Opinions & Analysis

I don’t need to tell you about the Apple iCloud hack: the lurid details have been exhaustively documented elsewhere. However, I do want to tell you what your organisation should take away from it: it is critical to think about the security of your information at the file-level, rather than the device level. Data-centric protection is critically important, particularly in business, and particularly for files - whether they are selfies or strategy PowerPoints. With the...

A study announced today, by taxi app Hailo, claims that making calls on a Smartphone is now only the sixth most common use for a mobile phone. Which made me question - why it’s still called a phone! Sadly I fear it’s just a matter of time before we’re all carrying around ‘Smartscreens’ instead.   And that got me thinking – what else don’t we do anymore because of technology …   Who’s that knocking...

Today may be Halloween, but security provides plenty of scare stories according to industry researchers.   We reached out to some of security’s finest minds to give us their thoughts on what the greatest threats and scares to security professionals are.   Dr David Chismon, senior security researcher at MWR - Windows XP - The Zombie OS that won't die   Although most organisations have moved on to supported operating systems, a number retain a number...

The “hype” over the Xen hypervisor flaw put the technology back in the spotlight.   Not specifically covering virtualisation or cloud in any great depth, this hasn’t been an area I have focused on, but we do cover flaws and this was of interest. I recently caught up with hypervisor vendor Bromium, whose security researcher Rafal Wojtczuk was presenting on “lessons learned from 8 years of breaking hypervisors” at the Black Hat Europe conference.  ...

24 hours ago, the internet was ablaze with talk of a “second leaker” being identified by the FBI.   The second leaker, whom cryptographer Bruce Schneier actually deemed to be the third leaker (behind Edward Snowden and the person passing secrets about the Angela Merkel surveillance story, the TAO catalog and the X-KEYSCORE rules), was suggested at the end of the documentary Citizen Four in a conversation between Snowden and journalist Glenn Greenwald.   I attended a private screening of the documentary last...

Data breaches through insiders—or trusted employees, contractors and vendors who have access to your network—are becoming more and more common.   For example, the recent JP Morgan breach began when hackers compromised one employee’s username and password to a web development server. The major breach at US retailer Target started when hackers stole credentials from an HVAC vendor who connected to Target’s network for invoicing and billing purposes.   Once these hackers established a beachhead...

The problem of suspicious user activity identification is still a hot topic, widely discussed by IT community. The recent Verizon Data Breach Investigations Report gives food for thought, revealing that 88 per cent of insider misuse incidents are the result of privilege abuse.   The report sets a task for businesses of all sizes to establish user activity monitoring as a mandatory measure that ensures integrity of sensitive business data. However, the ethical aspect of...

There has been much smirking and finger pointing recently - with the FBI left and centre.   As reported by IT Security Guru a few weeks ago, FBI Director  James Comey was very vocal in criticising unbreakable encryption on smartphones saying such capabilities allow users to “place themselves beyond the law”.   So, imagine my surprise to discover this week that nestled among the smartphone safety tips promoted by said agency, the FBI itself recommends...

Currently, there's a lot of talk about "pass-the-hash" (PtH) attacks.   PtH attacks are based on exploiting vulnerabilities in the Windows Lan Manager (LM) and Windows NT Lan Manager (NTLM) authentication systems. Therefore, any Windows system is vulnerable to PtH attacks, which are very difficult to defend against because it only takes one misconfigured computer, or a computer missing a single security patch in a Windows domain, for an attacker to find a way in....

Thought for the weekend... This week the security world was hit by vulnerability after vulnerability after vulnerability. Or at least that’s what it felt like. We’d barely finished with the news that another retailer, Kmart, had suffered a breach before Sandworm started burrowing through defences, POODLE ran amok and finally we ended the week being hit by DrupAgeddon! In the middle of all of this were reports that Snapchat and Dropbox were hacked – a...