Blog

Blog

Women in Information Security: Amanda Berlin

Back by popular demand, I’ve interviewed a new group of women and non-males in information security for Spring 2018. I’m really honoured by all of the positive feedback I’ve been getting on this interview series since it launched in the fall of 2016. This series was even mentioned outside of the tech media during my appearance on a popular non-tech...
Blog

Saks Fifth Avenue, Lord & Taylor Suffer Payment Card Data Breach

Saks Fifth Avenue and Lord & Taylor have both suffered a data breach involving customers' debit and credit card information. The data breach became apparent on 28 March when Joker's Stash, a seller of stolen payment card details on underground markets, announced its "BIGBADABOOM-2" sale of five million cards. Working with financial organizations,...
Blog

Data Integrity Follow Up: Ways to Protect Your Data

Previously, I brought attention to what I believe is one of the biggest cybersecurity challenges: data integrity. As I note in a different piece, we have entered a strange phase in our history where questioning “evidence” is not such a ludicrous idea. For example, altering photographs digitally so you can’t tell there have been alterations is a full...
Blog

Payment Gateways – What Are the Risks Lurking Around?

Online businesses of all sizes need to be able to accept payments today. This really is the only way in which you can buy and sell products and services without a physical presence. It's convenient and economical but there are also some risks associated with it because of the information being shared. Payment gateways are something that you must...
Blog

The FBI's 10 Most-Wanted Black-Hat Hackers – #9 and #8

Recently, we renewed our countdown of the FBI's 10 most wanted black-hat hackers. First up was Bezhad Mesri at number 10. He is accused of having compromised Home Box Office (HBO) employees' emails and abused that access to steal data, extort the company for ransom, and leak the information online when he didn't get his way. This week, we present No. 9 and No. 8: Viet Quoc Nguyen and nine...
Blog

A Checklist for Online Gaming Privacy

Something that I like to discuss is the ease with which individuals open themselves up to cyberstalking. A lot of people don’t even realize the detail they are revealing during online conversations and gaming sessions. While these online gaming tips should be considered by adults, the goal of this checklist is to create a conversation point for...
Blog

Cambridge Analytica: The Devil Is in the (Contractual) Details

It appears we reached a global level of moral outrage surpassing a high warp factor during the week commencing 19th March 2018 with widespread news coverage of the machinations of Cambridge Analytica (CA). [I write as a long-time cynic who did not need to experience last week to know that “I am the product.”] We are all making choices daily – for...
Blog

Atlanta Struggling to Recover from Ransomware Infection Days After Attack

The city of Atlanta is struggling to recover from a ransomware infection days after the initial attack targeted its computer network. As of 26 March, the municipality was still struggling to collect customers' online payments for bills and fees. Such disruption continues to plague the State of Georgia's capital city at a time when Atlanta is busy...
Blog

Security Research Ideas to Improve Post-Graduation Outcomes

One of the ways I try to give back to the community is by using my writing to be the resource I wish I had earlier in my journey. I have constraints on what I can publish due to the nature of my work, but I’m passionate about sharing career advice that can positively impact the industry. I’ve made my desire to be a public resource, so people ping me...
Blog

Cobalt/Carbanak Malware Group Leader Arrested in Spain

The Spanish National Police has arrested the leader of a criminal group responsible for developing sophisticated banking malware including Cobalt and Carbanak. On 26 March, EUROPOL announced the arrest of the yet-unnamed computer criminal mastermind in Alicante, Spain. That individual is responsible for helping to attack 100 financial institutions...
Blog

Researchers Can Earn up to $15K in Netflix's New Public Bug Bounty Program

Netflix has launched a public bug bounty program through which security researchers can receive rewards of up to $15,000. Announced on 21 March, the streaming service's new vulnerability responsible disclosure framework will award researchers upwards of thousands of dollars for reporting weaknesses discovered in Netflix's primary targets. In-scope...
Blog

Tripwire Patch Priority Index for March 2018

BULLETIN CVE Browser CVE-2018-0942, CVE-2018-0929, CVE-2018-0927, CVE-2018-0932, CVE-2018-0879 Scripting Engine CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0934, CVE-2018-0933, CVE-2018-0936, CVE-2018-0937, CVE-2018-0930, CVE-2018-0931, CVE-2018-0939, CVE-2018-0891, CVE-2018-0876, CVE-2018-0889, CVE...
Blog

The Ransomware Threat to ICS Security

Industrial control systems (referred to as ICS) have faced an ever-growing volume of threats over the past few years. From 2015 to 2016, IBM Managed Security Services reported a 110 percent increase in ICS cybersecurity attacks. The US accounted for most of these incidents, given it has the most Internet-connected ICS networks on the planet, but the...
Blog

Preventing Azure Storage Breaches

In my previous post, I took deep dive into AWS S3 permissions to outline the myriad of ways someone could expose their AWS S3 buckets and objects to everyone on the Internet. As I discussed there, the complexity of the S3 permission system is very powerful and provides users with a lot of flexibility; however, it also makes it very easy to...