ComputerWorldIndependent

IDG Contributor Network: Dealing with NIST's about-face on password complexity

Credit to Author: Sandra Henry-Stocker| Date: Mon, 05 Jun 2017 11:13:00 -0700

In the last few years, we’ve been seeing some significant changes in the suggestions that security experts are making for password security. While previous guidance increasingly pushed complexity in terms of password length, the mix of characters used, controls over password reuse, and forced periodic changes, specialists have been questioning whether making passwords complex wasn’t actually working against security concerns rather than promoting them.

Security specialists have also argued that forcing complexity down users’ throats has led to them writing passwords down or forgetting them and having to get them reset. They argued that replacing a password character with a digit or an uppercase character might make a password look complicated, but does not actually make it any less vulnerable to compromise. In fact, when users are forced to include a variety of characters in their passwords, they generally do so in very predictable ways. Instead of “password”, they might use “Passw0rd” or even “P4ssw0rd!”, but the variations don’t make the passwords significantly less guessable. People are just not very good at generating anything that’s truly random.

To read this article in full or to leave a comment, please click here

Read More
FortinetSecurity

Join Fortinet at HPE Discover 2017!

Credit to Author: Neil Prasad| Date: Mon, 05 Jun 2017 08:22:22 -0700

Fortinet is a Gold sponsor at Discover 2017, and will showcase several important security innovations to help you stay ahead of cyber threats. Join Fortinet at booth 231 while you’re at Discover 2017 to see a demo of the Fortinet Security Fabric in action! We’ll also have technical experts on hand to discuss any security needs you ma A key focus area for many attendees will be cybersecurity, given the challenges they face from today’s sophisticated and rapidly evolving threats. The isolated, proprietary security devices most organizations…

Read More
FortinetSecurity

Governmental Entities Bringing Financial Cybersecurity to Center Stage

Credit to Author: Bill Hogan| Date: Mon, 05 Jun 2017 08:20:49 -0700

By now, it’s no secret that cybercriminals have targeted, and continue to target, the financial services industry with advanced attacks that are designed to steal or otherwise jeopardize valuable data. As a result, many organizations have taken at least some initial steps to better secure their networks and the information that lives within them. In fact, according to Duff & Phelps’ “Global Regulatory Outlook,” 86 percent of professionals in the financial services industry say their companies have plans to put more…

Read More
MalwareBytesSecurity

Interview with a malware hunter: Pieter Arntz

Credit to Author: Wendy Zamora| Date: Mon, 05 Jun 2017 14:00:26 +0000

Welcome to our new series: interview with a malware hunter. In these Q&A sessions, we’ll take you behind the scenes to get to know our malware intelligence crew.

Categories:

Tags:

(Read more…)

The post Interview with a malware hunter: Pieter Arntz appeared first on Malwarebytes Labs.

Read More
QuickHealSecurity

Watch out for Android Ransomware – It’s rising!

Credit to Author: Rajib Singha| Date: Mon, 05 Jun 2017 12:39:16 +0000

It’s not only PC ransomware that you should be worrying about. Android ransomware too is on the rise… Android ransomware has grown by 200% according to the study done by Quick Heal Security Labs for its Q1 Threat Report. Click here to read the full report Android ransomware work in…

The post Watch out for Android Ransomware – It’s rising! appeared first on Quick Heal Technologies Security Blog | Latest computer security news, tips, and advice.

Read More
FortinetSecurity

An Inside Look at CVE-2017-0199 – HTA and Scriptlet File Handler Vulnerability

Credit to Author: Wayne Chin Yick Low| Date: Sun, 04 Jun 2017 18:52:30 -0700

FortiGuard Labs recently came across a new strain of samples exploiting the CVE-2017-0199 vulnerability. This vulnerability was fixed by Microsoft and the patch was released in April 2017. Due to its simplicity, it can be easily exploited by attackers. It has also been found in-the-wild by other vendors. We have also blogged about some samples recently found in spear phishing attack. While there are plenty of articles discussing this vulnerability, most of them are intended for technical readers and primarily focus on how to create proof-of-concept…

Read More