Main Page - SecurityForest
Now this is interesting, I've not had the chance to download/look at the software from the site but it claims to be similar to metasploit but with far more exploits.....
Which would be cool. one to look at anyway...

Ask me no secrets and I'll tell you no lies
A write up at Arstechnica of another successful social engineering excercise in London.... of course there's the usual point about how much of the information gathered is actually accurate, but I think it's still a good example of why humans can, in many cases, be the weak link in a security solution.

Surftp - Web Based FTP
handy site for accessing FTP sites from locations where you only have HTTP access. Of course, if you're paranoid like me then you wouldn't trust this service to transfer any sensitive data in the clear, as while they say they won't use any of the info. gained there's nothing to guarantee that..... (not that I'm implying they will, I'm just paranoid !!)

Breaking Firewalls with OpenSSH and PuTTY
This is a good walkthough on using SSH to tunnel other protocols through firewalls.
Usually though, I find that the protocols which are left open on firewalls these days are HTTP and sometimes SMTP....
Of course HTTP is all you need as things like SSL VPNS can be used to tunnel arbitrary protocols.... over HTTPS... while I think of it, there's a handy free one called SSL explorer

Security Clinics & Labs
Cool security info. from Microsoft.....

Martin McKeay's Network Security Blog: Still trying to absorb this one
A pointer to an interesting article to read...

Legal threat stops flaw info release - Computerworld
Well this isn't a good thing for security research in my opinion. Whilst I don't always think that security companies getting press by releasing exploits is a good thing, it is one of the main ways that software companies seem to be put under pressure to improve the security of their software.
Ideally companies would always be proactive about improving the security of their systems, but in the real world other things tend to take precedence, unless it's made a priority for them by external people, either security researchers pointing out flaws, or "black hats" exploiting their software...
Arguably if Microsoft hadn't developed such a bad reputation for security a couple of years ago, we wouldn't have seen all the excellent initiative their producing now.....

Robert Hensing's Secure Windows Initiative Blog : Windows Server 2003 spanks Red Hat's monkey?
Some interesting comment about the study comparing Redhat and Windows Server 2003 over at Robert Hensings blog.
As people'll know if they've been following slashdot, it turns out that this study was sponsored by Microsoft . More information and a link to the report source here
At first glance I like the principles behind the methodology used, ie use a specific server role, rather than a generic install. I'll hopefully get a chance to read it in more detail, but a couple of things do niggle at me from my first read through.
When they go through the nmap results for the "minimal" linux install, it appears to have ports open that weren't there on the full install! (631/tcp for cups) I find that a bit hard to believe, and even if there is a flaw in the install process, any competant admin will shut down and remove cups as soon as they realise it's running.
Also any competant admin will shut down other services like the rpc ports mentioned (111/tcp and 32768/tcp) and remove the software using them.
Not being too up on my MS stuff at the moment I can't comment whether simple hardening steps would improve it's performance (As far as I can recall shutting down ports like 445 is nigh-on impossible outside of firewalling the host)
All-in-all it's an interesting study and definately shows that the more modern Microsoft products have a much better stance in relation to security.
[rant] If only their marketing people would allow them to abandon their "you must install irrelevant components and then we'll make it really hard to remove them" stance, they'd be onto a real winner!
why do Microsoft insist that you need an Internet browser on a server! for that point why do you have to install a GUI on a server! it's irrelevant in many cases. The server will be put in a rack in a datacentre and no-one will physically log onto it again![/ rant]

Sharp Ideas: List of Information Security Mailing Lists (more than just Bugtraq and Full-Disclosure)
Handy link to loads of security mailing lists

IS 17799 & BS 7799-2 White Papers (index)
Came across this page, looks like a good source of information about 7799.