The Information Security Circus

A cynical take on the circus that is the world of Information security

[securitycircus]

[securitycircus]

[securitycircus]

100 percent of business networks analyzed by Cisco have traffic going to websites that host malware.

http://www.cisco.com/web/offer/gist_ty2_asset/Cisco_2014_ASR.pdf

[securitycircus]

"It should be clear by now to most managers what computer security risks they face. However, security is generally not the top priority item when it comes to funding...." Not a lot has changed in the 32 years since the article this is quoted from was published!

Computers & Security Journal - Reflections on ten years of computer security - published November 1982

[securitycircus]

I've today been told that a poster and a newsletter is good enough for a security awareness campaign. No. It isn't.

[securitycircus]

And today's data-breach victim is Sally Beauty with yet another tale of woe and leaked credit cards...read all about it here: http://krebsonsecurity.com/2014/03/sally-beauty-hit-by-credit-card-breach/

[securitycircus]

Poisoned Apple?

By now, most of us are familiar with the following lines of code:

if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)

        goto fail;

    if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)

        goto fail;

        goto fail;

    if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)

        goto fail;

These innocuous few lines are the reason for the recent Apple security faux pas. The question is: are they so innocuous to be a deliberate and malicious back-door? Bruce Schneier thinks so. He might be right...read more here.

[securitycircus]

Compliance is destroying security

Just about every major organization that has suffered a recent data breach has been certified as being in compliance with one or more security related regulatory requirements. With lawyers running the show, those of us manning the front lines can only continue to tut and shake our heads and wait for the next disaster. Maybe they'll call in a consultant to do an independant review....