February | 2012 | Branden R. Williams, Business Security Specialist

RSA Conference 2012, Are You Ready? standard

Some people are already in San Francisco, or will soon be enroute. It’s going to be legen… wait for it…. DARY! Watch the blog next week as I’ll be posting quite a bit of fun stuff, including some stuff on Monday that includes a freebie! You can expect the volume of posts to be pretty crazy next week, so follow me on Twitter, like me on Facebook, and/or keep the RSS feed handy for tons of great stuff! You will be able to find me in Room 131 at 2:40pm on Tuesday talking about the Dark Side of a Payment Card Breach, and expect to bump into me at the Expo hall, the RSA Booth, and the Securosis Recovery Breakfast ...

21st of February, 2012
In: Consumer Security, Enterprise Security
0
0

Implementation is Everything standard

Last week gave way to a flurry of activity around RSA and an alleged cryptographic flaw in the algorithm based on this report by Arjen K. Lenstra, James P. Hughes, Maxime Augier, Joppe W. Bos, THorsten Kleinjung, and Christophe Wachter. RSA’s Sam Curry writes a post here, as well as posts by Dan Kaminski, Nadia Heninger, and this New York Times article. As I was reading through this whole mess and understanding the technical issues at hand, I started thinking that the description of the problem, ultimately a lack of entropy in a particular implementation, is something that the security industry has dealt with before. You don’t have to look very far to see implementation problems that cause both minor ...

Activity is Cranking, #RSAC in Ten Days! standard

For most of us security professionals, our busy season kicks off with the annual RSA Conference in San Francisco. The last two days has been a frenzy of activity with a ton of my time reserved in the last 24 hours. I’m looking forward to this RSA Conference for a couple of reasons. It might be the biggest one yet! I get to spend time with media and analysts talking about our stuff. I’m speaking! Tons of great networking opportunities. I hope that I will see you there! Possibly Related Posts: RSA Conference 2013, YOU READY!? New Security Services from EMC Consulting Enable Trusted IT GRC in the NextGen Data Center Trusting Identities in the Cloud Discover Your Security Persona ...

Cracking iOS Privacy standard

I had an article pop up on my radar yesterday on iOS Privacy, specifically where a researcher found that a particular app (Path) was uploading data without explicit permission. iOS, in some respects, feels like it has been given a pass with the type of traffic it passes (and how it does so) because a significant number of iOS users are in fact iPhone users, where traffic often moves over cellular networks. Those networks are coming under increasing scrutiny as the equipment required to disrupt or spoof cellular communications is quite affordable whereas in years past that was a massive barrier to entry. With Facebook getting in all kinds of hot water over privacy concerns, how did iOS get a ...

PCI Compliance for…. standard

We are almost done with the next edition of the book! Anton & I are cleaning up a few last edits in the first manuscript and it will be in the publisher’s hands. One topic that we kept coming back to when writing this edition was broadening our scope to go beyond big, Level 1 merchants and service providers. We even dedicated a chapter to small businesses in this edition, and give you tips for what to do when starting a business that needs to accept payment cards. But one thing that strikes me as I reflect upon writing that chapter is the overwhelming urge to make the chapter three words long. Those three words would be: Just. Outsource. It. ...

Herding Cats: No Bubble People (February 2012) standard

Have you checked out ISSA Connect yet? The next issue is up there with my column, No Bubble People. We must assume malware will end up in our network. Unless we treat our users like the Boy in the Bubble, they will click things and infect themselves—many times without even realizing it. This month’s column discusses the war we face understanding that we cannot fight or even win every battle. If you are a member, log into ISSA Connect and join the discussion! Interact with great professionals globally as well as the authors that you enjoy reading every month. If you are not a member, sign up today! Possibly Related Posts: Top Posts from 2015 October 2015 Roundup September 2015 ...

January 2012 Roundup standard

What was popular in January? We’re already one month down in this new year and most of us have our sites set on RSA Conference in three weeks. Let’s talk infosec! Here are the five most popular posts from last month: Myth Busting with Ben Tomhave and Corporate Responsibility with Ben Tomhave took the top two spots this month. Ben Tomhave and I got into a fun discussion over Twitter that ended up going in two directions. First, can merchants self-assess, negating the need for a QSA-lead merchant assessment? Intelligence Driven Security. The latest Security for Business Innovation Council report is out, and one key indicator is that we have tuned our systems to support compliance, not security. Read this ...

1st of February, 2012
In: Consumer Security, Enterprise Security
0
1

Hardware Security, the New Frontier? standard

RSA Conference is right around the corner, and I’m excited to actually be able to see some talks this year. I’m on a panel with Dave Navetta and Serge Jorgensen on Tuesday covering the Dark Side of a Payment Card Breach (LAW-107, Room 131, 2:40pm). I am sure if you are there, we will bump into each other somewhere along the way! One of the topics that I want to explore with other security folks while I am there is a shift to hardware-focused exploits whereby you bypass software and focus on firmware to control machines. It’s not a new concept and has been seen in both theoretical and actual attacks on systems. But as software vulnerabilities are closed, the ...

Monthly ArchivesFebruary 2012