Archive for December, 2009

Meet my friend Micromort - he’s one in a million!

Posted on December 14 2009 by Pete Lindstrom

No, it i’s not some sort of mini-Mortman! It’s micromort, or in other words, a one-in-a-million chance of death. How can you add (or is that subtract?)  a micromort to your… err.. life? Here are some options (from Wikipedia):

smoking 1.4 cigarettes (cancer, heart disease)
drinking 0.5 liter of wine (cirrhosis of the liver)
spending 1 hours in [...]

Quick and Dirty Risk Calculations - CSI Survey Edition

Posted on December 14 2009 by Pete Lindstrom

The Computer Security Institute recently released its 2009 survey results (must register). One of the charts in the executive summary lists the frequency of occurrence in the survey population. Without any other information more pertinent or specific to your organization, you can use this information for quick and dirty risk calculations. Let me illustrate.
The frequency [...]

Notes on the Heartland breach

Posted on December 14 2009 by Pete Lindstrom

The Heartland saga continues and it appears that things are going its way. Not only has the company been on a campaign to make lemons out of lemonade by selling the equipment (”end-to-end” encryption) to their customers (and, presumably others), but at least one shareholder lawsuit was dismissed.
The class-action suit had some interesting information: First, [...]

Should we change passwords every 90 days?

Posted on December 8 2009 by Pete Lindstrom

[I was unsuccessful trying to post this as a comment on the Securosis blog so figured I'd post it here instead.]
David Mortman at Securosis recently posted with the following challenge:

Show me any reasonable evidence that changing all your users’ passwords every 90 days reduces your risk of being exploited. No wonder they don’t always listen [...]