Browse Blog Posts by Tags

MVP WordPress Blogs

Browse Blog Posts by Tags

Showing related tags and posts for the Blogs application. See all tags in the site

Playing with security blogs

I’ve found a new weekend hobby – it takes only a few minutes, is easily interruptible, and reminds me that the state of web security is such that I will never be out of a job. I open my favourite search engine (I’m partial to Bing , partly because I get points , but mostly because I’ve met the guys who...

Posted to Tales from the Crypto by Alun Jones on Sun, Apr 28 2013
Filed under: Filed under: General Security, Programmer Hubris, Security Awareness
That old “cyber offence” canard again

I’m putting this post in the “Programmer Hubris” section, but it’s really not the programmers this time, it’s the managers. And the lawyers, apparently. Something set me off again Well, yeah, it always does, and this time what set me off is an NPR article by Tom Gjelten in a series they’re currently...

Posted to Tales from the Crypto by Alun Jones on Wed, Feb 13 2013
Filed under: Filed under: General Security, Programmer Hubris, TCP/IP, Security Awareness
UDP and DTLS not a performance improvement.

Saw this update in my Windows Update list recently: http://support.microsoft.com/kb/2574819 As it stands right now, this is what it says (in part): OK, so I started off feeling good about this – what’s not to like about the idea that DTLS, a security layer for UDP that works roughly akin to TLS / SSL...

Posted to Tales from the Crypto by Alun Jones on Wed, Oct 31 2012
Filed under: Filed under: General Security, Programmer Hubris, Miscellany - not security, TCP/IP, Windows Server 2008, Windows 7, Security Awareness
But officer, everyone else is speeding…

I’ve been consistently amazed by human behaviours for many years, and through many employers. One of the behaviours that always astonishes me is when I let someone know that they’re violating security policy, or simply behaving in an insecure manner, and rather than changing their behaviour or defending...

Posted to Tales from the Crypto by Alun Jones on Mon, Aug 13 2012
Filed under: Filed under: General Security, Programmer Hubris, Security Awareness
MVP news

My MVP award expires on March 31 So, I've submitted my information for re-awarding as an MVP - we'll see whether I've done enough this year to warrant being admitted again into the MVP ranks. MVP Summit Next week is the MVP Summit , where I visit Microsoft in Bellevue and Redmond for a week...

Posted to Tales from the Crypto by Alun Jones on Mon, Feb 20 2012
Filed under: Filed under: General Security, Things I Learned At Microsoft, Alun's code, Security Awareness
Changing passwords on a service, part 3

It’s been quite some time since I wrote about changing passwords on a Windows service , and then provided a simple tool written in Visual Basic to propagate a password among several systems sharing the same account. I hinted at the time that this was a relatively naïve approach, and that the requirement...

Posted to Tales from the Crypto by Alun Jones on Sat, Feb 11 2012
Filed under: Filed under: General Security, Programmer Hubris, What my wife knows, Security Awareness
NCSAM 2011–Post 21–Failure is always an option

For my last post in the National Cyber Security Awareness Month, I’d like to expound on an important maxim for security. Failure is always an option – and sometimes the best If you can’t handle a customer’s credit card in a secure fashion, you shouldn’t be handling the customer’s credit card. If a process...

Posted to Tales from the Crypto by Alun Jones on Tue, Nov 1 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 20–Is SSL broken?

It seems like a strange question for me to ask, given that in a number of my National Cyber Security Awareness Month posts to date, I have been advising you to use SSL or TLS to protect your communications. [Remember: TLS is the new name for SSL, but most people refer to it still as SSL, so I will do...

Posted to Tales from the Crypto by Alun Jones on Fri, Oct 28 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 19–Is it safe to give out my keys?

There are some people who seem to get this right away, and others to whom I seem to have been explaining this concept for years. [And you know who you are, if you’re reading this!] Whenever you talk about keys used for encryption, you have to figure out how you’re going to keep those keys, and whether...

Posted to Tales from the Crypto by Alun Jones on Thu, Oct 27 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 18–Know what security you want from your network

In yesterday’s post , we talked about how SSL and HTTPS don’t provide perfect security for your web surfing needs. You need to make sure that a site is also protecting its applications and credentials. This can be generalised One of my favourite interview questions for security engineer candidates is...

Posted to Tales from the Crypto by Alun Jones on Wed, Oct 26 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 17–SSL does not make your web site secure

I know, it sounds like complete heresy, but there it is – SSL and HTTPS will not make your web site secure. Even more appropriate (although I queued the title of this topic up almost a month ago) is this recent piece of news: Top FBI Cyber Cop Recommends New Secure Internet , which appears to make much...

Posted to Tales from the Crypto by Alun Jones on Tue, Oct 25 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 16–FTP is secure

Week 4 of National Cyber Security Awareness Month, and I’m getting into the more advanced topics of secure communications and protocols. I figured I couldn’t start this topic without something that’s very near and dear to me – the security of FTP. The good/bad old days FTP is one of the oldest application...

Posted to Tales from the Crypto by Alun Jones on Mon, Oct 24 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Week 3 summary–names and addresses

So, what did we learn this week? Your user name is not a secret Because the operating system doesn’t bother to help you hide user names, and because those user names are used in countless protocols as if they were public information, you’re backing a loser if you want to try and act as if the user name...

Posted to Tales from the Crypto by Alun Jones on Sun, Oct 23 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 15–What’s the better firewall–black-hole, or RFC compliant?

So, given the information we have so far, you should be able to answer the question. Background info There are two schools of thought when it comes to how a firewall should behave in some situations. The one school says that a firewall should ignore all traffic that reaches it, unless it is traffic that...

Posted to Tales from the Crypto by Alun Jones on Fri, Oct 21 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 14–An IP address as an authenticator?

So we’ve talked a little about names as claims of identities and passwords as proofs of those identities , continuing on to describe a fingerprint as a reasonable proof of identity , but perhaps not so useful when it has to be a claim and proof of identity at the same time. So, how about an IP address...

Posted to Tales from the Crypto by Alun Jones on Thu, Oct 20 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 13–What’s a fingerprint–name or password?

I’ve given a couple of arguments about names and why they shouldn’t be treated like passwords now, and because I always like to turn problems into classes of problems to be solved (the “meta-approach”), I figured a long time ago that I should decide what it is that makes a name different from a password...

Posted to Tales from the Crypto by Alun Jones on Wed, Oct 19 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 12–Don’t bother renaming Administrator

My argument here is much in the same vein as my previous post on choosing random usernames . I’ve met a number of people who argue that renaming the built-in Windows Administrator account is a great security measure, because an attacker now has to guess the name of the Administrator account as well as...

Posted to Tales from the Crypto by Alun Jones on Tue, Oct 18 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 11–Your user name is not a secret

It always amuses me when I receive an email where the “From” line reads something like this: From: mo95213@example.com (Davis McTeague) Because what this means to me is that some well-meaning security practitioner has decided that giving users random names “adds to the entropy in the password” – meaning...

Posted to Tales from the Crypto by Alun Jones on Mon, Oct 17 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Week 2 summary–wireless networking (Wi-Fi)

So, what did we learn this week? Don't disable SSID broadcast While it may sound like it helps you secure your network, it doesn’t really do anything of the sort. About the only argument in favour of this feature is that it causes casual users to select a different SSID to connect to when they’re...

Posted to Tales from the Crypto by Alun Jones on Sun, Oct 16 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM
NCSAM/2011–Post 10–WiFi is MITM central

So, why all the fuss about securing Wi-Fi? And what’s this “MITM” you talk about in the title of this post? MITM is a common abbreviation for “Man In The Middle”, a type of computer security attack, in which the attacker sits between the two ends of a conversation. As you can imagine, if you call your...

Posted to Tales from the Crypto by Alun Jones on Sat, Oct 15 2011
Filed under: Filed under: General Security, Security Awareness, NCSAM

Page 1 of 2 (37 items) 1 2 Next >

Questions? Contact Susan at Susan-at-msmvps.com. Each post's copyright held by the original author. All rights reserved. Blog site is an independent site not sponsored by Microsoft.
Our servers would like to thank www.ownwebnow.com and www.exchangedefender.com. We wouldn't be here without the generosity of Vlad Mazek and his companies.

Powered by Community Server (Commercial Edition), by Telligent Systems

Theme based on the Paperclip Blog Theme included in Community Server.
Enhanced to a Site-Wide Theme by Interscape Technologies.