Our incident response plan covers the basics. The things we’ve seen before. Things like malware or phishing. That’s fine for a corporate environment, but what about cloud services? How do we update the plan for new changes?
Watch more videos on my YouTube channel.
SHA1 was broken earlier this year. RSA 1024 was broken earlier this week. So what can developers do to choose the right encryption? And how can we future proof our applications?
Watch more videos on my YouTube channel.
Fireworks remind us of just how interwoven our lives have become with software. Take the Big Bay Boom in San Diego, when all the fireworks went off at once. It was a bright loud shiny example of what happens when little glitches hit big events.
Watch more videos on my YouTube channel.
What if I were to tell you, there is no ROI on IT security purchases? (Spoiler: I’ll share the one exception at the end of the video.)
Watch more videos on my YouTube channel.
Password resets as an example of the process – program – product approach. Also, while we’re at it? A couple things organizations overlook with passwords resets.
Watch more videos on my YouTube channel.
The controls for ransomware, like file integrity monitoring (FIM), user behavior analytics (UBA), and anti-malware, these all have one thing in common. They rely on a booted OS. But Petya’s encryption was at pre-boot. It spoofed ChkDsk before Windows started. So now what?
Watch more videos on my YouTube channel.
“All workstations have local administrator with a shared password,” the penetration test findings often say. But why does it matter? For that answer, we can look at the latest flash random Petya. It steals and reuses these passwords to spread the infection to otherwise immune computers. Ouch.
Watch more videos on my YouTube channel.
Let’s say it takes 48 hours to do static code analysis. Say we’re developing code and pushing every 6 hours. Well huh. Now what?
Watch more videos on my YouTube channel.
It’s become a cliche question: “what are our crown jewels?” Typically, the answer focuses the cyber security tasks on what data matters most. But what happens when our business legitimately doesn’t have any crown jewels?
Watch more videos on my YouTube channel.
Take our favorite email controls. Domain-based Message Authentication Reporting and Conformance (DMARC), DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF). How often are these being enabled and enforced? Today in traffic, a case study in email and herd immunity.
Watch more videos on my YouTube channel.