The Register reports on the ‘new’ marching orders from the WH to gov’t IT.

In response to this week’s data breach at the US Office of Personnel Management, the White House has ordered federal agencies to immediately deploy state-of-the-art anti-hacker defenses – things like installing security patches, and not giving everyone the admin password.

I shake my head.

1. Install software patches for critical vulnerabilities “without delay.”
2. Use antivirus and check log files for “indicators” of malware infection or intrusion.
3. Start using two-factor authentication.
4. Slash the number of people with administrator-level access and limit what they can do and for how long per-login-session, and “ensure that privileged user activities are logged and that such logs are reviewed regularly.”

Can anyone in IT tell me why 1,2 and 4 are not standard operating procedure?
I’ll give them a break on 3, because 2 factor id is a tough nut. User + machine, user + user, user + IP, user + BYOD, etc can be difficult to integrate into a system.
I have some sympathy, though. You know how this happens? Every title needs a local wireless printer, cause, status. Then the users complain cause they can’t send email from their iPhone. And, “why can’t I use my Samsung tablet instead of that dirty old desktop?” “What do you mean the systems are going down for a restart? We can’t do that!” And pretty soon IT is just saying, “Screw it, I’m not going to bother fighting with senior management over what they see as nothing.” And you have a zillion holes in your perimeter.
How’s your networks perimeter? Have you chosen convenience over security?

According to a GMI poll, Brazilians don’t trust people with their data. That’s wise.

Some 76 percent of the consumers polled by GMI on behalf of Fortinet have concerns over how companies are looking after their details in the event of a possible data leak.

Look at the Top 30 Targetted High-Risk Vulnerabilities as identified by US, CAN, UK, NZ and AUS cyber security organizations.
A healthy lack of faith in corporate security isn’t enough. Two-stage identification vastly improves online security.

However, when it comes to what consumers are doing to protect their own information, some 81 percent mentioned they had adopted some form of improved security measure such as better passwords, but were not aware of other ways of boosting data security, such as two-factor authentication.

Two-stage identification is such that not only the user, but the machine is authenticated as well, and if a user connects via a previously unidentified computer the user is contacted (email, text message, what have you) for permission to allow that computer access to your accounts.
You should definitely set up 2-stage id for any online account that you use.
(Crossposted from my place)

You FREAK, we FREAK, we all FREAK.
Chrome, Android, and an MS Security Advisory.
Also Apple products.

“I have a router between the Internet and my computer, I don’t need a dedicated firewall.” – Said lots of people who don’t believe in defence in depth and should know better.
D-Link addresses home router vulnerabilities.
So, if you’ve got a model listed you’ll need to patch the firmware when your version is released.