Looking past Layer 7 - Web security is more than the app

Here's a bit I wrote on why we need to look deeper than the application when testing our Web security:

Looking past Layer 7

...it's the little, often overlooked, things that'll get you.

Read More

What part of No Truck Crossing do you not understand?

Check out this wild video of a train crash yesterday. It's a great example of the fact that just because you have a policy (i.e. the no truck crossing sign) doesn't mean that people will abide by (i.e. the dummy driver who probably thought "Aw, I can make this."). Some people just believe that they are exempt from certain things.

Keep this in mind for your information security matters...you can't save people from themselves all the time (like in this case) but you've got to set people up for success whenever you can.

Read More

Deep thought of the day

All we have are our knowledge and our time and we don’t have a grip on managing our day-to-day tasks and projects we’ll let both go to waste and drive ourselves crazy. Get to know the basics of time management soon. This knowledge will do wonders for your career.

Read More

Relying on users to wipe out wimpy passwords??

I just came across this Dark Reading bit by Adrian Lane on wiping out wimpy passwords. Adrian says that user training is needed so people know how to create strong passwords. I'm not picking on you Adrian however this has become a downright ridiculous approach, one that's been proven time and again not to work.

My take is if you have to set your users up for success and, therefore, have to MAKE them create strong passphrases. It's as simple as enabling minimum password complexity policies in the OS and building in strong passphrase requirements within Web applications so that they don't have the option to take the path of least resistance.

Just like anti-lock brake systems in automobiles, circuit breakers in home electrical panels, and seat belt requirements on airplanes, we have to build in security controls that set our users up for success. Period. Unless and until we do, we're going to continue having the same old ridiculous password issues we've always had.

Read More

Webinar on database security this week

Here's a webinar put on by Application Security, Inc. that I'm participating in this Thursday (1/28/10) in case you're interested...should be enlightening.

Five Burning Questions Series: 2010 IT Security Auditor’s Roundtable

Read More

What are your thoughts on Web hosting / colo providers?

Better think things through when giving up the reigns and letting a third-party Web hosting or colo provider run the show:

When using a Web hosting provider can be bad - really bad - for your business

You'd think Network Solutions would have better security controls in place.

When will people pull their heads out of the sand? Maybe never??

Speaking of this specific vulnerability, here's a recent bit I wrote on Acunetix's blog about on looking past layer 7 and fixing all Web-related issues.

Read More

My latest information security content

Here are my latest information security articles and a podcast focusing on Web security and document security. Enjoy!

First, my Web security articles:
Changes coming to the OWASP Top 10 in 2010 (read the comments too, I stirred the puddin' with this piece!)

Free Web proxy tools you need to get to know

Securing Web servers in Windows environments

...and a document security podcast (this is a really interesting story if you haven't heard about it)
Document redaction and the recent TSA leak

You know the drill - as always, be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, videos, Twitter updates, and more.

Read More