Today, after leaving a meeting, one of my junior analysts said “I guess we need to lower the threshold for declaring an incident.” Intrigued, I asked what brought him to that conclusion. He said “well, our incident response plan says that we organize the team if more than ten computers are affected, but you just […]
This is part 1 of a 10-part series of articles on protecting your business assets from ransomware. You can read the articles as a series of blog posts, or request a copy of the entire series in this free whitepaper: 10 Critical Steps to Survive a Ransomware Attack. Step 1: Drop Administrator Rights One of […]
We’re seeing a rash of ransomware sweeping across IT systems, ranging from large enterprises to microbusinesses with only a few PCs. As I am writing this, we are in the middle of responding to an incident where a business has been entirely shut down due to being infected with the Locky ransomware. The entire business has […]
Last week, Brian Krebs reported on a disturbing trend in federal (.gov) websites having “open redirects” enabled, allowing scammers to delivery content from seemingly legitimate (government) websites. So why do these open redirects even exist in the first place? Simply put, they are a convenience for website developers. Many websites will offer links to other […]
We regularly receive reports from clients who are denied access to certain websites, all while in the course of performing their legitimate work duties. As this Ars Technica article explains, a number of very high profile websites, including The New York Times, the BBC, MSN, and AOL, were effectively compromised by their advertising partners’ ad […]
We’ve all gotten that spam message that, despite being annoying and unsolicited, kinda seems interesting. “Yeah, I know I wasn’t really looking to buy any prescription drugs today, but that price seems really good…” If you ever get a spam email that looks enticing enough to buy, from, don’t! Here’s why:
You know the feeling: you go to open up Facebook, Amazon, a work-related website, or even worse, your own company website, and get the message that the “page cannot be displayed.” Frustrated, you immediately pick up the phone and call your web host or “IT guy” and complain that your website is offline. He calmly […]
“We’re too small to be a target.” “Nobody wants what we have.” “Nobody cares about our systems.” “There isn’t enough money in our bank account for anyone to want.” These are all phrases that clients of mine have uttered during meetings on the topic of information security. But even if you think have nothing anyone […]
Apple’s Touch ID fingerprint scanner is little, round, innocuous looking Rorschach test. Stare into its unflinching gaze and you’ll see wonder, terror, good security, no security, a social revolution, or a lie being foisted on the smartphone buying public by Apple, depending on your background, biases, and philosophical inclinations.
In June, the makers of the Opera web browser had their IT systems breached. While the title of their blog post reads that they stopped the breach, this is really misleading. Yes, they stopped it, after hackers had compromised their systems, forged malware to make it look like authentic Opera software, and allowed people for […]