Things to Consider When Buying a Password Manager, U.S. News

Archive for the ‘Blogs’ Category

Things to Consider When Buying a Password Manager, U.S. News

Posted by

Modern life means the proliferation of passwords. From banking to BBC iPlayer, nearly every website or application requires creating a password. But remembering multiple passwords is cumbersome and using the same easy-to-remember password for every application is a security nightmare. This is where password managers have come into their own

Excerpt from: Best Password Managers in the UK

Things to Consider When Buying a Password Manager

Security features and encryption. “It’s important to determine whether your passwords are safeguarded with multi-factor authentication and if the protection is structured so that only you have access to your data,” says Wolfgang Goerlich, faculty member at cybersecurity research and advisory firm, IANS Research. “This is commonly known as zero-knowledge architecture, which is a great way of saying that the vendor cannot access my passwords and secrets.”

Data backup and sync. For business users with “higher demands on the availability and integrity of their password manager”, Goerlich says that it is important to look into data recovery options, especially if the product is cloud-based: “If the cloud becomes unavailable, the password managers need to be able to continue to function.

Read the full article:

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.

We were wizards — a foreword to Learning Perl

Posted by

In the 1990s, computers were magic and we were wizards. Want proof? I offer below, Larry Wall’s foreword to Learning Perl from 1993. It greatly inspired a very young me who wandered into a book shop, picked up an odd book with llama on the cover and a seemingly misspelled title. The first few pages had me hooked and led me on a romp that would last decades. I hope it’ll inspire you, too. As Larry put it, “So be it! So do it!” — Wolf


Attention, class! Attention! Thank you.

Greetings, aspiring magicians. I hope your summer vacations were enjoyable, if too short. Allow me to be the first to welcome you to the College of Wizardry and, more particularly, to this introductory class in the Magic of Perl. I am not your regular instructor, but Professor Schwartz was unavoidably delayed, and has asked me, as the creator of Perl, to step in today and give a few introductory remarks.

Let’s see now. Where to begin? How many of you are taking this course as freshmen? I see. Hmmm, I’ve seen worse in my days. Occasionally. Very occasionally.

Eh? That was a joke. Really! Ah well. No sense of humor, these freshmen.

Well now, what shall I talk about? There are, of course, any number of things I could talk about. I could take the egotistical approach and talk about myself, elucidating all those quirks of genetics and upbringing that brought me to the place of creating Perl, as well as making a fool of myself in general. That might be entertaining, at least to me.

Or I could talk instead about Professor Schwartz, without whose ongoing efforts the world of Perl would be much impoverished, up to and including the fact that this course of instruction wouldn’t exist.

That might be enlightening, though I have the feeling you’ll know more of Professor Schwartz by the end of this course than I do.

Or, putting aside all this personal puffery, I could simply talk about Perl itself, which is, after all, the subject of this course.

Or is it? Hmmm…

When the curriculum committee discussed as this course, it reached the conclusion that this class isn’t so much about Perl as it is be you! This shouldn’t be too surprising, because Perl is itself also about you – at least in the abstract. Perl was created for someone like you, by someone like you, with the collaboration as many other someones like you. The Magic of Perl was sewn together, stitch by stich and swatch by swatch, around the rather peculiar shape of your psyche. If you think Perl is a bit odd, perhaps that’s why.

Some computer scientists (the reductionists, in particular) would like to deny it, but people have funny-shaped minds. Mental geography is not linear, and cannot be mapped onto a flat surface without severe distortion. But for the last score years or so, computer reductionists have been first bowing down at the Temple of Orthogonality, then rising up to preach their ideas of ascetic rectitude to any who would listen.

Their fervent but misguided desire was simply to squash your mind to fit their mindset, to smush your patterns of thought into some sort of hyperdimensional flatland. It’s a joyless existence, being smushed.

Nevertheless, your native common sense has shown through in spots. You and your conceptual ancestors have transcended the dreary landscape to compose many lovely computer incantations. (Some of which, at times, actually did what you wanted them to.) The most blessed of these incantations were canonized as Standards, because they managed to tap into something mystical and magical, performing the miracle of Doing What You Expect.

What nobody noticed in all the excitement was that the computer reductionists were still busily trying to smush your minds flat, albeit on a slightly higher plane of existence. The decree, therefore, went out (I’m sure you’ve heard of it) that computer incantations were only allowed to perform one miracle apiece. “Do one thing and do it well” was the rallying cry, and with one stroke, shell programmers were condemned to a life of muttering and counting beads on strings (which in these latter days have come to be known as pipelines).

This was when I made my small contribution to saving the world. I was rolling some of those very beads around in my fingers one day and pondering the hopelessness (and haplessness) of my existence, when it occurred to me that it might be interesting to melt down some of those mystical beads and see what would happen to their Magic if I made a single, slightly larger bead out of them. So l fired up the old Bunsen burner, picked out some of my favorite beads, and let them melt together however they would. And lo! the new Magic was more powerful than the sum of its parts and parcels.

That’s odd, thought I. Why should it be that the Sedulous Bead of Regular Expressions, when bonded together with the Shellacious Bead of Gnostic Interpolation, and the Awkward Bead of Simple Data Typology, should produce more Magic, pound for pound, than they do when strung out on strings? I said to myself, could it be that the beads can exchange power with each other because they no longer have to commune with each other through that skinny little string? Could the pipeline be holding back the flow of information, much as wine doth resist flowing through the neck of Doctor von Neumann’s famous bottle?

This demanded (of me) more scrutiny (of it).

So I melted that larger bead together with a few more of my favorite beads, and the same thing happened, only more so. It was practically a combinatorial explosion of potential incantations: the Basic Bead of Output Formats and the Lispery Bead of Dynamic Scoping bonded themselves with the C-rationalized Bead of Operators Galore, and together they put forth a brilliant pulse of power that spread to thousands of machines throughout the entire civilized world. That message cost the Net hundreds if not thousands of dollars to send everywhere.

Obviously I was either onto something, or on something.

I then gathered my courage about me and showed my new magical bead to some of you, and you then began to give me your favorite beads to add in as well. The Magic grew yet more powerful, as yet more synergy was imbued in the silly thing. It was as if the Computational Elementals summoned by each bead were cooperating on your behalf to solve your problems for you. Why the sudden peace on earth and good will toward mentality? Perhaps it was because the beads were your favorite beads? Perhaps it was because I’m just a good bead picker?

Perhaps I just got lucky.

Whatever, the magical bead eventually grew into this rather odd-looking Amulet you see before you today. See it glitter, almost like a pearl.

That was another joke. Really! I assure you! Ah well. I was a freshman once too… The Amulet isn’t exactly beautiful though; in fact, up close it still looks like a bunch of beads melted together. Well, all right, I admit it. It’s downright ugly. But never mind that. It’s the Magic that counts. Speaking of Magic, look who just walked in the door! My good buddy Merlyn, er, I should say, Professor Schwartz, is here just in the nick of time to begin telling you how to perform miracles with this little Amulet, if you’re willing to learn the proper mysterious incantations. And you’re in good hands; I must admit that there’s no one better at muttering mysterious incantations than Professor Schwartz. Eh, Merlyn?

Anyway, to sum up. What you’ll need most is courage. It is not an easy path that you’ve set your foot upon. You’re learning a new language: a language full of strange runes and ancient chants, some easy and some difficult, many of which sound familiar, and some of which don’t. You may be tempted to become discouraged and quit. But think you upon this: consider how long it took you to learn your own native tongue. Was it worth it? I think so. And have you finished learning it? I think not. Then do not expect to learn all the mysteries of Perl in a moment, as though you were consuming a mere peanut, or an olive. Rather, think of it as though you were consuming, say, a banana. Consider how this works.

You do not wait to enjoy the banana until after you have eaten the whole thing.

No, of course not. You enjoy each bite as you take it. And each bite motivates you to take the next bite, and the next.

So then, speaking now of the fruit of Merlyn’s labors, I would urge you to enjoy this, um, course. The fruit course, of course. Ahem, that was a joke too. Ah well.

Here then, Professor, I present to you your new class. They seem to have no sense of humor whatsoever, but I expect you’ll manage somehow. Class, I present to you Professor Randal L. Schwartz, Doctor of Syntax, Wizard at Large, and of course, Just Another Perl Hacker. He has my blessings, just as you have my blessings. May you Learn Perl. May you do Good Magic with Perl. And above all, may you have Lots of Fun with Perl. So be it!

So do it!

Larry Wall
September, 1993

Learning Perl (first edition). Copyright © 1993 O’Reilly & Associates, Inc. All rights reserved. Reprinted here with permission from Larry Wall and O’Reilly.

Passwordless authentication supports Zero Trust

Posted by

Passwordless authentication can make a zero-trust environment even more secure. Here’s what state and local governments need to know.

Excerpt from: How Passwordless Authentication Supports Zero Trust

State and local government agencies carry the heavy burden of collecting and managing large amounts of sensitive data to bring essential services to citizens. Naturally, they want to be on the cutting edge of cybersecurity, which is where the zero-trust security model comes in. And now, we’re seeing an innovation that could bolster zero trust’s already formidable defenses: passwordless authentication.

“When we think about zero trust, we want to regularly assess trust and evaluate everything,” Goerlich says. “If we’re constantly going to users and having them put in codes, PINs and passwords, we’re going to get a lot of resistance. So, I think many roadmaps that are successful for state and local governments pursuing zero trust are introducing passwordless as a way to reduce user friction while driving up assurance around identity.”

Passwordless authentication and zero trust work together. An agency may check a user’s fingerprint or face or have a user enter a PIN, but an agency that employs zero trust will also make sure the user is on the right computer in the right location and is behaving in a way that’s expected.

“This is the future of multifactor: implementing the strongest possible factors and addressing concerns around phishing and other common attacks,” Goerlich says.

How Can State and Local Agencies Implement Passwordless Authentication?

Read the full article:

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.


ZDnet article on identification and authentication

Posted by

Identification can no longer be just identity. Authentication can no longer be just authenticating. Compromised identity remains a foundational component for most attacks today. To overcome these vulnerabilities, organizations must step up their defenses around identification and authentication.

I’ve a guest article on ZDNet covering the problem and providing steps for a good defense.

Authentication is more complicated than ever. 4 ways to improve cyber defenses for our new reality

Bad actors are taking advantage of complex identity infrastructure to sneak in the front door, says Wolfgang Goerlich, advisory CISO for Cisco Duo.

Pre-mortems – #2 on SDxCentral’s Top 10 Stories

Posted by

SDxCentral posted the top ten stories of  2023. I was surprised and pleased my pre-mortem on Zero Trust came in at number two on the list. I’m not tagging this as news, as I covered the story when it came out here:

But! That did remind me. Since the original article came out, the video came out. If you want to see the RSA talk that landed the second spot on SDxCentral’s top ten, you can see it now. Right here. Right now. So much fun.

ConsumerAffairs says use multiple emails

Posted by

According to tech experts who say that if you slice and dice your email addresses the right way, you’ll not only declutter your digital life, but you will protect yourself better when it comes to phishing and financial scams.

Excerpt from: Multiple email address for different functions beefs up security.

How many email addresses do you have? If you’re like most Americans, you have two – personal and work. But there’s a large number – 28% – who have four or more email addresses. The privacy and scam experts that ConsumerAffairs spoke to were pretty much in agreement that the magic number is four or five email addresses and they’re shoulder to shoulder on what those addresses should be, too.

Wolfgang Goerlich  insists a separate shopping — including for subscriptions and newsletters — email account is an absolute must. “For example, a shipping scam or invoicing scam sent to an email address not used for shopping is easily spotted,” he told ConsumerAffairs.

“Say one of your email addresses gets compromised because of clicking on a scam, or falling for a phishing email, the criminal wouldn’t be able to get into your bank if it’s through a separate address. And when a website or app gets breached, and they often do, it helps to keep things separate.”

Read the full article:

Wolf’s Additional Thoughts

My recommendation is breaking email into: personal, professional, shopping, banking and finance, dating and relationships. Take that last category. People have been embarrassed, harassed, or even blackmailed when dating sites were compromised and their work email addresses were tied to those sites and leaked.

For the longest time, maintaining separate email addresses was a bit of a pain. You had to create them, remember to check them, and periodically clear out the inboxes. Today the major email providers make it easier to maintain several accounts. Moreover, on phones, it is easy to create separate email addresses for practically every website. Apple iPhone can do this natively with “hide my email” and Google Android devices can do this with third-party apps.

It’s never been easier to maintain a separation of email, and arguably, it’s never been more important to do so.

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.


9 in 10 organizations embraced zero-trust, CSO

Posted by

Nearly 90% organizations have begun embracing zero-trust security, but many still have a long way to go, according to a report by multinational technology company Cisco. “The more organizations know about zero trust, the less they feel competent in zero trust,” Goerlich adds. “The more they learn, the more they realize they need to go further.”

Excerpt from 9 in 10 organizations have embraced zero-trust security globally.

“What often happens to security concepts that begin as buzzwords and capture momentum is they fade off into business as usual,” Goerlich says. “What we’re seeing is people no longer asking, ‘Are you doing zero trust?’ It’s, ‘Are you securing this new line of business? Are you securing our mergers and acquisitions? Are you protecting us against ransomware? Are you enabling the business to keep up to changing market demands and changes in the threat landscape?”

“Now that we have the outcomes identified,” Goerlich continues, “we can apply the appropriate technologies and appropriate pillars to achieve those outcomes. What we’re going to continue to see is zero-trust principles becoming fundamental security principles. As we move forward, good security is good security, and good security will include some of these zero-trust principles baked into every layer.”

Read the full article:

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.


Investments in cybersecurity initiatives, Spiceworks

Posted by

“Good security first delivers a business outcome and then, and only then, as a result, increases security,” noted J. Wolfgang Goerlich, advisory CISO at Cisco Secure.

Excerpt from In the Line of Fire: Understanding and Conquering Cybersecurity Risks

The benefits of adopting zero trust go beyond its drivers. Through zero trust, organizations not only avoid risk (and thus unnecessary costs) but also save capital through operational efficiencies and enable business.

Since implementing zero trust takes two or more years, Goerlich pointed out that organizations may not necessarily have 100% zero trust. “Today, the strongest predictor of whether or not organizations feel that they are achieving zero trust is whether or not they have automation, orchestration in place,” he said.

Aberdeen found that endpoint detection and response (EDR) and extended detection and response (XDR) are becoming mainstream as a result of zero trust thinking.

Goerlich reiterated this and added that organizations increasingly pair extended detection and response (XDR) with zero trust. “If you have a zero trust project in progress, you are 40% more likely to say, ‘I have an XDR/EDR project,’” Goerlich said. “ Because as we harden that layer, criminals are going to move. If you have end-to-end protection, where do they go? They go to the edge.”

Read the full article:

This post is an excerpt from a press article. To see other media mentions and press coverage, click to view the Media page or the News category. Do you want to interview Wolf for a similar article? Contact Wolf through his media request form.