Why is there a man in my browser?

If you are not familiar with “man-in-the-browser” attacks you should read this article.

Malware integrating itself into a victim's Web browser is nothing new. Increasingly however, these man-in-the-browser attacks are being used to successfully bypass authentication mechanisms used by online banking sites, according to a security researcher.

If you think a one-time password (OTP) token protects you from MITB attacks you are wrong. Smartcards - in many case but not all - can protect against MITB attacks. If you are in corporate security you cannot ignore this either. This is not just about on-line banking! A MITB attack can be used to try to fool privileged users in your corporation to give up passwords or even download files from the administrator's workstation that would give the man in your browser access to privileged passwords.

Use a privileged account management product – like Quest’s Privilege Manager for Unix or ScriptLogic’s Privilege Authority and wash that man out of your browser.

Technorati Tags: security,identity management,QSFT,Quest Software,Scriptlogic

Happy 4th of July

Updated: Is Apple the new Ministry of Information?

I continue to read the amazing posts over at Kim Cameron's blog on privacy related to Apple and their use of your "non-personal" information. I cannot help but thinking how farcical it all is and how Apple is beginning to remind me of the Ministry of Information in Terry Gilliam's movie Brazil.

The question I have is who will be our Sam Lowry?

Update: Kim has a follow-up post on an article by Todd Bishop posted on TechFlash - "Microsoft identity guru questions Apple, Google on mobile privacy".


privacy
identity management
Kim Cameron

Protecting Active Directory administrative accounts

Another good article in InfoWorld -“How many enterprise admins is too many?” – that is well worth the read. I’ve been doing a lot of reading and talking to customers over the last 6 months or so on the topic of privileged account management and there’s a lot to be worried about in this area. In this article the author gives some good advice on protecting your Windows admin accounts:

• Enterprise admins should not be logged on for surfing the Web, picking up email, or any other task that doesn't require enterprise admin abilities
• All admin user accounts should have long passwords, 15 characters or more – or, even better, they should be protected by smartcards
• Used dedicated admin workstations for domain or enterprise admins
• Use third-party software that helps companies manage elevated accounts

With phishing attacks constantly on the rise it’s a good idea to review what you’re doing with your privileged accounts. The attackers on the outside are getting to be more of a risk than internal attacks. You need to be well locked down for both.

Technorati Tags: identity management,privileged account management,security