First: a link to another article for SC Magazine's Cybercrime Corner on password issues: Good passwords are no joke. However good your password is, your privacy still depends on rational implementation by the service provider. Also, one of the articles that sparked off that particular post: ESET Ireland's excellent blog post on a survey carried
Recent additions to SCMagazine's Cybercrime Corner blog include: "Password strategies: Who goes there?" by David Harley, May 23, 2011 Password selection usually involves compromise, but even a short password can be reasonably strong and still memorable. This follows up at some length on a previous ESET blog by Paul Laudanski. "Fighting cybercrime" by Randy Abrams,
CIPAV, the "Computer and Internet Protocol Address Verifier" spyware apparently used by the FBI to monitor activity on the computers of suspects, may not seem the hottest news item around: in fact, my friend and former colleague Craig Johnston and I put together a paper – Please Police Me – on the issues involved with policeware versus
Plenty more (potential) phish in the C:: The consequences of the Epsilon breach may have been a little overstated, but the Texas data exposures are far from trivial. Every picture tells a story: Your smartphone might be giving away more information than you really want to share. David Harley CITP FBCS CISSP ESET Senior Research
If you found my recent post on Public Access PCs Booby-Trapped of any use, you may also find a follow-up article by SC Magazine's Dan Raywood of interest. The article on Keyloggers found plugged into library computers quotes some further thoughts I sent him in a subsequent exchange of email, and also quotes Wilmslow police inspector Matt
While most of the recent media interest in Stuxnet has centred on the New York Times story, there’s been some thoughtful research published that considers it as just one aspect of larger issues: cyberwarfare, cyberespionage, cybersabotage and so on.
Tony Dyhouse writes in SC Magazine about the political implications for the security community of the Stuxnet and Wikileaks incidents. The link has also been added to the Stuxnet resources post at /2011/01/03/stuxnet-information-and-resources/5731 on 14th January 2011.. David Harley CITP FBCS CISSP
…While there are those who think that I’ve been in the anti-virus industry since mammoths roamed the Surrey hills, most of my computing career has actually been in medical informatics, though as you might expect from what I do now, documentation, security and systems/user support played a large part most of that time….
In researching today’s SC Magazine Cybercrime Corner article “From sci-fi to Stuxnet: Exploding gas pipelines and the Farewell Dossier”, I came across this ‘Damn Interesting’ article which showcases the successful cyberwarfare compromise of a SCADA / pipeline control system nearly thirty years ago, an event which I had heard stories about in Navy circles but
SC Magazine's Dan Raywood reports that "To be completely patched requires an average of between 51 and 86 actions per year", quoting findings by Secunia that " in order for the typical home user to stay fully patched, an average of 75 patches from 22 different vendors need to be installed, requiring the user to
SC Magazine has reminded me today of a new report on the top current security risks, jointly published by SANS, TippingPoint, who provided the attack data, and Qualys, who provided vulnerability data. With impressive modesty and finely-tuned understatement, Alan Paller of SANS describes it as the "best risk report ever". Well, with added analysis and educational
This is a research blog, not a marketing blog. Not that there isn’t a place for marketing (that’s what pays our salaries, in a sense!) and marketing blogs, but my guess is that most of our readers here would get bored quite quickly if we spent too much time on press-release type material, our latest