Stuxnet: The Gift That Keeps On Giving

Remember that time when the Iranian nuclear program was flummoxed by the speeding up or slowing down of their centrifuges? Though the actors have never been formally identified, the special sauce to that enterprise was Stuxnet, and the secret ingredient of that sauce was counterfeit cryptographic certificates from known companies that greased the skids for the malware. Ars Technica is reporting that the secret ingredients are now commonly available for all of your over-the-counter malware needs, if you know who to call. (more…)

This Is Only A Test

Imagine a scenario in which one of your employees — Madge in accounting, or Skip in sales, for instance — selects an incorrect option from a drop-down menu and opens your network and data to the world. Working with that set of menu options is part of his daily routine, but for some reason the mouse clicks on the “organizational armageddon” option instead of the “test network security” option. (more…)

Got Your Head In The Clouds?

A recent cloud security report, as you might expect, had some good news and some bad. Somewhere in the middle is the news that’s just that: news. The cases you hear the most about, like the ransomware attacks, make up only about 2% of the overall picture, while web applications represent about 75% of the vulnerability. As for cloud storage and cloud services, the report found that public clouds are more than 50% safer than private or onsite storage. A recent article by Security Intelligence summed it up nicely, and we commend that to your reading list. That’s good to know, especially if you are scaling up or outgrowing your current storage arrangement. But it’s not a perfect system. (more…)

The Most Interesting IT Guy In The World

You’ve seen him at conferences, sporting an ascot and a pocket protector and making it look good. He works the vendor pit like he owns the place, collecting cards and envy from everyone he meets, and connecting demand with supply in subtle but glamorous ways. He walks into a seminar like he was walking onto a yacht, his credentials strung unassumingly around his neck like a lift ticket from Davos. The panel surrenders a seat at the table and he holds forth on contemporaneous cyber issues. He is undoubtedly the most interesting IT guy in the world. (more…)

The Cure For What Ails You

History is rife with examples of enterprising salesmen rushing into lucrative markets to fill a void, real or perceived. Contractors and roofers who work the hurricane and tornado circuits, lawyers pitching the massive settlements they’ve secured for their clients, and even gameshow hosts selling reverse mortgages and arthritis balms. Like the Wizard in Oz, when you pull the curtain back, it’s a simple snake oil salesman with a good story. And the cybersecurity world has been a growth industry for those who overpromise but underdeliver. (more…)

From Oslo With Love

Let’s say you’re in the widget business. You studied widgets in college, made Lego widgets as a child, even named your dog Widget. If there’s anything you know a thing or two about, it’s widgets. And you’ve built a great business building widgets. Those in the know call you the Widget King. You’ve put three kids through college on widgets and even bought yourself a little widget bungalow on a coastal island somewhere. You are the man, or the woman! (more…)

Camp Songs For IT Professionals

It’s summertime, and the livin’ is easy. Fish are jumpin’, and the cotton is high. If you’re lucky, the old memories from summer camp return to the fore, as nostalgia delivers you from the daily stress of network security and constant threats.

(more…)

Introverted Social Media

Even if we could isolate the recent activity of Russian hackers, imagine a mainstream marketplace for nefarious services provided by invisible people paid in Bitcoin.The information you seek is mined from the personal profiles and accounts of your target audience, whether that audience is a cheating spouse or a rebellious teenager with a hidden social media presence. It’s a complete violation of privacy, and we feed our own vulnerability with every trace of our digital footprint. (more…)

Bundle Up To Avoid The Cold

Forest covered in snowWith every passing week, it seems, cyberthreats and hacks inundate the news cycle and bring home the absolute insecurity that most of us experience (or should) when we take even the smallest of baby steps with our digital footprints. Of late, it’s the Russians who seem to take center stage, hacking our politics and manipulating our elections. Though we could debate the extent of the success, nobody seems to doubt the intent any longer. If those chilly diplomatic breezes seem to intimate a second cold war, will cyber be the weapon of choice? Is it already?

(more…)

Breach is a Heartbeat Away

heartbleedOpenSSL, the vehicle through which the Secure Sockets Layer protocol protects most websites that encrypt data, has reminded us again of both the vulnerability and security of open source development. The Heartbleed bug, an accidental code addition about two years ago, exploits the heartbeat option within OpenSSL, a mechanism that allows fluid connectivity between user and server via small, hidden signals or pings. Hackers breach the system by sending false signals that fool a website’s server into releasing sensitive information. Hence the vulnerability.

Heartbleed, though, also demonstrates the security of open source development. While its revelation created initial fear and chaos, the Heartbleed bug was fixed within about four days, largely because lots of eyes were on the prize, each pair of which had a vested interest in the elimination of the Heartbleed threat. Imagine if the SSL vehicle had been proprietary, owned by a quiet company with no taste for conflict or liability. Now that’s a hot mess. (more…)

ISO 9001 2015Technology Industry InnovatorsVeteran Owned Small BusinessCMMI Maturity Level 3CISSP® - Certified Information Systems Security ProfessionalCertified Penetration TesterITIL IT Service ManagementCertified Ethical HackerProject Management Institute CertifiedUS Department of Homeland SecurityDisaster Recovery Institute CertifiedCertified Information Systems Auditor