A number of big name retailers, insurance providers and companies have hit the headlines with their cyber attacks and data breaches over the last year or two. But what about the small and medium businesses? There’s no doubt they have their own security incidents but…
In the headlines: Mr Grey hacker, Vtech hack, US government office hack and more
FBI hunting ‘Mr Grey’ hacker and his 1.2 billion stolen logins In a massive botnet operation which stole data from over 420,000 websites, the FBI are now zoning in on one member of a Russian crime ring known as ‘CyberVor’, with their target being known…
Defence in Depth – Part 3 – The Least Privilege Principle
An application does not need to use the root (MySQL), sa (Microsoft SQL Server), postgres (PostgreSQL) or SYSDBA (Oracle Database) to connect to the database. Likewise, it’s a bad idea to run daemons or services as root (Linux) or Administrator (Microsoft Windows), unless there is…
Takeaways from the VTech Hack, and the Vigilante Side of Security Breaches
Anyone following the news this week likely learned of the massive breach exposing the personal data of millions of parents and their children. VTech, a Hong Kong-based toy maker was hacked, exposing everything from children’s names and home addresses, to pictures (reportedly, 190GB worth of…
HIMSS survey uncovers critical weaknesses in hospital web security
A new report has just been published, covering the current state of cybersecurity in the US healthcare sector. Considering the very public breaches of Anthem and other health insurers over the last year, the sector is particularly under scrutiny. Unfortunately the results are not very…
PWC Global State of Information Security Survey 2016
Price Waterhouse Coopers have just published a report about cybersecurity. Not about the attacks and threats themselves, but about how businesses are tackling the risks. Titled the Global State of Information Security Survey 2016, its key findings relate to measures such as external collaboration and…
Defence in depth – Part 2 – Security before obscurity
Fail-safe defaults Software is bound to fail. Try as we might to create perfect, failure-resistant software, bugs will always exist that might cause software to fail. Notwithstanding this, it is important that this potential failure does not expose an application to a security risk. An…
In the headlines: Anonymous vs ISIS, Australian attorney general, NTP and DDoS exploits
Anonymous vs ISIS Naturally, even cybersecurity news in this past week has centred around ISIS in the wake of the Paris attacks. The main headline has come from Anonymous, who have again but more formally waged ‘war’ on ISIS themselves. So far their efforts seem…
Defence in depth and how it applies to web applications – Part 1
Information security generally refers to defending information from unauthorized access, use, disclosure, disruption, modification or deletion from threats. Organizations are constantly facing threats that exist both externally as well as internally — be they from nation states, political activists, corporate competitors or even disgruntled employees….