Branden R. Williams, Business Security Specialist

The Book, It’s OUT baby! standard

That’s right! If you pre-ordered our (Anton Chuvakin & mine) book, you should be receiving it today! It’s chocked full of all kinds of fun stuff. For example, did you know that I worked in the word “brewdog?” In fact, let’s make a contest out of this. The first five people to email me the page number in the book where that word appears will be entered to win a $30 Amazon.com gift card! Anton has a video in his blog where he talks about the book, and I have something special coming up soon. I’ve got it half done, but have not recorded the actual video of me talking yet. Look for that early next week or late on ...

Craking as a Service (Caas)? standard

This is not a new concept, and has even been discussed here before. PC World is reporting that a new service is available for all of us. Have a WPA PSK you want to crack? It will cost you $34 and about 20 minutes. WPA Cracker is a new service launched by the same researcher that has spent time attacking SSL/TLS over the last few years. While the price may be a little high, it certainly represents an interesting shift in activities typically reserved for botnets or universities with large computing resources. Where else could we take this? Rainbow tables for most hash types are readily available through Bit Torrent, or can be generated with simple scripts and a chunk ...

SIEM and VOIP standard

What in the world are those two topics doing in the same post? Well, I’ve got a small roll-up for you. Here are two blog posts you should read. Both are short and relevant, exactly what most of us like! The first is a post from my co-author Anton Chuvakin entitled Log Management + SIEM = ?, a post that lays out four scenarios where SIEM and LM can be combined as part of the technology deployment of a security strategy. This field is something that I’m enjoying watching grow, and in fact my new employer plays in the space. Log management and SIEM are both critical functions to any security environment. While mature installations may not be able to ...

“PCI Compliance” Book 30% Discount code standard

It’s coming! Don’t miss getting your copy on December 15th! During the entire “launch month”—December 2009—you can get our book at a 30% discount using the code: “SYNGRESS30“. Here is some more info: Book website (check out a couple of free PCI DSS sample policies there!) Official page of “PCI Compliance” at Amazon Book page at Syngress website (has full book Table of Contents); for the above discount code, you have to buy it from here. My co-author, Anton Chuvakin, and his blog. Anton & I worked VERY hard on this book, and under a very tight deadline. Of course, the final week of writing occurred during BlackHat, and I distinctly remember late night writing sessions at home while Anton ...

Herding Cats December: Disclose Me standard

Everyone is entitled to SOME right to privacy, right? Boy, thank goodness that isn’t the case, otherwise YouTube would be dead. In this month’s edition of Herding Cats, I explore the history of the right to privacy as well as the challenges with Social Media and the next generation of netizens. So go check out this month’s edition of Herding Cats here! Update 9:00pm: Fixed the link. Sorry bout that! Thank you, Nick! Possibly Related Posts: Top Posts from 2015 October 2015 Roundup September 2015 Roundup August 2015 Roundup June-July 2015 Roundup

November 2009 Roundup standard

Taking a hint from Anton Chuvakin’s blog, I thought I’d start posting the five most popular posts from the previous month. If you have not had a chance to read everything here, give these five a try! Here are the five most popular posts from last month: To New Beginnings. It was an epic run. Six years with the same company, seeing it through two acquisitions/divestitures, and working with some of the best in the industry to build a world class consulting organization makes you nostalgic. It was time to move on, and lots of folks were interested! Will PCI Mandate the Use of Data Discovery Tools? Some views on the ups and downs that DLP and data discovery tools ...

Consider Outsourcing Cashless Payments standard

One of the things that baffles me every time I walk into a retailer struggling with PCI compliance is why management doesn’t consider completely outsourcing all of their cashless payment processing. I know how we ended up in this situation, but who takes the blame for continuing to push this paradigm forward? Let’s take payments off the table and re-focus on the information we store. Information today is the lifeblood of business. The value of information is in the process of distilling petabytes of information into actionable tasks that create competitive advantage. Because information is perceived as highly valuable, the general position of information managers is “store or get access to every piece you can, then we’ll figure out how ...

The Gobble-Gobble of Public Networks standard

Here in the US we celebrate and give thanks for the harvest on the fourth Thursday of November, one month after our Canadian brethren did. Does security stop just because most companies in the US are closed? Nope, in fact, I’d like to give a shout out to all of you folks taking the overtime pay to spend time babysitting your networks. For you, I am thankful. The PCI Europe meeting has been the topic of several blog posts recently, and here’s yet another one inspired by the Q/A session at that meeting. The Technical Working Group (TWG) must cringe when the definition of public networks is asked in a crowd. I believe that this was one of those phrases ...

Multi-Function Service Providers, What To Do? standard

Service providers have dealt with compliance-driven information security mandates for much longer than merchant’s have. The catalyst for Visa’s CISP program was reportedly service providers, but enforcement ultimately expanded to all stakeholders. Regardless of its origins, a certain class of service provider has significant challenges complying with these requirements without shuttering portions of their business. Let’s say that a financial service provider is processing credit card transactions as an acqurier, as well as doing issuer processing for other third-party banks. How can the business comply with PCI if they also must store prohibited data in order to process on behalf of their issuer customers? That, my friends, is one of the big questions in the industry today. Attendees from both ...