Dennis Fisher

The cost of computer crime and vandalism is rising rapidly, as is the number of incidents occurring each year. Fully 85 percent of the respondents to the Computer Security Institutes annual Computer Crime and Security Survey reported detecting a security breach during 2001. And the cost to the respondents who could quantify their losses was […]

More than 15 percent of all of the SSL servers in the U.S. are using unnecessarily short RSA keys that are in danger of comprise, potentially threatening all of the data flowing to and from those servers, according to a new white paper due to be published next week. The paper, written by Nicko van […]

The Electronic Privacy Information Center earlier this week sued Tom Ridge and the Office of Homeland Security for access to documents related to the development of a national identification card program. The suit arose from a request that EPIC made under the Freedom of Information Act for copies of any material concerning the national ID […]

Sanctum Inc. this week unveiled the latest version of its AppShield application firewall, adding several new features, including a rapid-deployment tool and a set of templates with predetermined security settings. The new features in AppShield 4.0 are the result of feedback from customers who suggested ways that the company could improve the product, said Peggy […]

A well-known security researcher has released an advisory about–and exploit code for–two new unpatched flaws in portions of Microsoft Corp.s Office XP application suite. The two bugs are closely related and, if used in concert, could enable an attacker to gain complete control over a vulnerable machine. The first vulnerability is a problem with the […]

With last weeks acquisition of Digital Signature Trust Co. by Identrus LLC, the possibility of a standard, secure payment and authentication system for banking and financial services moved a big step closer to reality. DST, jointly owned by Zions Bancorporation and the American Bankers Association, operates a managed digital certificate service for secure online transactions […]

Network Associates Inc.s McAfee Security division on Monday unveiled a new scanning tool designed specifically to find network vulnerabilities that viruses and worms might be able to exploit. Known as ThreatScan, the software works in conjunction with the companys existing ePolicy Orchestrator management console and can perform scans of any network-attached device. ThreatScan works much […]

A newly discovered flaw in the way that Internet Explorer handles Web site cookies could enable an attacker to view and edit a users personal data contained in the cookies. The vulnerability affects all versions of IE but is mitigated by several factors, according to a bulletin released Thursday by Microsoft Corp. Under normal operation, […]

The Electronic Privacy Information Center won another round this week in its ongoing battle with the FBI over access to records pertaining to the Carnivore surveillance system. A federal judge has ruled that the nearly 2,000 pages of documents the bureau produced in response to EPICs request under the Freedom of Information Act likely dont […]

There is a growing debate in the cryptography community over whether the cryptographic keys used in dozens of applications should be considered compromised in light of a recent paper detailing a more efficient way of factoring large numbers. On one side are security and cryptography enthusiasts—professionals and amateurs alike—who believe that the technique, described in […]

One day after McAfee.com Corp. rejected its exchange offer, security vendor Network Associates Inc. on Tuesday revealed that it is the subject of a formal investigation by the Securities and Exchange Commission. The SEC on Friday informed the company that it has begun an inquiry into NAIs accounting practices during the 2000 fiscal year. As […]

The future looks increasingly murky for a document that many in the security industry hoped could help bring some order to the chaotic process of disclosing security vulnerabilities. The document, “Responsible Disclosure Process,” was withdrawn last week from consideration by the Internet Engineering Task Force by its authors, Chris Wysopal, director of research and development […]