April 24th, 2002 - Users Turn to Guardian Digital for Expertise

Responding to the rising demand for authoritative documentation on email configuration and security, resident Guardian Digital network guru Pete O'Hara authored the most comprehensive and definitive guides on the Postfix mail server program to date.

Exclaims Jared Raddigan in a post to the public EnGarde community, "I just read your entire Postfix doc (Configuring Postfix) and I wanted to say good job. I actually have the only Postfix book that is currently out and I used both it and your HOWTO, and I found your document was very competitive (on the comparable chapters) if not better. You have to admit it's a good sign when I am using ESL HOWTO's for both my ESL box and other non ESL boxes."

Configuring Postfix - This document outlines running Postfix on EnGarde. Wietse Venema, author of Postfix and several other staple Internet security products, describes Postfix as an "attempt to provide an alternative to the widely-used Sendmail program. Postfix attempts to be fast, easy to administer, and hopefully secure, while at the same time being sendmail compatible enough to not upset your users."

http://www.linuxsecurity.com/feature_stories/feature_story-91.html

April 9th, 2002 - Survey: Many Microsoft customers lack funds for new licensing

The study of 1,400 IT executives worldwide conducted by Information Technology Intelligence Corp. (ITIC) and Sunbelt Software found that 41% of respondents said they did not have the funds to convert to Microsoft’s new License 6.0 volume licensing plan by the July 31 deadline.

March 24th, 2002 - Which Linux Vendor?

Is your Linux vendor watching out for your best interests? Are they providing you with the level of security and support you demand? At least one Linux vendor has switched their focus to the largest of companies, dropping support for others, according to this ZDNet article

"Red Hat, ... has restructured to focus on big customers while cutting jobs elsewhere, executives said Tuesday. Red Hat eliminated its network consulting group, which the company acquired for $47 million in February 2001.

The company is paring down to focus on selling its operating system products and services to large corporate customers." There are many things to consider when choosing the right Internet solution for your business. How many servers do you have? If you don't have at least five, Red Hat won't support you. Concerned about security? Then doesn't it make sense to choose the one designed to withstand the hostile nature of the Internet? Guardian Digital, primary sponsors of EnGarde Secure Linux, provides support and services for organizations with one to one hundred servers.

---

March 14th, 2002 - Significant Vulnerability Afflicts Linux Systems

The vulnerability is rooted in the free() function and how it used. Quoting from the EnGarde Secure Linux advisory, "The zlib shared library may attempt to free() a memory region more then once, potentially yielding a system exploitable by certain programs that use it for decompression. Because certain packages include their own zlib implementation or statically link against the system zlib, several packages need to be updated to properly fix this bug."

---

March 4th, 2002 - Latest EnGarde Linux Updates: mod_ssl and mod_php

Ensuring that your systems are updated is an integral part of maintaining a secure Internet presence. Two security updates were released today for EnGarde, one for PHP and another for mod_ssl.

mod_php - There is a vulnerability in PHP's MIME data parsing code which may allow an attacker to execute arbitrary code as the web server user. Click for Advisory

mod_ssl - There is a buffer overflow in mod_ssl, part of EnGarde's apache package, which an attacker may potentially trigger by sending a very long client certificate. Click for Advisory

---

EnGarde implements the "Secure by Design" methodology, and this article in CIO describes how it dramatically increases your ROI. "Security has been an add-on at the last minute, and detecting security problems has been left to users." And, of course, hackers.

Overall, the average company catches only a quarter of software security holes. On average, enterprise software has seven significant bugs, four of which the software designer might choose to fix. Armed with such data, the researchers concluded that fixing those four defects during the testing phase cost $24,000. Fixing the same defects after deployment cost $160,000, nearly seven times as much.

The ROSI breakdown: Building security into software engineering at the design stage nets a 21 percent ROSI. Waiting until the implementation stage reduces that to 15 percent. At the testing stage, the ROSI falls to 12 percent.

---

Guardian Digital, Inc., the open source security company, has today announced a key partnership with iTS-LiNUX, the premier Linux distributor in the United Kingdom. Terms of the partnership include exclusive rights to distribute Guardian Digital Internet server software, including EnGarde Secure Professional.

---

Guardian Digital, the first full-service Open Source Security company, today unveiled Guardian Digital Secure Network, a central location for receiving product information, support, and system software services.

---

Guardian Digital, Inc., the open source security company, has today released the enterprise edition of its highly successfully EnGarde Secure Linux server operating system. EnGarde Secure Professional is a comprehensive software solution that provides all the tools necessary to build a complete online presence.

---

Further information on why open source leads to a more secure environment. Bruce Schneier comments in this article why he thinks Microsoft wants a closed-door policy on security vulnerability disclosure. "Security firms, [ScottCulp] says, can just whisper the problems to Microsoft, which will promptly patch the hole.

Bruce Schneier, chief technology officer of Counterpane Internet Security, says that won't happen. Microsoft has always treated security threats as a public relations problem, so it would do anything it could not to publicize its susceptibility, Schneier says. "Companies like Microsoft would ignore security researchers who quietly informed them of security vulnerabilities," he explains. "They would lie to the public and say
that the vulnerabilities were 'theoretical only' or 'impractical.' "

---