Blogs
How do I Keep My Data Secure Using Amazon S3 Encryption?
Cloud storage services allow customers to store and retrieve files on a remote, third-party server. [1] Cloud storage aims to be more cost effective and…
Onsite Social Engineering Part II
I’d rather lie to your face. The average corporate security training program might be useful when it comes to thwarting remote attackers, but does it…
AES-NI in Action
The use of encryption has drastically changed over the years. A vast number of encryption ciphers have been deemed weak (e.g., RC4), while others are…
Ransomware: Healthcare Security
“All truths are easy to understand once they are discovered; the point is to discover them” – Galileo Galilei Seems simple, right? Unfortunately, that’s not…
Anti-virus, a cure worse than the disease?
This blog post will explore situations in which anti-virus software caused more harm than good. As the anti-virus landscape changes, software vendors are eager to…
Don’t DROWN in Old Protocols—Disable SSLv2
A recently discovered vulnerability with SSLv2, dubbed the “DROWN” attack, has put the final nail in the SSLv2 coffin. Despite SSLv2 being deprecated since 2011[1],…
Assessing Healthcare: Patient Data vs Patient Health Part 1
Patients are a hospital’s most important asset, not their data. We recently concluded a study, www.ise.io/hospitalhack, at a variety of hospitals to determine the plausible…
An Important Misconception about Two-Factor Authentication
The adoption of two-factor authentication (2FA) could not be more important. Something-you-know secrets have proven ineffective time and again, be it through password guessing or…
HLS+concat/subfile
A few weeks ago, programmer, Maxim Andreev, released a critical ffmpeg and libav vulnerability in his blog that affects all ffmpeg versions prior to the…
Onsite Social Engineering 101
Social engineering is all about manipulation, misdirection, and, above all, opportunity. I was lucky to be mentored and introduced to social engineering and physical security…
Using OpenSSL to determine which Ciphers are Enabled on a Server
When evaluating a remote target, learning more about the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) configuration can be very useful. Being able to test…
Is Apple’s watchOS 2 Update Less Secure than the Predecessor?
If you are like me, you were ecstatic when Apple finally decided to release its version of the Apple Watch smart watch. For many, this…
Quantum Computing and Quantum Resistant Algorithms
Recently, I gave a little talk at ISE about quantum computing; I tried to delve into the subject a little deeper than what you might…
Advanced Package Tool: Privacy or No Privacy?
The Debian-based Linux distribution’s package manager, Advanced Package Tool (APT), does not ensure privacy out of the box. While other UNIX package managers use SSL/TLS,…
Samsung SwiftKey Killer Exploit
The security firm CrowdStrike recently revealed a vulnerability that its staff discovered in QEMU-based virtual machine (VM) products (CVE-2015-3456). These include Xen, KVM, and VirtualBox…
Technology in Healthcare and Patient Risk
Technology is a critical component in healthcare: we get it, we can all agree on this point. However, these same technologies…the ones meant to better…
VENOM Vulnerability: The Newest Threat to Your System’s Cyber Health
The security firm CrowdStrike recently revealed a vulnerability that its staff discovered in QEMU-based virtual machine (VM) products (CVE-2015-3456). These include Xen, KVM, and VirtualBox….
Cyber Security: The Gateway to Career Success
A notable weakness in most organizations’ security program is a lack of trained, experienced, and available security resources; to protect their assets, organizations require talented…
Don’t Believe Everything You Read: Security Bugs in Reference Materials
In this post, we consider the impact that the explosion of new software frameworks, and the frequent need to shift between them, has on security:…
Superfish and Lessons Not Learned – Preloaded Malware
Our customers regularly develop products for Windows systems. Due to the dynamics of today’s laptop and desktop market, machines hosting Windows operating systems often come…
Which SSL/TLS Protocol Versions and Cipher Suites Should I Use?
Our customers develop and deploy products that rely SSL/TLS to protect the confidentiality and integrity of Web, VPN, e-mail, and other traffic. We are often…