Ransomware is Not the Problem
Arbitrarily powerful software -- applications, operating systems -- is a problem, as is preventing it from running on enterprise systems.
Shostack + Friends Blog
Posts in category "security"
NSF Wants Data on Your Data Needs
The National Science Foundation is looking for information on needs for datasets.
Pacific Northwest Appsec Conference
AppSec Pacific Northwest Conference is a free application security conference that will be held Saturday, June 19th. It is a virtual, online event sponsored by the OWASP chapters of Portland, Vancouver, and Victoria.
Apple Guidance on Intimate Partner Surveillance
Apple has released ‘Device and Data Access when Personal Safety is At Risk’ and I wanted to explore it a bit.
The Updates Must Go Through
The timing of updates is not coincidental.
Mmmm, Pandemic Puppies
Podcast on Using Games
It would be trite writing to say it was fun to be on a podcast with Volko Ruhnke and Hadas Cassorla to talk about using games to teach. And while it was, it was really educational and inspirational. I learned from both of them, and I hope you enjoy the podcast as well!
Fireeye Hack & Culture
Thoughts on the recent Fireeye Hack and the culture surrounding breaches
Internet Society Opposition to LAED Act
The Internet Society Open Letter Against Lawful Access to Encrypted Data Act was published this morning.
Evidence Based Security
Check out “The Need for Evidence Based Security” by Chris Frenz.
Encryption & Privacy Policy and Technology
A few tidbits in recent news.
Medical Device Security Standards
Recently, I've seen four cybersecurity approaches for medical devices, and we can learn by juxtaposing them.
Interesting reads
Sharing for you, bookmarking for me.
Interesting Reads, August 19
Just what the title says
Actionable Followups from the Capital One Breach
What have we learned and what steps can we take?
Passwords Advice
Bruse Marshall has put together a useful comparison of password requirements from OWASP ASVS v3 and v4.
When security goes off the rails
My newest post over at Dark Reading ponders regulation.
Cybersecurity is not very important
Some points to consider, from Andrew Odlyzko.
Incentives and Multifactor Authentication
What if we gamified security?
Does PCI Matter?
It's certainly not a silver bullet...
CyberSecurity Hall of Fame
[no description provided]
CSO on AppSec at the Speed of Devops
[no description provided]
Conway's Law and Software Security
[no description provided]
Just Culture and Information Security
[no description provided]
$35M for Covering up A Breach
[no description provided]
Designing for Good Social Systems
[no description provided]
Gartner on DevSecOps Toolchain
[no description provided]
Pen Testing The Empire
[no description provided]
Microsoft's PCI Blueprint
[no description provided]
The Fights We Have to Fight: Fixing Bugs
[no description provided]
It's Not The Crime, It's The Coverup or the Chaos
[no description provided]
Open for Business
Recently, I was talking to a friend who wasn't aware that I'm consulting, and so I wanted to share a bit about my new life, consulting!
Interesting Monday Reads
Each of these is long and thought-provoking and worth savoring.
Threat Modeling Password Managers
[no description provided]
Threat Modeling Encrypted Databases
[no description provided]
IoT Security Workshop (Seattle, August)
[no description provided]
Hospital Ransomware
[no description provided]
Ross Anderson on Edge
[no description provided]
Warrants for Cleaning Malware in Kelihos
[no description provided]
“...the Elusive Goal of Security as a Scientific Pursuit”
[no description provided]
Cyber Grand Shellphish
[no description provided]
Groundrules on Complaining About Security
Everyone complains about security, but no one ever... sets boundaries