From Pinterest again
4
SEP
SEP
0
Share
Phishing is still the overwhelming go-to choice for cyber-criminals launching an attack. Over 90% of computer system breaches start with a phishing email in an inbox. Finding ways to unmask these impostors is a good first step are protecting yourself from a phishing exploit. Let’s look at this first example, apparently from a law firm about a legal action.
Continue Reading →
2
SEP
Share
SEP
DARPA (Defense Advanced Research Projects Agency) recently held a contest to explore the feasibility of automating the process of finding vulnerabilities on a group of target computers, and automatically fixing the vulnerabilities. Using a game format similar to “capture the flag,” on Aug. 5,at the Paris Las Vegas hotel, seven teams of programmers, hackers and researchers set a cybersecurity milestone.
According to Darpa “Our best ...
Continue Reading →
31
AUG
Share
AUG
Here is a short list of applications that I use frequently when undertaking a penetration test of vulnerability scan. I don’t use all of these all the time, but they are probably the most popular tools in the security community. We start with Kali, the Swiss Army knife of exploitation tools. What can’t Kali do? Then we look several stand alone tools for host enumeration, port scanning, packet sniffing, vulnerability detection, ...
29
AUG
Share
AUG
Not sure how funny this is. According to Smithsonian.com, the U.S. Department of Defense still uses floppy disks for its Strategic Automated Command and Control System.
The system is still in use because, according to the a Pentagon spokesman, “it works.” He also was touting the built in “security” in using a technology so old that most modern hackers would not be ...
Continue Reading →
28
AUG
Share
AUG
Holy acronyms Batman! What the heck does this headline mean? Well, the National Institute for Standards and Technology (NIST) has removed two-factor authentication (TFA) via short-messaging service (SMS) from the approved list of two-factor authentication methods. The reason is that SMS is an unencrypted service, and the lack of encryption makes it too insecure for use in Federal authentication systems. NIST is recommending that all ...
26
AUG
Share
AUG
I am a firm believer in, and user of two-factor authentication (TFA or 2FA). Heck, if there was three-factor authentication I would probably sign up. The two most popular authenticator apps are Authy and Google Authenticator. I primarily use Google Authenticator wherever I can. I use SMS when Authenticator isn’t an option, or won’t work. I had trouble, for instance, getting Facebook to work ...
24
AUG
Share
AUG
Bruce Schneier had an interesting post where he attacked the commonplace practice of requiring regular password changes. Usual corporate IT policies require changes every 90 days, and in some high security environments, more frequently than that.
The basic issue with frequent password changes is that humans will create a system that makes it easy to remember the next iteration of the password. ...
Continue Reading →
22
AUG
Share
AUG
You have trained your staff and improved your defenses. In spite of your best efforts, you have an active case of crypto-malware running on a system in your business. How do you recover?
Here are the steps to recovery:
- Disconnect the affected system from the network by removing the Ethernet network cable connection or turning off the Wi-Fi connection.
- Determine if the encryption process has completed.
- If so, leave the system running, but disconnected from the ...
19
AUG
Share
AUG