Posts Tagged Database Security

Linoma Software products are not affected by Heartbleed bug

Posted by on Wednesday, 9 April, 2014

Heartbleed bug graphic from heartbleed.comIf you are a Linoma Software customer using any of our products such as the GoAnywhere suite (Director, Services, Gateway, Open PGP Studio), Crypto Complete, Surveyor/400 or the RPG Toolbox, we are pleased to report that our products are NOT vulnerable to the Heartbleed bug.  

The CVE-2014-0160 exploit, or Heartbleed bug, has made big headlines over the last 48 hours. The Heartbleed bug exploits vulnerabilities in the popular OpenSSL server software potentially allowing the memory of SSL/TLS encrypted systems to be compromised. The bug essentially allows access to the memory of the SSL/TLS protected systems and attackers can potentially steal and read formerly encrypted information such as usernames and passwords, credit card numbers and other sensitive data.  To learn more about the Heartbleed bug please visit Heartbleed.com.  Additional resources allow you to check and see if your website or server is affected by the Heartbleed bug:  Heartbleed Test and LastPass Heartbleed Checker.

GoAnywhere Suite (Director, Services, Gateway, Open PGP Studio)
GoAnywhere does not use native libraries for SSL/TLS and relies on the JSSE libraries of the JVM that GoAnywhere is running on. This exploit does not exist in the JSSE implementation of SSL/TLS.  While Tomcat does, however, have the ability to utilize native SSL/TLS capabilities for its HTTP/S connections with the APR Connectors, GoAnywhere does not employ this functionality.
GoAnywhere Secure File Transfer mobile apps:
For Apple devices: The GoAnywhere Apple app uses the Secure Transport implementation of SSL/TLS and is not affected by Heartbleed.
For Android devices:  The GoAnywhere Android app uses the JSSE implementation of SSL/TLS and is not affected by Heartbleed.

Surveyor/400:
Surveyor/400 does not use native libraries for SSL/TLS and relies on the JSSE libraries of the JVM that Surveyor/400 is running on. This exploit does not exist in the JSSE implementation of SSL/TLS.

Crypto Complete:
Crypto Complete does not use SSL/TLS for Field or Backup encryption and is not affected by Heartbleed.

RPG Toolbox:  Our RPG toolbox does not use any encryption and is not affected by Heartbleed. 

Upcoming Webinar: Focus on FTP Server Compliance

Posted by on Wednesday, 23 January, 2013

Don’t miss our upcoming live webinar led by Chief Architect Bob Luebbe!

Get Your FTP Server in Compliance

Thursday, January 31 at Noon Central

Secure FTP Server Compliance WebinarWith the recently added rules for the Healthcare Insurance Portability and Accountability Act (HIPAA) that now holds trading partners and business associates accountable if they also handle patient data, it’s a good time to review whether your FTP server is updated and ready to meet compliance requirements. Learn how to keep your data as well as trading partner files protected within your network and still allow external access without opening inbound network ports.  You can also see a demo of Linoma Software’s GoAnywhere™, a managed file transfer solution that includes a secure FTP server and a reverse proxy DMZ gateway with clustering and load balancing capabilities to ensure high availability.

Learn more


 

IBM i Encryption Made Easy with DB2 Field Procedures

Now Available On Demand

IBM i 7.1 DB2 Field Procedures, data encryptionDuring this recorded webinar, you can learn about how to make the DB2 Field Procedures Tool in IBM version 7.1 work even more efficiently as part of a more comprehensive solution, one that makes it easier to implement encryption, manage keys, and generate auditing reports so important for meeting compliance regulations like HIPAA and PCI DSS,.  You can also see a demo of Linoma’s popular encryption software Crypto Complete.

Learn more


All of our webinars are recorded, so if you register and are not able to attend live, you’ll be able to review the webinar at a more convenient time.

We look forward to having you join us and will be happy to answer any questions you have.

 

 

Susan Baird

Susan is the Marketing Manager at Linoma Software, helping promote our secure file transfer and encryption solutions. Her specialty is content creation and social media marketing, and you can find out more about her by viewing her LinkedIn profile.

More Posts - Website - Twitter - Facebook

Cyber Threats: Beyond Entertainment Value!

Posted by on Tuesday, 7 September, 2010

On June 8th, 2010 the National Public Radio (NPR) broadcast a debate by the public charity Intelligence Squared U.S. (IQ2US) entitled “The Cyber War Threat Has Been Grossly Exaggerated.” The show’s format is based on the traditional Oxford-style debate, with one side proposing and the other side opposing a sharply-framed motion.

The broadcast pitted Marc Rotenberg (executive director of the Electronic Privacy Information Center) and Bruce Schneier, (a security technologist), against Jonathan Zittrain, (a Harvard Law School professor), and the former U.S. Director of National Intelligence, Mike McConnell. Zittrain and McConnell rolled out the heavy security artillery, describing the threats and touting facts and figures, while Zittrain and Schneier pooh-poohed the seriousness of the threat, and tried to cast suspicion onto the U.S. government’s C.I.A., claiming that they just want to spy on us.

The debate was both entertaining and informative, but it also shed light on an unusual dichotomy in our public subconscious regarding cyber security: We – as denizens of computer technology – are as wary as Jason Bourne about where, exactly, our cyber security threats are coming from. Are they coming from real terrorists and enemy spies? Is there really some vast criminal conspiracy afloat? Or are these threats perhaps coming from within the very ranks of government itself?  Who do you really trust and why?

Even the term “cyber” is a subconscious mnemonic to the old Marvel Comics super-villain of the same name, and enemy of Wolverine. Cyber, (alias Silas Burr) in the comic book, was once an agent of the Pinkerton Detective Service before he turned into a criminal mastermind. Why wouldn’t we be suspicious of government representatives telling us that we’re engaged in a kind of comic book war?

But data security is obviously not an issue about comic book super-villains, or government conspiracies. For example, in this same month that IQ2US was airing their debate many of us were receiving notices about a class action settlement. Countrywide Financial – the behemoth that sold mortgages during the real estate bubble and which is now owned by BofA – has begun the process of contacting customers whose identities may have been stolen when their records were pilfered by an employee.

No, it was not Jason Bourne nor Silas Burr, but a former Countrywide senior financial advisor who wanted to sell the names, SS#s, credit information, employment history, and other personal information of mortgage applicants.

The U.S. District Court’s remedy in the settlement will be to require Countrywide to provide free credit monitoring of all those involved in the class action suite for a period of 2 years, along with a potential liability against Countrywide of up to $50,000 for each incident of identity theft.

Isn’t it time we, in our organizations, got serious about data encryption? Shouldn’t we be stepping into this battlefield to fight back with a secure, managed file transfer system between our workstations and servers?

The cyber wars of comic books may populate our imagination, but our company’s challenges are much more real. And if we’re not mindful to use the right tools in our IT departments, we may all be faced with a customer base of angry Jason Bourne’s who have lost their identities through our security lapses.

(Listen or watch the televised debate produced by Intelligence Squared U.S. (IQ2US) entitled “The Cyber War Threat Has Been Grossly Exaggerated” by clicking here.)

Thomas Stockwell

Thomas M. Stockwell is one of Linoma Software's subject matter experts and a top blogger in the industry. He is Principle Analyst at IT Incendiary, with more than 20 years of experience in IT as a Systems Analyst, Engineer, and IS Director.

More Posts - Website

1.800.949.4696  |  sales@linomasoftware.com  |  privacy policy
Copyright ©1994 - 2012 Linoma Software  |  All rights reserved