Security Balance

Just a quick note to say I’ve just heard that I’m now PCI QSA certified. Nice
(the test is really easy, actually…open book :-O)

So we are finally approaching the BH/Defcon weeks, when all the new stuff is presented to the security world and the sky starts to fall once more. I’m not going to Vegas this year (I’d love to), but as I came back to work on vulnerability assessments and penetration testing I noticed the main issue [...]

The PVLAN concept allows you to design a VLAN where the peers can communicate only with one (or more) specific peer, instead of full “n to n’ connectivity.
Now, why I’m not seeing people using that to deploy more secure DMZs (or simply zones)? I mean, if you’ll place a web server, a SMTP server and a [...]

I really promised to myself that I would avoid “look at this post from X” posts here. But today is Friday and I’ve just read something that was so perfectly written and fun that I will break that promise:
Read this, from Gunnar Peterson!

Congrats for Andrew Hay on getting his CISSP. He does a great job when describing the value of this certification:
“Due to the scope of the exam I forced myself to learn aspects of security that I had neither the reason, nor the desire, to understand. I feel that I have grown as a security professional [...]

Today I read about this VMWare vulnerability on Beaker’s blog. It is related to the possibility of a non-admin user on the host OS to execute code on the guest OS. I read the details of the vulnerability and I understand why VMWare is saying that the described behavior is by design, and can also see [...]

I’m trying to finish my Master dissertation on the next months. In order to do that I need to test the log analysis methodology I’m proposing. The methodology is targeted to detect insider attacks, so I need to collect logs from internal resources, which include AD domain controllers, internal e-mail systems, file and folder access [...]

A few years ago, it would be impossible to imagine something like what Dan Kaminsky has done with the recently uncovered DNS cache poisoning vulnerability. Although the technical details of the issue are still not public (and are probably “wicked cool”, 3117, etc), the mosr impressive fact of the whole story is that there was [...]

I was reading the post from Hoff where he writes about virtualization and the DMZ, based on a white paper from VMware. I’ve been reading Hoff’s posts (and others with whom he discusses the subject) about virtualization and I thought it would be interesting to also right a little about it.
There is a lot of [...]