Categories
- Economics and Risk (14)
- Highlights (348)
- Identity Management (103)
- Incidents (31)
- Metrics (75)
- Quotes (2)
- Random (19)
- Threat Management (125)
- Trust Management (16)
- Vulnerability Management (201)
Archives
Microsoft’s Security Intelligence Report - Day 2
More off-the-cuff ramblings while reading Microsoft's Security Intelligence Report:
will I actually get through this report? life intervenes...
page 68: interesting data on parent and child malware... but I don't know what to do with it.
page 71: "An infected computer can belong to several different botnets, which overlap to varying degrees." It appears that infected systems sleep ...
Somebody Pinch Me
Saw this headline on the InfoSecurity News mailing list today:
"Firms spend only up to 20% of their budget on IT security"
This is one of the more bizarre statements I've seen in a long time. It refers to one person's notion of security spending in the United Arab Emirates. The article interviews representatives from Symantec, McAfee, ...
Top Ten Web Security Risks
Here is a list of the top ten Web security risks:
Hidden Manipulation
Cookie Poisoning
Backdoor and Debug Options
Buffer Overflow
Stealth Commanding
3rd Party Misconfiguration
Known Vulnerabilities
Parameter Tampering
Cross Site Scripting
Forceful Browsing
Looks like a pretty timely list, doesn't it? Actually, I pulled this list out of my archive. I got it from Sanctum when they called it "10 Types of Web Perversion" ...
Confirmation Bias at work?
Evan Schuman has an intriguing blog post on the McAfee blog about whether the reduced number of data breach reports at DataLossDB.com are indicative of fewer actual data breaches. His answer is unequivocally "No." His reasoning is as follows:
Media outlets are less interested in data breaches and therefore not publicizing them as frequently.
Retailers, banks, and ...
Ramblings while reading Microsoft’s Security Intelligence Report
I just downloaded Microsoft's Security Intelligence Report. Given my predisposition toward good stats, I am looking forward to reading it. Herewith is a running chronology of my thoughts as I read it:
opening pages - 25 authors! even more contributors! wow - it better be worth it...
232 pages!
page 8: "the most significant trend in 1H09 was ...
Lindstrom’s Razor is not about security spending
After a few conversations, and having seen (part of) Russell Cameron Thomas' post on the topic, I am beginning to realize that people are making a common mistake about Lindstrom's Razor, which states:
The digital assets in question must be worth at least as much as you pay for them.
It is important to recognize that these ...
What is “Lindstrom’s Razor”?
Yesterday, Andrew Jaquith from Forrester blogged about digital asset value, in response to Russell Cameron Thomas' post on the same topic, which was in response to a Jeremiah Grossman tweet*. Andrew's post mentioned a cost-based approach I use for valuation that he aptly named "Lindstrom's Razor" (has a nice ring to it, doesn't it? ;-)). ...
You say you want an evolution…
... well, you know, we all want to change the world.
Josh Corman from ISS/IBM is ready for change. He lays out a call to action over on fudsec.com. Lots of good comments over there. Here is my contribution:
I agree wholeheartedly that we need to consider evolution and that our profession is reticent to do so. ...