Writing

Security Blog

  • Password weakness

    In the xkcd comic on password strength, Randall Munroe triggers a discussion on the effectiveness of password algorithms. While he raises valid points, the real risk lies in password reuse and breaches. Moving away from passwords and exploring alternatives like SSL certificates or one-time passwords may be a more promising approach.

  • How certificates go bad

    The recent Comodo sub-CA bogus certificate issuance has sparked a loud discussion in the security community. This incident highlights the flaws in the SSL certificate authority (CA) model. Trusting numerous CAs globally creates vulnerability, and compromised registration authorities (RAs) can issue certificates for any domain. Incident response and transparency are crucial, but incidents like this…

  • Architecting for DDoS -Defense

    Designing a robust DDoS mitigation strategy requires understanding potential failures and the efficiency of attacks. While increasing capacity can be a simple solution, it’s crucial to push functionality to the edge, prioritize user authentication, employ caching techniques, and store user-generated content. Instead of focusing on recovery time, design for a Minimum Uninterrupted Service Target to…

  • Awareness Training

    Implementing a robust security awareness program is not difficult if your company prioritizes security. However, if security is not a concern, you have a significant problem. Many programs focus on meeting auditor requirements with annual training sessions and policy acknowledgments. While these are necessary, a comprehensive program integrates security into various activities and encourages employees…

  • NSEC3: Is the glass half full or half empty?

    NSEC3 is a DNSSEC specification that addresses the issue of authenticated denial of existence in DNS. It replaces the NSEC method by using a hashing function and signed hash ranges to prevent easy collection of zone file contents. While NSEC3 improves secrecy, it raises questions about the need for semi-secret public DNS names and suggests…

  • Contracting the Common Cloud

    After attending CSO Perspectives, Bill Brenner has some observations on contract negotiations with SaaS vendors. While his panel demonstrated a breadth of customer experience, it was, unfortunately, lacking in a critical perspective: that of a cloud provider. Much of the point of SaaS, or any cloud service, in the economy of scale you get; not just in…

  • The Adaptive Persistent Threat

    Much ado has been made of the “Advanced Persistent Threat”. Unfortunately, pundits look at the ease of some of the attacks, and get hung up on the keyword, “Advanced.” How do we know the adversary is so advanced, if he can succeed using such trivial attacks? The relative skill of the adversary is actually uninteresting;…

  • Why is PCI so successful?

    At the RSA Conference, participating in a panel discussion on the PCI Data Security Standard, it was evident that PCI has significantly impacted the industry. The standard’s simplicity, broad applicability, and narrow focus on protecting specific data have improved security more than any other standard. It serves as a model for future compliance standards.

  • Why don’t websites default to SSL/TLS?

    HTTP is designed for web administrators to host multiple sites on fewer systems, while HTTPS (SSL/TLS) focuses on security-conscious users. SSL’s design creates scalability issues, although solutions like wildcard and SAN certificates, as well as SNI, aim to mitigate them, pending widespread SNI support.

  • Modeling Imperfect Adversaries

    Brian Sniffen’s paper at FAST highlights the importance of understanding adversaries in risk assessment, particularly in the streaming media space. It explores concepts like defense in breadth and tag-limited adversaries, emphasizing the need to consider different capabilities and attack strategies when formulating security frameworks. His work provides valuable insights into the evolving landscape of streaming…

Leadership Newsletter

  • What’s in the cards for you?
    What’s in the cards for you?

    Leadership Moment: Playing Your Cards Right Last week, I was in New York for a CISO dinner with two of our portfolio companies, Valence Security and Aim Security. Yoni Shohet (Valence CEO) pulls me aside before the dinner and says, “I brought you a gift.” Now, I often get a lot of swag from companies… Read this …

  • Inspiration as a Shield
    Inspiration as a Shield

    Leadership Moment: Shields Down Talking with a startup CEO recently, they shared the story of one of their principal software engineers who had just left to join an even earlier stage startup. On the surface, it seemed like a reasonable career choice: after learning that they had what it took to be a key contributor… Read this …

  • Too Much Deference to Blind Compliance
    Too Much Deference to Blind Compliance

    Leadership Moment: Choice isn’t Frozen There are times when an organization wants to demonstrate bold leadership on as issue, as the Paris Olympic Committee did when it decided to use geothermal cooling systems instead of more effective air conditioners. Unfortunately for the POC, they didn’t anticipate the entirely predictable consequence: that many countries would bring… Read this …

Fiction