Categories
- Economics and Risk (14)
- Highlights (348)
- Identity Management (103)
- Incidents (31)
- Metrics (75)
- Quotes (2)
- Random (19)
- Threat Management (125)
- Trust Management (16)
- Vulnerability Management (201)
Archives
Addressing the Advanced Persistent Threat (APT)
In the past few weeks, the Advanced Persistent Threat (APT) has been all the rage in the infosec world. Security professionals everywhere are taking sides about whether APT is new or not, despite (or perhaps due to) the lack of a clear and consistent definition.
It started with Google suggesting (but not explicitly stating) that the ...
What does “Aurora” mean in Chinese?
George Kurtz of McAfee is providing some details about the hack attack against Google et.al. purportedly originating in China. One of his comments:
I am sure you are wondering about the name “Aurora.” Based on our analysis, “Aurora” was part of the filepath on the attacker’s machine that was included in two of the malware binaries ...
Meet my friend Micromort - he’s one in a million!
No, it i's not some sort of mini-Mortman! It's micromort, or in other words, a one-in-a-million chance of death. How can you add (or is that subtract?) a micromort to your... err.. life? Here are some options (from Wikipedia):
smoking 1.4 cigarettes (cancer, heart disease)
drinking 0.5 liter of wine (cirrhosis of the liver)
spending 1 hours in ...
Quick and Dirty Risk Calculations - CSI Survey Edition
The Computer Security Institute recently released its 2009 survey results (must register). One of the charts in the executive summary lists the frequency of occurrence in the survey population. Without any other information more pertinent or specific to your organization, you can use this information for quick and dirty risk calculations. Let me illustrate.
The frequency ...
Notes on the Heartland breach
The Heartland saga continues and it appears that things are going its way. Not only has the company been on a campaign to make lemons out of lemonade by selling the equipment ("end-to-end" encryption) to their customers (and, presumably others), but at least one shareholder lawsuit was dismissed.
The class-action suit had some interesting information: First, ...
Should we change passwords every 90 days?
[I was unsuccessful trying to post this as a comment on the Securosis blog so figured I'd post it here instead.]
David Mortman at Securosis recently posted with the following challenge:
Show me any reasonable evidence that changing all your users' passwords every 90 days reduces your risk of being exploited. No wonder they don't always listen ...
ENISA Cloud Computing Security Project
Today, the European Network and Information Security Agency (ENISA) released its Cloud Computing Risk Assessment report. I enjoyed participating on the project and making a number of new friends. As with most workgroups, this project had its ups and downs as each member found his position within the group. One of the biggest challenges was ...
Last Night’s NCIS Backdoor
Last night's episode of NCIS revealed a secret that has been hidden for quite some time. There is a backdoor in all iris scanners - two people have had their iris minutiae programmed into every iris scanner and can unlock any protected door (which amounts to about 5 doors, but important doors they must be)!
I ...