Cloud Security Alliance Releases Update to Software Defined Perimeter (SDP)

<div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ-CgOICy2neU1Uif574szZhijSrSO5UfnHdeg9I2vQWLWjbB28SfTKXHxj29cYazYx5HL8VBqoaFYuoNp0a1WK6SdyWJzsK_lvghT2Ycgu3kVpB8kj8ia56waPqLHA-qZ2TizsdWzAfM/s1600/csalogo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="140" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ-CgOICy2neU1Uif574szZhijSrSO5UfnHdeg9I2vQWLWjbB28SfTKXHxj29cYazYx5HL8VBqoaFYuoNp0a1WK6SdyWJzsK_lvghT2Ycgu3kVpB8kj8ia56waPqLHA-qZ2TizsdWzAfM/s1600/csalogo.png" width="320" /></a></div> <div style="text-align: justify;"> <br /></div> <div style="text-align: justify;"> LONDON - Infosecurity Europe – The Cloud Security Alliance (CSA), a not-for-profit organization which promotes the use of best practices for providing security assurance within cloud computing, announced the release of two key documents related to the CSA's Software Defined Perimeter (SDP), an initiative to create the next generation network security architecture. The SDP Version 1.0 Implementation Specification and SDP Hackathon Results Report provide important updates on the SDP security framework and deployment in protecting application infrastructures from network-based attacks.  CSA will be providing press briefings about SDP developments at Infosecurity Europe.<br /><br />The SDP, a collaboration between some of the world's largest users of cloud computing within CSA's Enterprise User Council, is a new approach to security that mitigates network-based attacks by creating dynamically provisioned perimeters for clouds, demilitarized zones, and data center infrastructures. <br /><br />Cloud Security AllianceThe SDP Version 1.0 Implementation Specification being released today provides a detailed description of the base architecture.  Version 1.0 provides the necessary information to design and implement a highly secure network system for a wide variety of use cases.  As part of the updated framework, key concepts comprising the SDP, such as Single Packet Authorization (SPA) and Mutual Transport Layer Security (TLS) have undergone extensive review.  Additionally, a number of CSA members, including some of the largest global companies, have SDP pilots in place.<br /><br />Also being released today, the SPD Hackathon Results Report Whitepaper provides a detailed explanation of the SDP concept, its multiple layers of security controls, and the results of the hacking contest. The Hackathon, announced by Alan Boehme of Coca Cola at the CSA Summit at RSA 2014, invited hackers worldwide to attack a server defended by the SDP.  While more than 10 billion packets were fired at the SDP from around the world, no attacker broke through even the first of five layers of security controls specified by the SDP architecture.<br /><br />"The Hackathon provides critical validation for the multi-layer SDP security model. Even after 10 billion attack packets, no one was able to crack even the first layer of SDP security controls during the event," said Junaid Islam, co-chair of the SDP Working Group and CTO of new CSA corporate member Vidder, Inc. "Its the goal of this research initiative to keep testing SDP against real life attack scenarios to provide the highest level of security for cloud, mobile computing and the Internet of Things applications." <br /><br />In releasing the SDP Version 1.0 Implementation Specification, the SDP working group is providing the industry with a validated and proven concept for cloud-based security models and has also announced an open call for participation for the development of version 2.0.  According to Bob Flores, former CTO of the CIA and Chief Executive Officer of Applicology Incorporated and SDP Working Group Co-Chair, now is the time for interested experts to get involved.  "Today's release of SPD 1.0 will enable sufficient industry participation and feedback to allow CSA to release version 2.0 at the CSA Congress US taking place Sept 17-19 in San Jose, CA."<br /><br />"The new SDP specification, together with the results of the Hackathon, represent the tremendous progress and confidence we have in making this framework part of every organization's security posture in the future," said Jim Reavis, CEO of the CSA.  "Now it is time for the industry to join us in the next phase of the SDP, version 2.0, to make the framework stronger and even more secure against outside attacks."<br /><br />SOURCE Cloud Security Alliance</div>

Cloud Security Alliance Releases Update to Software Defined Perimeter (SDP)

LONDON - Infosecurity Europe – The Cloud Security Alliance (CSA), a not-for-profit organization which promotes the use of best practice...

Read more »

KALI Linux Website Hacked Using Heartbleed Bug

<div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdX87cEU0l6EQ3dLfCAdqWuD7MBO0WJca-h6Od6zwQs3bNJ2nHyeQM14htgSKPF6_IJzFsTFii34GvNeIQXD0xHKQkYmawy2kG3WfBecOhELyxf-wijdsheU5V_dgLXKl86F_IZZmLnOg/s1600/kali-linux-website-hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdX87cEU0l6EQ3dLfCAdqWuD7MBO0WJca-h6Od6zwQs3bNJ2nHyeQM14htgSKPF6_IJzFsTFii34GvNeIQXD0xHKQkYmawy2kG3WfBecOhELyxf-wijdsheU5V_dgLXKl86F_IZZmLnOg/s1600/kali-linux-website-hacked.png" width="320" /></a></div> <span id="goog_1006895919"></span><span id="goog_1006895920"></span><br /> <div style="text-align: justify;"> When it comes to hacking there is nothing like 100% security. Same has happened with the popular penetration testing and Security-related Linux provider Kali aka BackTrack.<br /><br />Few hours ago the Libyan hackers from ‘’The GreaT Team (TGT)’’ hacked and defaced the official mailing list sub-domain of Kali Linux website (lists.kali.org).<br /><br />The hackers left their deface page along with a note expressed in following words:<br /><br />    <span style="color: red;"><i>"Hacked By The GreaT TeAm –TGT"</i></span><br /><br />The hacker news reported that lists.kali.org has been hosted on http://mailmanlist.net/ which offers an easy solution for domain owners to manage their discussion list. The hackers claimed that Mail Man List website is vulnerable to Heartbleed bug. <br /><br />He explained how he breached the site:<br /><br />  <span style="color: red;">  "<i>I got access to one of the mailmanlist.net user account with stolen cookies, collected by exploiting Heartbleed vulnerability and then I searched for other web apps vulnerabilities. That’s how he was able to access login details of Kali Linux mailing list.</i>"</span><br /><br />The bug, called Heartbleed, is a serious vulnerability in the openSSL cryptographic software library, which allows stealing of the protected information.<br /><br />Mirror of hacked site is available here.<br /><br />At the time of publishing this article, the mailing domain was down. However, Kali Linux tweeted from their official Twitter handle about the hack.<br /><br />The GreaT TeAm – TGT is the same group which hacked and defaced the official website of Egyptian Ministry of Information just 3 days ago.</div>

KALI Linux Website Hacked Using Heartbleed Bug

When it comes to hacking there is nothing like 100% security. Same has happened with the popular penetration testing and Security-relate...

Read more »