MD5 hashing, due to the avalanche effect, is a really easy detective control to bypass. (Other algorithms exist, like ssdeep, that are a bit harder but not widely used.) So, then, why don’t many attackers bother modifying the file?
Watch more videos on my YouTube channel.
What happens when a control fails? And have we considered the fail state when designing our security system? Take, for example, credit cards and Format Preserving Encryption (FPE).
Watch more videos on my YouTube channel.
An overview of the malicious activity seen taken against critical infrastructure in the US.
Watch more videos on my YouTube channel.
Want to find a mentor? Want to know how to be a mentee? Well, check out Timothy De Block’s episodes of the Exploring Information Security podcast. I was on along with Javvad Malik (@J4vv4d), Johnny Xmas (@J0hnnyXm4s), and Amanda Berlin (@InfoSystir). If you’re wondering where to start, here is your answer.
First, how to find a mentor? Decide what you want to learn and where you want to strengthen. Keep an eye on the people you already know. Be curious, be humble, and seek advice. Offer something in return, even something as simple as sharing your story.
Finally, how to be a good mentee? Be specific in your requests and keep your commitments. Expect to put in the work. We need to realize that mentors are guides, not teachers, and that we are there to dig and hunt and learn. Show up and follow through.
In the end, its about applying the hacker mindset to mentoring. So take a listen.
Edit 2017-01/14: Once you’re done listening, check out the relaunch of the InfoSec Mentors Project. Headed up by Jimmy Vo (@JimmyVo) and Keith Hoodlet (@andMYhacks), The InfoSec Mentors Project provides a platform for finding and connecting mentors and mentees.
Business continuity is strategy. Disaster recovery is tactics. And it is snowing in Detroit.
Watch more videos on my YouTube channel.
Structuring work for junior and mid level folks so that they can grow and develop as professionals.
Watch more videos on my YouTube channel.
A summary of AWS controls around security groups and the thinking behind redundant controls for state and activity.
Watch more videos on my YouTube channel.
Last year, instant messages from Gawker staffers were cited as evidence in the defamation lawsuit filed by professional wrestler Hulk Hogan.
What they revealed wasn’t pretty: tasteless jokes about the former pro-wrestler’s sexual trysts and his genitals, snide remarks that weren’t meant for publication.
The transcripts quickly became a cautionary tale for journalists who might exchange sensitive information via instant message (and the companies that host them).
Newsroom instant messaging apps have only gained momentum since then, with Slack among the vanguard thanks to its ease of use and its cool-kid factor.
Journalists should exercise more caution when it comes to digital tools like Slack, said Wolfgang Goerlich, director of cyber security strategy at CBI, a risk management firm that provides security solutions for companies.
“As no chat system is immune to being misconfigured or misused, my advise is to limit any information over such channels,” Goerlich said. “Meeting in person for conversations remains the gold standard for the highest level of privacy.”
Read the full article:
Don’t want the public to see your newsroom’s gossip? Don’t put it on Slack.
https://www.poynter.org/2017/dont-want-the-public-to-see-your-newsrooms-gossip-dont-put-it-on-slack/444202/
Sussing out the recent attack widely trumpeted by the media as Russians hacking the US power grid. Spoiler alert: it wasn’t.
Watch more videos on my YouTube channel.