simple Network Management Protocol (SNMP), File Transfer Protocol (FTP), Telnet
The use of any authentication method on ESX(i) other than the local password database
VMware Software Development Kit (SDK) tools
The procfs interface (used to manage CPU resources) on the ESX host Service Console
VMware Scripting Application Programming Interface (API) on the ESX host.
VMware Consolidated Backup
Guest OS patch updates via Update Manager
By earning this certification VMware stays way ahead of Citrix for which XenServer 5.6. and XenDesktop 4.0 achieved EAL2 certification in September this year.

four pillars of endpoint security

Interesting article from Microsoft technet

http://technet.microsoft.com/en-gb/magazine/gg213837.aspx

Java outstrips Adobe

Apparently Java is the new Adobe when it comes to malware attacks on PC's. According to a report by Microsoft, the attacks on vulnerable are magnitudes of order greater than adobe, previous number one target of malware.

Image: microsoft.com

Increase in 'Cyber Security' Budget

Taken from BBC News Website

Tenable Nessus YouTube Channel

Tenable have a YouTube channel and have some good walk through's.

FDCC compliance check

Nessus XML parsing with Awk

Article on the HiR blog about Nessus XML output parsing

http://www.h-i-r.net/2010/10/nessus-xml-parsing-with-awk.html

Contains a link to a script to provide a list of IP's to severity rating, here

Seems to work better than some contractors output I could mention....

Sophos articles on malicious code

Couple of pdf's on malicious code.

1. Want my autograph? The use and abuse of digital signatures by malware

http://www.sophos.com/security/technical-papers/digital_signature_abuse.pdf

Interesting article on the use of stolen certificates in modern malware.

2. FINDING RULES FOR HEURISTIC DETECTION OF MALICIOUS PDFS: WITH ANALYSIS OF EMBEDDED EXPLOIT CODE

http://www.sophos.com/security/technical-papers/malicious_pdfs.pdf

What to look for in malicious pdf's

highlights of that one

Heuristic 1: If the PDF contains JavaScript look more closely

Heuristic 2: If the objects or streams are mismatched look more closely

Heuristic 3: If the Cross-Reference (XRef) Table is invalid look more closely

Heuristic 4: The presence of LZWDecode, ASCII85Decode, DCTDecode and Encrypt Filter are indictative of clean files

Heuristic 5: Hash (#) encoded tags are indictative of malicious files

These comments appear to be based on the use of Adobe Acrobat Reader as the infection vector. Sumatra PDF reader, which doesn't support Flash or Javascript, might be an interesting alternative to get away from a lot of these problems.