Security professionals typically overlook the Windows command line, instead spending their time with more complex GUI-based forensics tools. In this tip, Ed Skoudis explains how just a few command-line tricks can help users closely examine the configuration of a Windows machine and discover whether a box is infected by malware. 

Threat Monitor

Finding malware on your Windows box (using the command line)

Mutating computer viruses have been around for some time, but one type of malware possesses the ability to constantly rewrite its own code to successfully evade the most sophisticated antivirus systems. Noah Schiffman explains how metamorphic malware works, how it differs from polymorphic malware and which defense strategies are best for enterprises. 

Metamorphic malware sets new standard in antivirus evasion

Unified communications systems promise exciting productivity gains for workers and cost savings for businesses, but many often underestimate the security threats facing them. John Burke outlines the dangers facing unified communications and how to mount an effective defense. 

Unified communications infrastructure threats and defense strategies

There are a lot of dirty and destructive pieces of software out there, but a logic bomb may cause some of the most damage. Triggered by the smallest of events, logic bombs can wreck computers, networks, and even an organization's precious profits. In this tip from our Ask the Experts section, contributor Ed Skoudis explains how to prepare for a hacker's detonation. 

Investigating logic bomb attacks and their explosive effects

Mergers and acquisitions are common headlines in today's information security world, and that's great news for malicious hackers and data thieves. When companies join forces, they often leave themselves open to attack. In this tip, contributor Ed Skoudis reviews the top merger-related threats and how to avoid them. 

Mergers and acquisitions: Building up security after an M&A

Web application server attacks are nothing new, but attackers are coming up with creative new ways to penetrate them. Information security expert Peter Giannoulis examines how data-hungry attackers are using Web application servers to crack into back-end databases, and offers advice on what can be done to protect Web infrastructures. 

Finding and blocking Web application server attack vectors

Microsoft has touted Windows Vista as its most secure operating system ever. But if that's the case, why has it already been the subject of several high-profile security problems? As Ed Skoudis explains, despite its improvements, Vista's security posture is far from perfect. 

Windows Vista security flaws show progress, not perfection

Employee profiling is one technique to combat malicious insiders, but organizations should tread carefully. As identity and access management expert Joel Dubin writes, protecting data and systems against insiders with criminal intentions requires a multifaceted defensive strategy. 

Employee profiling: A proactive defense against insider threats

Steganography is a useful technique for securely storing sensitivedata, but the difficulty in detecting its usage can create anopportunity for digital miscreants. Michael Cobb explains how toensure the practice isn't used maliciously. 

Using steganography for securing data, not concealing it

Enterprise VoIP vendors may tout "plug-and-play" products that are ready to run right out of the box, but those vendors may not be taking security into consideration. As information security threats expert Ed Skoudis writes, there are many potential VoIP threat vectors, but packet-based telephony services can be secured with due diligence and adherence to best practices. 

Plentiful VoIP exploits demand careful consideration

Security practitioners know to keep sensitive information under lock and key, but as Web services proliferate, ensuring that information remains private is more difficult than ever. In this tip, Ed Skoudis examines how one of Google's latest Web applications, Google Notebook, can lead to accidental exposure of sensitive data, and provides five ways to reduce the chances of a data leak. 

The security risks of Google Notebook

Allow iPods in the office? Perhaps it's time to reevaluate thatdevice policy, as iPods pose more danger to the corporate networkthan it might seem. In this tip, contributor Peter Giannoulisintroduces pod slurping, the latest hacking technique, and explainshow revising corporate policies can prevent potential data leaks. 

Pod slurping: The latest data threat

From phishing threats to zero-day flaws, hackers have certainly developed many sophisticated ways to exploit vulnerabilities for their gain. And, as SearchSecurity.com's information security expert Ed Skoudis explains, new methods are constantly being discovered. In this podcast, Skoudis outlines 10 emerging malware trends and provides tools and tactics to defend against them. 

Ten emerging malware trends for 2007

Three years have passed since CAN-SPAM was enacted, but has this legislation truly contained unsolicited commercial email? In this tip, contributor Joel Dubin examines if the law has effectively cracked down on spamming activities and examines how to put a stop to this email misuse. 

Is the CAN-SPAM Act a help or a hindrance?

From WMF exploits to the Veterans Affairs data breach, information security threats were plentiful in 2006. In this tip, contributor Joel Dubin reviews what grabbed the attention of hackers in the information security world in 2006 and explains how they set the tone for 2007. 

Eight top information security events of 2006

The Threat Monitor podcast is a semimonthly tip from SearchSecurity.com that focuses on current information security threats, including hack attacks, viruses, worms, Trojans, backdoors, bots, spyware and DDoS, and provides you with the tactics required to defend against them.

hubhopper

Threat Monitor

hubhopper