The term “black swan event” was introduced by Nassim Nicholas Taleb in the book Fooled By Randomness. Black swan events have three major characteristics: they are rare, they cause a significant or extreme impact, and upon retrospection, they are actually predictable. As described very well in this Wired article, “getting hacked” is a black swan event. While “getting hacked” can mean many different things, let’s take the example as used in the Wired article of having your identity stolen by hackers. It is rare enough that many of us will probably never experience it. Some cases have an extreme impact such as having your identity stolen, losing funds from your bank account, or having your computer or mobile devices wiped. And as this blog and any number of[…]
I read a good article a few weeks ago, by Tom Mendoza of NetApp called 6 Powerful Ways to Embrace Change. It’s worth the short read. It got me thinking about how the Information Security industry is really in the business of change management. Change management seems a business term for “doing everything you can to avoid embracing change”. I’m going to take Tom’s 6 ways and rewrite them from an information security perspective. 1) Don’t look back Unfortunately, in the information security industry, not looking back is a sure key to failure. If you don’t continue to address the risks presented by your legacy system which no longer gets security patches, or pay attention to information that was long[…]
Numberphile recently posted a video about the math behind RSA encryption. In the video below, a brief description of public key cryptography is given and then we are shown a simple example of the math used to perform encryption and decryption (math example @ 2:25). In the video, James skips over the method for determining the private key, so I thought I would run through the key generation steps for his example. Choose two distinct prime numbers p and q. These are the two primes that he mentioned, so p = 2 and q = 5. Compute n = pq. Simply multiply 2 and 5. n = 10. Compute the totient of n, or (p-1)(q-1). (2-1) times (5-1) is 1[…]
The tl;dr summary for those with short attention spans – Don’t open the attachment, be quick to delete anything you’re not sure about, and if you want to help in the fight against phishing, report it using the guidelines I’ve outlined below. I received a pretty awesome phishing email today. It included a significant attachment that I’m looking forward to analyzing at a later date. Since it will take me a while before I’ve got the time to run the analysis, I decided I wanted to forward it around to the appropriate organizations to ensure that they take some time and analyze it and make sure other individuals can be protected from it. It turns out that there are more places[…]
Ever forget your password on a website? Yeah, thought so. Ever hit the “forgot password” link on a website and got your password emailed back directly to you? If that’s the case, it means that website saves your password in plain text so that they can email it back to you. This is a terrible security practice for a few reasons: Email is not a secure protocol, so even if you use a secure protocol to log in (HTTPS), when your password is emailed it becomes exposed to the world. If that website is hacked, your password will be quite available and visible to the attacker. Even if the website is not attacked, your password is available to anyone who has[…]
I saw this article come across my news feed today, and I thought to myself “what a great idea for an article!” The title is The Petraeus Affair: Human Nature Beats IT Security Every Time. I was thinking the article was going to be how General Petraeus and Paula Broadwell out-foxed the IT security measures in place at their various organizations to engage in (what they thought was) clandestine electronic communication. I figured the CIA would block access to GMail for security reasons, and yet these individuals were so determined to communicate they would have found a way. After all, most security controls can only defend against those willing to play by the rules. Reading the article disappointed me because it[…]