Cybersecurity is generally considered to be a highly reactive field where professionals struggle to keep up with new and emerging threats. As the profession works to become more human-centered and proactive, I have attempted to design a new modeling process that is highly pertinent to these emerging priorities. It combines the existing conceptual,...

Last time, I had fun speaking with Beth Cornils. She has a pretty cool job that involves testing IoT cars. This time, I spoke with Claudia Johnson. A cyber attack got her into the industry, and now she helps answer people's questions about cybersecurity. Kim Crawley: Please tell me about what you do. Claudia Johnson: In my current, as well as,...

An elite club in the United Kingdom has announced a data security incident where someone stole data pertaining to 5,000 of its members. Oxford and Cambridge Club. (Source: Wikipedia) The theft occurred when someone stole a backup computer drive for the Oxford and Cambridge Club out of a locked room...

In recent years, there has been a huge movement from storing data the traditional way, as the cloud has grown and become the better answer and option for companies and organizations alike. However, this has also led to a growth in cyber criminals and data breaches now that someone can access sensitive documents from their living room couch. As such,...

Federal and local authorities have arrested eight individuals in connection with a credit card skimming scheme that caused losses in excess of $3.5 million. On 17 November, representatives of the United States Attorney Western District of Kentucky's office, Kentucky FBI division, Secret Service, and the Louisville Metro Police Department announced...

The Australian Broadcasting Corporation (ABC) leaked sensitive data online through a publicly accessibly Amazon Web Services (AWS) S3 bucket. Public search engine Censys indexed the misconfigured asset on 14 November during a regular security audit of the S3 environment. Researchers at the Kromtech security center don't know who might have accessed...

If you thought it was scary when security researchers remotely hijacked a Jeep as it was driven down the freeway, consider this - now airplanes are getting hacked. The US Department of Homeland Security has revealed that a Boeing 757 airliner was successfully hacked as it sat on the runway at the airport in Atlantic City, New Jersey on September 19,...

Last time, I spoke with Nitha Suresh. She's written IEEE papers and knows her stuff when it comes to pentesting and aircraft data networks. This time, I had the pleasure of interviewing Victoria Walberg. She has a lot of ideas when it comes to IoT and the cloud. Kimberly Crawley: Please tell me about what you do, Victoria. Victoria Walberg: I'm a...

A group of Muslim activists hacked a 'secure' mailing list used by the ISIS terrorist group and published 2,000 of its email subscribers online. On 10 November, a spokesperson for Amaq, one of the Islamic State's key outlets for communicating with its supporters and members, sent out an email written in Arabic to its subscribers. The update...

Think of all the recent DDoS attacks. They all seem to share the common trait of bad guys disrupting the normal flow of data against a legitimate business. Sometimes, these attacks are used for revenge, and other times, they are used for ransom. Sometimes, however, the bad guys become the targets. This is the story of an odd caper that played out on...

Soft skills are a hot topic in information security. You’ll see a lot of articles, blogs and talks on the subject. I’d like to go a little deeper – beyond the basics of soft skills and talk about a concept from communication theory that can be used to achieve behavior change – efficacy. Efficacy is the ability to achieve a desired effect. In risk...

While data center consolidation has been trending in government and commercial spaces since the 1970s, new government initiatives and directives released recently have created a new sense of urgency: those who haven’t yet consolidated are now required to. Many organizations are now looking to the cloud to meet the requirements. Whether they know it...

I’ve been involved in information technology and infosec since the mid-1990s. Until recently, I had not been actively attending infosec or hacker conferences. I started attending DEF CON in 2013 when the conference was held at the Rio Hotel. DEF CON was the first hacker conference I ever attended. I did not know many in the community and certainly...

Ransomware activity didn’t skyrocket last month, but there was definitely a substantial increase compared to September. Perhaps the most serious wake-up call was the onset of BadRabbit, a Petya-like culprit going on a rampage in Eastern Europe. A likely successor of the Cerber ransomware dubbed Magniber started making the rounds via the Magnitude...

The social media landscape has undergone dramatic change in recent years. Elon Musk bought Twitter and changed its name to "X." Mark Zuckerberg bought Instagram and WhatsApp before launching Threads to capitalize on Twitter's recent PR disasters. TikTok came out of nowhere to become the platform of choice for Gen Z. One thing, however, has stayed...

"123456" has once again topped an annual list of the worst passwords created by users in North America and Western Europe. On 19 December, password management provider SplashData released the 2017 edition of its "Worst Passwords of the Year" list. The dataset comprises five million leaked passwords exposed by data security incidents over the course...

We want more of the CIA Triad. No, this has nothing to do with the US government agency. It stands for “confidentiality, integrity, and availability.” What it alludes to is the idea of protecting access to privileged information (confidentiality), asserting that the information hasn’t been tampered with (integrity), and that the information can be...

If the eyes are the window to the soul, then the Application Programming Interface (API) is the window to the software.After all, an API is a way for products to communicate with each other through a documented interface, just as the eye is a human interface, communicating with the outside world (but it’s not as well-documented as to meanings). APIs...

No-one responsible for computer security should forget what happened in October 2016. The Mirai botnet launched an attack on the internet, the scale of which had never been seen before. By unleashing a massive distributed denial-of-service (DDoS) attack on DNS service company Dyn, Mirai managed to knock out significant chunks of the internet -...

On 11 May 2017, President Donald Trump signed an executive order that provides guidance on strengthening the United States' digital security. The directive makes clear that each head of a U.S. federal agency or government department is ultimately responsible for managing their organization's risk. It also emphasizes their use of a specific document...