California and Microsoft Sign CJIS Security Policy Agreement

AppId is over the quota
AppId is over the quota

As more and more state and local governments are looking to centralize and adopt cloud productivity solutions across their various agencies, including law enforcement, the need to meet unique requirements like the FBI Criminal Justice Information Systems (CJIS) Security Policy become increasingly important. CJIS stands for Criminal Justice Information System. The CJIS Division of the Federal Bureau of Investigation operates systems that provide state, local, and federal law enforcement and criminal justice agencies throughout the United States with access to critical criminal justice information including, personal information such as fingerprint records, criminal histories, and sex offender registrations.

A key requirement law enforcement agencies will place on their cloud service provider is signing the CJIS Security Addendum.  By signing the CJIS Security Addendum, the cloud service provider agrees to comply with the security policies required by the FBI. California Department of Justice (CA DOJ) recently determined that Microsoft Office 365 has implemented technologies and processes that will enable the agencies that use it to meet the latest FBI CJIS Security Policy requirements (CJIS Security Policy version 5.2). This means that government customers in the State of California such as City of San Diego, City of San Jose, City of Oakland, Santa Clara County, and San Mateo County can now have their law enforcement agencies use Office 365 as their cloud productivity solution and comply with CJIS. California becomes the fourth state after Texas, Illinois and New York where Microsoft has signed the CJIS Security addendum.

We are committed to investing in technology, processes and partnerships to win our customers' trust and help them comply with an evolving set of US and international standards which includes but isn't limited to ISO 27001, HIPAA, FISMA/FedRAMP, FERPA and EU Model Clauses. 

To learn more about Office 365 Security, Compliance and Privacy please see the Office 365 Security, Compliance and Privacy blog. You can also learn more about the California DOJ's decision by visiting the Microsoft in Government post.

View the original article here

The Garage Series: Explaining data security and your control in Office 365

AppId is over the quota
AppId is over the quota

In this week’s show, hosts Jeremy Chapman and Vijay Kumar tackle one of the most common questions asked about cloud services, “How safe is my data?” Security is an important element of trusting the service of any service provider. But even beyond security, they cover related concerns around data privacy, availability and show some of the controls your IT administrators have to configure access policies, lock down clients and build your own control set for data stored in or transferring though Office 365 services.

Jeremy: In last week’s show we rounded up all of Office apps and services to show cross-platform mobile devices coverage – from the core Office Mobile apps on iPhone and Android to new experiences like OWA for iPad. We also put Office VP, John Case, and skateboarding legend, Bucky Lasek, along with Office Mobile to the test as they navigated a rally course using roaming pace notes an Android phone, iPhone and Windows Phone all accessed from a single Office 365-stored document. 

This week, I’m joined by Office 365 security and compliance lead, Vijay Kumar, to address the topics of security, privacy, configurability, availability and overall trust of Office 365 services. We also hear from Office 365 General Manager of Engineering, Kevin Allison, and hear back from Mark Russinovich, then we return to Madrid to hear from European-based security experts and get their perspective about Cloud versus on-premises security and data access. 

Vijay: In fact today’s show we hope to give you the 101 on how we protect and manage access to your data with Office 365, as well as the behind the scenes view on Microsoft’s approach. We explore the topic in two halves. First, the measures that Microsoft has put in place to manage and monitor the Office 365 online service and second we look at what you can do to configure Office 365 for your specific organizational needs.

Jeremy:  So let’s explore the first side of the coin, if you are considering a shift to Office 365 Cloud services, the first thing that you may want to know is who has access to it and how it’s safeguarded by Microsoft?

Vijay: Well we do all the things that you would expect from a physical security perspective in terms of how we lock down our data centers including perimeter and personnel access and replicate your data across data centers to protect from data loss or natural disasters. What many people don’t know is that access to every file is gated based on access permissions with a lock box process. Also, your data has its own unique footprint and is isolated from the data of other organizations.

Jeremy: And speaking of access, a related fear is around overall privacy. Whether or not you sign up with Microsoft as the service provider, you don’t want your data being mined for other purposes such as advertising and you want your data to move with you if in future, you decide not to use the service. 

Vijay: Absolutely, and these measures are a given with Office 365. It’s your data and we simply process it while providing productivity services through email, Office applications, unified communications etc.

Jeremy: So even if a third-party requests access to my data it’s protected? 

Vijay: That’s a great question and very topical given the recent press reports around domestic and foreign government access to stored data and data in transit. Ultimately unless legally obligated, Microsoft cannot fulfill requests to access your data. We have to inform you of third-party requests and require your consent. We even provide reports of non-owner access to email inboxes from the Office 365 Administrator Console.

Jeremy: So let’s talk about vulnerability of the service and how Microsoft mitigates criminal attempts to hack its data centers and your data. What most people want to know is how secure is their data in the Cloud compared to on-premises? One of the points that resonated with me made by Marcus Murray, a European security expert that we spoke to on location in Madrid was that one key advantage of the Cloud is that it’s difficult to hack into a system if you don’t have machine level access as you would do on-premises. The way most malware works is to install software or replace system level services on host machines to access data and mask the existence of the malware, if the host layer is abstracted as with Office 365, it is much more difficult to infect a system.

Vijay: We also take extra measures to ensure that services are sufficiently hardened from external hacking threats. Mark Russinovich discussed are red and blue teaming approach where we have experts on staff tasked with the challenge to penetrate the service. They employ all standard means from automated and code execution to social engineering in order to access infrastructure and service layers. At the same time, the blue team works to detect any successful breaches and block any points of entry. They also review access logs and details from the red team to look for patterns and issues to inform ongoing security hardening work.

Jeremy: And of course, a related point on how Microsoft safeguards data access is what happens if the service goes down? How can I trust that I will always have access to my data when I need it?

 Vijay: We get asked that all the time, and we’ve had a lot of practice in maintaining ongoing application availability with our email and collaboration services that have been around for decades. The first thing to know is that we have a financially-backed SLA of 99.9% - which means the service cannot be down for more than 43 minutes in any given month or we need to compensate you as a customer. 

We want to be transparent and accountable too. In fact, we publish our historical uptimes quarterly on the Trust Center. More than that though we built the code and so we know how to fix it and as Kevin Allison explains, we have a Dev Op process, which means the developer who wrote the code is the assigned operator and is on point to fix – resulting in faster and more agile issue resolution compared to traditional approaches for on-premise software.  

Jeremy: Switching gears to explore the other half the coin has been a continuous topic on the Garage Series shows, that is how you define your own control set for managing Office 365 which is a key differentiator for Microsoft compared to other service providers. This is particularly important if you are concerned about meeting regulatory or company Compliance requirements around access to corporate data.

The good news is that, you have control over where your data resides – you can run Office 365 Services along-side your on-premises environment and keep your most sensitive data within your organization’s walls. Importantly too, can apply the same type of access rules that you would typically use to configure your on premises environment and in many respects they are easier to implement and faster.

Take for example Rights Management Services (RMS) – you can now set up file level access in 5 clicks in a large organization versus setting up and configuring a whole array of servers as you would do in the on-premises world. RMS protects the document and ensures that only those with access rights can view it. It is much stronger than simple password protection, because if the document does leak out of an organization, even employees of the organization where it was created would need to authenticate that A. they are still a member of the organization and B. have appropriate permissions to view or edit the file. For example, if a user were to load a USB drive with documents, then leave the company, then any document with RMS protection would not be viewable until that person authenticates against the Rights Management Service. In this case, since the former employee is no longer with the company, his log in and authentication attempts will fail and he won't be able to access the file.

In addition to RMS, we also have tools like Data Loss Prevention where an IT administrator set up rules for sensitive information like credit card or personal identification numbers. Then Outlook will mount an attached file or scan the email text and warn users or if the information leaves the inbox, transport rules in Exchange will block that information from sending. We saw this in a previous episode as Mr. #DealWithIt (played by Stephen Rose) attempted to send his boss's credit card details in a New Orleans bar. 

Vijay: So today’s show was just an overview, we are just scratching the surface in terms of what’s possible – which is why we have two security show specials coming soon in the New Year 

Jeremy: And, in fact we tackle mobile device control and security with Office 365 on next week’s show, when I’m joined again by all things data management and SharePoint expert, Mark Kashman. I’m also joined by Exchange engineering lead Greg Baribault to discuss the genesis and evolution of mobile device management in the advent of the ‘bring your own device’ trend where more and more people are using multiple devices of choice to get work done and to work from anywhere. 

See you next week.

Jeremy and Vijay

More Resources:

Office 365 Trust Center

Garage Series Video Channel

Garage Series Season 1 Blog Archive

Follow @OfficeGarage on Twitter

 

View the original article here

Cloud Services you can trust: Security, Compliance and Privacy in Office 365

AppId is over the quota
AppId is over the quota

 When you make a decision to place your trust in a cloud services provider for productivity services, security, compliance, and privacy are top of mind. With over a billion customers on Office and decades of experience running online services, we understand what it takes to earn and continue to maintain your trust and confidence in Office 365.

Our construct for security, compliance and privacy in Office 365 has two equally important dimensions - Built-in capabilities that include service-wide, technical capabilities, operational procedures and policies that are enabled by default for customers using the service and Customer controls that include features that enable you to customize the Office 365 environment based on the specific needs of your organization.

We will look at Built-in capabilities and Customer controls for each of the key pillars of trust - Security, Privacy and Compliance - in more detail below.

Security

Security of our customers' information is a key trust principle. We implement policies and controls to safeguard customer data in the cloud and provide unique customer controls that you can use to customize your organizational environment in Office 365.  

As an Office 365 customer, you will benefit directly from in-depth security features that we have built into the service as a result of experience gained from years of building enterprise-grade software, managing a number of online services and billions of dollars in security investments. We have implemented technologies and processes that are independently verified to ensure high security of customer data.

Some key aspects of our built-in security capabilities are:

Physical security - We monitor our data centers 24/7 and we have technologies and processes to protect our data centers from unauthorized access or natural disastersSecurity best practices -We use best practices in design like Secure Development Lifecycle and operations like defense-in-depth to keep your data secure in our data centersData encryption - Every customers' email content is encrypted at rest using BitLocker Advanced Encryption Standard (AES) encryptionSecure network layer - Our networks are segmented, providing physical separation of critical back-end servers from the public-facing interfaces at the same time our Edge router security detects intrusions and signs of vulnerabilityAutomated operations like Lock Box processes - Access to the IT systems that store customer data is strictly controlled via lock box processes. This access control mechanism is similar to a system where two people have to turn the key for an action to be allowed.

As a result of Office 365 offering productivity services to a wide range of industries, we have built both features and choices that you can control to enhance the security of data based on the needs of your organization. 

Some key aspects of our customer controls for security are:

Exchange Hosted Encryption - Enables delivery of confidential business communications safely, letting users send and receive encrypted email directly from their desktops as easily as regular email.S/MIME - Enables encryption of an email messages and allows for the originator to digitally sign the message to protect the integrity and origin of the message. As part of our continued investment in security technologies that Government and Security conscious customers care about, we are adding support for S/MIME for Office 365 in the first quarter of Calendar Year 2014.Rights Management Services - Enables a user to encrypt information using 128-bit AES and use policies on email or documents so that the content is appropriately used by specified people.Role based access control - Allows administrators to enable access to authorized users based on role assignment, role authorization and permission authorization.Exchange Online Protection - Allows administrators to manage your company's Anti-virus and Anti-spam settings from within the Office 365 administration console.Identity Management - Provides organizations with various options for identity management such as cloud based identity, identities mastered on-premises with secure token based authentication or hashed passwords to integrate into the Office 365 identity management system based on the security needs of your organization.Two factor Authentication - Enhances security in a multi-device, mobile, and cloud-centric world by using a second factor, such as a PIN, in addition to the primary factor which is identity.

Another key principle of Office 365 trust is Compliance.  It is expected that commercial organizations have regulations and policies that they must comply with to operate businesses in various industries. These policies can be a mix of external regulatory requirements that vary depending on industry and geographical location of the organization and internal company-based policies.  Office 365 provides built-in capabilities and customer controls to help customers meet both various industry regulations and internal compliance requirements.

Office 365 stays up-to-date with many of today's ever-evolving standards and regulations, giving customers greater confidence.  To bolster this and to continue earning your confidence, we undergo third-party audits by internationally recognized auditors as an independent validation that we comply with our policies and procedures for security, compliance and privacy.

Some key aspects of built-in compliance capabilities are:

Independently Verified - Third party audits verify that Office 365 meets many key world-class industry standards and certificationsControl framework - We follow a strategic approach of implementing extensive standard controls that in turn satisfy various industry regulations. Office 365 supports over 600 controls that enable us to meet complex standards and offer contracts to customers in regulated industries or geographies, like ISO 27001, the EU Model Clauses, HIPAA Business Associate Agreements, FISMA/FedRAMP Comprehensive Data Processing Agreement - Our Data Processing Agreement comprehensively addresses privacy and security of customer data, helping customers comply with local regulations

We provide Compliance controls within the service to help our customers comply based on the policy needs of their organization. 

Some key customer controls for compliance are:

Data Loss Prevention - Helps customers to identify, monitor and protect sensitive data through content analysisArchiving - Allows organizations to preserve electronically stored information retaining e-mail messages, calendar items, tasks, and other mailbox itemsE-Discovery - Permits customers to retrieve content from across Exchange Online, SharePoint Online, Lync Online, and even file shares

Privacy is our third trust principle.  As more and more customers are relying on online service providers to keep their data safe from loss, theft, or misuse by third parties, other customers, or even the provider's employees, we recognize that cloud services raise unique privacy questions for businesses.   

To meet your needs, we are continually developing technologies to enhance privacy in our services. We call this privacy by design - which is our commitment to use best practices to help protect and manage customer data. 

Key built-in capabilities and principles of Privacy in Office 365 are:

No Advertising - We do not scan email, documents, build analytics or data mine to build advertising products. In fact, we do not use your information for anything other than providing you services you have subscribed for.Data Portability - As an Office 365 customer, your data belongs to you, and you can export your data at any time with no restrictions. We act only as a data processor and provider of productivity services, not as a data owner Notice and Consent - When we act upon your data, we let you know why and we ask for permission in advance or redirect any enquiries to our customers unless legally prevented to do so.Breach Response - We have strong, tested and audited processes to inform you if there is a breach and remediate issues if they occur.Data Minimization - We strive to minimize the actual amount of customer data that our internal teams have access to.

In addition to built-in capabilities, Office 365 enables you to collaborate through the use of transparent policies and strong tools while providing the distinct ability to control information sharing.

Some examples of customer controls for privacy are:

Rights Management in Office 365 - Allows individuals and administrators to specify access permissions to documents, workbooks, and presentations. This helps you prevent sensitive information from being printed, forwarded, or copied by unauthorized people by applying intelligent policiesPrivacy controls for sites, libraries and folders- SharePoint Online, a key component service of Office 365 that provides collaboration functionality has a number of privacy controls. One example is that SharePoint Online sites are set to "private" by default. A second example is that a document uploaded to a SkyDrive Pro is not shared until the user provides explicit permissions and identifies who to share with.Privacy controls for communications - In Lync Online, another key component service that provides real time communications in Office 365, there are various administrator level controls as well as user level controls to enable or block communication with external users and organizations. One example is blocking access to federation in Lync. Similarly there are controls throughout the service for the admins and users to ensure privacy of their content and communications.

At Microsoft, we have been building Enterprise software for over two decades and we run over 200 online services. We bring all of this experience to Office 365 to give you industry leading capabilities in security, compliance and privacy. In addition, we take the advantage of scale and continuous feedback from providing services to a diverse customer base across industry and geography to constantly learn and improve the Office 365 services. Security, Compliance and Privacy are the key pillars of the Office 365 Trust Center (the other two pillars being Transparency and Service Continuity). Customers can have confidence that Microsoft is a thought leader and will continue to make deep investments to protect customers in the cloud.

Learn more about security, compliance, and trust in this weeks Garage Series: Explaining data security and your control in Office 365.

Learn more about recent compliance agreements with the announcement for the state of California and Microsoft signing the CJIS security policy agreement.

-- Vijay Kumar

View the original article here

Will One Antivirus Program Take Care of Your Security Needs?

AppId is over the quota
AppId is over the quota

Bvs1216 uses Microsoft Security Essentials. He asked the Answer Line forum if he needs to supplement it for additional protection.

That all depends on what kind of supplement you're looking for. You only need one antivirus program, and Microsoft Security Essentials fills that role. But an antivirus program isn't the only kind of security software you may need.

Don't be misled by the term antivirus program. These programs don't just protect you from viruses (which, technically speaking, are passé, anyway). They protect you from Trojans, worms, spyware, rootkits, and all sorts of malware. As the term is generally used, an antivirus program is software that loads automatically when you boot, then stays in the background, protecting you against malware in real time.

But no software is perfect, so it's a good idea every week or two to scan for malware with another program. But you don't want another antivirus program; two of these running in the background at all times, doing the same job, is asking for trouble. You need an on-demand malware scanner--a program that only runs when you launch it and scans only when you ask it to. I recommend either SUPERAntiSpyware or Malwarebytes' Anti-Malware, or both.

You also need a firewall that can check for suspicious packages going in and out of your computer. Windows has its own firewall, but Windows 7 is the first version where I actually felt I could trust it. If you're using XP or Vista, you might want to consider the Comodo Firewall.

There are other types of security software you might want, as well. If you need to protect sensitive files, consider TrueCrypt. And Password Safe can help you safely manage your passwords.

Read the original forum discussion.

Contributing Editor Lincoln Spector writes about technology and cinema. Email your tech questions to him at answer@pcworld.com, or post them to a community of helpful folks on the PCW Answer Line forum. Follow Lincoln on Twitter, or subscribe to the Answer Line newsletter, e-mailed weekly.

View the original article here

Outlook.com increases security with support for DMARC and EV certificates

AppId is over the quota
AppId is over the quota

In a previous blog post, we talked about our goal of making Outlook.com the best and most-used personal email service on the planet. That means building a great service with all the features you expect from modern email, but it also means building a service that is known for world-class reliability, industry leading spam protection and rock solid security features.  Today we're announcing two new enhancements to Outlook.com that help protect your email. 

Over the past several weeks since we announced Outlook.com, we've continued to work to deliver you the highest levels of security and protection technologies.  Today, we are excited to announce two important new security features that help fight common phishing attacks and provide you with even more protection.  The first is complete support for DMARC, a standard that makes it harder for someone to deliver phishing mail to your inbox.  And the second is support for Extended Validation Certificates (EV Certificates), which provides a more secure SSL connection when you are using Outlook.com. We're proud to be the first major email service to provide this higher level of safety and security. Taken together, these new security measures help prevent attackers from stealing your account information and protect your account from phishing attacks.

One example of a common phishing attack is when someone fakes the sender's address, and uses that to try to trick someone into giving up personal information.  For example, an attacker could send mail that looks like it is from a legitimate bank and ask for account verification to trick someone into giving their account name and password.  The attacker could then use that name and password to access the actual bank account.  Today we help prevent these phishing attacks by supporting email authentication standards for sending and receiving email--including SPF, SenderID and DKIM--as well as our own email filtering technology. 

DMARC is a new policy enforcement and reporting standard that builds on SPF and DKIM providing more deterministic outcomes of authentication-failed messages.  Microsoft has been a core participant in the DMARC standards body since its inception. We share their mission to fight against domain-based phishing, along with Facebook, PayPal, Gmail, ReturnPath and others. This standard helps prevent phishing mail from getting into your inbox, and helps senders understand when an attacker is trying to send phishing mail from their domains. 

Our DMARC implementation helps protect you by making it easier to visually identify mail from senders as legitimate, and helps keep spam and phishing messages from ever reaching your inbox. If a sender supports DMARC, we put a trusted sender logo next to their email indicating it is legitimate. The effect is cumulative; the more the email sending services that use DMARC, the broader the protection offered against phishing. 

DMARC helps protect email sending services by giving them valuable information about mail coming from their domain.  As part of DMARC, senders get reports on email that comes from their domain (good and bad), as well as how much of their traffic is passing/failing email authentication checks. This info helps them plan their authentication deployment as well as better understand the nature of the attacks on their domains.  They can also request that messages using their domain that fail authentication be quarantined or rejected, and receive data extracted from failed messages such as header information and URIs from the message body, to provide them visibility into the types of attacks that are targeting their brands.

This combination of protection for readers and senders allows DMARC to help the entire email ecosystem and we are happy to be fully compliant with DMARC for received mail. 

A second type of phishing happens when an attacker puts up a website that pretends to be from one company, but is actually from another.  SSL is an important part of protecting against phishing, but there have been recent cases where some SSL certificates have been compromised, which allowed attackers to impersonate SSL sites.  EV Certificates make your browsing experience more secure than plain SSL by adding confidence that you are interacting with a trusted website and that your information is secure. 

EV certificates are deeply vetted by the Certificate Authority, providing significant assurance that you can trust the sites that use them.  These certificates require a minimum of 2048-bit encryption, which is far more secure than what is commonly used with standard SSL.  The green address bar in your browser provides immediately recognizable assurance that your connection to the service is as secure as it can be from prying eyes. Contrast that with the key length standard SSL uses-in many cases, it can be fairly low, creating a false sense of security.  EV certificates deter phishing attacks by preventing malicious sites from masquerading as the trusted service. While malicious sites might try to impersonate a site's UI or brand, they cannot replicate the browser's green bar.  And by deploying EV certificates broadly we can apply 2048 bit encryption not just to your login, but to your actual mail content as well.

EV certificate support in Outlook.com is rolling out now, and will be coming soon to SkyDrive and our other services.  And of course, the same level of protection is extended to Hotmail.com and Live.com customers while they are upgrading to Outlook.com.  We have chosen one of the most-trusted Certificate Authorities (CA) to issue our EV certificates--Symantec. You can easily verify the authenticity of our webpages by using the enhanced display supported by most browsers, which includes the name of the company or entity that owns the certificate--in this case Microsoft Corporation--and a distinctive green color shown in the address bar to indicate that a valid EV certificate was received.

 

Security is a top concern when choosing an email service, and it's a top priority for all Microsoft development efforts, products, and services. We're never done and will always keep improving.  But we believe that Outlook.com is the best email service available, and now Outlook.com offers even more security enhancements that you won't find anywhere else.

--Krish Vitaldevara, Outlook.com Program Management Team

View the original article here

FISMA becomes latest security certification for Office 365

AppId is over the quota
AppId is over the quota

By Julia White, Senior Director, Microsoft Office Division

Today, we're pleased to announce Office 365 was granted the Authority to Operate under the Federal Information Security Management Act (FISMA) by the Broadcasting Board of Governors. FISMA is important to our customers because it creates a process for federal agencies to certify and accredit the security of their information management systems.  IT solutions with FISMA certification and accreditation have federal agency approval for their use in line with the level of security established by that agency.  

We take our responsibility to protect customer data very seriously.  While we're pleased to have been granted FISMA ATO, Office 365 already meets the industry's most rigorous global security and privacy standards.  

Office 365 is the first and only major cloud based productivity service to sign EU Model Clauses with all customers.  In addition, we added the Data Processing Agreement (DPA) to the EU Model Clauses to address additional requirements from the EU member states.  Office 365 also signs the Business Associate Agreement (BAA) to meet the security requirements of the US Health Insurance Portability and Accountability Act (HIPAA).  Importantly, Office 365 signs the HIPAA-BAA, DPA and EU Model clauses with all customers regardless of size.  Along with EU Model Clauses and HIPAA, Office 365 is ISO 27001 certified.

We understand people have high expectations of any service provider and an interest in understanding where their data resides, who can access it and what we do with it. To that end, we created the Office 365 Trust Center to enable customers to learn more.

With FISMA, it becomes even easier for governments to choose Office 365 and join the ranks of the USDA, the first federal agency to deploy cloud services, the States of California, Minnesota and New York; the cities of San Francisco, Newark, Plano and many others.  The move to Office 365 is afoot in government, and the savings and benefits to citizens are considerable.  Today's news should further hasten that transition.

View the original article here

Adobe product security updates available

Adobe product security updates available « Adobe Product Security Incident Response Team (PSIRT) Blog function clearSearch() {document.search_form.s.value = "";} adobe.com      Adobe Product Security Incident Response Team (PSIRT) Blog / Adobe product security updates availableby Wendy PolandRoboHelp for Word (1)Shockwave Player (13)CreatedFebruary 14, 2012

Today, we released the following Security Bulletins:

APSB12-02 – Security update available for Adobe Shockwave Player (Critical Severity)APSB12-04 – Security update available for RoboHelp for Word (Important Severity)

Customers of the affected products should consult the relevant Security Bulletin(s) and apply updates as recommended. 

This posting is provided “AS IS” with no warranties and confers no rights.

CareersPermissions & TrademarksEULAsReport PiracyContact AdobeSecurityCopyright © 2010 Adobe Systems Incorporated. All Rights Reserved.
Use of this website signifies your agreement to the Online Privacy Policy and Terms of Use (updated 07/14/2009)

View the original article here

New Video from ‘Intersection of Security & Information Sharing’ Event

New Video from ‘Intersection of Security & Information Sharing’ Event « Government Bits function clearSearch() {document.search_form.s.value = "";} .avatar {vertical-align:middle}.credit {font-size: 50%;}adobe.com      Government BitsTracking how technology is transforming interaction between governments and citizens.Defense Information Systems Agency (4)Department of Defense (5)DISA (4)Federal Computer Week (1)Information Sharing (1)John Landwehr (1)Security (2)  

View the original article here

Security Breach!

Today, I applaud Marriott for sending a notice that stated:

“We were recently notified by Epsilon, a marketing vendor used by Marriott International, Inc. to manage customer emails, that an unauthorized third party gained access to a number of Epsilon’s accounts including Marriott’s email list. In all likelihood, this will not impact you. However, we recommend that you continue to be on the alert for spam emails requesting personal or sensitive information. Please understand and be assured that Marriott does not send emails requesting customers to verify personal information. We take your privacy very seriously. Marriott has a long-standing commitment to protecting the privacy of the personal information that our guests entrust to us. We regret this has taken place and apologize for any inconvenience.”Data breaches are inevitable.  This was not Marriott but a third party used by them.  I applaud Marriott for being timely and honest with their news.  This is what I call good customer service.  I will continue to use Marriott.  In fact, I just left one this morning in Mexico City and have another one booked for next month.

View the original article here

Security updates released for Adobe Reader and Acrobat (APSB11-06)

Security updates released for Adobe Reader and Acrobat (APSB11-06) « Adobe Product Security Incident Response Team (PSIRT) Blog function clearSearch() {document.search_form.s.value = "";} adobe.com      Adobe Product Security Incident Response Team (PSIRT) Blog / Security updates released for Adobe Reader and Acrobat (APSB11-06)by David LenoeAcrobat (37)Reader (47)CreatedMarch 21, 2011

Today, a Security Bulletin (APSB11-06) has been posted to address a critical security issue (CVE-2011-0609) in the products, as referenced in Security Advisory APSA11-01. This Security Bulletin affects the authplay.dll component that ships with Adobe Reader and Acrobat X (10.0.1) and earlier 10.x and 9.x versions for Windows and Macintosh operating systems. Adobe recommends that users apply the updates for their product installations.

This posting is provided “AS IS” with no warranties and confers no rights.

CareersPermissions & TrademarksEULAsReport PiracyContact AdobeSecurityCopyright © 2010 Adobe Systems Incorporated. All Rights Reserved.
Use of this website signifies your agreement to the Online Privacy Policy and Terms of Use (updated 07/14/2009)

View the original article here