Security News

Adobe has confirmed a vulnerability in its widely used Reader and Acrobat products, and is recommending users disable JavaScript to stay protected.

Lawmakers and public policy experts have clashed at a U.S. Senate committee hearing over whether cybersecurity control should be taken away from the U.S. Department of Homeland Security (DHS) and placed under the White House’s purview.

Adobe again is staring down a zero-day vulnerability in its popular Reader software, according to a new security advisory.

Two-thirds of systems administrators are worried that employees are sharing too much information on social networking sites and threatening the security of corporate systems, according to new research from Sophos.

The Adobe Product Security Incident Response Team blog has reported a security vulnerability in “all currently supported shipping versions of Adobe Reader and Acrobat (Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions.”

The suggested mitigation is disabling javascript. We’ve previously disabled that using Group Policy.

Adobe notes that at this time, this issue is not known to be exploited in the wild. That can change.

Rich and I are back from RSA, rested and ready to go!  Baah, who am I kidding; here it is four days later and we’re both still so tired we’re barely able to talk coherently.  Not that we’d let that stop us from recording a podcast.  Never has and probably never will.  In any case, we start tonight with a recap of some of our observations of the 2009 RSA Conference and move on to the current media hype over the swine flu.  Use the swine flu as a learning exercise in how to cope with media hype, a good excuse for reviewing your own disaster preparedness plans and a way to get some of the same issues dealt with by your management.  The hours you spend looking at your options today may save you hours or days down the line.

Network Security Podcast, Episode 148, April 28, 2009
Time:  40:06

Show Notes:

• World Health Organization
• Center for Disease Control and Prevention
• Tonight’s music:  Johnny Citizen with Painful Tired

At the RSA Conference, I was asked a lot about what we “are” as the security division of EMC.  I think I’ve come up with a pretty clean and clear way to answer that in a few simple statements.

Companies slowest to fix Office, Acrobat flaws

Congress is mulling over whether to give more authority on cybersecurity issues to the Department of Homeland Security or create a new office within the White House.

Good Obfuscation, Bad Code

I’ve previously written about the piece of counterterrorism silliness known as the no-fly list: Imagine a list of suspected terrorists so dangerous that we can’t ever let them fly, yet so innocent that we can’t arrest them — even under the draconian provisions of the Patriot Act. Turns out these people are so dangerous that they can’t be allowed to…