X-Force Threat Insight Quarterly Report
The IBM Internet Security Systems X-Force® Threat Insight Quarterly is designed to highlight some of the most significant threats and challenges facing security professionals today. This report is a product of IBM Internet Security Systems Managed Security Services (MSS) and is compiled by the IBM Internet Security Systems X-Force (X-Force) security intelligence team of IBM Internet Security Systems (ISS). Each issue focuses on a specific challenge and provides a recap of the most significant recent online threats.
About the X-Force
The X-Force is a primary security research organization that discovers vulnerabilities and security flaws in computer networks and tracks emerging Internet threats. The X-Force serves as trusted security advisor to the U.S. Department of Homeland Security as well as many other federal, state and local government organizations, helping create governmental security standards and initiatives.
X-Force research helps form the basis for the IBM ISS protection platform. By researching vulnerabilities, IBM ISS is able to update its products and services to prevent attacks before they negatively impact an organization. IBM ISS products and services rely on X-Force research to preempt threats. Questions or comments regarding the content of this report should be addressed to xftas@us.ibm.com.
Latest report
This edition of the X-Force Threat Insight Report provides an exhaustive list of security alerts, breaches and the most commonly seen threats in Q1 2009. It also delivers three new and insightful articles by IBM ISS researchers. The first article assesses the "insider threat" to determine if it is an overstated problem, or a legitimate concern facing organizations today. The second article investigates the Microsoft Internet Explorer SPAN tag vulnerability, an issue that caused IBM ISS to raise the threat level to AlertCon 2 in December 2008. The third article covers various Web application vulnerabilities and discusses how they pose a significant threat to businesses and their customers.
The second article revisits a previous report topic - Domain Name System (DNS) cache poisoning. At the BlackHat USA 2008 conference, one of the presenters, Dan Kaminsky, detailed new ways in which caching name servers can be attacked and poisoned with false information. This article examines the details of the DNS vulnerability highlighted in Kaminsky’s presentation and provides recommendations on enhancing the resiliency and robustness of a DNS deployment and protecting against DNS cache poisoning.