Tenable Blog

On the 24^th of November 2014, a major anti-malware vendor released a report concerning a long running piece of backdoor Trojan malware, now called “Regin.” We at Tenable Network Security were aware of this report on the Sunday before the release, and looked forward to reading the technical analysis.

In a new article on BetaNews, Tenable’s Jeffrey Man discusses the viability of cybersecurity insurance for companies that experience payment card breaches. “Is cyber insurance your last line of defense?” examines the impact of litigation on retailer liability and PCI compliance.

Continuing his blog series on SecurityWeek, Tenable’s Marcus Ranum discusses the challenges in presenting and comparing system metrics. Metrics should be normalized and placed in context for effective communication. He uses several stock market charts to reinforce his message.

The latest Patch Tuesday from Microsoft (November 11, 2014) includes fixes for some major vulnerabilities, including remote code execution bugs affecting core Windows components and Internet Explorer. The three major bulletins of note are MS14-064, MS14-065 and MS14-066, all of which have a CVSS score of above 9.0.

At a recent conference, I heard a security practitioner blame a couple of users for being dummies who click on everything. He then said, “At a certain point, it's reasonable to blame the user. It's just like when someone parks a car with the keys in it, in a known bad neighborhood. You have to take ownership of your actions.” Well, yes and no.