Not that we need more proof of the average Joe’s lack of security awareness, but Verizon are out with their annual security breach report stating exactly how the bad guys are getting in to our networks and it does not look good for the average Joe. The answer, Phishing, Bad Web Security and Weak Passwords. Two out of every three attacks were based on using legitimate user credentials to access the compromised systems. These credentials were gained via one of two common methods, brute force the password or just ask the user to provide you the... 

I have got a new toy, and its cool. An Encrypted Portal Hard-disk that can only be accessed if you know the pin, which you must type in to the number pad on the front of the drive. I have a new contract with a local government client, where I am creating a new database for at risk individuals. They take user data protection pretty seriously and required that all documents I took off premises is protected, that includes providing protection in the case of losing my laptop, USB Stick or portable drive. They, as well as all UK government organisations,... 

A Toxic Hell Stew of Vulnerabilities The above quote was made by Tim Cook at last years Apple developers conference in regards to the Android operating system. He went on to say that 99% of all Mobile Malware was produced for, and operated on Android. Having come from a threat research background I can tell you he is not to far wrong. But…. There are lies, damn lies and then, there are statistics. If you just limit your view to a portion of the statistics you could easily conclude the Android is indeed “a toxic hell stew of vulnerabilities”,... 

Dr Kevin Jones & Ben Parish It has been announced today that Airbus Group Innovations has been awarded a major contract by the Defence Science and Technology Laboratory (DSTL), as part of their Cyber Situational Awareness research project. The project goal is to develop and mature a Virtual Cyber Centre of Operations (VCCO), that will allow military decision makers to call on experts anywhere around the world to help deal with cyber situations. The research will assist in the development and design of a next generation Security Operations... 

In today’s diverse and sophisticated threat landscape, CISOs and IT departments face daunting information security challenges. When you start to secure your network and monitor the events occurring then SIEM solution comes in, but they are expensive and time consuming. While that may be true with enterprise SIEM products placed into environments that don’t have the capability to manage them, technology does exist for smaller security departments. So first let’s look at selecting a SIEM solution, when selecting a SIEM product you... 

Kaspersky Anti-Virus users today were waking up to no internet! An update from the Anti-Virus vendor cut off internet access for users. Presumably with no Internet access your risk profile was significantly improved, however users were none too happy to find they could not check in to Facebook to see what the Ex-Boyfriend/Girlfriend was up to. The update seemed to impact the web anti-virus component of the Kaspersky suite. In an update from Kaspersky they stated that the issue was caused by a database update at 8:52pm on Feb 4th, Moscow time. They... 

In a previous article I explained what an APT looked like. Most organisations I talk to believe they are not likely to be a target of an APT, the logic being that they have nothing of interest that a foreign government would need. It is true certain organisations are more likely to be targeted by a foreign government, other government organisations for example, organisations that make up part of the critical national infrastructure, that would include most banks, oil and energy companies, broadcasters or power generating organisations, however... 

One of the big themes of InfoSec 2013 was APT’s. A number of talks specifically targeted (excuse the pun) this topic. The perception is that APT’s are state sponsored attacks, this perception is driven by the cost and resources required to implement this type of attack. The reality is however that if you have digital assets that are worth going after, you are at risk of this type of attacks. For those not in the specific anti-malware/anti-virus industry the definition of an Advanced Persistent Threat is not entirely clear. From... 

There have been a lot of recent security breaches in cyber land, including LinkedIn, the FBI and more recently Yahoo. The Yahoo breach included over 400,000 usernames and passwords. While this is bad news for Yahoo, it does give us a chance to analysis the passwords from the 400,000 users and see what insights we can derive. Below is an analysis of the Yahoo passwords. The top ten passwords are a list of the usual suspects with “qwerty,”123456” and good old “password” all appearing again. It is good to see password... 

Obviously the old adage, you get what you pay for is just as relevant on the Web as it is offline. However there are always exceptions to the rule, and software developed by the community, or by Enterprises that give you a free taste of their full version, hoping you will one day upgrade are an example of one of those exceptions. There are many commercial antivirus products out there, and most are worth paying for, our favorite is Trend Micro Titanium Large organisations do not usually install freeware or open source, as they struggle to get the...