JANUARY 2003

Wide Open on Port 80
WEB SCANNERS   How good are Web app scanners at rooting out vulnerabilities? We test two of the leading tools head-to-head to find out.
By Kelly White and Yong-Gon Chon

Open for Business, Open to Attack

Testing for Failure
SIDEBAR   New tools ease the burden of building secure code.
By Pete Lindstrom




FEATURES

Algorithm Alphabet Soup
APPLIED CRYPTO   Cryptography doesn't have to be so cryptic. Here's a primer, in plain English, to walk you through the basics.
By Rick Smith

Faster Cards, Declining Need
SIDEBAR    Cheap, more efficient general-purpose chips are reducing the need for accelerator cards.
By Lawrence M. Walsh

A New Security Layer
TEST CENTER   ForeScout Technologies's ActiveScout 2.5 stops malicious traffic outside the network perimeter, but only under certain conditions.
By JP Vossen

Law & Order
REGULATIONS & STANDARDS   IT security supports increased federal cybersecurity law, according to an Information Security survey.
By Andrew Briney

The Legislative Landscape
The U.S. has already adopted several cybersecurity laws, but few affect operational IT security.

Security Liability
Who's responsible for security breaches? Short answer: everyone.
By Frank Prince

Portrait of Two Extremes
Who wants the government's help? Who wants to be left alone?
By Andrew Briney



COLUMNS

Security Resolutions
EDITOR'S NOTE   It's New Year's, and here's the challenge for you--adopting security-related resolutions for 2003
By Andrew Briney

Banishing Hackers
ON THE LIGHTER SIDE    A monthly look at the foibles, follies and felons of infosec.
By Lawrence M. Walsh

Hardening Windows
ASK THE SURGEON GENERAL     How to harden a Windows box to improve security without impairing functionality.
By Russ Cooper

Belt and Suspenders Redux
JUST THE BASICS     As businesses expose systems to the Internet, it's important to revisit how routers can act as the "suspenders" to the firewall "belt."
By Fred Avolio

Stop Whinging
CURMUDGEON'S CORNER     The British have a marvelous word, "whinging"--the practice of complaining without doing anything about it. Security practitioners love to "whinge."
By Jay Heiser

Conflicting Priorities
LOGOFF     Cooperation and compromise is needed to resolve the growing tension between security and privacy.
By Andrew Konstantaras



DEPARTMENTS
VIEWPOINT

News & Analysis
NIPC Director Retires
Advocating Cyber Self-Defense
Mandated Disclosures
Few Companies Monitor Employees
PGP Rebounds
SOC Building
By the Numbers
On the Move
@work
HIPAA Prescription

Products
REVIEWS
FilterLogix's Intelligent Content Manager; Ubizen's Online Guardian 3.0; Entrust's Secure Transaction Platform; e-Security Online's Advisor; netForensic's 3.0; GuardedNet's neuSECURE; Zone Labs' Integrity; Big Fix's Enterprise Suite 2.0; AirZip's Document Secure and Website Secure; Waveset's Lighthouse; NetContinuum's Web Security Gateway NC-1000; Visualware's VisualRoute; Top Layer's Attack Mitigator IPS.

SECURE READS
Internet Security Dictionary is an attempt to help readers navigate through the fog of infosecurity jargon.
Reviewed by David J. Bianco

Happenings
CALENDAR OF EVENTS
Security events on tap.