The demand for security auditing has shown its ugly head and now demands respect. Recent, well-documented events provide an image of why security auditing is necessary. If security audits had been carried out, and management had confirmed the results and taken action, some of these organizations might not be in the current predicament they are in....

Last week, I spoke with Candy Alexander. An attack by the famous Kevin Mitnick started her cybersecurity career! This time, I had the pleasure of interviewing Kim Wong. She recently started in a cybersecurity role in the UK's financial services industry. Kim Crawley: Tell me a bit about what you do. Kim Wong: I’m a security analyst in the cyber...

The Payment Card Industry Data Security Standard (PCI DSS) was introduced to provide a minimum degree of security when it comes to handling customer card information. While the Standard has been around for over a decade, penetration testing has only recently been officially incorporated into the process. There’s a lot to cover in a PCI DSS...

If you have read any of my posts or attended my webinars about security awareness, training, compliance, or other IT risk management items, you will notice a recurring theme: expecting technology to do all of the work in preventing a security or risk-related event is not the correct mindset. Rather, creating a culture of risk management is the key....

A malvertising campaign is distributing code that mines different cryptocurrencies inside an unsuspecting user's web browser. For the operation, computer criminals are targeting mainly visitors to video streaming and in-browser gaming sites based in Russia and Ukraine. They abuse an online advertising network to display ads containing custom...

A data breach might have exposed the personal information belonging to approximately one million users of the Canoe.ca portal. On 2 September, the news and entertainment gateway learned of a security incident that involved some of its databases containing records it collected between 1996 and 2008. The company, operated by MediaQMI Inc. and owned by...

"Cloud computing" is not a buzz phrase anymore, but it is essential for most businesses looking to achieve sound business continuity alternatives combined with a comprehensive security model. Cloud Computing What is cloud computing, and what does it do? Very simply, for the end-user, a cloud computing experience is no different than using a...

We've been hearing a lot about IoT security recently. The news is overwhelming us with stories about baby dolls and baby monitors that can listen in on conversations at home, not to mention surveillance cameras that provide video streams to unauthorized individuals. To better understand these events, let’s start by looking at what is IoT. According...

A researcher has uncovered security holes in Google's bug-tracking database that could have potentially resulted in malicious hackers accessing sensitive information, including details of ways to exploit unpatched vulnerabilities in Google products. Researcher Alex Birsan has described how he managed to trick Google Issue Tracker (known internally...

Negligence by a third-party contractor exposed the personal information of approximately 50,000 Australian employees online. A Polish security researcher who uses the moniker "Wojciech" discovered the information while searching for open Amazon S3 buckets. The details belong to 48,270 employees of Australian government agencies, banks, and a utility...

“Hello, again, friend. It all went quiet for a while and the depictions of hacking and cyber on TV seemed to become trite and clichéd again. We stopped seeing him, Mr. Robot, but now he’s back again. Did you see him, too?” This blog may contain spoilers and was written following ‘eps3.2_legacy.so,’ which seems a good enough point into the new...

BULLETIN CVE APSB17-32 CVE-2017-11292 Microsoft Browser - IE CVE-2017-11790,CVE-2017-11822,CVE-2017-11813 Microsoft Browser - Edge CVE-2017-11794,CVE-2017-8726 Microsoft Browser - Scripting engine CVE-2017-11796, CVE-2017-11808, CVE-2017-11809, CVE-2017-11805, CVE...

Britain's largest and busiest airport has launched an investigation to determine how someone found a USB containing 2.5GB of its data on the street. News of the incident involving Heathrow London Airport first came to light when an unemployed man contacted The Sunday Mirror. He told the tabloid he was on his way to a local library to search for work...

In my last interview, I spoke to Katherine Teitler, who is the director of content for MISTI Training Institute. She also helps run the InfoSec World conference. This time, I spoke with Carrie Roberts. She has a senior red team role with Walmart. She's also a pretty good cartoonist if I say so myself. Kimberly Crawley: Tell me a bit about what you...

Google has announced a bug bounty program covering other developers' popular Android apps available for download in its Play Store. On 19 October, the American multinational technology company launched its Google Play Security Rewards Program. Here's a high-level description of the new framework: "Google Play is working with the independent bug...

Nobody welcomes the prospect of having our online accounts hacked. It's a pain in the neck resetting passwords, warning your contacts, and worrying about the prospect that your identity may be stolen. But for some of us, the consequences of having our Gmail account compromised by state-sponsored hackers could be even more catastrophic and even life...

When designing systems today, everyone is aware that security is an essential feature, even in systems that you don’t think are critical. The recent Equifax breach brought home to me one of the most important factors of designing secure systems (software or not): delivering systems with secure defaults. In today’s threat-rich environment, the...

If you've read a security blog anytime in the last year, you haven't escaped mention of the dreaded skills gap for cybersecurity professionals. There seems to be consensus that it's getting harder to hire skilled security staff, though the reason for that is up for debate – some say we're just going about it the wrong way, while others claim it is an...

In my last interview, I got to speak with Keren Elazari. Not only did she start BSides TLV but also contributed to a book about women in technology. The book is Women in Tech: Take Your Career to the Next Level with Practical Advice and Inspiring Stories, which was authored by Tarah Wheeler. So, guess who I got to speak with this time? Yep, Ms....

As organizations' IT environments become increasingly more complex, so too does the software they install on their systems. Software developers and managers have embraced microservices written in node.js and Spring Boot, for example. These new types of dynamic applications challenge organizations to establish appropriate trust chains and secure old...