WhiteHat Inc.

IT Security & Business Solutions | Toronto | With over three decades of experience in the technology marketplace WhiteHat Inc. has assembled a suite of security offerings and strategies, responding to the real-world needs of the enterprise.

[whitehatinc]

How Xmas Scans Help Fingerprint A Target Machine

How Xmas Scans Help Fingerprint A Target Machine

The “Transmission Control Protocol”, or TCP, exchanges huge quantities of information daily, however, some OS (Operating System) vendors have not fully implemented the protocol as it is defined by the Internet Engineering Task Force (IETF) in its definitive, the industry standard, the RFC 793 specification. Specifically, a TCP port is supposed to send an RST (reset) packet when closed or not in…

View On WordPress

[whitehatinc]

All About IDPS – Why Do I Need It? Part 3

All About IDPS – Why Do I Need It? Part 3

In Part Three of our IDPS by WhiteHat series, we are going to strongly assert the reasons why you need IDPS (Intrusion Detection Prevention System) — even if you already have a firewall.

A common misunderstanding is that firewalls recognize threatening attacks and block them. This is not true. Firewalls are simply a device that shuts off all communications to internal network(s) then selectively…

View On WordPress

[whitehatinc]

All About IDPS – Business Benefits – Part 2

All About IDPS – Business Benefits – Part 2

As part two of our IDPS by WhiteHat series, we are going to explore the primary business benefits of having IDPS (Intrusion Detection Prevention System) operational within your network and IT systems.

The most important business benefit IDPS provides is reducing the chance of missing security threats which could compromise a business’s confidentiality, privacy, integrity, or the availability of…

View On WordPress

[whitehatinc]

All About IDPS – Part 1

All About IDPS – Part 1

With the active and zero-day threats running wild today, companies need to ensure they have an Intrusion Detection Prevention Service (IDPS) to protect their systems, and information, from the malicious traffic coming in from the internet.

Intrusion detection and prevention technologies can be confusing with all of its concepts, acronyms, technology options, and implementations. It is difficult…

View On WordPress

[whitehatinc]

Threat Bulletin – OpenSSL Heartbleed bug causing SSL/TLS information leakage. A new vulnerability has been discovered in OpenSSL that allows for theprivate/public key pair to be disclosed, in addition to the data that is…

[whitehatinc]

Wi-Fi Protected Access 2 – Defense Against Current Known Issues

Wi-Fi Protected Access 2 – Defense Against Current Known Issues

Wi-Fi Protected Access 2 (WPA2) was introduced to solve issues with the earlier WEP and WPA protocols. However many network administrators are not aware that WPA2 also has a few security issues of its own. It has been known for some time that WPA2 can be broken when a weak encryption protocol or shared key (PSK) is used. Additionally, it is possible to capture handshake details between a client…

View On WordPress

[whitehatinc]

The Calculus of Negligence

The Calculus of Negligence

The Calculus of Negligence is a legal principle used to determine whether a legal duty of care has been breached. The term calculus of negligence was coined by Judge Hand in a case involving the sinking of a barge in New York harbour in United States vs. Carroll Towing Co. So what does the sinking of barge have to do with information security? To paraphrase the judge’s ruling:

The duty of a…

View On WordPress

[whitehatinc]

Where Did Vulnerability Assessments Come From?

Where Did Vulnerability Assessments Come From?

Vulnerability Assessments – where did they come from? As in almost all things software / network / web, the tools, procedures, compliance laws, etc. come from a need…typically a need for “protection”. In the case of Vulnerability Assessments, it is derived from tools developed and used by “blackhats” (the bad guys, the hackers of the world).

The old saying, “it takes a thief to catch a thief”…

View On WordPress

[whitehatinc]

Best Practices for Mobile Devices in the Enterprise

Best Practices for Mobile Devices in the Enterprise

Best practices for mobile devices is more about changing the habits of a user versus using other security measures to manage risk. The prevalence of these devices has dramatically increased the risk of data compromises.

By following these six common sense rules, your risks will be reduced:

When outside of trusted Wi-Fi network access points, disable Wi-Fi entirely, Turn it off!

Disable Bluetooth…

View On WordPress

[whitehatinc]

Are you a Spammer?

Are you a Spammer?

You may not think you are but learn how Canada’s new Anti-Spamming Law might just say otherwise!

As of July 2014, Canada’s Anti-Spam Law (CASL) will take full effect.  This law will require active and “expressed consent” for all commercial electronic communications (CEMs).  The intent of the legislation is to reduce volumes of spam as well as the threats to electronic and digital commerce,…

View On WordPress

[whitehatinc]

Threat Bulletin - Cisco IPS Defense - CSCty05171

Threat Bulletin – Cisco IPS Defense – CSCty05171

A significant number of occurrences of a known issue, CSCty05171, have been recently reported from customers running older IPS versions.

For more information please review the bulletin here: http://tools.cisco.com/security/center/viewBulletin.x?bId=590&year=2014

View On WordPress

[whitehatinc]

Is Detection the New Prevention

Is Detection the New Prevention

Even prior to learning of the latest round of major breaches from Target and other large retailers, as 2103 ended a popular observation had become, “Detection Is The New Prevention.”

This represents a significant mind shift for many information security professionals and the industry.  Traditionally information security, and especially vendors in this market, has focused on “prevention”.   The…

View On WordPress

[whitehatinc]

Three Lessons from the Target Hack of Encrypted PIN Data

Three Lessons from the Target Hack of Encrypted PIN Data

1. Keep your encryption key separate from your encrypted data 

The first lesson to take away is simply to keep your encryption key separate from your encrypted data.  We know not to write our passwords on the bottom of our keyboard. We know not to put the combination of our safe on a sticky-note on the door to the safe, and we should never allow our encryption keys to be accessed in the same way…

View On WordPress

[whitehatinc]

Improved for Excellence!

  WhiteHat’s mission is to make the world a safer place by assisting our clients in protecting and managing their information and data securely so that they may focus on achieving their goals. It’s a statement that ties our business goals to a social purpose as we help people, businesses, and governments secure and manage their information-driven world against more risks at more points, more…

View On WordPress

[whitehatinc]

iSignum™ is an intuitive, scalable solution that dramatically increases the levels of trust in electronic business processes by providing "Certainty of Identity." iSignum™ measures of the unique biometric characteristics of an individual's signature. iSignum is the only system tin the market to provide multi-aspect signature authentication; Three-factor validation; Progressive profile; Fully web-based administration system; Web-based or stand-alone solutions.

[whitehatinc]

WhiteHat is a premier Information Security Provider dedicated to leading the IT security industry and inspiring our customers to employ industry best practices.