Not one of our Top X lists, this time, but one featured in an article on the SANS site. SANS have been banging the drum for safer coding for quite a while – in fact, they do quite a few courses on safe coding in various development contexts. Admittedly, that gives them a financial incentive to fly
Many people in the US associate HIPAA with the rules required to protect medical data. It actually is a lot more than that, but the HIPAA laws do require some minimal standards for medical providers. I recently came across an example of where HIPAA is ineffective. The medical providers are required to protect your data,
I know, the Twitter hack is old news, but poor passwords are still common. It is a pity because it really is so easy to make a password much better and still be easy to remember. According to the press, an admin used the password “happiness” and that is how a hacker gained access to
I recently received an email stating “It is a privilege to inform you that you are being considered for inclusion into the 2009/2010 Princeton Premier Honors Edition Registry. This recognition is an honor shared by only the most accomplished professionals who have demonstrated excellence within their careers and communities.” I had always assumed these were
Nigel Morris, of the UK’s “Independent” newspaper reported recently on new powers given to police in the UK and proposals to extend similar powers across the European Union. Understandably, civil rights groups like Liberty have apparently expressed the belief that such expansion of “police hacking operations” should be regulated by Act of Parliament and that there
And finally… Don’t use cracked/pirated software! These are easy avenues for introducing malware into, or exploiting weaknesses in, a system. This also includes the illegal P2P (peer-to-peer) distribution of copyrighted audio and video files: some of these are counterfeited or modified so that they can be used directly in the malware distribution process. Even if
Over the past few months I received a lot of spam about a site called Fanbox.com. I finally set up a disposable email account and joined. I was not at all surprised to find that I suddenly had many fans. Even a skinny geek is a “hunk†to a chatbot!!! Yes, all, but one of
It occurs to me that I should make it clear that this “top ten” isn’t in any particular order. Like the other “top ten” suggestions by the research team that are likely to find their way here in the near future, they’re all significant issues that need thinking about. Point 9 (a short one!) is, don’t
Update: Graham Cluley’s issued a blog post a couple of days ago suggesting that so far, at least some of the phishes described in our earlier blog about Twitter phishing have been used for old style defacement purposes rather than out-and-out fraud. (I suspect, though, that now this latest phishing genie is out of the bottle, there
Don’t expect antivirus alone to protect you from everything. Use additional measures such as a personal firewall, antispam and anti-phishing toolbars, but be aware that there is a lot of fake security software out there. This means that you need to take care to invest in reputable security solutions, not malware which claims to fix
If sensitive information is stored on your hard drive (and if you don’t have -something- worth protecting on your system, you’re probably not reading this blog…), protect it with encryption. Furthermore, when you copy or move data elsewhere, it’s usually at least as important to protect/encrypt it when it’s on removable media, or transferred electronically.
[Update info moved to new blog post on 6th January] In deference to all those old enough to get a panic attack when reminded of how bad pop music was capable of being in the 1970s, I’ll try to overcome by the urge to mention “Chirpy Chirpy Tweet Tweet”. Anyway, to business. Having all the
Speaking of SANS, the Internet Storm Center has more than once talked about problems with digital photo frames, and at Xmas did so again with reference to the well-publicised Samsung incident. The San Francisco Chronicle came up with a story a couple of days ago that was even more alarming, and not only in the volume
Don’t disclose sensitive information on public websites like FaceBook or LinkedIn. Even information that in itself is innocuous can be combined with other harmless information and used in social engineering attacks. Rather than expand on that point, for now, I’m going to point to another “10 ways to protect yourself” resource: the more good advice
Don’t trust unsolicited files or embedded links, even from friends. It’s easy to spoof email addresses, for instance, so that email appears to come from someone other than the real sender (who/which may in any case be a spam tool rather than a human being). Basic SMTP (Simple Mail Transfer Protocol) doesn’t validate the sender’s
Welcome to prime-time scam season. This is when the advertisements for taxes in the USA really start to pick up. Granted, they go on all year long, but now is when we traditionally see an increase in volume. There are a variety of such scams. The worst of the scams are the phishing attacks. If
Use different passwords for your computer and on-line services. Also, it’s good practice to change passwords on a regular basis and avoid simple passwords, especially those that are easily guessed. As Randy pointed out in a recent blog, it’s debatable whether enforced frequent changes of hard-to-remember passwords are always constructive (they can force the user to write down
Log on to your computer with an account that doesn’t have “Administrator” privileges, to reduce the likelihood and severity of damage from self-installing malware. Multi-user operating systems (and nowadays, few operating systems assume that a machine will be used by a single user at a single level of privilege) allow you to create an account
Further to my post of 25th December about the withdrawal of the CastleCops services, there’s a blog at Darkreading that includes more information, including some quotes from Paul Laudanski, who was, with his wife Robin, the driving force behind the organization: also quotes from our own Randy Abrams, David Ulevitch of PhishTank, and Garth Bruen
