Categories
- Economics and Risk (14)
- Highlights (348)
- Identity Management (103)
- Incidents (31)
- Metrics (75)
- Quotes (2)
- Random (19)
- Threat Management (125)
- Trust Management (16)
- Vulnerability Management (201)
Archives
Social Networking Security
Hang on, I'll get to it after I get to the next level of Farmville...
Best Practices for creating Best Practices
Given that best practices are here to stay, I thought it important to come up with a set of best practices for creating them:
Don't let the "practices" part of best practices get in the way. Best theories work just as well.
Don't let the "best" part of best practices get in the way. Mildly useful practices ...
Should you swap out Windows for better security?
Brian Krebs at Security Fix does excellent research into breaches, but I cringed when I saw his advice to "business owners" about how to protect themselves from cybercriminals:
"The simplest, most cost-effective answer I know of? Don't use Microsoft Windows when accessing your bank account online."
In my opinion, this is horrible advice, especially to small and ...
Information Systems Security Association
I am off to the Information Systems Security Association (ISSA) annual meeting this weekend where I'll be taking over as Director of Operations, a volunteer position. I would be interested in hearing your thoughts about the organization - things it does well, where it could get better, etc.Comment here or send me an email.
The Question of Low Priced PCI Assessments
Branden Williams at Verisign (who has a great security blog, especially for its coverage of PCI issues) posts about a Bob Carr, Heartland Payment Systems, interview. The gist of the interview is don't hire the low-cost bidder. Branden's final comments:
Of course, this attitude requires foresight. Which would you rather do:
ask for more money today, or ...
Whenever I read a post like this…
Bruce Schneier posts on how he signs guest registers using somebody else's name:Since I read that, whenever I see a tourist attraction with a guest
register, I do the same thing. I sign "Robert J. Sawyer, Toronto, ON"
-- because you never know when he'll need an alibi.This type of thing goes on all the time among ...
Implied Value of Life
When I wrote a while back about implied value, I was thinking about this story I saw a while back in the New York Times. In it, economist Stan Smith used an implied value calculation to estimate the value of life experience which he calls "hedonic damages":THERE is economic damage from a wrongful death: the ...
Why won’t anyone define what “failure” and “hopeless” mean?
It is easy for security folks to get into a funk. We exhibit huge levels of confirmation bias associated with the publicity associated with "how bad things are" and ignore the often boring and yet extremely more common case of things [on the Internet] being "good". So folks end up saying the Internet is failing ...