Tech Support For Dummies

  • Subscribe to our RSS feed.
  • Twitter
  • StumbleUpon
  • Reddit
  • Facebook
  • Digg

Monday, 31 January 2011

The Egyptian uprising tie-in with the U.S. Internet kill switch

Posted on 07:12 by Unknown
The people rioting in Egypt against their oppressive government and the subsequent blocking of the Internet is an interesting issue that has a global reach. Foreign policy aside, have you stopped to think about the ramifications of the cybersecurity "kill switch" bills that our measly politicians are trying to force upon us?

As I wrote previously, the proposed Rockefeller-Snowe Cybersecurity Act of 2009 (Senate Bill 773) and Lieberman-Collins-Carper Protecting Cyberspace as a National Asset Act of 2010 (Senate Bill 3480) provide undeterred powers to the government to effectively shutdown our economy as we know it. Would the president use this power during a cyberattack? Presumably. Would the president use it during an uprising like what's going on in Egypt? It wouldn't surprise me.

But, you say, all of this is happening in Egypt...this is America - we'd never reach that point! That's a shortsighted and dangerous mindset. Just look at all the nonsense the Social Democrat Party have shoved on us the in the past two years alone...evidence enough to rational people that anything's possible with a runaway government. Our government "leaders" don't want to be questioned, they don't want to explain their actions and they certainly don't like it when people speak out against them. [The whole free speech thing cracks me up when you think about what the old-school liberals of the 1960s demanded, but that's another story.]

As Senator Susan Collins recently said "unlike in Egypt, where the government was using its powers to quell dissent by shutting down the internet, it would not." Oh, okay, we understand and believe you Senator Collins. The government has never put legislation in place for one purpose and ended up abusing it for other means down the road. We're good. Here are some more details on this recent news:
As Egypt goes offline US gets internet 'kill switch' bill ready (the graph showing Internet traffic to and from Egypt last week is really interesting)

...according to Wired Magazine, it looks like the Lieberman-Collins-Carper cybersecurity bill is set to be reintroduced into a Senate committee any day now.

So, it's scary to many what the Egyptian government did/is doing to it's people and the U.S. is now wanting to put the same draconian powers in place? But you know it'll be different here...like Socialism. It's failed elsewhere for centuries, but big, strong America can make it work for the greater good of the people.

Folks: good, bad or ugly, our politicians are going to get their way. Way too many voters are concerned about what's happening on Facebook, NCAA basketball and American Idol for us to be able to truly hold these people's feet to the fire.

What can you do...? Interesting times indeed.
Read More
Posted in compliance, government intrusion, government regulations, personal responsibility, scary stuff, stupid security, thinking long term | No comments

It's hard being human

Posted on 05:38 by Unknown
Cavett Robert once said something about character that resonates within information security - especially regarding ongoing management and leadership. He said:

"Character is the ability to carry out a good resolution long after the excitement of the moment has passed."

When I saw this I was reminded of how pumped you can get when attending a show like RSA or CSI or how neat certain vendor marketing spiels sound. Another is when an information security consultant or internal auditor produces a report that kindles the fire inside so you resolve that you're going to make things right this time around...but then the newness and the excitement wear off. We get busy and fall back into our old ways and like I wrote about we lose sight of what's important. The cycle continues.
Read More
Posted in careers, great quotes, information security quotes, security leadership, security management, stupid security | No comments

Friday, 28 January 2011

Take patch management out of IT's hands completely?

Posted on 05:37 by Unknown
Here's a piece by CNET's Stephen Shankland on continuously updating software and patch management. Not sure where things will end up (we're already halfway there with this technology) but it's something that certainly couldn't hurt security.
Read More
Posted in patch management, patching, security management | No comments

Monday, 24 January 2011

Web application security testing: how much is enough?

Posted on 17:24 by Unknown
How often should you test your Web sites and apps for #security flaws? Well, it depends of course! Here's a new bit I wrote where I delve into the different variables and things you need to be thinking about:

How often should you test your web applications?

Enjoy.
Read More
Posted in ethical hacking, Kevin's security content, penetration testing, security policies, web application security | No comments

My book Hacking For Dummies is now in 3 languages

Posted on 03:30 by Unknown
I was just told by my acquisitions editor at Wiley that my book Hacking For Dummies is being made available as an Italian language publication.



English, Estonian (I know, who would've thought!?) and now Italian...cool.
Read More
Posted in ethical hacking, Kevin's books, Kevin's security content, recommended books | No comments

Sunday, 23 January 2011

Cybersecurity schmybersecurity

Posted on 11:10 by Unknown
Here are a couple of #cybersecurity pieces I authored for TechTarget's SearchCompliance.com regarding the proposed Rockefeller-Snowe Cybersecurity Act of 2009 (Senate Bill 773) and Lieberman-Collins-Carper Protecting Cyberspace as a National Asset Act of 2010 (Senate Bill 3480):

Why the Cybersecurity Act is better for government than business

Is the latest cybersecurity bill an Internet takeover by the fed?

You know how I am about government growth and its intrusion into the free market. By and large that's what both of these pieces of legislation represent. As with so many other federal government regulations I strongly believe that it'd serve to cause more problems than it fixes.

But who am I to question...the politicians know best, right?
Read More
Posted in compliance, government intrusion, government regulations, Kevin's security content, scary stuff, security leadership, stupid security | No comments

Thursday, 20 January 2011

Skill to do comes of doing

Posted on 02:16 by Unknown
Ralph Waldo Emerson once made this statement which completely and totally applies to what you do in your job and how you develop your career over the long haul:
"Skill to do comes of doing."

As with surgeons, home builders, mechanics, race car drivers and so on...we learn most by doing.

I know a lot of people are going back to school and focusing on getting their degrees and certifications right now. There's certainly value in doing so. Just never ever forget that formal training and education are only a relatively small part of the overall package that you bring to the table. So get out there and get your hands dirty because there's no replacing good old-fashioned hands-on experience!

If you're interested in hearing a lot more of my take on certifications, degrees, and experience and the best way to approach each of them to enhance your career, check out this Security On Wheels audio program I put together. Here's a snippet you can download and listen to.
Read More
Posted in audio programs, careers, certifications, great quotes, information security quotes | No comments

Wednesday, 19 January 2011

Good bits to share about computer disposal

Posted on 06:16 by Unknown
Here's a good short read from SANS (@sansinstitute) you can share with your non-technical family members, friends & neighbors on why they need to careful when disposing of their computers and how they can do it properly.
Read More
Posted in disposal, ediscovery, forensics, stupid security | No comments

More on the Ponemon Lost Laptop Survey

Posted on 05:38 by Unknown
Here's a short piece where I was quoted by Rod Scher in Processor magazine (a very good trade rag by the way) on the Ponemon Institute's Billion Dollar Lost Laptop study.

Not only are the numbers astounding, this is a big problem that's growing every day - crying out for our attention.
Read More
Posted in drive encryption, laptop encryption, laptop security, mobile security, scary stuff, stupid security | No comments

Tuesday, 11 January 2011

My "new" book on ethical hacking turns 1

Posted on 18:12 by Unknown
Today marks the one year anniversary of the publication of my "new" book Hacking For Dummies, 3rd edition.



Wow, how time has flown by! Thanks so much to those of you who have provided both kind words and constructive criticism via your emails, Amazon.com reviews, and in your own independent sites and blogs. No doubt it'll soon be time to start planning out the 4th edition. Until then...
Read More
Posted in ethical hacking, Kevin's books, message from Kevin, penetration testing, recommended books, security assessments, vulnerability assessments | No comments

Tidbits on MS security, MBSA vs. the competition & cloud backups

Posted on 18:03 by Unknown
Here are a few new articles I wrote for TechTarget where I talk about IIS 7.5 security, encrypting Windows Server drives, MBSA vs. commercial vulnerability scanners and the dearly beloved cloud backup services. Enjoy!

How vulnerable is Microsoft IIS 7.5 to attacks?

Pros and cons of Windows Server drive encryption

Weighing MBSA against paid vulnerability scanners

Preventing online backup security threats to your network
Read More
Posted in backups, cloud computing, drive encryption, encryption, IIS, laptop encryption, online backup, penetration testing, saas, security testing tools, vulnerability assessments, Windows | No comments

Beware the "network assessment"

Posted on 09:07 by Unknown

There are many IT services firms - including some run by friends and colleagues of mine - who perform something called "network assessments". The outcome of these assessments - which are usually aimed at SMBs - is to determine the overall health of your network and computing environment, supposedly including security.

First, let me be clear that these are legitimate services to see where your network stands. That's fine and dandy - a useful service indeed. The problem is that these network assessments are being pushed/sold under the guise of security assessments. I was recently on a friend of mine's website and saw how they can check the security environment of a network. I looked at the Web site of another colleague of mine and his business claims to offer a service that ensures your sensitive data remains protected. In our discussions, neither of these people have ever claimed to be security experts. I don't believe "in-depth security assessments" are their intent either.

But what about all the other network services firms/consultants out there like them...?

My point is to be careful. Don't assume that just because a network engineer checks your systems, recommends some software updates or network design changes, and ultimately installs some new security products in your environment that your information is truly secure. A solid and effective information security program is much grander beast.

Read More
Posted in network analysis, scary stuff, security assessments, stupid security | No comments

What's holding you back?

Posted on 07:48 by Unknown
Orison Swett Marden once said:

"What keeps so many employees back is simply unwillingness to pay the price, to make the exertion, the effort to sacrifice their ease and comfort."

So true...as the saying goes good enough hardly ever is.
Read More
Posted in careers, great quotes, information security quotes, personal responsibility, security leadership | No comments

Monday, 10 January 2011

Great quote on information security choices

Posted on 05:41 by Unknown
Here's a great quote by Fred Smith that says it like it is:
"You are the way you are because that's the way you want to be. If you really wanted to be any different, you would be in the process of changing right now."

Obviously this also applies to our careers and personal lives...Like calories we ingest, our choices add up dramatically over time.
Read More
Posted in careers, great quotes, information security quotes, security leadership | No comments

Wednesday, 5 January 2011

Speaking of supererogation, here's a great quote

Posted on 06:39 by Unknown
Regarding yesterday's post about the word supererogation and how it can help you in your infosec career, here's a great quote by the poet Ovid that supports such an approach:

"Make the workmanship surpass the materials."

Spot on...otherwise you just fall in line with the majority. Not good for your career, not good for business.
Read More
Posted in careers, great quotes, information security quotes, security leadership | No comments

My message to Republicans on this critical day in history

Posted on 05:40 by Unknown
This is a big, big day for the future of the United States of America. The people spoke in the last election telling the jokers in Washington that we don't want their "hope and change" that's running this country into the ground. Today our new Congress gets rolling. But what's it going to lead to? I have my fingers crossed that we won't see more of the same old Big Government nonsense coming from the new Republican leadership in the House.

Republicans: You've let us down so many times in the past that the lines are now blurred between you and the Socialist Democrat party. You've all represented Big Government for years. So what are you going to do differently now?

Republicans: Know that we're watching...if you don't stick by your principles and the Constitution this time around I'm confident that our country as it was intended and your party will become a thing of the past and we'll fall in line with the rest of the sheeple around the world. The standard of living that we've all grown accustomed to in America will slowly erode away in the interest of "the greater good" of the dumb masses - a system proven to fail time and again over the centuries. If this is what ultimately occurs, Republicans who fail to stand by their principles from this point forward will carry that responsibility and that burden.

Republicans: Please, please proceed with caution and think long term...we've all got too much to lose.
Read More
Posted in government intrusion, government regulations, message from Kevin, scary stuff | No comments

Tuesday, 4 January 2011

Supererogation helps infosec

Posted on 14:20 by Unknown
I saw a great Word of the Day from Merriam-Webster over the Christmas break: Supererogation

It means "the act of performing more than is required by duty, obligation, or need". Said another way it's going the extra mile above and beyond to make things happen.

If there's any one underlying component of being successful in everything you do it's doing all the other things that need to be done in security (or wherever in your life) after you've completed what's generally expected.
Read More
Posted in careers, success | No comments

Sunday, 2 January 2011

Security complacency & leadership - focus on both in 2011

Posted on 16:16 by Unknown
Happy New Year! Here are a couple of recent pieces I wrote for Security Technology Executive magazine I thought would be good to get things rolling for 2011:

Don't lose sight of what's important

Four traits of successful information security leaders

My wishes to you and yours for a healthy and prosperous year ahead!
Read More
Posted in careers, goal setting, incident response, personal responsibility, security leadership, security management | No comments
Newer Posts Older Posts Home
Subscribe to: Posts (Atom)

Popular Posts

  • How you can get developers on board with security starting today
    Some people - including a brilliant colleague of mine - think security is not the job of software developers . In the grand scheme of things...
  • NetScan Tools LE - a must-have for investigators
    Have you ever had a need to run a program and get a relatively small amount of data just to do your job but end up getting caught in the com...
  • "Top Blogs" list & some home security considerations
    I think I may have found the first sign that my blog is growing and gaining some traction. I've made it to the Top 20 Home Security Blog...
  • Wooo...HIPAA audits are coming & the irony of KPMG's involvement
    I've always believed that compliance is a threat to business [hence why I help businesses take the pain out of compliance by addressing ...
  • Great tool for seeking out sensitive info on your network
    One of the greatest risks in business today is the issue of unstructured information scattered about the network waiting to be misused and ...
  • It's hard being human
    Cavett Robert once said something about character that resonates within information security - especially regarding ongoing management and l...
  • Dario Franchitti and I
    As many of you know I'm a motorsports nut -both as a driver and a fan. This provided the influence for my Security On Wheels logo. Well,...
  • The value of partial code scanning, now
    Check out my new piece on the business value of partial code scanning where I outline why it's better to start your source code analysi...
  • Be it in healthcare or infosec, the short term is for losers
    With all the doctor & hospital visits I've gone (and am still going) through with family members in the past few years, I've com...
  • Live from #RSAC: Cloud computing's got some kinks (but you knew that)
    I'm attending the RSA Conference this week and just sat through a panel discussion on cross-jurisdictional issues in the cloud. It was p...

Categories

  • active directory
  • application firewalls
  • APTs
  • aslr
  • atm security
  • audio programs
  • audit logging
  • automated scanner oversights
  • back to basics
  • backups
  • big brother
  • bitlocker
  • budget
  • business case for security
  • business continuity
  • BYOD
  • car hacking
  • careers
  • certifications
  • change management
  • checklist audits
  • cissp
  • clear wireless
  • cloud computing
  • communication
  • compliance
  • computer glitch
  • conferences
  • consulting
  • content filtering
  • cool products
  • cool sites
  • cross-site request forgery
  • cross-site scripting
  • csrf
  • customer no service
  • cybersecurity bill
  • data at rest
  • data breach laws
  • data breaches
  • data centers
  • data destruction
  • data leakage
  • data protection
  • data retention
  • database security
  • degrees
  • desktop management
  • disaster recovery
  • disk imaging
  • disposal
  • dns
  • document security
  • domino
  • DoS attacks
  • drive encryption
  • e-discovery
  • ediscovery
  • employee monitoring
  • encrypting data in transit
  • encryption
  • end point security
  • ethical hacking
  • exchange
  • experience
  • expert witness
  • exploits
  • facebook
  • FERPA
  • file integrity monitoring
  • firewalls
  • forensics
  • full disk encryption
  • global warming
  • goal setting
  • good blogs
  • government intrusion
  • government regulations
  • great quotes
  • hacking
  • hardware
  • hipaa
  • hitech
  • hitech act
  • home security
  • humor
  • identity access management
  • identity theft
  • IIS
  • incident response
  • information classification
  • information security quotes
  • intel
  • intellectual property
  • internal threat
  • java
  • Kevin's books
  • Kevin's interviews
  • Kevin's keynotes
  • kevin's panels
  • kevin's quotes
  • Kevin's security content
  • Kevin's seminars
  • Kevin's videos
  • laptop encryption
  • laptop security
  • legal
  • Linux
  • locking screens
  • low-hanging fruit
  • malware
  • marketing hype
  • message from Kevin
  • messaging security
  • metasploit
  • metrics
  • mobile apps
  • mobile security
  • motivation
  • multi-factor authentication
  • network analysis
  • network complexities
  • network protocols
  • network security
  • networking essentials
  • Novell
  • office
  • online backup
  • online safety
  • open source security
  • owasp
  • p2p
  • passwords
  • patch management
  • patching
  • pci 6.6
  • pci dss
  • PCNAA
  • penetration testing
  • people problems
  • personal responsibility
  • phishing
  • physical security
  • pii
  • podcasts
  • policy enforcement
  • politics
  • presentations
  • privacy
  • quality assurance
  • recommended books
  • recommended magazines
  • recycling
  • remote access security
  • ridiculous password requirements
  • risk analysis
  • risk management
  • rogue insiders
  • ROI
  • RSA 2012
  • running a business
  • saas
  • salary
  • scary stuff
  • sccm
  • sdlc
  • security assessments
  • security audits
  • security awareness
  • security committees
  • security leadership
  • security management
  • security operations
  • security policies
  • security policy
  • security scans
  • security standards
  • security statistics
  • security technologies
  • security testing tools
  • security tools
  • selling security
  • sharepoint
  • small business
  • smartphone security
  • SMBs
  • social media
  • software development
  • source code
  • source code analysis
  • special offer
  • SQL injection
  • sql server
  • ssl
  • storage security
  • student information systems
  • stupid security
  • success
  • telecommuting
  • testimonials
  • thinking long term
  • third-party applications
  • threat modeling
  • time management
  • training
  • twitter
  • uncool products
  • unstructured information
  • unstructured infromation
  • user awareness
  • vendors
  • virtual machine security
  • visibility
  • voip
  • vulnerability assessments
  • web 2.0
  • web application security
  • web browser security
  • web server security
  • webcasts
  • WebInspect
  • whitelisting
  • whitepapers
  • Windows
  • Windows 7
  • windows 8
  • windows 8.1
  • Windows Mobile
  • windows security
  • Windows Vista
  • wireless
  • wireless security
  • zero tolerance

Blog Archive

  • ►  2013 (35)
    • ►  November (3)
    • ►  October (3)
    • ►  September (1)
    • ►  August (2)
    • ►  July (3)
    • ►  June (1)
    • ►  May (4)
    • ►  April (4)
    • ►  March (4)
    • ►  February (5)
    • ►  January (5)
  • ►  2012 (77)
    • ►  December (2)
    • ►  November (2)
    • ►  October (4)
    • ►  September (3)
    • ►  August (3)
    • ►  July (4)
    • ►  June (5)
    • ►  May (9)
    • ►  April (5)
    • ►  March (10)
    • ►  February (14)
    • ►  January (16)
  • ▼  2011 (163)
    • ►  December (15)
    • ►  November (11)
    • ►  October (9)
    • ►  September (16)
    • ►  August (13)
    • ►  July (8)
    • ►  June (13)
    • ►  May (18)
    • ►  April (16)
    • ►  March (13)
    • ►  February (13)
    • ▼  January (18)
      • The Egyptian uprising tie-in with the U.S. Interne...
      • It's hard being human
      • Take patch management out of IT's hands completely?
      • Web application security testing: how much is enough?
      • My book Hacking For Dummies is now in 3 languages
      • Cybersecurity schmybersecurity
      • Skill to do comes of doing
      • Good bits to share about computer disposal
      • More on the Ponemon Lost Laptop Survey
      • My "new" book on ethical hacking turns 1
      • Tidbits on MS security, MBSA vs. the competition &...
      • Beware the "network assessment"
      • What's holding you back?
      • Great quote on information security choices
      • Speaking of supererogation, here's a great quote
      • My message to Republicans on this critical day in ...
      • Supererogation helps infosec
      • Security complacency & leadership - focus on both ...
  • ►  2010 (170)
    • ►  December (10)
    • ►  November (14)
    • ►  October (7)
    • ►  September (27)
    • ►  August (20)
    • ►  July (8)
    • ►  June (15)
    • ►  May (4)
    • ►  April (23)
    • ►  March (21)
    • ►  February (11)
    • ►  January (10)
  • ►  2009 (55)
    • ►  December (5)
    • ►  November (10)
    • ►  October (21)
    • ►  September (19)
Powered by Blogger.

About Me

Unknown
View my complete profile