Basic Bubble Burst – Security Lessons

This week had several news features on the security pages, mostly to do with Windows (everything) and Adobe (Flash/Reader/Acrobat) and Oracle (Java) patching by emergency fiat instead of by well planned Patch Tuesdays. Good that they are catching up with the malware that plagued their software and clients with successful in-the-field attack vectors.

The point is always that the attackers just have to find oue hole in your system, while you have to protect not just on a linear basis – modem, firewall, VPN for example, or even a flat view of walling off everything on the field of play. You must protect a sphere, and actually a series of spheres.

So, it is of interest to read the lessons of groups who have failed, and this week's lesson comes from a company who boaested that they identified and fought against several pieces of malware in the past before they were even known of. This time, the attackers grabbed their certificates. To what end is still not known.

Security Firm Bit9 Hacked, Used to Spread Malware — Krebs on Security

Boring? Yes; company gets hacked. Security firm gets hacked is getting routine.

The method is interesting through. The firm had the technology on their own shelf yet somehow the bad guys found the systems that were exposed through negligence.

And your system?