Stop operating under a Principle of Most Privilege for the desktops
Stop operating under a Principle of Most Privilege for the desktops. In a corporate environment this is far easier. A little more difficult in an academic environment (I’ve been party to debates in academia on why we can’t do information security because it impedes academic freedom… luckily much of this has subsided, but still a problem). It is a very difficult problem at home, but there are still some things that we can do and some things that operating systems shouldn’t allow.
- John Bambenek [SANS]
Is Anti-Virus Dead? (2008-Jul-31) [SANS]
Proving that we have already lost …
(Previously discussed as You can’t do ‘that’ research in the UK!)
Academics have no “right” to research terrorist materials and they risk being prosecuted for doing so, the vice-chancellor of the University of Nottingham has told his staff.
Researchers have no ‘right’ to study terrorist materials
(2008-Jul-17) [Times Higher Education]
VMware ESXi Hypervisor Now Free
PALO ALTO, Calif., July 28, 2008 – VMware, Inc., (NYSE: VMW), the global leader in virtualization solutions from the desktop to the datacenter, today announced its stand-alone ESXi hypervisor will be available at no cost to help companies of all sizes experience the benefits of virtualization. Since 2001, VMware has provided the industry’s most popular and reliable hypervisor, which is now used by more than 120,000 customers. In December 2007, VMware announced significant improvements with ESXi – its third-generation stand-alone hypervisor. With the industry’s smallest footprint and OS-independence, ESXi sets a new bar for security and reliability. ESXi 3.5 update 2, available today, meets the criteria for mass distribution: (1) ease of use and (2) maturity and stability now having been ‘battle tested’ for six months with customers. The leading server manufacturers have all embedded VMware ESXi, including Dell, Fujitsu-Siemens, HP, IBM, and NEC. ESXi can be downloaded now from www.vmware.com/products/esxi/
VMware ESXi Hypervisor Now Free ( 2008-Jul-28 ) [VMware]
The real lesson is that the patch treadmill doesn’t work, and it hasn’t for years. This cycle of finding security holes and rushing to patch them before the bad guys exploit those vulnerabilities is expensive, inefficient and incomplete. We need to design security into our systems right from the beginning. We need assurance. We need security engineers involved in system design. This process won’t prevent every vulnerability, but it’s much more secure — and cheaper — than the patch treadmill we’re all on now.
– Security Matters: Lesson From the DNS Bug: Patching Isn’t Enough
(2008-Jul-23) [Wired]
