Quick Hits
Commentary
News
News
Quick HitsNewsNewsNews
CommentaryNews
Commentary
Commentary
CommentaryQuick HitsNews
CommentaryNewsNews
CommentaryNews
you don't blame the tools for sloppy work. heartbleed was caused by a crass violation of an old and well known programming standard: you don't let user input data control your program. you control the input. ...
In reply to: don't blame the tools
Use the word "passcode" instead of "password" and less people will use simple passcodes based on words. Something like "H6f4ggmo3fGaM" is not a word, so it doesn't make sense to call it a "password."
In reply to: language
Has there been any report as to what type of malware was used to exploit the POS machines? Also, how were the machines infiltrated?
In reply to: Type of Malware
From what I have been told is that for many the focus is on "compensating measures" such as firewalls and physical security. Truth is, they have been dealing with this type of issue for years. It's not uncommon to find Windows...
In reply to: compensating measures
This is a great post Matt. Does anyone have a problem with the way companies were notified? Certain companies were told early, certain companies weren't, and there are vendors that still don't know if their product are vulnerable....
In reply to: Heartbleed
Ok thank you for the insight. It seems very logical to have something like a password manager in place. However, let me play devil's advocate for the moment. For the password manager to work it needs to store your passwords....
In reply to: Re: RoboForm Password Manager
As an IT Auditor who worked with one of the big five (before they became the big four) global audit firms, I can only suggest that our definitions of assurance are vastly different. Arthur Andersen certainly found it out...
In reply to: Re: But assurance equals accountability equals liability.
I wrote a nice tool to generate these labels automatically. If anyone is interested in making an open-source tool out of it, I'd be happy to share.
In reply to: Re: Assurance Evidence
It is an embarrassing situation. The level of security offered to the customers is very poor. In many cases pos systems are common windows based machine with a few defense systems that in many cases are not sufficient...
In reply to: embarrassing
Perfect analogy, and exactly my point summed up fantastically!
In reply to: Re: Great Article
I imagine it would be almost impossible for the ISP's to track down these compromised hosts. The ports and traffic generated by the compromised machines is not overly odd when compared to the traffic of legitimate...
In reply to: Re: Broadband provider's responsibility?
@Ryan to answer yoru questions for lastpass at least; I can't speak to other password managers. It does act as a single sign on but I still have to manually log into my password manager and click the button to sign into...
In reply to: Re: RoboForm Password Manager
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Tweet This
0 Comments
