Women are eagerly needed in information security because we offer unique perspectives and there are so few of us. So far in this series, I interviewed Tiberius Hefflin, Tracy Maleef, Isly, Kat Sweet, and Jess Dodson--five different women from different parts of the English-speaking world and from different areas of IT. For my sixth and final interview...

Once again, researchers have uncovered security flaws that could allow malicious hackers to attack implanted medical devices, such as heart pacemakers and cardiac defibrillators, with the potential to deliver fatal shocks. In a newly-published paper, "On the (in)security of the Latest Generation Implantable Cardiac Defibrillators and How to Secure...

My talk at BSides Philly on December 3 is called "Hacking the Human: Social Engineering Basics," and it's about providing a social engineering foundation for people to adapt to their individual situation and needs. "Teach a man to fish" and all that, you know? Over the course of the talk I reference many thinkers, philosophers, psychologists, and...

For the third time in under a year, I've had to analyze a CVE against a third-party library I use that is related to CWE-502 De-serializing of Untrusted Data. In each case, the library maintainers have pushed back, correctly in my opinion, that the problem is not in the library itself but in the hosting application. Fortunately for me, my...

As humans and as users, we make mistakes. Sometimes we forget to implement that software patch until a week or two after its release. Other times, we decide to click on an enticing pop-up. Those types of actions can degrade our computer's speed and security. It's, therefore, our responsibility to adjust our behavior accordingly and protect ourselves...

Women in information security are a fascinating group of people. I should know, being one myself. But being female in a quickly growing male-dominated industry poses its own challenges. And those of us who pursue security and IT in spite of gender stereotypes have unique strengths and insight. I first interviewed Tiberius Hefflin, a Scottish security...

Women are vital to the information security field, but there are relatively few of us. Speaking to women in our industry gleams insights about how we've ended up in that male dominated field and perhaps how to attract more of us. I first interviewed Tiberius Hefflin, a Scottish security analyst who's working in the United States. Then I spoke to...

On September 20, 2016, the Mirai botnet temporarily brought down Brian Krebs' information security blog KrebsonSecurity.com. It did so by launching a distributed denial-of-service (DDoS) campaign, the attack traffic of which peaked at approximately 620 Gbps in size – one of the largest DDoS offensives the Internet has ever seen. A week or two later,...

A type of macro malware campaign has incorporated password protection into its attack emails in order to serve up ransomware. The campaign begins with an email that comes with an attached document bearing the .dot extension. It's password-protected, and the only way a recipient can open it is to enter in the password provided by the sender in the...

Hackers stole nuclear research data and personal information off of a computer at the University of Toyama’s Hydrogen Isotope Research Center. According to university officials, the hackers posed as a Tokyo university student to deliver a malware-laden document to a teaching member at the center, which conducts research on hydrogen, deuterium, and...

At least 58 million people have had their personal information published on the internet - including their names, dates of birth, email and postal addresses, job titles, phone numbers, vehicle data, and IP addresses - after a hacker stole a massive unsecured database. And, if you think that sounds bad, there may be yet more hacked data still to be...

Information security is a growing problem even in the protected, static environment of the business office. The challenges of securely accessing and storing data while traveling, however, are particularly acute, but they are manageable with (1) a high-level of awareness coupled with (2) a few good habits. Awareness Forget about hackers in the...

Crypto ransomware authors were really busy coining new samples, updating the existing ones and adopting novel techniques in September, just as they did in August and the months before it. Some of them opted for the use of pop culture themes in their victim interaction modules. Others started leveraging ‘autopilot’ offline encryption mode with no need...

We at The State of Security kicked off National Cyber Security Awareness Month (NCSAM) 2016 with a review of how companies can defend against common IT security threats. In one guide, we discussed how organizations can leverage their people, processes and technologies to protect against the likes of phishing and other risks. We then crafted...

TorrentLocker, a ransomware family member, is a type of file-encrypting ransomware that significantly infected Windows operating systems. It was first observed in February 2014 and released in late August 2014. Later, it released with five new major releases. TorrentLocker encrypts the victim's data files by using a symmetric block cipher AES and...

The old saying, "What you say can be used against you in a court of law," extends itself into other areas, such as business, finances and even parenting. Digital forensics is playing a critical part in court cases, executive layoffs and parenting situations. We can see why now – the mounds of data produced from digital forensics can result in rich...

Fraudsters have designed a new LinkedIn scam that uses phishing emails and a fake website to trick job seekers into handing over their CVs. The scam begins when a user receives a phishing email disguised as a LinkedIn email. In their message, the fraudsters inform the recipient that a company is "urgently seeking for immediate employment" in their...

My last series of interviews on women (and non-males) in information security was really popular. I spoke to some amazing minds in the cybersecurity field last fall. As spring arrived, I figured that there are probably a lot more professionals in our field who also have interesting stories to tell. Encouraging more non-males to enter the industry...

There has been a lot of news recently about the cybersecurity skills shortage. While there is a lot to be concerned about with all of the news about insecure devices and unsecured networks, I am confident that the shortage alarms are more headline-grabbing sensationalism than actual fact. In this two-part article, I will explore the problem of the...

In my last post, I briefly summarized the evolution of network security. I will now discuss how network security strategies are no longer meeting the needs of organizations' increasingly complex IT environments. A Different Strategy Technological innovation has changed the nature of the network itself. No longer are employees limited to their...