Archives

In our experience, building a security portfolio on attack scenarios has 2 clear benefits; A robust, cost-effective security portfolio based on attack analysis  results in robust compliance over time. Executives related well to the concepts of threat modeling / attack analysis. Competing, understanding the value of their assets, taking risks and protecting themselves from attackers …

A recent article on CSO online ponders the question of whether or not passwords are dead – since they are not much of a security countermeasure anyhow (or so the article intimates). The article quotes a person who seems to believe that SQL injection attacks have to do with password security. Christopher Frenz, CTO at …

Do you run an e-commerce site? Are you sure you do not store any payment card data or PII (personally identifiable information) in some MySQL database? The first step in protecting credit card and customer data is to know what sensitive data you really store, classify what you have  and set up the appropriate security …

My friend Nissan Ratzlav-Katz starting blogging about customer service in Israel and how tolerant many of us have become to sub-standard and even really crappy customer service. An objection I’ve heard frequently to Google Apps is that they don’t give customer service – although I would argue that great products delivered that work on a global scale …

IT is about executing predictable business processes. Security is about reducing the impact of unpredictable attacks to a your organization. IT and security adopt a common goal and a common language – a language  of customer-centric threat modelling Typically, when a company ( business unit, department or manager) needs a line of business software application, IT …

In my previous post – “The Israeli credit card breach”  I noted that there are  5 fundamental reasons why credit cards are stolen in Israel. None have to do with terror; 4 reasons are cultural and the 5th is everyone’s problem: “confusing compliance with security. After reading the excellent article  by Sarah Leibowitz-Dar in the Maariv …

There are 5 reasons why credit cards are stolen in Israel. None have to do with terror; 4 reasons are cultural and the 5th is everyone’s problem: “confusing compliance with security“. I  could write a book on mismanagement of data governance and compliance, data security, web server security, web application software security. In 2003, I …

Trends –  security and movie stars, Manuela Arcuri and  Monica Bellucci, Verisign and Mcafee. Information security and  risk analysis is complex stuff, with multiple dimensions  of people, software, performance, management, technology, assets, threats, vulnerabilities and control relationships.  This is why it’s hard to sell security to organizations. But, information security is also a lot like fashion with cyclical …

Don’t break the build. There is absolutely no question that the build process is a pivot in the software quality process. Build every day, don’t break the build and do a smoke test before releasing the latest version. This morning, I installed the latest build of an extremely complex network security product from one of …

Every so often my ISP calls us up and asks to speak with the IT manager or the person who is responsible for the network. This time it was Netvision offering me a special deal on Symantec anti-virus and a $5/month service package for virus updates. Well, I said “We don’t use Windows, and I …