Jason A Lindsley

Wow. Thanks for sharing Vaibhav. This is a very low-tech scheme that could cause a lot of trouble for users that think this is just a new security feature. I can see a lot of folks falling for this type of scam and how it can create a lot of hassle for them. There is such a strong need for cyber awareness and education to the general public.

It took them 15 months to create the report on this. I wonder how long it will take them to remediate all the security findings. The other day a colleague was talking about how the OPM breach was much more than government employee information. I can see now how the SF-86 form could also provide personal and confidential information of employee’s…[Read more]

I think the following comment in the article is interesting:

“Nevertheless, hacking an election would be far from easy, he added. For example, there’s no central authority when it comes to ballot counting or voter registration. Instead, management of U.S. elections is spread out across 50 different states, and then to thousands of…[Read more]

Nice article Scott. 22% of the top 140,000 sites use 1024-bit keys despite the fact that NIST has been recommending 2048-bit keys since 2010. That’s quite astonishing!

The SSL pulse survey referenced in this article appears to aggregate the information and does not provide specific sites that are weak. I think the vulnerable sites will be…[Read more]

I agree with Loi Van – these companies should be required to do more due diligence and vulnerability testing for their advertisers to protect their customers.

In the meantime, I’ll be happy to pay my Spotify bill this month knowing that I’m not vulnerable to this threat. Can’t really complain with the $5 per month student rate for this service!

Critical infrastructure protection (or lack there of) really requires some drastic improvements across the globe. Many of the power plants across the globe (including US) are run by antiquated SCADA systems that were not built with security in mind. They are non-current, End-of-Life/End-of-Support and cannot be patched for security…[Read more]

I also did not see a quiz posted in blackboard.

This is a very concerning trend. The number of inherent threats and vulnerabilities that exist today alone is concerning, however usually the individuals with the skills to exploit vulnerabilities is limited. These individuals usually have specific motives (e.g. hacktivism, nation state, etc.),

Cybercrime as a Service gives attackers one…[Read more]

I think this is a smart move by Google. Admittedly, I don’t always check to see if HTTPS is used when processing a payment. I usually will if it is a site I’ve never used before, but I like the idea of this added Chrome functionality that will warn me. I also think they should warn users if older, non-secure versions of SSL/TLS are being used…[Read more]

Thanks for sharing Vaibhav. The greatest way to prevent these scams from being successful is public awareness. Unfortunately, the victims of these scams probably are novice users of the Internet and are not aware of these types of scams. There was a post last week about a crackdown on one of the payment processors for these types of scammers…[Read more]

I’m glad this vulnerability was discovered. While I don’t typically backup my iPhone to iTunes, there have been times I’ve done this either as a precaution or because my iCloud account was full. We typically don’t think to delete these backup files, so there was a risk that data backed up during this period could be stored indefinitely without a…[Read more]

These password breaches are not just a risk to internal employee credentials, but also a risk to companies that have customer facing websites. With the hacks referenced in these articles, many companies are seeing a rise in brute force password attacks on their sites with hackers attempting to use the same or similar passwords associated with…[Read more]

We also have a very strong BYOD policy at our work. We utilize a Mobile Data Management (MDM) solution with a containerized environment for mail, calendar, and contacts. We’ve locked down our webmail so that it cannot be accessed via native applications on the device.

If a device is lost or compromised, it can be remotely wiped from the admin…[Read more]

I have a Yahoo account that I rarely use, but it still contains PII that I would not like leaked. Fortunately, I was using Yahoo’s one time password feature. It’s similar to two-factor authentication (i.e. password + SMS one time code), but you do not enter a password at all. Each time you try to login, you are e-mailed an 8 character one time…[Read more]