Have you ever wondered why the state of cybersecurity is so screwed up? Why is it so easy for bad actors and cyber-criminals to hijack systems and steal information? Would you be surprised to learn the answer is because we designed it that way? Computers, networks, operating systems and software were designed to work together as easily as possible, and were inherently “trusted” by each other. In the beginning, most systems ...
Do the web sites your frequently visit offer two-factor authentication? Have you enabled 2FA where it is available to you? Is the particular implementation of 2FA or MFA security really adding any extra protection for you? Not sure? Please read on.
Password management company Dashlane recently ranked 34 of the top websites for their implementation of two-factor or multi-factor authentication options for ...
Continue Reading →
Two-factor and multi-factor authentication historically have been based on using two or more of three criteria: something you know (passwords), something you have (security token) or something you are (biometrics such as fingerprints). There have been two new additions to MFA criteria: something you do (keyboard cadence or mouse movement), and somewhere you are (geo-location through GPS or public IP address).
Google has been busy heightening the security for it’s account ...
Continue Reading →
This article is an amusing collision between our last two topics – the problems with two-factor and multi-factor authentication and our four-part story on Google’s data mining habits. Google has developed and released their Titan MFA security key as a more secure way to implement multi-factor authentication that can’t be attacked through phishing and man-in-the-middle exploits. So if you can ...
In our last post we looked at several problems you might encounter using two-factor or multi-factor authentication. If you have two-factor authentication, or are thinking about using it, there are some additional steps you should take in case you lose your second factor and have to re-establish access.
I am admittedly a huge proponent of two-factor and multi-factor authentication. For me, TFA, 2FA, and MFA have allowed the password some badly needed extended life as a secure authentication method. With multi-factor authentication, losing your password to an attacker is not enough for them to gain access to and compromise a system, resource, or account.
Multi-factor authentication requires a user to log ...
Continue Reading →
If you use a password manager app on your smartphone, it may be vulnerable to package name spoofing, which would allow the password manager’s autofill feature to enter your login credentials on a spoofed web form. This vulnerability applies to popular apps from LastPass, Dashlane, Keeper, and 1Password.
I have been an advocate for password managers. They are part of the solution to ...
Continue Reading →
The holy grail of a cyber-attacker is the ability to achieve remote access to a computer on a network. It is even better when the attacker can get administrator privileges. Then they have the ability to do anything they need to do on the compromised computer to cross the network and compromise other computers and servers. Who has this kind of access ...
A quick Saturday digest of cybersecurity news articles from other sources.
New to cybersecurity? Building a successful cybersecurity career begins with taking good foundational steps. In this ebook, two InfoSec professionals share their advice for those just starting out.
A la “Catch Me If You Can” Frank Abignale ...
Continue Reading →A quick Saturday digest of cybersecurity news articles from other sources.From LastPass – It feels like almost every day there’s another data breach in the news, or a case of user credentials up for sale on the Dark Web. Despite the headlines, and repeated warnings from experts about weak passwords and the dangers of password reuse, users have yet to change their ...
Continue Reading →