Category: best practices
Securing the real perimeter – part 1
I was thinking about the way that the concept of a “perimeter” has changed in the time I have been in information security. (Obviously, I…
Recognizing and dealing with insider risk
I came across an interesting white paper from the deep mists of the past (2011) which is as relevant today as it was back when…
Boredom and security
We security management types would like to think that every task we give our minions is exciting and engaging. However, there are lots of security…
Juice Jacking – meh!
Lately, I have been seeing a number of posts and articles warning us all not to use publicly available USB charging points due to the…
The NYPD (and the rest of us) need some new barricades
Not all security barricades are made of wood. Some are made of bits. According to the New York Post, the New York Police Department ran…
Orvis data leak and the need to monitor ‘paste’ sites
Fishing retailer Orvis had a serious (and embarrassing) data breach recently. Independent security researchers found a posting on text snippet site Pastebin with what appeared…
US DoJ guidance on responding to and reporting cyber incidents
When thinking about how to respond to cyber security incidents, you need to think about how your organization will engage with law enforcement – and…
OWASP API Top 10 Security List
If your organization is developing software, chances are that your developers are building application program interfaces (APIs) to allow interoperability between your code and code…
Insider threat reporting by the numbers
I don’t normally take security advice from goats, but I think I need to make an exception for Red Goats. A recent report on insider…
Great resource for configuring TLS
OK, let’s admit it – issues around cryptography are the most complex and confusing part of information security. Aside from all that math, there are…
