Author Archives: Hacker Medic

??????????????????????????????????

Hacker Medic June 16, 2015 No Comments

攻撃者は、テキストメッセージとちょっとしたソーシャルエンジニアリングを利用するだけで Gmail、Hotmail、Yahoo メールのアカウントを侵害しています。

Read More

New Rules: Feds Mandate HTTPS on U.S. Government Sites

Hacker Medic June 16, 2015 No Comments

The White House has mandated that all public-facing Web sites of the federal government must implement HTTPS within the next two years.

Twitter Card Style:

summary

Have you read the news lately? It seems like hardly a week can go by without another data breach happening.

In the past few years, cybercriminals have upped their game considerably, using incredibly sophisticated attacks in growing number. Out of every six large companies, five were targeted last year for attack—that’s a 40% increase over 2013.*

The recent breach on federal employees’ private data, allegedly from China, only underscores the continued looming menace cybercriminals present—and this threat hasn’t gone unnoticed by the feds.

In a January 12 post on the White House Blog, President Obama is quoted as saying: “This is a direct threat to the economic security of American families, and we’ve got to stop it.” Further adding, “If we’re going to be connected, then we need to be protected.” So true! And that line of thinking is what prompted the U.S. government’s latest move.

To help combat these attacks, the White House has mandated that all public-facing Web sites of the federal government must implement HTTPS within the next two years.

This is no minor security update. It carries far-reaching implications that extend beyond the fed. Here’s what we mean.

What HTTPS Offers to Everyone

HTTPS provides a secure line of communication over the Internet, combining the usual HTTP (Hypertext Transfer Protocol) that you see in the address bar of unsecure sites, with SSL (Secure Sockets Layer) that you’re likely to see on most sites involving financial transactions.

This federal move shouldn’t come as a surprise, as the majority of the U.S. government sites have already made the switch to the secure protocol. This includes whitehouse.gov, which made the switch on March 11, 2015, to other federal sites that made the jump earlier, like ftc.gov, donotcall.gov, and others.

This goes beyond the initial site communication handshake—drilling down to subdomains, like examplesection.whitehouse.gov, too.

Up until now, many government sites are current with NIST-recommended SSL standards, but the administration has now moved to make prioritizing security and privacy a common practice among all aspects of federal government sites.

Make no mistake about it, this is huge!

These extra security measures follow the Always On SSL tenets advocated by the Online Trust Alliance, exhibiting some of the strongest moves yet to protect the identity and personal information of U.S. citizens online.

Others Must Follow, Strengthening the Security of the Web

Cybercrime isn’t going to easily back down.

Now, it’s far too easy to compromise private information on sites with subpar security. Today’s cybercriminals are smart and tenacious. By protecting all aspects of a site with SSL—not just transaction pages—businesses can help quell social engineering techniques. These complex ruses can now fool even the savviest netizens into handing over their private information to the bad guys.

Nothing is 100% unhackable now and forever. But just like locking your car doors when you’re out, providing as much security as possible is still a good great idea! By expanding the coverage of SSL, we help further the strength and backbone of the Internet itself.

*2015 Internet Security Threat Report, Volume 20

Easy Ways to Help Boost Your Bottom Line with SSL

Hacker Medic June 16, 2015 No Comments

Let your site visitors know their transactions are secure!

Twitter Card Style:

summary

Attending to all of the day to day routines in running a small business can eat up so much of your time that you don’t have any spare moments (or energy left) to devote to actually growing your business. Everything seems to fall into the bucket of “get it done and out the door.”

We’re here to help.

There are only so many ways to reduce the costs of running your business no matter how silver-tongued your negotiations may be, and one person can only juggle so many hats when trying to be the owner, customer service manager, IT department, and graphic designer all rolled into one. (Whew!)

Take a breather and discover some easy things you can do tomorrow to help your business grow. Let’s get right to them!

Let your site visitors know their transactions are secure

People care about security—a lot. They also care about appearances. There’s a reason why your local bank always has employees dressed to the nines, cameras everywhere, and a security guard.

Use this frame of mind when designing your website. With all of the stories of data breaches hitting the news, customers are more wary than ever about handing over their credit card information. They want to feel secure.

Assure them right up front by displaying a SSL (Secure Socket Layer) Trusted Site Certificate in a highly visible location. Use it in multiple places, like your home page, login page, and buy page. It’s recognized worldwide and immediately assures people that they’re dealing with the right business—you.

Show visitors the green bar

Not all SSL certificates are created equally. EV (Extended Validation) certificates include a green bar where you type the URL. The exact appearance differs slightly depending upon which browser you’re using. No doubt you’ve seen this when visiting your financial institution online.

Now, your average customer isn’t going to think, “Aha! That site is using a certificate with extended validation. Cool!” But customers will recognize the visual cue (green means go), and they will have seen it at other sites known for their security and be assured they’re not on some phishing site.

Moving over to EV SSL certificates is painless and it’s an easy way to lump your small business in with the big boys for a fairly nominal annual cost.

Avoid cutting corners on security

To many small businesses, every dollar counts. But while you can save the freshly stocked break area for later, online security doesn’t fall into the “nice to have” category. It’s now essential. One data breach is all it takes to destroy everything that you’ve worked so hard to build up.

While the number of mega breaches decreased in 2014, according to the 2015 Website Threat Security Report, the overall number of breaches increased. As the report recommends, keeping your server configuration up to date and ensuring that old, unsecure versions of the SSL protocol (SSL2 and SSL3) are disabled, and newer versions of the TLS protocol (TLS1.1 and TLS1.2) are enabled and prioritized is the way to go.

Sound like technobabble gobbledygook? It isn’t hard to implement, and the digital stitch in time here could pay off far more than saving time later. Talk to your SSL salesperson and make sure you’re up to speed.

While you may not have the budget of some major corporation (yet!), these methods are some easy ways to tweak your SSL certificates and help you get the most mileage out of them.

Author Archives: Hacker Medic

New Rules: Feds Mandate HTTPS on U.S. Government Sites

Easy Ways to Help Boost Your Bottom Line with SSL

MERS ????????????? Trojan.Swort

??????MERS???? ?????????????

??????MERS???? ?????????????

MERS outbreak used as bait to spread Trojan.Swort

Duqu 2.0: ?????????????????