Opinions & Analysis

IBM recently issued a security bulletin for a newly discovered security vulnerability - a weak cryptography algorithm in the SSL/TLS protocol stack--that could allow hackers to steal data. That vulnerability was discovered by Itsik Mantin, director security research at Imperva. The Bar Mitzvah attack uses "a 13-year-old vulnerability of RC4 that is based on huge classes of RC4 weak keys." Mantin demonstrates how the vulnerability "can be used to mount several partial plaintext recovery attacks on SSL-protected...

A term I have heard a lot about both this week at RSA Conference and in the past few months is that of DevOps, particularly related to security. What is DevOps? According to wikipedia, DevOps is a software development method that stresses communication, collaboration (information sharing and web service usage), integration, automation and measurement of cooperation between software developers and other IT professionals. Emphasis is on the interdependence of software development, quality assurance and IT operations, with...

Is there more demand for forensic technology to be hosted on endpoints, as more breaches occur at the employee’s end?   Stuart Okin, VP EMEA at Cipher, told IT Security Guru that it commonly sees Guidance Software’s Encase solution deployed on every endpoint, as most businesses only wait until something bad occurs to do something about it.   “What we are seeing is a trend in this direction in the US which allows a remote...

This week saw the launch of the annual Verizon Data Breach Investigations Report (DBIR), and among its pages were details on poor defences, enabled attackers and mobile malware was the great research on time to detect.   In particular, 79,690 security incidents with 2,122 events of data loss were surveyed and showed that attackers are able to compromise a victim a matter of days, and while the time to discover has risen, it has not...

The rapid pace of digitisation is fundamentally transforming the need for data analytics. As such, businesses need to rely on new data sources, such as machine-generated data vs. traditional structured data.   Insight into such data in real time is what gives companies the competitive edge they need to succeed. Machine-generated data is one of the fastest growing and complex areas of big data, it's also one of the most valuable, containing a definitive record of...

12 months have passed since a bug was publically revealed that would shape headlines, researchers and presentations for the next year.   A flaw in the OpenSSL cryptographic software library, Heartbleed allowed information protected by the SSL/TLS encryption to be captured by anyone on the internet who was able to read the memory of the systems protected by the vulnerable versions of the software.   A fix was released on April 7th 2014, and many...

Last week was the week of the last ever Symposium on Security for Asia Network (SyScan) conference in Singapore.   Well known for being unafraid to court controversy, SyScan had become something of a legend in vulnerability research circles. This year was no exception with a very public reaction to Blue Coat's alleged bullying of Airbus researcher Raphael Rigo's Proxy SG internals talk. But between the talks, the whiskey and an amazing badge there were...

Much like the iCloud “hack” story of last summer, it appears that another vault of sensitive details had been accessed because of users reusing the same credentials over and over for different services.   In the case of the British Airways incident, a third party “using information obtained elsewhere on the internet, via an automated process, to try to gain access”. So who wants to put money on this being done by a brute force...

An interesting email dropped into my inbox back at the start of March, and made we wonder if the headlines are affecting the way that businesses interact with customers. The email in question came from Lastminute.com, that great bastion of the dotcom that if I am honest, I used once and had not been aware I was even on a mailing list for anymore. But I am glad I was, as in announcing its acquisition...

This morning we are delighted to introduce the all new IT Security Guru website. After we launched the first full version of the website last January, we identified areas that we wanted to improve, and what we liked, and worked with designers and developers to build this new site that we hope you will find as easy to use and inviting as we do. So what is new? Well apart from the reduced (but still...