If you are running a blog, you might most probably use one of the websites which show where your user come from – no? Like Clustrmaps, which I used for a few years. Then I found a new one, which I like much more as it gives me more information. If is called WorldMaps and the best thing is, it is based on Bing maps :-) and delivers fairly cool pictures (read until the end. The real cool thing is at the very end of the post :-)):

Additionally, it delivers the statistics I need with regards to hit rates over the month, browser hits etc:

and a few more. But the real reason, why I am blogging this is the live view on the traffic. If you go to the Stumbler, you get a live Silverlight view of where the hits are coming from. The only drawback I found is that the selection of the web pages you want to see live is not saved. So, e.g. if you want to see the Live hits for my blog (a slow one – so help me to increase), you click on Maps on the top right, click Uncheck All, in the filter box enter Halbheer and click on both blogs shown, close the window – and then just watch. Unfortunately I was unable to embed it into this page but it looks like this (click on it to see it live):

When I access the blog, I am shown in the far west of Switzerland - so, at least the country is right :-) 

Roger

As it happens: I have been skiing last week (the weather was gorgeous) and now I am back (unfortunately) and confronted with the next Internet Explorer 0Day vulnerability, which already causes noise – in my opinion too much for the real technical problem. If you read the blog post of the Microsoft Security Response Center called Investigating a new win32hlp and Internet Explorer issue, you will find the following facts – as far as we know them by now:

• The user has to be tricked into pressing F1 in response to a Pop-Up (no automation)
• We are not aware of any attacks exploiting this issue
• It is Windows XP “only”

This leads me back to the discussions I had with customers over the last few weeks: Windows XP was released 31. December 2001 – 8 years ago. If you would give it 2 years development and engineering time, we are talking of a 10 year old operating system. During a discussion a friend of mine said “your are not driving a 10 years old car neither” – which is not accurate. If you look how the threat landscape developed on the Internet over the last 10 years, you should probably compare it with a 50 years old car. The real problem with Windows XP in my opinion is, that it is rock-solid – but in my opinion not suited anymore for today’s threats. As you have a great alternative now – you should definitely consider moving to Windows 7. And you should move from IE 6 (if you are still there) to IE8!!

If I would have one wish to you from a security perspective: Move to the latest version of your software – everywhere (knowing that this is not an easy task to do)

Roger

It is so old: Software telling you that you are infected and that you have to install this latest security software immediately. You can bet that this then installs malware on your PC instead of cleaning it. We mentioned this problem already in the first chapters of our Security Intelligence Report v7.

And it was to be expected that the success of the Microsoft Security Essentials will be leveraged by criminals as well to do exactly what I just mentioned – it happened last week. Read yourself: If it calls itself “Security Essentials 2010”, then it’s possibly fake, innit?

Roger

Our EMEA Security Program Manager, Henk van Roest, started this series internally and with his consent I am publishing it here in my blog as I think it contains a lot of great information for you to use.

So far, in the first 4 chapters, we have addressed the usual excuses for not Managing Your IT Environment and Security Updates:

1. Security is not worth it, nothing ever happens and if it does it will be “no big deal”
2. I installed the Microsoft updates, but my network was still compromised
3. OK now I understand why Security is important but no idea how I start
4. I now know what I want to do, I just don’t know how, I need training

Here we address the need for automation, cost reduction and standardization, Microsoft has literally hundreds of tools to help management assess risk and administrators implement security updates and policies.

Security Update Management Tools: http://technet.microsoft.com/en-gb/security/cc297183.aspx#EPC

Security Update Detection Tools: http://technet.microsoft.com/en-gb/security/cc297183.aspx#EID

Security Risk Assessment Tool: http://technet.microsoft.com/en-gb/security/cc297183.aspx#EUD

Lockdown, Auditing, Intrusion Detection, Remediation Tools: http://technet.microsoft.com/en-gb/security/cc297183.aspx#E2D

Virus and Malware Protection and Removal Tools & Apps: http://technet.microsoft.com/en-gb/security/cc297183.aspx#E1E

Reduce Your Risk: 10 Security Rules To Live By

This is from 2006 but it demonstrates on a conceptual level how the technology can change but the rules remain the same.  Yet again we learn that Security is a Process, not a Product!

http://technet.microsoft.com/en-us/magazine/2006.05.reducerisk.aspx

I often talk about how we learned to engineer security into the products and the results prove that we are on the right track. One of the challenges we always have is how to help the ecosystem to improve as well. One of the ways is to communicate through our website. Not, that this is really new news – it is actually a few weeks old but still… We renewed our Security Development Lifecycle site.

If you are developing software internally you should definitely look at the site and think how to implement SDL in your organization. If you want help, there is the SDL Pro Network here to help you to implement SDL. Or leverage the tools we make available. Or much more…

If you are “just” buying software, look at the lifecycle and start to ask your vendors a few questions like:

• How do you engineer security into the products? (I am not talking about the classical software engineering processes – I am talking about security…)
• How do you do Threat Modeling (to me a key piece of the engineering process)
• …

Roger