Microsoft out-of-band security update for Internet Explorer. Microsoft released an urgent security update for Internet Explorer on all currently supported versions of Windows.
Compare Bargains on Hardware Diagnostics
|
Identity ProIdentity theft is on the rise. Your own computer may be one of the easiest ways for thieves to access your information! Search and secure your private information, including social security numbers, credit cards, drivers license, and even passwords. Find and secure your personal information (PI) before others get the chance! Identity Pro goes beyond current protection offered by anti-virus, anti-spyware, anti-spam, or anti-phishing, etc, to protect you where these programs don't. Automatically seek out and protect your important data. You'll be surprised at how much of your information is kept on your PC, from web forms to emails. Once you know what's there, you can delete or encrypt with ease. |
CIS Center for Internet Security. A non-profit enterprise whose mission is to help organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls.
Nessus is a popular vulnerability scanner used in over 75,000 organizations world-wide. Use Nessus to audit business-critical enterprise devices and applications. Check your networks, servers and applications for potential security vulnerabilities.
ITsafe provides a free Warning Service to help protect home and small business users of computers and other devices from attack. IT Security Awareness For Everyone. UK Government's ITsafe Service.
How To Break Web Software - A look at security vulnerabilities in web software. Video- (Large, but worth, (a must), watching video).
Sysinternals File and Disk Utilities Harddrive links
Microsoft Security Assessment Tool (MSAT) is a risk-assessment application designed to provide information and recommendations about best practices for security within an information technology (IT) infrastructure.
Microsoft Baseline Security Analyzer More Microsoft links
Seecrets Delivery Services (SDS) will be free for personal users. An e-security suite of crypto e-mail, secure password manager, zip manager & For-Your-Eyes-Only content viewer. The unique e-mail security caters for the privacy of all web mail and POP3 users. SDS uses RSA 8192-bits public key cryptography and AES 256-bits. All symmetric encryption uses our Secrets Signature-Free technology. Keeping Your Secrets Secret, Encryption, For-Your-Eyes-Only Protection, Watermarking, Secure Delivery.
Common Weakness Enumeration (CWE) Now Available. CWE is a community-developed formal list of common software weaknesses. The intention of CWE is to serve as a common language for describing design, or code; as a standard measuring stick for software security tools targeting these weaknesses; and to provide a common baseline standard for weakness identification, mitigation, and prevention efforts. Broad community adoption of CWE will help shape and mature the code security assessment industry and also dramatically accelerate the use and utility of software assurance capabilities for organizations in reviewing the software systems they acquire or develop.
Encryption with DeGPG Protect your files. DeGPG runs in the background on your server to provide access to GPG encrypted data to your web scripts. It will also work with GPG to encrypt and store data submitted via web forms. To give your web scripts access to encrypted data, you log in and enter the passphrase to decrypt the data. The data is decrypted and stored in memory till a web script needs to access it. In cases where your web script only needs, for example, and MD5 hash of the data, rather than the decrypted data itself, DeGPG can be instructed only to reveal the MD5 hash, and not the raw data. Additional data may be prepended or appended to the decrypted data before computing the hash.
Androsa FileProtector is a professional and freeware file encryption software that protects any type of file encrypting completely the content with the most advanced systems of cryptography.
SecuritySpace is proudly brought to you by E-Soft Inc., a privately owned Canadian consulting firm, with proven expertise in internet security and on-line services. We specialize in the following areas:
The Windows Memory Diagnostic Tests the Random Access Memory (RAM) on your computer for errors. The diagnostic includes a comprehensive set of memory tests. If you are experiencing problems while running Windows, you can use the diagnostic to determine whether the problems are caused by failing hardware, such as RAM or the memory system of your motherboard. Windows Memory Diagnostic is designed to be easy and fast. On most configurations, you can download thediagnostic, read the documentation, run the test and complete the first test pass in less than 30 minutes.
The Platform for Privacy Preferences Project (P3P) enables Websites to express their privacy practices in a standard format that can be retrieved automatically and interpreted easily by user agents. P3P user agents will allow users to be informed of site practices (in both machine- and human-readable formats) and to automate decision-making based on these practices when appropriate. Thus users need not read the privacy policies at every site they visit. Have a look at the list of P3P software. PSP is a W3C standard for creating machine-readable privacy policies. The standard allows a website to create an XML version of its privacy policy so that it can be evaluated automatically against an individual's privacy preferences.
P3P Toolbox is a one-stop resource developed by the Internet Education Foundation in cooperation with the World Wide Web Consortium and a coalition of Internet industry leaders and public interest organizations to provide privacy officers and Webmasters with the information they need to make their Web sites P3P compliant. The site is no longer active and is being hosted here by Internet Education Foundation for archival purposes.
Iconix eMail ID software download Iconix is committed to making it easy to identify legitimate emails. We are working closely with companies like Google and Iconix to give our users the best protection against fraudulent, phishing and suspect emails. If you are a Gmail user, it's easy to identify legitimate emails. You can simply enable an icon which will only show up when an email is from PayPal (or from our sister company, eBay). So when you receive an email from us, or our partners at eBay , you will see a key icon next to the message in your Inbox. Only legitimate PayPal emails have this icon so if you get an email claiming to come from PayPal and you don't see the icon, it's not from us. So please don't open it. To enable this feature in Gmail, go to 'Settings', 'Labs', then tick the Enable box next to the 'Authentication icon for verified senders' option and click on 'Save Changes'. This software download from Iconix can help reduce phishing by confirming whether you received a legitimate PayPal email. After Iconix eMail ID has been installed, you'll see an Iconix eMail ID icon (a gold lock with a tick) whenever you receive authentic emails from PayPal. It's free and it works with most of the major email services like Gmail, (Google Mail), MSN Hotmail, Yahoo Mail, Outlook Express, and many more. If your preferred email program, web mail provider or operating system. is not listed, click here and we will notify you when support is available. For more information, go to the Iconix website, How does the Iconix solution work? The Iconix solution couples our advanced technologies with authentication techniques such as Yahoo!'s Domain Keys and Microsoft's Sender ID to confirm the source of an email, and will support Domain Keys Identified Mail (DKIM), which is a joint effort between Cisco and Yahoo!, as it is adopted in the industry. This combined solution makes it very difficult for bad guys to spoof the identity of emails with an Iconix Truemark icon. Also see PayPal Support Club. Review and helpful links, coding examples, warnings, other shopping cart links, etc. PayPal is a on-link banking system that allows website owners to integrate shopping cart technology into their site. Find out more, includes links to helpful site about PayPal shopping cart technology.
PrivacyFinder is a privacy-enhanced search engine. Once you state your privacy preferences (low, medium, high, or custom), the search results are ordered based on how their computer-readable privacy policies comply with your preferences. A red bird indicates that the site has conflicts with your preferences while a green bird indicates compliance. The absence of any bird means that a valid computer-readable privacy policy, known as a The Platform for Privacy Preferences Project (P3P) policy, could not be located.
No Right Click Disable the right click on your pages to prevent users from "borrowing" images from your site and viewing your page source! . (BACK UP ALL FILES FIRST) Do a temporary copy upload and check the site works first, (as this does some more complex code changing onload), if the site functions OK then replace the normal site with the temp upload and retest... May only work with LINUX host) This can be a bit time consuming as if I remember correctly each image has to be Hot-Link prevented individually, and then if you add a new image this also has to be Hot-link protected. (I believe Hot-Link protection on the Host uses .htaccess) and this may be worth checking out as well.
CopyWipe is a utility for copying or securely overwriting (wiping/erasing) entire hard drives. CopyWipe can ease and expedite the transition to a new hard drive by copying the entire contents of one drive to another. CopyWipe can also help prevent confidential or private data from being recovered, by securely wiping the contents of a drive. A number of options are provided for wiping, most of which exceed governmental standards (such as DoD 5220.22-M, NAVSO P-5239-26, etc.); this allows the user to choose an optimal balance between security and duration of the wiping operation.
Stop Badwear. The "Badware" problem. We've all seen it happen: you or someone you know has downloaded something from the internet that seemed harmless enough at the time. Next thing you know, the computer has slowed to a crawl. Pop-up advertising starts to appear out of nowhere. Private information gets sent to some company you've never heard of. And the worst part? Trying to uninstall the software sometimes makes the problem worse. Find out more...
Sender Policy Framework. Sender Address Forgery. Today, nearly all abusive e-mail messages carry fake sender addresses. The victims whose addresses are being abused often suffer from the consequences, because their reputation gets diminished and they have to disclaim liability for the abuse, or waste their time sorting out misdirected bounce messages. You probably have experienced one kind of abuse or another of your e-mail address yourself in the past, e.g. when you received an error message saying that a message allegedly sent by you could not be delivered to the recipient, although you never sent a message to that address. Sender address forgery is a threat to users and companies alike, and it even undermines the e-mail medium as a whole because it erodes people's confidence in its reliability. That is why your bank NEVER sends you information about your account by e-mail and keeps making a point of that fact.
Auslogics System Information provides you with detailed information about your computer operating system and hardware, including installed devices, running processes and services, memory and CPU usage, drive properties as well as other technical details. The information can be viewed from the categorized interface or exported to HTML, XML or text format.
Falcon21 Home PC Security website!
Security Team Blog ( Security Team ) more Blog links
The Secunia PSI is the FREE security tool that is designed with the sole purpose of helping you secure your computer from software vulnerabilities.Free Internet Eraser is an Internet privacy software that protects your Internet privacy by permanently erase internet history and past computer activities. Even though, many of the tasks can be performed manually,
Advanced Windows Care - Freeware Advanced Windows Care v2 Personal is a comprehensive PC care utility that takes an one-click approach to help protect, repair and optimize your computer. It provides an all-in-one and super convenient solution for PC maintenance and protection. This fantastic program is available free of charge for private use. More Microsoft Windows Windows Vista. Windows XP, etc.
SpoofStick is a simple browser, (Internet Explorer or Firefox), extension that helps users detect spoofed (fake) websites. A spoofed website is typically made to look like a well known, branded site (like ebay.com or citibank.com) with a slightly different or confusing URL. The attacker then tries to trick people into going to the spoofed site by sending out fake email messages or posting links in public places, hoping that some percentage of users won't notice the incorrect URL and give away important information. This practice is sometimes known as phishing".
Identity theft. (Home Office Identity Theft website), Your identity and personal information are valuable. Criminals can find out your personal details and use them to open bank accounts and get credit cards, loans, state benefits and documents such as passports and driving licenses in your name.
The Identity and Passport Service was established as an Executive Agency of the Home Office on 1 April 2006. The Agency builds on the strong foundations of the UK Passport Service (UKPS) to provide passport services and in the future, as part of the National Identity Scheme, ID cards for British and Irish nationals resident in the UK. Foreign nationals resident in the UK will also be included by linking the scheme to biometric immigration documents.
National Identity Fraud occurs when a person's personal information is used by someone else without their knowledge to obtain credit, goods or other services fraudulently. It can even extend to securing a passport in their name.
Federal Trade Commission (Identity Theft)
Visit the UK Passport website issue UK passports to British nationals living in the UK. Our website is here to help you with your passport application.
Preventing Virtual Blight: my presentation from Web 2.0 Summit
:-
Belarc Advisor builds a detailed profile of your installed software and hardware, missing a href="http://www.acomputerportal.com/microsoft_windows.html">Microsoft hotfixes, anti-virus status, CIS (Center for Internet Security) benchmarks, and displays the results in your Web browser. All of your PC profile information is kept private on your PC and is not sent to any web server.
OpenID is an open, decentralized, free framework for user-centric digital identity. OpenID starts with the concept that anyone can identify themselves on the Internet the same way websites do-with a URI (also called a URL or web address). Since URIs are at the very core of Web architecture, they provide a solid foundation for user-centric identity.
Free Internet Window Washer is a free internet tracks eraser and privacy cleaner software. As you work on your computer and browse the Internet, you leave behind traces of your activity. The Windows built-in functions will not protect you, most of the tracks can not be erased with them. Therefore, anyone else can see what you have been doing on your computer. Furthermore, much of your activity information takes up valuable disk space, and recovering this space can be very beneficial.
Process Library resource is for anyone who immediately wants to know the exact nature and purpose of any and every single process that is - or should not be - running on your PC.
Security Config, your security portal. Here you can find all of the tools you need to secure your website, business, data, and everything else digital. Downloads ranging from: Anti Virus Software, Cookie Tools, Desktop Security, Email Security, Encryption , Enterprise Monitoring , Firewalls, Network Security, Password Software, SSH Tools and more.
Google Hacks 2.0 - video powered by Metacafe Also see Google Knowledge. Google Information
Microsoft Baseline Security Analyzer
The ISO 17799 Information Security Portal. ISO17799, ISO 27000 and Computer Security News.
Consumer Direct, a telephone and online consumer advice service supported by the Department of Trade and Industry.
APACS - Association for Payment Clearing Services
National Lottery, (United Kingdom), scam (fraudulent) emails are increasing at an alarming rate.
Business Software Alliance. Help businesses avoid software licensing problems. We've designed the Anti-Piracy Information section to help users prevent software theft. BSA® one of the World's leading anti-software piracy groups is committed to providing support every step of the way. In 2003, across the EMEA region, the BSA handled 57,625 calls, followed up 7,929 end user leads and took legal action against 9142 companies. Learn about the types of software piracy, its penalties and find all the tools you need to make a difference: Asset Management Resources, Guide to Software Management, Reasons to Fight Software Piracy, Online Shopping Tips and much more. If you've already thought through the issues and now wish to report a company that uses illegal software, you can do so anonymously through our Online Reporting Tool. (Don't forget, when an organization is prosecuted, it is the company directors who face legal action.) Report Piracy Now
Red Flag Rule, (Federal Trade Commission), require financial institutions and "creditors" with "covered accounts" to establish identity theft prevention programs to identify, detect and respond to patterns, practices or specific activities that could indicate a customer-account holder has been victimized by -- or is engaged in -- identity theft.
The Windows Security Center, (Microsoft Windows®), which is already installed on your computer, monitors and enables you to manage important security settings on your computer, including a firewall, automatic updates, and the status of your antivirus software.
Microsoft Windows® Service Pack 2 A free software update pack for Windows XP, which is the operating system of many home PCs. Microsoft Windows® Service Pack 2 is commonly known as SP2 is designed to fix several bugs and vulnerabilities in Windows XP simultaneously, and give your PC better protection from viruses and hackers. How to get SP2 Also view Microsoft Windows®
BitLocker Drive Encryption is the final feature release name for the project previously referred to as "Secure Startup Full Volume Encryption." Some preliminary releases of Windows Vista®, still use the old project name in text strings and Windows® titles. This step-by-step guide uses the old project name where appropriate, such as referring to the user interface where it appears. Otherwise, the feature release name is used.
WinErrs Did you ever get an Illegal Operation 'or' Page Fault' error message when using Microsoft Windows® and wonder what it meant? WinErrs is a database of 1.554 (Microsoft Windows®), error codes and their definitions. These codes are extracted directly from (Microsoft Windows®), and are their descriptions.
Apple Product Security Mac OS X Security Apple Security Updates page More Apple Links
Hoax-Slayer is dedicated to debunking email hoaxes, thwarting Internet scammers, combating spam, and educating web users about email and Internet security issues. Hoax-Slayer allows Internet users to check the veracity of common email hoaxes and aims to counteract criminal activity by publishing information about common types of Internet scams. Hoax-Slayer also includes anti-spam tips, computer and email security information, articles about true email forwards, and much more. New articles are added to the Hoax-Slayer website every week.
Secunia PSI (Personal Software Inspector) scans your computer for seriously outdated software products that have been discontinued or require critical security updates from the vendor.
CAPTCHA™ is a program that can generate and grade tests that most humans can pass, but current computer programs can't pass. For example, humans can read distorted text, but current computer programs usually can't read such distorted text. This may be useful to confirm emails are genuine and other basic Diagnostics and Security checking.
WebScarab is a Web Application Review tool. It sprang from the designs of the people inhabiting the WebAppSec list run from SourceForge, for a powerful, free, open tool for reviewing web applications for security vulnerabilities. Not much of the original design has actually been implemented as envisioned. WebScarab started as a spider that could download all the pages on a site. It stayed that way for almost a year, before I decided to take lessons learned during the development of Exodus and implement them as part of WebScarab.
OWASP project is a collection of related tasks that have a defined roadmap and team members. OWASP project leaders are responsible for defining the vision, roadmap, and tasks for the project. The project leader also promotes the project and builds the team. The Open Web Application Security Project (OWASP) is dedicated to finding and fighting the causes of insecure software. Everything here is free and open source. The OWASP Foundation is a 501c3 not-for-profit charitable organization that ensures the ongoing availability and support for our work. Participation in OWASP is free and open to all.
Security config Software to Protect your system.
Identity Finder - Freeware. Let us prove to you the power of our search capabilities for free. Simply download, install, and run the search. It will detect unprotected credit cards and passwords on your computer that are vulnerable to identity theft or fraud. Once found, you can permanently shred or encrypt the information with a password so identity thieves cannot steal them. Take the first step towards protecting your family, your employees, and your business; try Identity Finder today. Installation and removal are easy.
 |
PC Pitstop!  Is your PC acting sluggish? Are strange windows inexplicably popping up on your screen? Do you have to reboot your computer because of errors and lockups? Our free computer checkup and diagnostics can help you detect and fix many common computer problems! |
GetNetWise. Accessing the Internet through a broadband or high speed Internet connection at home really enhances the online experience. However, broadband users should take extra precautions to secure their computer and their computer files. The speed at which information can be transferred to and from your computer and the fact that it stays connected to the Internet for long periods of time makes your it a more likely target for hackers than dial-up Internet users. By taking some basic precautions and using a few simple tools, you can do your part to protect cyberspace from hackers. At the same time, you'll also protect your computer and your information from theft, misuse and destruction. GetNetWise Main page
Information Virtual Private Network (or VPN) is a secure network connection that is layered on top of the Internet. This type of connection is used to move secure data to and from corporate networks safely, minimising the chance of these systems being "hacked or abused".
Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. A free implementation of this protocol is available from the Massachusetts Institute of Technology. Kerberos is available in many commercial products as well.
SpoofStick is a simple browser add-on for Internet Explorer, that may help novice users to spot phishing scams that are linked from emails or web sites.
PhishFighting. Fight back and take down the Phishers. Enter phishers URL to Report it.
PhishGuard is a simple, FREE software service for computers running Microsoft operating systems (Windows 98 through XP) and any version of Microsoft Internet Explorer 4.0 or greater. PhishGuard harnesses the collective observations of Internet users to detect and rapidly disable Internet Phishing or Spoofing attacks designed to steal critical financial data.
Reporting Spam SpamCop parses reported email, sending warning information to the internet service provider responsible for hosting the services used by the spammer (web sites and email sending sites). SpamCop also uses the information to generate SpamCop's free blocking list. Unfortunately, this is an ongoing battle. Spammers adapt quickly and persistently. Report spam and help SpamCop turn the tide. SpamCop makes this otherwise slow and technical task quick and easy. The SpamCop reporting service is free. More...
What is "mole" reporting? SpamCop Mole reporting was an experiment that presented many problems in the operations and integrity of SpamCop, so is mostly being disabled. Reports from users who choose to be mole reporters will count only in the statistics and aggregate counts. Reports are not sent and can only be viewed by SpamCop administrators. Mole reports do not count in the stats used to determine listing and delisting of IP addresses in the SpamCop Blocking List. As spam defenses and spammers become more sophisticated, many smart spammers have developed very sophisticated defenses against being detected. One of the spammer's strategies is to quickly and effectively remove anyone from their mailing lists who files a spam complaint (until they want to get revenge, and then the use these "remove lists" differently). This is generally (although not always) good for the person filing the complaint, but it is bad for spam defense in general, since these activists are the only ones identifying the problem. By removing the "trouble makers", spammers too often slip "under the radar" and appear to be legitimate senders, even though the majority (or entirety) of the victims don't want the mail (they are just the ones who don't bother to make waves). More...
Cloud Computing is a somewhat nebulous word to describe that modern users will "rent" or borrow online software instead of actually purchasing and installing it on their home computers. It is the exact same idea as people using Gmail or Hotmail services, except that cloud computing goes much further than simple email. Cloud computing is where entire businesses and thousands of employees will run their computer tools as online rented products. All of the processing work and file saving will be done "in the cloud" of the Internet, and the users will plug into that cloud every day to do their computer work. It is said that Could Computer suppliers buy computer systems by the container load. This help reduce cost because of Economies of scale. Software as a Service (aka "Saas" or "SaS"). Platform as a Service (aka "PaaS" or "PaS") . Software and Platform.
Cloud Security Frame. Cloud Security Frame at Shaping Software. This frame is especially important because we’re using it to help us map out the Cloud security space for our patterns & practices Cloud Security Guidance project. It’s helps us scope our project. The frame is basically a set of Hot Spots. We use the Hot Spots to find, organize, and share principles, patterns, and practices. We also use the Hot Spots to find pain points and opportunity or to organize key engineering decisions.
The Security Development Lifecycle:- Jeremy Dallman here to let you know we published a couple of new interesting Microsoft SDL stories last week in an effort to continue demonstrating in a tangible and easy-to-read way how Microsoft teams implement the SDL. We hear about more companies investigating how they can integrate the Microsoft SDL into their software development process in order to ship more secure software. At Microsoft, we have been doing this for several years, but have only recently shared the stories behind how our product teams do the SDL (see SDL Publications – whitepapers). As Windows Internet Explorer 8 and the 2007 Microsoft Office System were publicly released, the security experts that guided those products through the full Security Development Lifecycle saw an opportunity to share some details about how each of these products executed on the SDL. They have written the stories of the SDL for each of these products. Internet Explorer 8 and the Security Development Lifecycle These papers can serve as a reference tool as you begin to think about the implementation of the SDL in your own software development lifecycle. The Microsoft SDL has been in place at Microsoft for almost six years and has demonstrated its effectiveness in improving software security. We hope that these papers along with the SDL Optimization Model, the Simplified Implementation of the Microsoft SDL whitepaper, and our other resources on the SDL portal will help you as you begin integrating the Microsoft SDL into your own software development process. If you are starting to think about adopting the SDL or already have created your own version of the SDL, we would love to hear from you! Feel free to either tell us in the Comments section of this post or email us directly. Adam Shostack here. I’m pleased to announce that at RSA this week, Microsoft is releasing Elevation of Privilege, the Threat Modeling Game. Elevation of Privilege is the easiest way to get started threat modeling. EoP is a card game for 3-6 players. Card decks are available at Microsoft’s RSA booth, or for download here. The deck contains 74 playing cards in 6 suits: one suit for each of the STRIDE threats (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service and Elevation of Privilege). Each card has a more specific threat on it. For example, here’s the 5 of Tampering. The threat is “an attacker can replay data without detection because your code doesn’t provide timestamps or sequence numbers.” Because we want everyone developing software to threat model, and there’s no better way to get people to do what you want than to ensure they have fun while doing it. Everyone in software draws diagrams. From pictures on napkins or whiteboards to DFDs, UML or other formalisms, everyone diagrams. When you’re done (all the cards have been played), count up the points, give the winner a pat on the back, and have someone file bugs. That may seem a little complex, but it’s pretty simple when you have cards in hand. There’s a video of me explaining the game here and of people playing on the launch page. There’s also a strategy card in the deck with a flowchart to help you decide what card to play. Right now! If you’re at RSA, come by the Microsoft booth, or download the cards here If you’re developing software, this is for you. We’d love to hear your feedback here, we’d love for you to blog about it, but most of all we’d love for you to play Elevation of Privilege. Once you have, we’d also like you to play with the idea of serious games for threat modeling and security. To help you get started, we’re making Elevation of Privilege available under a Creative Commons Attribution license which gives you freedom to share, adapt and remix the game. I want to thank Austin Hill of Akoha for introducing me to the wide field of serious games (see http://www.seriousgames.org/ or http://en.wikipedia.org/wiki/Serious_game for some more on the broad concept), and Laurie Williams of North Carolina State University for designing “Protection Poker,” which inspired me to design Elevation of Privilege. On Friday, the team at Microsoft that’s driving our End to End Trust initiative launched a new web site that provides an update on the End to End Trust vision for a more trustworthy and accountable Internet. The site’s launch was timed to precede Scott Charney’s keynote next Tuesday at the RSA Security Conference in San Francisco. The site will be updated later that day with a video of Scott’s keynote. One of the key components of the End to End Trust vision is what we refer to as “Security and Privacy Fundamentals” – the recognition that better authentication and accountability are only effective if the underlying computer systems are built to resist attack and the intrusion of unwanted software. At Microsoft, the way we build systems to resist attack is by implementing the SDL for any products or online services that expose our users to risk. The End to End Trust site includes several videos about the SDL and its role in End to End Trust, as well as links to details posted on the SDL web site. I’d encourage you to review the End to End Trust site, Scott’s video when it’s posted, and of course the SDL information on both the End to End Trust and SDL web sites. Steve Lipner Hi everyone, if you’re headed to RSA next week be sure to check out these sessions featuring SDL team members: Wednesday, March 3, 9:10 AM Katie Moussouris and Bryan Sullivan (A preview of this session is available as a podcast at https://365.rsaconference.com/blogs/podcast-series-rsa-conference-2010/2010/02/19/and-202-microsoft-sdl-tools-automating-the-security-development-lifecycle-pk-session.) Wednesday, March 3, 9:10 AM David Ladd, Eric Baize (EMC), Gary McGraw (Cigital), Richard Pethia (Carnegie Mellon University) Wednesday, March 3, 10:40 AM Katie Moussouris, Martin McKeay (Network Security Blog), Brad Arkin (Adobe Systems), Tim Stanley (Continental Airlines), Steve Dispensa (PhoneFactor), Michael Barrett (PayPal), HD Moore (The Metasploit Project) (A preview of Katie Moussouris speaking on the topic of Responsible Disclosure can be found at https://admin.secure.streamos.com/streamos/player/flv/?url=http://rsa.edgeboss.net/flash/rsa/rsaconference/2010/us/podcasts/rsac_02-03-10-hot-203-moussouris.mp3.) Thursday, March 4, 1:00 PM Adam Shostack and Danny Dhillon (EMC) Hi everyone, Bryan here. We’ve written here before about Casaba Security’s Watcher tool and how it can help you verify compliance with several of the SDL web application security requirements, such as: · User controlled open redirects · Insecure domain references in Silverlight client access policy files · Use of the Javascript eval method · More… I’m excited to report that Casaba has just released Watcher v1.3.0, which adds even more useful checks and also integrates with the SDL and MSF-A+SDL process templates. In addition, it can also tell you which of its checks map to SDL requirements. Watcher is available for free download on Codeplex, and Katie will be demonstrating Watcher during our presentation at RSA next week (AND-202: Microsoft SDL Tools: Automating the Security Development Lifecycle). Hi, Michael here, As you might be aware, a collaboration of industry experts and academia worked together on the CWE/SANS Top 25 Most Dangerous Programming Errors for a second year to define and describe the most significant programming errors that can lead to some of the most serious software vulnerabilities. As we did last year, Microsoft was involved helping define the CWE/SANS Top 25 for 2010. As the process to define the Top 25 started to draw to a close and the draft top 40 candidates were selected to be whittled down to 25, we decided, as we did in 2009, to see how the SDL processes and tasks map to the Top 25. As we expected, the SDL maps very nicely to the 2010 Top 25, just as it did in 2009. Every one of the Top 25 is covered by one or more SDL requirements, and most of them are also covered by an automated SDL verification tool or secure coding library. Even CWE 98, "PHP File Inclusion," is covered by the SDL in our required security training classes, which is especially remarkable when you consider that virtually no PHP code is written at Microsoft! The reason that we address issues like PHP file inclusion in the SDL is that we don't simply wait for new vulnerability taxonomies to be released and then rush to add mitigations to our security processes; rather, we structure the SDL to provide developers with fundamentally sound, secure programming practices. As a result, we cover not just the known vulnerabilities of today (like the Top 25) but also many of the unknown vulnerabilities that will be discovered tomorrow. The fact that all of the Top 25 are addressed by the SDL is a great validation, but it is the result of the content of our process and not the cause. CWE Title Education Manual Process Library, tool or code gen Fix? Threat Model 120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Y Y Y 129 Improper Validation of Array Index Y Y 131 Incorrect Calculation of Buffer Size Y Y 805 Buffer Access with Incorrect Length Value Y Y 209 Information Exposure Through an Error Message Y Y Y 754 Improper Check for Exceptional Conditions Y 22 Path Traversal Y Y 98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion') Y 434 Unrestricted File Upload Y Y 770 Allocation of Resources Without Limits or Throttling Y 78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') Y Y 79 Failure to Preserve Web Page Structure ('Cross site Scripting') Y Y Y 89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') Y Y Y 352 Cross Site Request Forgery (CSRF) Y Y 362 Race Condition Y 494 Download of Code Without Integrity Check Y 601 URL Redirection to Untrusted Site ('Open Redirect') Y Y 190 Integer Overflow or Wraparound Y Y 807 Reliance on Untrusted Inputs in a Security Decision Y 285 Improper Access Control (Authorization) Y Y Y 306 Missing Authentication for Critical Function Y 311 Missing Encryption of Sensitive Data Y 327 Use of a Broken or Risky Cryptographic Algorithm Y Y Y 732 Incorrect Permission Assignment for Critical Resource Y Y 798 Use of Hard coded Credentials Y A year ago, I wrote a short post about us banning memcpy in the SDL for new code. Well, I’m happy to announce that in VC++ 2010, we have made it much easier to remove potentially insecure calls to memcpy and replace them with more secure calls to memcpy_s; it’s automagic, just like we do did for other banned functions! As I said in a previous post, I am a huge fan of adding defenses to code automatically, and making such changes as easy as possible for software engineers, and this auto-migration is a great example. In short, if your code has a call to memcpy, and the compiler can determine the destination buffer size at compile time, the compiler will replace the call to memcpy with a call to memcpy_s. For example, if you compile the code below with: cl /D_CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES_MEMORY=1 foo.cpp #include <memory.h> int main() { int src[100]; memset(src, 12, src_size); const size_t dst_size_int = _countof(src); memcpy(dst, src, src_size); return 0; } You’ll see that the calls to memcpy are replaced with memcpy_s courtesy of this code in memory.h: #if defined(__cplusplus) && _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES_MEMORY extern "C++" { #ifndef _CRT_ENABLE_IF_DEFINED #define _CRT_ENABLE_IF_DEFINED template<bool _Enable, typename _Ty> struct _CrtEnableIf; template<typename _Ty> struct _CrtEnableIf<true, _Ty> { typedef _Ty _Type; }; #endif template <size_t _Size, typename _DstType> inline typename _CrtEnableIf<(_Size > 1), void *>::_Type __cdecl memcpy(_DstType (&_Dst)[_Size], _In_opt_bytecount_(_SrcSize) const void *_Src, _In_ size_t _SrcSize) _CRT_SECURE_CPP_NOTHROW { return memcpy_s(_Dst, _Size * sizeof(_DstType), _Src, _SrcSize) == 0 ? _Dst : 0; } } #endif Note that for this to work, you must define a preprocessor variable: _CRT_SECURE_CPP_OVERLOAD_STANDARD_NAMES_MEMORY = 1 This is another great example of why migrating your C++ code to Visual C++ 2010 can help improve the security of the code with virtually no engineering effort. (Big thanks to the C++ folks over in the Developer Division for getting this work done in time for VC++ 2010) - Michael The SDL pond may have seemed quiet over the holidays, but we have three new announcements we hope will make ripples for developers and organization who want to adopt the SDL. We are announcing three new releases at the Black Hat conference in Washington DC today: 1. a new white paper: Simplified Implementation of the Microsoft SDL 2. a new program: SDL Pro Network Tools category and new members 3. a new tool: MSF for Agile Software Development + SDL Process Template for VSTS 2008 Simplified SDL whitepaper First up is the release of the Simplified Implementation of the Microsoft SDL white paper. One of the common misconceptions about the Microsoft SDL is that you have to be an organization the size of Microsoft in order to be able to implement it. Another misconception is that the SDL is only appropriate for Microsoft languages and Microsoft platforms, and that you need to use some other methodology if you’re writing code with Ruby for OS X. The Simplified SDL white paper helps address these misconceptions by explaining how the SDL can be implemented with limited resources and applied to any platform. By outlining a minimum threshold that stays true to the core attributes of the SDL, this paper provides an effective model for building an effective security development lifecycle in any organization. SDL Pro Network Security Tools category and new members Our second announcement is the expansion of the SDL Pro Network to include a new category of membership, Tools, which will complement the existing Consulting and Training categories. Tools member organizations are able to deploy security tools such as static analysis tools, fuzzers, or dynamic and binary analysis tools. Security tooling is a critical piece of the SDL and we’re excited to have this new Pro Network category to help organizations use their tools and their time more effectively. We’re also announcing an expansion of the Pro Network to include seven new members: · Fortify (Tool Member) · Veracode (Tool Member) · Codenomicon (Tool Member) · Booz-Allen Hamilton (Consulting Member) · Casaba Security (Consulting Member) · Consult2Comply (Consulting Member) · Safelight Security Advisors (Training Member) We welcome our new members and hope you will consider them or our other Pro Network members for your security training, consulting, and tooling needs. MSF for Agile + SDL Process Template Last, but not least, we’re releasing the first public beta of the new MSF for Agile Software Development plus SDL Process Template for VSTS 2008, or “MSF-A+SDL” for short. Like the SDL Process Template we released last year, this template helps teams to integrate secure development processes directly into their Visual Studio Team System development environment. However, the MSF-A+SDL template is based on the new SDL-Agile process. MSF-A+SDL also has some completely new features from our previous SDL Process Template offering: · Automatic generation of SDL task work items for new iterations. Given that Agile projects can live forever (as in the case of web applications or cloud services with no defined “end date”), these projects need to periodically re-complete SDL requirements as defined in the SDL-Agile process. The MSF-A+SDL template accomplishes this by creating new security tasks for the project whenever a user adds a new iteration. · Automatic generation of SDL task work items for new code. Whenever new Visual Studio projects or web sites are checked into an MSF-A+SDL project’s source control repository, the template will generate new SDL requirements appropriate to that project. For example, if the user creates a new C# web site, the template will add requirements such as disabling ASP.NET tracing, and applying the AntiXss library. · Much more, that we’ll be posting about here soon If you’re attending Black Hat this week and would like to see MSF-A+SDL in person, come to Bryan’s talk “Agile Security; or, How to Defend Applications with Five-Day-Long Release Cycles” on Wednesday February 3 at 1:45. Just in case you missed them inline, here are some handy links: Simplified Implementation of the Microsoft SDL white paper MSF for Agile Software Development plus SDL Process Template for VSTS 2008 free download Jeremy Dallman here to tell you about some new security guidance papers we are releasing today. “My company was just attacked by something called SQL Injection! I have no idea what that is, or what I should do next! Where do I start?” Unfortunately, this is a frequent scenario for many developers and IT Pros who have just discovered their systems, websites or applications have been compromised. We’ve spoken to a number of people in the IT community who equate this to being tossed a parachute and thrown out of a plane into free-fall with no idea what to do next. These folks know the parachute will help them, but need a quick and easy way to find the D-Ring. Today we are releasing the first of a new type of security guidance paper. We are calling them “Quick Security References” (QSRs). A QSR is designed to provide the information necessary to quickly understand and address specific security threats from the perspectives of four IT-focused job roles (business decision makers, architect/program manager, developer, and tester). QSRs will also help establish security practices and provide a framework for addressing future incidents. For those familiar with the SDL Optimization Model, the guidance contained in a QSR is targeted at organizations that fall into the “Basic” level of organizational maturity. The first two QSRs focus on Cross-Site Scripting and SQL Injection. We chose these two topics since they represent the most common attack types a development or IT Pro team will encounter today. These papers were the result of some collaboration with some experts in both XSS and SQL Injection. I would like to thank each of them for sharing their knowledge and contributing to the paper. Acknowledgements: For the XSS paper: Contributors: Jeremiah Grossman, Robert Hansen, Gareth Heyes, Dennis Hurst, David Ladd, Eric Lawrence, Katie Moussouris, Billy Rios, David Ross, Bryan Sullivan, and Jeremy Dallman. For the SQL Injection paper: Author: Bala Neerumalla Contributors: Raul Garcia, David Ladd, Katie Moussouris, Bryan Sullivan, and Jeremy Dallman The QSR papers can be accessed from the SDL website or downloaded directly from the Microsoft Download Center. Hi, Michael here. Over the years, we have learned a great deal about the practical aspects of securing software; but two lessons that really stand out for me are: · You will never get the code perfect, so add defenses. · Make securing software as easy as possible for designers, developers and testers. Anyone following the SDL will realize that we spend a lot of time, research and effort adding defenses such as /GS, ASLR, NX and so on and then making them SDL requirements. Another SDL defensive requirement we added about two years ago, is to add the following to the startup code, usually main(), in native C or C++ code: BOOL f=HeapSetInformation(NULL, HeapEnableTerminationOnCorruption, NULL, 0); You can read more about this function and its security benefits in a blog post from February 2008. The problem with adding this code is you have to churn your code! Obviously, it’s not a big deal in this case, as the code diff is only one line long. Even though I’m a huge fan of defenses like this, we’re always looking for ways to make life as easy as possible for developers, and often that means changing the way we generate code or adding defenses to Windows. Now back to the subject of this post! Something we have added to VC++ 2010 beta 2 is an automatic call to HeapSetInformation() for all unmanaged C and C++ applications. I love this for two reasons: it’s a great defense that makes it harder for an attacker to successfully exploit a heap-based buffer overrun in your code, and it’s frictionless because there is nothing the developer needs to do other than compile the code with VC++ 2010 beta 2 or later! Later in the year I’ll write about some other defenses in VC++ 2010 . Michael The Information Security Tools (IST) team has released the InfoSec Assessment & Protection (A&P) Suite. It’s a suite made up of protection and assessment tools which include: Read more about the A&P suite here and watch the podcast, “Assessment and Protection Suite,” as Anil Revuru (RV) and Mark Curphey from Microsoft IST team discuss the future of this suite of tools. To download these tools for free, you will need to register on the Connect site. Once you’ve registered, you can download the tools below directly. Get the latest on the A&P Suite on the IST Blog. Download, A&P Suite will include: Hi everyone, Bryan here. There is a common misconception that because the SDL was originally created for Microsoft’s big showcase box products like Windows and SQL Server, that it only works for those kinds of products. This is of course patently false: virtually every Microsoft product and online service, large or small, follows the SDL. Many other organizations outside of Microsoft are also successfully implementing the SDL. However, while the content of the SDL – its requirements and recommendations – may be universal, the structure of the SDL as originally designed is more suited to long-running waterfall- or spiral-style development methodologies. Consider the classic “chevron” SDL graphic: As you can see, the SDL prescribes certain activities to take place during certain phases of the development lifecycle – threat modeling for example happens during the Design phase, and static analysis is performed during the Implementation phase. But not every development methodology has well-defined lifecycle phases like this. Specifically, Agile development methodologies do not have distinct phases and instead follow an iterative, time-boxed approach. How can the SDL be applied successfully in these environments? One solution might be to take all the SDL requirements and put them into the product backlog, then pull them into the active queue (aka the sprint backlog, if you’re using Scrum) just like any other user story. This might work adequately for box products with well-defined product lifecycles that use Agile; for example, the Visual Studio teams that follow Scrum would fall into this category. However, the majority of internal teams (and very likely the majority of all development teams outside Microsoft too) that follow Agile use it to build web applications. This is important because web applications often don’t have a defined “end”; they just keep building and growing indefinitely. If we put the SDL requirements into the product backlog, it might take a year or more for a team to complete them all, but all the features added to the product after that date would go unsecured. An alternative solution might be to just apply the entire SDL to every iteration. This would solve the problem of unsecured functionality being added after the SDL requirements have been completed, but it would create a whole new problem just as big, namely: how to complete all that SDL work in such a short amount of time! Per the Agile Manifesto, Agile projects should have short iterations, lasting from one month to a few weeks or less. There are online services teams here at Microsoft with one week long sprints. There’s no way these teams could complete the entire SDL in a sprint that short. And even if they could, there would be no time left to actually develop new features. Another alternative would be to pare back the SDL, to cut out the “unnecessary” SDL requirements and just complete a smaller, core subset of the SDL each iteration. Unfortunately, this approach is flawed too, because none of the SDL requirements are unnecessary. Every requirement has been proven to prevent vulnerabilities or to reduce the impact of a successful exploit. Leaving requirements out of Agile projects would jeopardize their security, and that’s simply not an acceptable solution. However, although none of these approaches solves the problem of adapting the SDL to Agile, that doesn’t mean the task is impossible. Over the last year, a team of security professionals throughout the Trustworthy Computing Security and Online Services Security & Compliance teams (including myself and Michael Howard from SDL) have worked to find a solution to the problem. Our resulting process has been in internal beta since the spring, has just recently released internally, and now I’m happy to announce that we’re releasing the details of the SDL for Agile Development Methodologies process today. In brief, SDL-Agile breaks the SDL into three categories of requirements: every-sprint requirements, the requirements so important that they must be completed every iteration; one-time requirements, the requirements that only have to be completed once per project no matter how long it runs; and bucket requirements, the requirements that still need to be completed regularly but are not so important that they need to be completed every sprint. Over and above the reorganization of requirements into a more Agile-friendly structure, SDL-Agile also provides guidance for adapting many of the core SDL activities to Agile. Threat modeling is a perfect example: a team could easily spend an entire week-long sprint performing threat modeling, but this may not be the best use of their time. SDL-Agile describes how a team can spend an appropriate amount of time modeling new features as well as how to build up a baseline of threat models for existing functionality. Instead of getting into an in-depth discussion of SDL-Agile in the limited space I have here, I ask that you download and read the complete SDL-Agile guidance here, included as part of the SDL 4.1a Process Guidance document. We believe we’ve developed a process that is faithful to both Agile and to SDL, in which teams can innovate and react quickly to changing customer needs but in which the products they create are still more resilient to attack. As always, we welcome your feedback. Hi everyone, Bryan here. I’m going to be presenting two sessions on the SDL next week, one for TechEd Europe and one for the Microsoft Platforma event in Moscow. If you’re attending either of these conferences, stop by and introduce yourself, or better yet stay for the session! SIA-205: SDL-Agile: Microsoft’s Approach to Security for Agile Projects Monday 11/9 9:00-10:15, Berlin 1 Hall 7-3a FF-206: The Microsoft Security Development Lifecycle Thursday 11/12 4:30-5:30, Red Congress-Hall Hope to see you there! Hi everyone, Bryan here. Earlier this week, Microsoft released the latest volume of the Security Intelligence Report (SIR), which covers the first half of 2009. There are many interesting statistics in this report, but there’s one that I’d like to draw particular attention to: the number of industry-wide reported vulnerabilities as broken down by OS vulns vs. browser vulns vs. application vulns. It is gratifying to see a sharp decline in the number of application vulnerabilities reported in the first half of 2009, but it’s important to note that they still make up the vast majority of vulns. Attackers are still largely focusing on the long tail of third-party applications. It’s more important than ever for all development shops, no matter how small, to bake security practices into their development lifecycles and ensure that their products don’t end up contributing to next year’s blue Application Vulnerabilities bar. Cory at Matasano has a new blog post explaining “Ninja threat modeling.” Ninja threat modeling is Matasano’s approach to threat modeling as part of a penetration test. I’m really happy that they’ve given their approach a name. A few years back, we would just talk about “threat modeling” and it got confusing. With that said, Adam here, and I wanted to offer up our perspective. I’ll do that by first comparing and contrasting the SDL and ninja approaches, and then respond to on some Cory’s impressions of the STRIDE-per-Element approach to threat modeling which we’re using in the SDL. There’s a lot to be said for giving your approach a cool name, and we love cool names too, like “The SDL Threat Modeling Tool.” How cool is that? Ok, ninja is much cooler. It seems from Cory’s post that Matasano’s customers are coming to them for security at the end of their process, rather than at the start. I think we all agree that threat modeling late produces less value. Here at Microsoft, we’ve invested in making it possible for any software engineer to threat model at the start of development. We’ve made enough progress in this that Forrester has said “Many application architects and developers don’t know enough about developing secure applications… Microsoft’s SDL Threat Modeling Tool is a unique new tool that helps developers identify and mitigate security risks to make applications more secure from the get-go.” (“Use Threat Modeling To Develop More-Secure Applications,” March, 2009.) I do think that we can map between the current SDL approach and the Ninja approach: Stage STRIDE/Element Ninja Model DFD App overview, data flow Identify Threats STRIDE/Element Assumptions, deadly sins Mitigate Redesign/standard/custom/accepted ? Validate Check model, all threats have bugs Test plan For a summary of their process, I looked at the boxed text “Ninja threat modeling at a glance.” I wish Cory had explained the approach a bit more: what’s the difference between an app overview and a data flow? Why are there 2 threat enumeration checklists (assumptions, deadly sins)? I think it might be interesting to combine the two threat enumerations. I also think that the risk management step could be formalized a bit more. So I’m glad that Matasano has a way to help you if you haven’t threat modeled. Our experience and observations over many, many years has shown that most people don’t want (or haven’t budgeted for) ninjas to drop into their process and slice up their design at the last minute. That’s why we’ve been sharing the SDL optimization model, building out the SDL Pro Network and sharing our approaches. We think that most people want to engineer a good and secure product from the start. We all need to work to make that easier, more predictable, and more effective. I also recognize that many organizations are not building security into their development processes yet. So it’s great to see Matasano think through what a threat model at the end of the dev process should look like, and share that thinking. I wanted to reply to one thing that Cory said: “It has spawned not just one, but two, Visio-driven toolsets from Microsoft and countless data-flow diagrams, attack trees, consulting engagements, and perplexed developers. When performed by a skilled and experienced team member, the model can be used to identify architectural weaknesses, guide default application behavior, and outline functional requirements for the product.” Cory’s right. We have two tools, and it’s confusing. We’ll be making that much clearer soon. Additionally, we’ve presented a lot of information about our many approaches over the years.Today, we have one authoritative site at microsoft.com/sdl which presents the most current guidance. We no longer use attack trees. We’re working hard to speak clearly. Is it working for you? Let us know what’s not clear. Yes, there are a lot of books and what-have-you that can’t be updated, but we aim to publish and maintain guidance on the SDL portal that is authoritative, current, and understandable. Kicking attack trees is sort of like commenting on the security of Win98: we’ve learned a lot since then. One of the most important things we’ve learned is that we needed to simplify the model, the approach, and the training, and we’ve done all three of those things. Having done those things, we’ve seen non-experts pick up the tool and create good threat models. We’ve heard from partners who are using the tool successfully, and we’ve received great feedback from analysts about efforts. None of which means we’re perfect. We’re still continuing to innovate with the aim of making the process better, and seeking the feedback from anyone who’s downloaded and applied our free tools and guidance. We’ve got some tricks up our sleeve, and while we don’t want to play them too close to the chest, we’re going to continue to innovate, and are glad to see a profusion of ideas for making things better. Finally, we work to share our experience. We’ve seen the STRIDE-per-element approach work for non-experts. We suggest you give it a try. But far more important than which approach you try is when you try it. Start early. Take a look at the optimization model. If you want some consulting help, go to one of our Pro Network partners or even to Matasano. If you have a few hours, experiment with both approaches and see which fits. But start early and find a threat modeling approach that helps you deliver more secure software. Pirates and script kiddies would prefer you just fuzzed.
The Security Development Lifecycle
What
Why
How
When
Who
Acknowledgements
AND-202: Microsoft SDL Tools: Automating the Security Development Lifecycle
EXP-202: Picking a Yardstick to Measure Your Software Security Practices
HOT-203: Responsible Disclosure: It’s Their Fault!
AND-304: Threat Modeling: Lessons Learned & Practical Ways to Improve Your Software
const size_t src_size = _countof(src) * sizeof(int);
int dst[dst_size_int];
Pirates are Way Cooler than Ninjas, but Engineering Got us to the Moon
![dd206731.ThreatModelingTool1(en-us)[1]](http://blogs.msdn.com/blogfiles/sdl/WindowsLiveWriter/Ninjasarecoolbutengineersbuildbridges_9F5D/dd206731.ThreatModelingTool1(en-us)%5B1%5D_2.jpg "dd206731.ThreatModelingTool1(en-us)[1]")
Ninjas and Engineers Agree: Threat Model
PayPal Support Club. Review and helpful links, coding examples, warnings, other shopping cart links, etc. PayPal is a on-link banking system that allows website owners to integrate shopping cart technology into their site. Find out more, includes links to helpful site about PayPal shopping cart technology. Report eBay spoof emails to spoof@ebay.com Report spoof PayPal emails to spoof@paypal.com
| Yoggie Internet Security Systems at CES 2009 | |
| Yoggie main website |
Hacktivism is the writing of code, or otherwise manipulating bits, to promote political ideology. Taking Lessig's message to heart, hacktivism believes that proper use of code will have leveraged effects similar to regular activism (or civil disobedience). Fewer people can write code, but code affects more people. myWiseOwl
PC WIZARD is a powerful utility designed especially for detection of hardware, but also some more analysis. It's able to identify a large scale of system components and supports the latest technologies and standards. This tool is periodically updated (usually once per month) in order to provide most accurate results.
CPU-Z is a freeware that gathers information on some of the main devices of your system. Name and number. Core stepping and process. Package. Core voltage. Internal and external clocks, clock multiplier. Supported instructions sets. All cache levels (location, size, speed, technology).
System Monitor. This software lets you keep your eye on system resource usages of your PC. It currently supports 27 kinds of information including CPU, Memory, Network, and detailed HDD usages.
Diag Plus Diagnose registry problems from DOS. From WindizUpdate (62NDS Solutions Ltd.) More Hardware links
AIM Encryption Certificate Generator You can use this tool to generate a security certificate file that you can import into AIM. You can then have encrypted conversations with any other member who also has imported a security certificate. The certificates produced by this tool are generated on demand, and no two certificates will share the same private key. This means that the certificates produced here are much more secure than the one certificate being mass distributed at AIM Encrypt - Free Security Certificate for AIM
AIM Encrypt - Free Security Certificate for AIM! Encryption certificate. Why do I want AIM Security? AIM is known to not have the best security, or any for that matter. If someone on your network is using a "packet sniffer" or other type of traffic analyzing tool they can see your AIM conversations and read them word for word. AIM Security using SSL Certificates makes your conversation appear much like trash to anyone analyzing what you type much like "Sw43jg73js7HSkg8Skeq3k65" instead of "Hello Friend". This certificate encodes the message so only the sender and the receiver can read the message. But still please use common sense and don't send credit card numbers, etc. over IM, this should only make you about "this" much safer on the internet, and make you feel cool having a padlock next to your name
SSL, Secure Socket Layer. This is a system used to protect secure information, for example credit card, bank account details, etc. Most sites that use this system will have URL's that start with https:// ,( note the "s" ), instead of the normal unprotected http://
The sites that use SSL, Secure Socket Layer may also display a small padlock image in the Task Bar. You should not send private or sensitive information of any type without using the SSL, Secure Socket Layer method.
The Secure Sockets Layer protects data transferred by using encryption enabled by a server's SSL Certificate. Uses a public key and a private key. A public key is used to encrypt, ( note that some systems may have different levels of encryption but this should not be any less than 128 bit encryption ), information and a private key is used to decipher it. When a browser points to a secured domain https://, a SSL handshake authenticates the server and the client and establishes an encryption method and a unique session key.
The GNU Privacy Guard. GnuPG is a complete and free replacement for PGP. Because it does not use the patented IDEA algorithm, it can be used without any restrictions. GnuPG is a RFC2440 (OpenPGP) compliant application.
OpenPGP is the most widely used email encryption standard in the world. It is defined by the OpenPGP Working Group of the Internet Engineering Task Force (IETF) Proposed Standard RFC 2440. The OpenPGP standard was originally derived from PGP (Pretty Good Privacy), first created by Phil Zimmermann in 1991.
OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, full-featured, and Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL toolkit and its related documentation.
SSL 3.0 specification, Netscape.
Get Safe Online will help you protect yourself against internet threats. The site is sponsored by government and leading businesses working together to provide a free, public service.
Bank Safe Online sets out simple steps you can take to help keep safe online. We also provide you with updates on the latest scams, and enable you to report any suspicious emails or websites to us direct.
Advanced WindowsCare Repair and fix windows with 1-click. Slow down, freeze and blue-screen crash are over. Advanced WindowsCare thoroughly examines the Windows system, accurately detects the bottlenecks for slowing down and crashing, fixes these problems and repairs Windows. All work will be done with 30 seconds and 1 click. The intuitive interface makes Advanced WindowsCare the perfect tool for Non-IT professionals
Free Internet Window Washer is a free privacy cleaner to remove internet tracks and computer activities. It can erase Window®:s temp folders, run history, search history, recent documents, browser's cache, cookies, history, typed URLs, autocomplete memory, index.dat files, and more. You can also easily erase the tracks of up to 100 popular applications. It also provides you option to clean the data more securely so that they could not be recovered.
Home Office Identity Fraud Steering Committee What is Identity theft? Your identity and personal information are valuable. Criminals can find out your personal details and use them to open bank accounts and get credit cards, loans, state benefits and documents such as passports and driving licenses in your name.
CIFAS, (Credit Industry Fraud Avoidance Scheme), the UK's Fraud Prevention Service. CIFAS is a not for profit membership association solely dedicated to the prevention of financial crime. CIFAS provides a range of fraud prevention services to its members, including a fraud avoidance system used by the majority of the UK's financial services companies.
Card Watch raises awareness about all types of plastic card fraud in the UK, and provides information to prevent fraudulent use of credit cards, debit cards, cheque guarantee cards and charge cards.
The Council of Better Business Bureaus and BBB OnLine Complaint System. The BBB does not take sides in a dispute. The BBB works to facilitate communication between the company and the consumer, to help both sides come to a satisfactory resolution to the complaint. In many cases, dispute resolution, including mediation and arbitration, may be available to help resolve the dispute.
The European Telecommunications Resilience and Recovery Association (ETRA) is a European forum for discussion, debate and information. Based in the UK it aims to extend understanding of the relationship between telecommunications, information assurance, security, disaster management and corporate governance.
WARPs (Warning Advice and Reporting Points). WARPs are part of the Centre for the Protection of National Infrastructure Security information sharing strategy to help combat the increasing risk of electronic attack on our information systems.
Center for the Protection of National Infrastructure. Information sharing strategy to help combat the increasing risk of electronic attack on our information systems.
Securityvulns Computer Security Vulnerabilities. Reports on Vulnerabilities in software and hardware:- securityvulns.com vulnerabilities newsline
Iirongeek. Adrian Crenshaw's Information Security site (along with a bit about weightlifting and other things that strike my fancy). Articles and tutorials.
CERT® Coordination Center (CERT/CC) is a center of Internet security expertise, located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.
The National High Tech Crime Unit:- National unit formed in April 2001 comprising personnel from the National Crime Squad, the NCIS, and from HM Customs & Excise. It works in conjunction with computer crime units in UK police forces.
National crimes quad police UK The National Crime Squad works at the heart of tackling serious and organised crime.
Computer Crime and Internet-Related Crime The Metropolitan Police Service.
National Crime Prevention Council's (NCPC) mission is to prevent crime and build safer, more caring communities.
Terrorist Activity Report Them Here (FBI) Federal Bureau of Investigation. Stop and report terrorists United States of America
CRIMESTOPPERS United Kingdom. Call anonymously with information about crime.
MI5 the official website of the UK Security Service (MI5) are responsible for protecting against threats to United Kingdom National Security, such as terrorism and international terrorism. If you know something about a threat to National Security. STOP and report terrorists.
Blocking Unwanted Parasites with a Hosts File and other security tips.
Fraud:- Attention Footie fans! Following discussions with the European Commission FIFA has agreed to accept more ticket payment methods in the next stages of ticket allocation for the 2006 World Cup in Germany. Watch out for the latest scam - an e-mail that pretends to come from FIFA, telling you that you've got a ticket to the World Cup. It carries a mass-mailing worm. The advice, as always, is not to open attachments in such e-mails, (use anti-spam software), and to ensure that your
Anti-Virus Software Tools & Utilities protection is up to date.
SPIM & SPIT (SPIM, SPam using Instant Messaging), is another new spamming technique, the difference in this case being that the spam is delivered through Instant Messaging rather than email. It's not as common as email spam. According to a report from Ferris Research, 500 million IM spam were sent in 2003, twice the level of 2002. As it becomes more common, spim could affect businesses in the same way that email spam does now, creating security problems and costing time and money. SPIM stands for Spam over Internet Telephony. It's essentially like spam email, only rather than getting unwanted messages in your inbox, they're left on your voicemail. It can happen if you're using a phone connected to the Internet, something more and more people are choosing to do. VoIP, ( Voice over Internet Protocol ), addresses or may hack into a computer used to route VoIP calls. And, because calls routed over IP are much more difficult to trace, there's a far greater potential for fraud.
Yahoo Security information and advice
Yahoo Hacking. Social Engineering, Phishing information (Faux is a French work used to describe something made to resemble something else. The original French word means false, fake, imitation or artificial.)
Yahoo Reporting Password Scams
Free PC Scan
PC Security Software PCSecurityShield. Protection Range. Anti-virus, Firewall, Privacy Defender, Spam Shield, Popup Blocker, Delete files PERMANENTLY, etc...
Department of Trade and Industry Notes
SiteAdvisor. We test the Web to help keep you safe from spyware, spam, viruses and online scams.
APNIC Spammers & hackers : Using the APNIC Whois Database to find their network | Spam | Hacking
!exploitable, (pronounced "bang exploitable") Crash Analyzer, (!exploitable Crash Analyzer - MSEC Debugger Extensions). A plugin for the
Windows Debugger that parses your crash logs and gives you two important pieces of information. First, it will collate all of your crashes and determine exactly how many there actually are. So for example, out of 60 crash reports, there may only be 2 or 3 actual problems. The second thing it does is look at the type of crash and try to determine if the error is something that could be exploited by a malicious hacker. This means that more junior employees can work these bug issues without taking the time of more senior examiners.
More Microsoft Windows Links.
Web Master Tools and Utilities
Scurity wonks.org Forum
Alliance of Security Analysis Professionals (ASAP).
Keylogger Hunter - Detects Keyboard Monitoring Programs
Help maximize your security with the Internet Explorer High Encryption Pack. UBCD4Win Bootable CD Repair/Restore/Diagnose etc for Windows®.
DomainKeys: Proving and Protecting Email Sender Identity (Information by Yahoo) Email spoofing, (and Phishing) - the forging of another person's or company's email address to get users to trust and open a message - is one of the biggest challenges facing both the Internet community and anti-spam technologists today. Without sender authentication, verification, and traceability, email providers can never know for certain if a message is legitimate or forged and will therefore have to continually make educated guesses on behalf of their users on what to deliver, what to block, and what to quarantine, in the pursuit of the best possible user experience.
Net Tools
is a comprehensive set of host monitoring, network scanning, security,
administration tools and much more, all with a highly intuitive user
interface. It's an ideal tool for those who work in the network security,
administration, training, internet forensics or law enforcement internet
crimes fields. Phishing. A lot of Major banks, Credit Card operators, e-Commerce Sites, Visa, PayPal, (PayPal Support Club), and eBay, (also many other websites), have suffer from Phishing. This is where people were directed to a fraudulent website that is identical to the companies' sites in the hope that they will supply details so they can be used illegally. Anti-Phishing Working Group - Committed to wiping out Internet scams and fraud. Phishing Report The Phish Report Network (PRN) was established to address the growing problem of phishing. As the industry's first anti-phishing aggregation service, PRN enables companies to better protect consumers against online fraud.
Know your Enemy: Phishing Behind the Scenes of Phishing Attacks. The Honeynet Project & Research Alliance. FireFox Browser A Mozilla project, empowers you to browse faster, more safely and more efficiently than with any other browser.
Internet Watch Foundation Site Index (Legal issues. Reports illegal and offensive Internet Issues.)
SafeSurf Creating a Safe Internet Without Censorship Help Us Accomplish This Goal.
EFF is a nonprofit group of passionate people
& lawyers, volunteers, and visionaries working to protect your digital rights.
Copyscape Search for copies of your page on the Web. Defend your site a against plagiarism.
Rules for Uniform Domain Name Dispute Resolution Policy (the "Rules") (As Approved by ICANN on October 24, 1999)
Domain Name Transfer's ICANN Inter-Registrar Transfer Policy.
UKReg Domain Name Dispute Policy
Nominet Disputes account all registrations in the .uk Top Level Domains.
Domain Name law (Sedo)
eSecurity4Britain Inform, educate and provide protective measures to ensure small businesses can use the internet to operate their businesses - with security.
7Safe is an Information Security services firm offering a diverse portfolio of services including security training & certification, penetration testing, computer forensics and risk management (including BS 7799).
Police United Kingdom UK Police Service portal.
Ofcom
is the independent regulator and competition authority for the UK communications industries, with responsibilities across television, radio, telecommunications and wireless communications services.
Check premium rate numbers
ICSTIS, Independent Committee for the Supervision of Standards of the Telephone Information Services- the premium rate services regulator.
Also view our Scams and hoaxes. Fraud warnings. Virus Attacks. SquareTrade eBay User Support. Trouble with a transaction? SquareTrade can help you resolve issues independently or through professional mediation.
Federal Trade Commission - As part of an international group of consumer protection agencies, the FTC monitors an online complaint site called econsumers.gov. Although they do not resolve individual consumer problems, complaints are used to help investigate fraud, and can lead to law enforcement action.
National Fraud Information Center - The NFIC helps consumers distinguish between legitimate and fraudulent promotions in cyberspace and route reports of suspected fraud to the appropriate law enforcement agencies.
Mobile Industry Crime Action Forum.
An organisation set up by the United Kingdom mobile telecommunications industry, including mobile handset manufacturers, to address the issues of mobile phone theft.
Security Focus Magazine (Phishing Forensics)
Federal Trade Commission (Anti-Phishing)
Better Business Bureau (Anti-Phishing)
Patents: Commission proposes rules for inventions using software
Wireless Security Issues from our page WAP, WML, Wireless Markup Language, Wireless links, Wi-Fi, BlueTooth, PixeCode, PDF414, Semacode, Datamatrix, radio links.
Safe Options Safe Options is the UK's leading online security store. Buy Safes, Lockers, Convex Mirrors and Key Cabinets online from our UK security store. We supply fire safes and security safes to both Business and Home Safe Users Buy Safes on 30 Day terms - available for recognised UK institutions FREE DELIVERY OF SAFES and LOCKERS ON THE UK MAINLAND* (*Ground Floor with easy access except N.Ireland and Islands)
Homeland
Security Threat Monitor (United States of
America). A small Windows application that runs in your system tray, showing the
current terrorism threat level. It periodically checks to make sure the
information is up to date by contacting the Department
of Homeland Security web server. Establish an emergency
preparedness kit and emergency
plan for themselves and their family, and stay informed about what to do
during an emergency.
The Open Web Application Security Project released a helpful document that lists what they think are the top ten security vulnerabilities in web applications.
Host Files. You can begin blocking ads and help keep yourself from being tracked by using the Hosts file with Windows and other operating systems.
Microsoft Diagnostics and Recovery Toolset. 30 day evaluation of the Microsoft Diagnostics and Recovery Toolset. This product provides powerful, intuitive tools that help administrators recover PCs that have become unusable, and easily identify root causes of system issues. This toolset is part of the Microsoft Desktop Optimization Pack.
eBay Help about how to spot a Spoof emails
Reporting eBay Account Theft, If you feel your account has been compromised, please report it.
New PayPal phishing scam uncovered The email, which purports to come PayPal, claims that the recipient's account has been the subject of fraudulent activity. However, unlike normal Phishing emails, there is no internet link or response address. Instead, the email directs the recipient to call a phone number and verify their details. When dialled, users are greeted by an automated voice saying: "Welcome to account verification. Please type your 16 digit card number." Once the credit card details are entered, the scammer is free to steal the credit information for their own use. Spyware analysts SophosLabs are warning users not to respond to the email. Graham Cluley, senior technology consultant at Sophos said "Though it's an American telephone number, the fact that PayPal is used globally means that anyone could potentially be tricked into making the call." More SpyWare Removal Links.
PayPal Support Club. Review and helpful links, coding examples, warnings, other shopping cart links, etc. PayPal is a on-link banking system that allows website owners to integrate shopping cart technology into their site. Find out more, includes links to helpful site about PayPal shopping cart technology.
Freenet is free software which lets you anonymously share files, browse and publish "freesites" (web sites accessible only through Freenet) and chat on forums, without fear of censorship. Freenet is decentralised to make it less vulnerable to attack, and if used in "darknet" mode, where users only connect to their friends, is very difficult to detect.
Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which enable malicious attackers to inject, client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy. Their impact may range from a petty nuisance to a significant security risk, depending on the sensitivity of the data handled by the vulnerable site, and the nature of any security mitigations implemented by site owner.
Also read Methods of Internet adverting
Click Fraud Protection and Click Fraud Security
Scams and hoaxes. Fraud warnings. Virus Attacks
Backup/File Compression Data Recovery
Protect your Usernames and passwords. Protect your system
Disaster Recovery Planning. (Also Undelete Files) So how good is your Disaster Recovery Planning?
Anti-Virus Software Tools & Utilities
Web Master Tools and Utilities
Forums. Computing Forums. Webmaster Forums, Programming Forums
Terrorist Activity Report Them Here (FBI) Federal Bureau of Investigation. Stop and report terrorists United States of America
CRIMESTOPPERS United Kingdom. Call anonymously with information about crime.
MI5 the official website of the UK Security Service (MI5) are responsible for protecting against threats to United Kingdom National Security, such as terrorism and international terrorism. If you know something about a threat to National Security, STOP and report terrorists.
Police United Kingdom UK Police Service portal.
Securityvulns news channel
Windows Registry Repair
http://www.icann.org/udrp/udrp-rules-24oct99.htm or http://www.icann.org/udrp/udrp-rules-24oct99.htm
A Computer Portal. Freeware, Shareware. Download software. Computer languages and Programming code. Including PERL Scripts and Java Scripts. Webmaster Tools. Internet Marketing, Website promotion. Hardware Help from BIOS to Windows and UNIX.
® © ™ are owned by respective authors and websites. There may be a charge for some software. Google™ is a trademark of Google Inc, These pages are not endorsed by Google or any other Company
