The security dilemma

Information Security has a dilemma:

the problem is that we don’t want to be seen(interfere) with whatever the user wants to do, but yet there

need to be secure transactions. The security of our network and applications need to be part of Information technology actions.

The website, email and network traffic needs to get where it is supposed to go without interference or eavesdropping.

But in network security we have many types of grey areas.

False positives, negatives, and many Heisenberg principle issues (i.e. if you want to view network traffic you may be altering the traffic itself)

Was breach at Target internal or a vendor?

X-force has information on the specific malware that breached the Point of Sale terminals (POS).

The Internet Storm Center has an interesting comment,which is discussed in their newssummary section.

Is a refrigeration vendor ultimately to blame for the target breach?

This brings up another point – your vendors better have good security, as the weakest link in the chain breaks and allows the criminals in.

Are all viruses detectable with AntiVirus?

If all viruses were detectable with antivirus then malware would be easily found and no more hacks would happen.

Some viruses are hard to detect on purpose. They evade antivirus software, system administrators and other software.

But a scan of a system will show a port open which requires further analysis. Because the virus or malware wants to phone home, well it has to have a port open to do that.

Now we can find it: with  Sigma

or Alpha