Categories
- Economics and Risk (23)
- Highlights (362)
- Identity Management (104)
- Incidents (34)
- Metrics (80)
- Quotes (2)
- Random (25)
- Threat Management (126)
- Trust Management (16)
- Vulnerability Management (207)
Archives
Vulnerability Research in the age of Embedded Systems (SCADA)
I have a post over at the Verizon Business blog (Considering Vulnerability Disclosure in the Realm of SCADA Systems) about how vulnerability discovery and disclosure impacts risk. Although it provides a basic risk model that can be applied to any situation, it focuses on the recent SCADA disclosures by Digital Bond and Rapid7. These are some ...
Evaluating the Oracle Security Manifesto
The cool thing about Mary Ann Davidson is she doesn't mince her words; you know where she stands on every issue and she is willing to own it in the security world. So when I started hearing some buzz about her latest blog post - Those Who Can't Do, Audit - I expected some sizzle. ...
Liability and Secure Software
iang over at Financial Cryptography has a thought-provoking discussion of liability (ht @alexhutton) and its corresponding risks. I think I added a comment (but can't be sure) that said this:
Culture and consciousness is all a distraction and very malleable. What really matters at the end of the day is the relative number of vulns in ...
My Dream Metrics Status Report
"Last month, our IT and information assets generated $20 million in revenue in support of 15,000 people using 350 applications. To accomplish this feat, over 32 million connections were attempted across our systems and we applied specific control measures an average of 2.4 times per connection to ensure the completeness and accuracy of our transactions. ...
Dr. Laura as Information Security Officer
[One of my first Trend Watch essays circa 2000 or whenever Dr. Laura - the queen of saying "no" - was popular]
Dr. Laura: “Hello Kate, you’re on the air”
Kate: “Hi, Dr. Laura, thanks for taking my call. My security dilemma is that I would like to open a port in our firewall…”
Dr. Laura: “ No. ...
Thinking about APTs and the RSA Hack
The recent RSA hack has once again (after Google and Aurora made a big splash a little over a year ago) brought to the surface this notion of an "advanced persistent threat." There is great emotion on all sides of the debate about what it is and whether it matters. As I listened to Uri ...
EMC (RSA) Acquires Netwitness
It is no surprise that EMC has acquired Netwitness. Looks like they are serious about this security stuff ;-)
Here is a list of EMC / RSA acquisitions through the years, for your historical enjoyment:
July, 2001 RSA Security acquires Securant
March, 2006 EMC acquires Authentica
April, 2006 RSA Security acquires PassMark
June, 2006 EMC acquires RSA Security
September, 2006 EMC ...
Just a Reminder for RSA: The “P” in APT stands for “Persistent”
RSA's Chairman Art Coviello has issued an open letter to its customers about a security breach that resulted in lost information related to SecurID. Two lines don't seem to go together:
"Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA. We took a variety of aggressive measures against ...