2004 January February March April May June July August September October

2003 January February March April May June July August September October November December

2002 January February March April May June July August September October November December

2001 January February March April May June July August September October November December

2000 January February March April May June July August September October November December

1999 January February March April May June July August September October November December

1998 January March May June July August September October December

NOTE: Online postings include all features beginning with January 2000. For a free subscription to the printed version, go to our subscription form. Certain articles have been archived from 1998 and 1999.

OCTOBER 2000 TOP

COVER STORY The New Holy Grail? Authorization policy servers make single sign-on a reality in multi-application Web environments. BY JOEL SNYDER Also in this article... Who's Missing? | What is AAA?| Authorization=SSO?| Portal-bility

FEATURES WIRELESS SECURITY: Locking Down the Wavelengths Wireless devices are flooding the airwaves with millions of bits of information. Securing those transmissions is the next challenge facing e-commerce BY EDMUND X. DeJESUS

PAYMENT PROTOCOL: Cache on Demand This is the story of how I joined a dot-com startup and built a security infrastructure virtually from scratch. Suffice to say, it's been a wild ride. BY JOE JUDGE

SECURE STRATEGIES: Avoiding IS Icebergs Part four of "Audits, Assessments & Tests (Oh, MY)" delves into information systems auditing, the often maligned but always necessary practice of evaluating technologies and security procedures to ensure they work as intended BY DAN SWANSON

Q & A: All Geered Up Dan Geer, @Stake CTO ad the new president of USENIX, muses about privacy, security culture and the importance of self-reliance in the age of ubiquitous networks. BY RICHARD THIEME

DEPARTMENTS NOTE: Sorry, SSL BY ANDY BRINEY

VIEWPOINT: No Longer Silent

NEWS: Empty Promises BY LAWRENCE WALSH Also in this article... Lee's Security Legacy | Gotta Have Security

HAPPENINGS: Calendar of events

COLUMNS NEWS AND VIEWS: Disarming the Black Hats? BY DOROTHY E. DENNING

HEISER ON TRAQ: You'll Hear From My Lawyer BY JAY HEISER

EC DOES IT: Laying Down the Law Federal privacy regs are coming soon to an industry near you. BY MacDONNELL ULSCH

SEPTEMBER 2000 TOP

COVER STORY 2000 INDUSTRY SURVEY Security Focused Security budgets are way up. So are security breaches. As the challenges multiply, the 2000 Information Security Industry Survey explores how to maintain your focus. BY ANDY BRINEY - 542Kb .pdf

FEATURES DATABASE SECURITY: Securing Oracle New utilities and third-party "add-on" tools take security in Oracle 8.1.6 to the next level. BY KEN IHRER

SECURITY POLICIES: Adero's Security Guy This is the story of how I joined a dot-com startup and built a security infrastructure virtually from scratch. Suffice to say, it's been a wild ride. BY JOE JUDGE

SECURE STRATEGIES: Penetration Testing Exposed Part three of our series on "Audits, Assessments & Tests (Oh, My)" explores penetration testing, the controversial practice of simulating real-world attacks by discovering and exploiting system vulnerabilities. BY GEORGE KURTZ and CHRIS PROSISE

SIDEBAR: Penetration Testing: MYTH vs. REALITY BY GEORGE KURTZ and CHRIS PROSISE

Q & A: A Wizard Gets Wiser Fearing ever-increasing "hacker-related pain," MARCUS RANUM turns his focus from technology to social change. BY RICHARD THIEME

DEPARTMENTS NOTE: Survey Sound Bytes BY ANDY BRINEY

VIEWPOINT: Readers comment on the "people security" problem, BS 7799 and air gaps.

NEWS:  On the Cutting Edge Divine Intrusion Protection BY AL BERG

HAPPENINGS: CALENDAR OF EVENTS Fall security events on tap

COLUMNS NEWS AND VIEWS: Magic in the Mix? BY RICHARD THIEME

HEISER ON TRAQ: Renaissance Men BY JAY HEISER

EC DOES IT: The Perils of Privacy Anonymizer services bolster 'Net privacy, but they're not without their own set of risks. BY MacDONNELL ULSCH

LOGOFF: The Next War Most AV strategies defend against known attacks. More innovative thinking is needed to guard against future threats. BY ROBERT VIBERT

AUGUST 2000 TOP COVER STORY Authentication- Patterns of Trust There are plenty of options for user authentication, but none is a "one-size-fits-all" solution. With so many available technologies, how do you select the right one for your organization's needs? BY RICK SMITH FEATURES ACCESS CONTROL: Beyond Firewalls In most organizations, firewalls are now a commodity: everyone has at least one. In the future, access controls will need to become more granular, all the way down to the data level. BY STEPHEN D. REED APPLICATION SECURITY: Securing the Final Frontier New security solutions can protect Web applications before- and after- you run them. BY EDMUND X. DeJESUS COUNTERPOINT: Beware the Red Herring BY JAY HEISER SECURE STRATEGIES: Audits, Assessments & Tests (Oh, My) On the surface, all vulnerability assessment scanners perform essentially the same way. Here's how to decide which one-if any-is right for your requirements. BY AL BERG DEPARTMENTS NOTE: Reassessing Microsoft BY ANDY BRINEY OFF THE CUFF: Hacking NASA NEWS: On the Cutting Edge Alice doesn't sign here anymore; Mitnick: Unlikely security advice HAPPENINGS: CALENDAR OF EVENTS Late summer and early fall security events on tap BY MacDONNELL ULSCH COLUMNS HEISER ON TRAQ: Leave me Alone BY JAY HEIESER CRYPTORHYTHMS: The Fallacy of Trusted Client Software Controlling what a user can do with a piece of data assumes a trust paradigm that doesn't exist in the real world. BY BRUCE SCHNEIER SECURITY MARKET: (Out)Source of Concern Practical tips for choosing a security- conscious service provider. BY GREGORY L. MACHLER EC DOES IT: Silent Partner Is SilentRunner a productivity boost or privacy bane? BY MacDONNELL ULSCH AUDIT & ASSESSMENT: Ironclad Security Mainframe security has become lax at the same time the potential for catastrophic damage has mushroomed. New audit and assessment tools can help you batten down the hatches. BY PAUL KORZENIOWSKI LOGOFF: Hitting the Bull's Eye When it comes to information security, there are no "silver bullets." BY KEN CUTLER

JUNE 2000 TOP

COVER STORY ESM, ASAP! Getting a handle on enterprise security management has never been more important?or more complicated. Here's a practical methodology and eight product suites that will help you manage the job. BY DALE GARDNER Also in this article... ESM @ EMC | ESM Blueprint | Expanding the ESM Taxonomy | Account Ability | First Person Compliance Manager

FEATURES PENETRATION TESTING: Sweeping Changes for Modem Security Commercial modem scanners can carry a hefty price tag, especially compared to freeware war dialers. Our lab tests prove they're probably worth it. BY NATHAN A. KING

SECURITY MODELS: It's About Time Measuring detection and reaction time to cyberattacks is a key element of an infosecurity plan. BY WINN SCHWARTAU

OF THE ESSENCE BY BEN ROTHKE

SECURE STRATEGIES: Secure Directory Services for E-Business A practical primer for securing enterprise directory services (Part 3 of 3). BY DENNIS SZERSZEN

Q&A: Battle Zone Bruce Schneier wrote The Book on applied cryptography?literally. Now he's throwing his hat into the managed security services battle zone. INTERVIEWED BY RICHARD THIEME

DEPARTMENTS NOTE: The Storm After the Calm BY ANDY BRINEY

VIEWPOINT: Readers sound off on L0phtcrack, employee retention, open-source OSes and heuristical scanning.

NEWS: On the Cutting Edge? Love Sick; Managed security: Boom or bandwagon?

OFF THE CUFF: Love Bug stats; Security hits close to home for Gates.

COLUMNS HEISER ON TRAQ: Bad Boyz BY JAY HEISER

EC DOES IT: The Forest for the Trees Experience in a legacy IT environment may inhibit your ability to envision an effective e-security strategy. BY MacDONNELL ULSCH

OPEN SOURCES: Security By Default OpenBSD is one OS that's likely to be voted "most secure." So why not use it for all enterprise apps? BY PETE LOSHIN

LOGOFF: 86ing BS 7799 Why is it so hard for us to agree on a universal standard for infosecurity policies? BY ROBERT E. JOHNSTON

MAY 2000 TOP

COVER STORY ENTERPRISE SECURITY: PKI: Be Careful What You Wish For? What's it gonna take for public-key infrastructures to deliver on their promise? BY ANISH BHIMANI Also in this article... PKI and Win2K

FEATURES LOAD BALANCERS: A Balanced Approach to DoS It's virtually impossible to block denial-of-service attacks. But you can take steps to mitigate their impact, including deploying intermediate devices such as load balancers. BY ALISTAIR A. CROLL and ERIC PACKMAN Also in this article... HARDENING TCP/IP AGAINST DoS | TRAFFIC COP

OS SECURITY: OS Guard Dog Can you afford to get Argus Systems's PitBull? Can you afford not to? BY RICHARD THIEME

SECURE STRATEGIES: Secure Directory Services for E-Business (Part 2 of 3) Properly secured, directories can be an effective tool for authorization to back-office legacy applications. BY DENNIS SZERSZEN

DEPARTMENTS NOTE: Naked DB Realities BY ANDY BRINEY

HAPPENINGS

COLUMNS HEISER ON TRAQ: Potent Portals BY JAY HEISER

EC DOES IT: Web Democracy While the Web gives dot-coms some business advantages over traditional brick-and-mortars, it may also put them at a disadvantage when it comes to security. BY MACDONNELL ULSCH

LOGOFF: Full Disclosure? To disclose or not to disclose? When it comes to vulnerabilities and viruses, that is the question. BY M.E. KABAY

APRIL 2000 TOP

COVER STORY Web of Worries Web security on your mind these days? It should be, 'cause securing your company's Web architecture is a never-ending process. BY GARY C. KESSLER

FEATURES CONTENT SECURITY: Pulling the Plug on Surfing and Spam URL blockers and spam filters help you fend off content-related threats, preserve bandwidth and improve worker productivity. But without employee education and an acceptable use policy, these tools will have only limited success. BY AL BERG Also in this article... Hacker Leapfrog: How one retailer corralled Trojan horses | Head-to-Head: 10 Content Security Products

Q&A: Banker's Trust An interview with Guy Tallent, CEO of the Identrus PKI Consortium. INTERVIEWED BY RICHARD THIEME

MULTIMEDIA SECURITY: Tapping the Next Stream As the market for streaming media matures, encryption, access control and bandwidth managment will become key parts of securing this newest form of intellectual property. BY MARGOT SUYDAM

SECURE STRATEGIES: Secure Directory Services for E-Business, Part 1 Extending your business to the Web requires a firm understanding of directories, what they offer and the challenges you'll face in deploying them. BY DENNIS SZERSZEN

DEPARTMENTS NOTE: Good Question BY ANDY BRINEY

NEWS: ON THE CUTTING EDGE Government Security: Better Late Than Never?

INFOSECOND: Key players in the Symantec/L-3 merger: Cress Carter, President of L-3 Network Security, and HenriI Isenberg, Vice President of Business Development, Symantec

COLUMNS NEWS & VIEWS: Who's to Blame? Should programmers be held responsible for how their software is used? The answer is more complicated than it seems. BY BEN ROTHKE

HEISER ON TRAQ: Secret Squirrel Stuff BY JAY HEISER

CRYPTORHYTHMS: The Process of Security BY BRUCE SCHNEIER

OPEN SOURCES: How Easy Is Too Easy? BY PETE LOSHIN

LOGOFF: Privacy, Please BY SIMSON L. GARFINKEL

MARCH 2000 TOP

COVER STORY DIGITAL FORENSICS: Crime Seen How can the feds track down the DDOS perps? The same way you would-through a disciplined, methodical investigation, one that involves equal parts technology, sociology and criminology. BY BILL BETTS Also in this article... CyberCrime WATCH | Storage Media Primer

FEATURES I&A TOOLS: Mapping Form to Function Is biometrics technology poised to become the next killer app for individual authentication? BY MICHAEL THIEME Also in this article... Privacy Boon or Bane? | Taking (Health) Care

MESSAGING SECURITY: (In)Security From End to End The myth of secure e-mail is that all you need to do is install the right products or protocols, and away you go. The reality is much more complicated. BY JAMES M. GALVIN

SECURE STRATEGIES: Mastering the Fundamentals, Part 3 Getting all the details right may still leave your business insecure?maybe even unsecurable. Amazingly, many organizations miss the big picture entirely. BY RICHARD MACKEY and JONATHAN GOSSELS

DEPARTMENTS NOTE: Break-Away Security BY ANDY BRINEY

"Developing and Implementing Organizational Policy" Chapter from The NCSA Guide to Enterprise Security BY M.E. KABAY

NEWS ON THE CUTTING EDGE: DDoS Debriefing What the Heck Is Intrusion Prevention?

INFOSECOND: John Ryan, President & CEO, Entrust Technologies

OFF THE CUFF: Fool's Gold

COLUMNS NEWS & VIEWS: DDoS: The High Cost of Apathy The February denial-of-service attacks were preventable, if only we'd paid more attention to the warning signs. BY WINN SCHWARTAU

HEISER ON TRAQ: The Real Deal on Malware BY JAY HEISER

EC DOES IT: Culture Shock Anything less than a robust security culture in the Internet age is an invitation to an unpleasant party. BY MACDONNELL ULSCH

LOGOFF: Firm Conviction Harsh punishments will deter some cybercriminals some of the time. But if we hope to achieve a better solution, we must first re-examine our own assumptions about legal rights and social responsibility. BY VESSELIN BONTCHEV

FEBRUARY 2000 TOP

COVER STORY OPEN-SOURCE SECURITY: Linux Security Is open source too open for its own good? BY PETE LOSHIN Also in this article... The Eros Alternative | Open Source Security Tools

FEATURES AV TOOLS: Enterprise-Class AV An extended, heterogeneous computing environment places new demands on antivirus scanning, updating and administration. How well do today's AV products meet the challenge? BY ROGER THOMPSON

M&A MANIA: How to Survive Merger Madness What should you do when your favorite infosec vendor gets acquired? BY EDMUND X. DeJESUS

SECURE STRATEGIES: Mastering the Fundamentals, Part 2 Extending your business to the Web requires securing your corporate perimeter, identifying and fixing vulnerabilities and conducting best practices in e-commerce security. BY RICHARD MACKEY and JONATHAN GOSSELS

DEPARTMENTS ROUNDTABLE: Win2K: Worth the Wait? Feb. 17 marks the long-anticipated public release of Windows 2000. We invited four NT security experts to discuss the merits and shortcomings of Microsoft's "next-generation" NOS, and to answer the question on everyone's mind: Does Win2K deliver on its promise? MODERATED BY ANDY BRINEY

INFOSECOND: TED JULIAN, VP of Marketing & Business Development, @Stake and MUDGE, VP of Research & Development, @Stake

NOTE: The Skinny on RSA BY ANDY BRINEY

COLUMNS HEISER ON TRAQ: Dueling Bugtraqs BY JAY HEISER

SECURITY MARKET: Roaming Securely Today's roaming PKI certificates are the forerunner of tomorrow's any-to-any "virtual VPNs." BY GARY C. KESSLER

LOGOFF: A Crisis of Confidence Until infosec professionals can prove their value to employers and clients, expect the "ethical hacker" debate to go on...and on. BY IRA WINKLER

JANUARY 2000 TOP

COVER STORY CRYPTO ACCELERATORS: Fast?& Secure Crypto accelerators can cure a variety of e-security headaches. But be sure to choose the right one for your IT strategy, ?cause one size does not fit all. BY ALISTAIR CROLL & BEN ROTHKE

FEATURES BROADBAND SECURITY: Securing DSL Without a well-thought-out security strategy, "always on" DSL Internet connections can translate into "inherently vulnerable." BY RANDY DAY

Q&A: Uncompromising Position Where online privacy is in jeopardy, code sniffer Richard M. Smith has been there to uncover it. INTERVIEWED BY RICHARD THIEME

SECURE STRATEGIES: Mastering the Fundamentals, Part 1 Encryption Technology provides a valuable means to guarantee confidentiality, integrity and authenticity in today's networked world. BY RICHARD MACKEY and JONATHAN GOSSELS

DEPARTMENTS NOTE: Crime and Deterrence BY ANDY BRINEY

INFOSECOND: Sophos senior technical consultant Graham Cluley

COLUMNS HEISER ON TRAQ: The Essestials: RISKS and CERT BY JAY HEISER

SECURITY MARKET: Safety on the Auction Block While technical advances in infosecurity can make the virtual world a safer place, what people believe about the safety of their transactions will ultimately determine whether they accept the Internet as a secure place to do business. BY JOSH BOYD

EC DOES IT: Secure (e)-Business As companies outsource more and more services to third-party hosts, SLAs will be a critical tool in avoiding reputational risk. BY MacDONNELL ULSCH

LOGOFF: Infowar of Words Are you tired of hearing about cyberterrorism yet? The DoD has expended more resources sending out the alarm than determining how to protect the U.S. against it. BY GEORGE SMITH