Information Security Articles

Showing Articles: 16 of 6

Nov 11 2014

A Video Is Worth a Million Words

It is a well-known fact that system administrators with root-level privileges have wider access to company’s critical information assets than the C-level executives. With great power comes great responsibility, and most people will also act responsibly. But as an information security officer, would you trust this power and responsibility to someone you cannot identify or whose actions you cannot verify…

Keep Reading

Oct 7 2014

Potential Pitfalls of MAS TRM Guidelines

Monetary Authority of Singapore (MAS) revised its Technology Risk Management Guidelines (TRM) in June 2013. Financial Institutions (FI) operating in Singapore have since been reviewing the guidelines against their own security procedures and infrastructures, to determine necessary enhancements to match the new requirements. While the guidelines are not legally binding, MAS uses them when performing risk assessments of the…

Keep Reading

Jul 23 2014

Snowden Calls On Employees To Leak Company Secrets

During the Hackers On Planet Earth (HOPE) conference, Edward Snowden and Daniel Ellsberg called on insiders (employees) to spill corporate and government secrets.  Snowden is calling for the development of encryption and obfuscation tools to make this easier. The goal is to anonymously expose malfeasance without any repercussions. They believe that people should be able to do this without paying any price and without being held accountable. Superficially this all sounds like a good idea, but who gets to decide what should be leaked or stolen and what constitutes improper behavior?  What else could be leaked or…

Keep Reading

Apr 30 2014

Free Can Make You Bleed

By now anyone concernedwith internet security has heard about the Heartbleed security vulnerability in OpenSSL.  What you may not be aware of is how much money and personal information is riding on this “free” security program and others like it (OpenSSH).  Free is not usually a bad thing, but it can be when it causes the software your business depends on to be under resourced…

Keep Reading

Apr 27 2014

Privileged Users – Not Malicious But Still a Threat

One of challenges security architects face is finding the right balance between security and end user convenience. This conflict is typified by the example of password policies. A too stringent policy drives users to write down their passwords on sticky notes (thus defeating the security objective) and a too weak policy leaves passwords exposed to cracking…

Keep Reading

Mar 18 2014

People Centered Security: Themes from The Gartner IAM Summit

Growing up, we get a lot of conflicting advice. We are told  “look before you leap” but also “nothing ventured nothing gained”. The book of clichés is littered with other examples. The world of Identity and Access Management is similarly conflicted. On the one hand, IAM  should be transparent to the user and simple to administer. On the other hand, IAM must enforce the principle of least privilege. These goals are mutually exclusive. Why? It is just too complex to define specifically the fine grained access each user needs in order to perform their job and manage that access over time in a dynamic work environment. The result is too many job roles, too many exceptions and ultimately weaker, not stronger…

Keep Reading