It appears that in RBAC, a Subject creates a Session with an Active Role(s), these Roles are then used to determine what permissions and actions can be taken. This appears to be fine for most of our organization until you reach Subjects wi…
We are pleased to announce that as of today customers with access to Microsoft Services Premier and Professional Support can receive EMET related technical assistance. This is an important step for us to better support professional and enterprise custo…
Today we released twelve security bulletins addressing 57 CVE’s. Five of the bulletins have a maximum severity rating of Critical, and seven have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment o…
MS13-018 addresses a potential denial-of-service condition in the Windows TCP/IP stack. This vulnerability could be leveraged by an attacker in certain circumstances to exhaust a server’s non paged pool, preventing it from making new TCP connections. T…
We are pleased to announce the release of a stable version of the open source web application firewall module ModSecurity IIS 2.7.2. Since the announcement of availability of the beta version in July 2012, we have been working very hard to bring the qu…
I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys – I’m looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will automatically be granted access to the …
Consider some files and folder in Unix/Linux OS which are configured for only read access by root, if the hard drive stolen, and used in Windows Environment, are these permissions are still effective?
Same scenario: setting file and folde…
My security department insists that I (the system administrator) make a new private key when I want a SSL certificate renewed for our web servers. They claim it’s best practice, but my googling attempts have failed to verify their claim. W…
I’m looking at the the Subject Key Identifier attribute of a CA certificate and am trying to understand the role it plays in validation and infer how validating client software could get it wrong.
What is the role of the Subject Key Iden…
MS13-001 addresses a vulnerability in the way the Windows Print Spooler handles maliciously-crafted print jobs. The potential attack scenario is a little different than previous spooler service vulnerabilities so we’d like to share more details to help…
