Application scanning companies tackle Web 2.0 threats

Chenxi Wang

On Monday, March 23, 2009, HP’s Application Security Center announced the release of a free tool, SWFScan, designed to analyze security vulnerabilities in applications using Adobe Flash.

A few months earlier, IBM Rational announced the availability of their scanning/testing capability against Adobe Flash objects, which is a new addition to their AppScan 7.8 release on January 13, 2009.

For those who are not familiar with Adobe Flash, Flash is a multimedia platform that allows better processing of graphics, animation, special efforts, and bi-directional video streaming. Many websites that have rich interactive content or multimedia content use Flash as an underlying technology.

Read more

What would you do if you knew your network only had a week to live?

Crank-defib 
 

Read more

Categories:

Data Toxicology

As most Forrester customers know, data security has rocketed to the top of the list of CISO priorities for 2009, even considering the down economy. Our Business Data Services group has published some excellent quantitative research on this subject, which we've summarized in report form for Forrester customers. I refer you to Jonathan Penn's excellent The State of Enterprise Security 2008 to 2009 for more details. But for those of you who want the sound bite, 90% of CISOs said that data security was either "important" or "very important" on their proirity lists for this year. That trumped disaster recovery, identity and access management and regulatory compliance.

Read more

Lost Laptops Get the Press; Server Breaches Cause More Stress

In the next few weeks, Forrester Research will release my report, Forrester TechRadar: Database and Server Data Security, Q1 2009. In this report, we describe how the risks of theft, corruption and abuse has made securing data stored on servers and in databases much harder. To help security and risk professionals plan their next decade of investments in server data security, the report describes current and future state of 8 important technologies: centralized key management, data classifiers for security, data discovery scanners, data obscurity tools, database activity monitoring, database encryption, outbound web application filtering, and tape and backup encryption.

As part of the process of researching some of the business drivers for this report, I analyzed data from DataLossDB, a public database containing information on data loss events reported in the press and to governmental organizations as required by various disclosure laws. The data makes for fascinating study, and I urge our readers to take a look at it if they want to see what's been going on in the whole area of data breaches. Best of all, I know some of the principals involved in the project, and they are doing a terrific job.

Some of the analysis nuggets we mined from the database are fascinating. I thought I'd share one here, as excerpted from the report:

Read more