Loi Van Tran

Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) are two different concepts. BCP is the organizational strategy involved with ensuring the continuous operation of core business functions during and after a disaster. DRP is a subset of the overall BCP and are more specific. DRPs may be developed for specific groups within the…[Read more]

I believe that this is a real concern. Strong passwords are extremely difficult to keep track of and cyber threats are continuing to grow at an exponential rate. Even for the most security aware professional, keeping up with security can be tiring.

Thanks for the post Scott,

Your last statement make it very clear, don’t digitized anything that you don’t want nobody to see. For consumers using digital applications, they have to make the choice between their privacy and their convenience. It is a decision that should not be taken lightly, but more often than not, people download and…[Read more]

Hi Wayne, thanks for the post.

In this day and age “Hack-proof” code seems like an illusion. I agree that making things simpler also makes it easier to secure, but compartmentalization doesn’t actually make the system “hack-proof” as the article indicated, it just it makes it harder.

I couldn’t agree more, but after watching the presidential debate the other night where cybersecurity was not even brought up, it concerns me that our government is not doing enough to protect its nation or citizens from cyber attacks. Yes, President Obama has made some strives in budgeting to increase the US Cybersecurity posture, but I don’t…[Read more]

This is an extremely interesting article. If think outside the bounds of just Spotify, a lot of freemium apps provide ads in exchange for their service, e.g., Facebook, games, etc. If these companies do not properly screen the ads that they add into their network they are making hundreds, thousands, or even billions of people vulnerable to…[Read more]

The influx of technology creates a high demand for security professional to help protect organizations from attacks. According to a research conducted by Frost & Sullivan and the International Information Systems Security Certification Consortium (ISC)2 worldwide shortfall of security professionals will be 1.5 million workers by…[Read more]

Synopsis of “2016 Emerging Cyber Threats Report” from Georgia Tech Institute for information Security and Privacy.

This report came out of the security summit in 2015. It speaks of cyber threats in broader terms and addresses these four areas:

Consumers continue to lose their privacy as companies seek to collect more data:
As…[Read more]

Ruslan,

Thanks for your post and examples. It really helped me understand Kerckhoff’s second principle: cryptosystem should be secure even if everything about the system, except the key, is public knowledge. If I understood correctly, then the importance in any cryptosystem is the “private” key and not the algorithms or protocols r…[Read more]

Although EMP is not as common as cyber threats posed on a organizations information infrastructure, it should not be a threat that is taken lightly. A massive EMP, either naturally or man-made, can have devastating consequences to any organization. When deciding how a company should protect itself from this risk, I believe it should also come…[Read more]

When considering the natural disasters in physical security, the organization should choose Denver, Co.

According to the Disaster Hot Zones of the World (http://io9.gizmodo.com/5698758/a-map-of-the-world-that-shows-natural-disaster-hot-zones), the other choices seems more riskier than Denver.

Miami, FL: Is located in a hurricane path which…[Read more]

PHYSBITS is Physical Security Bridge to Information Security. It is the collaboration between physical security and information security, where as links information system are used to control physical access to facilities, information infrastructure and resources. PHYSBITS focuses on the human aspect of physical security by integrating…[Read more]

Attackers might first try to obtain a list of usernames through social engineering. They can pose as new Wells Fargo employee, that has a Temple degree, and reach out to other Temple-grad employees. Attackers may be able determine how usernames/emails are structured through this contact. They can derive a list of possible usernames by using…[Read more]

I do not think it’s okay for Apple to share your personal data. Legal and privacy should you hand in hand. Unfortunately, many people fail to realize that what Apple is doing with your data is legal. Below is and excerpt from Apple’s User’s Agreement :

“b. Consent to Use of Data: You agree that Application Provider may collect and use…[Read more]

Like you Jason, public awareness is one of the method to prevent these scams. Unfortunately, these scams are uses highly sophisticated social engineering techniques that can make people feel overwhelmed and obliged to comply. Some of the things that I tell people is never to provide payment information or Social security number over the phone,…[Read more]

I agree that white listing is a more secure approach, but it is inherently more expensive to manage, especially for larger organizations whose number of applications seems to grow over time. You would also require a group of staff to manage, review, and test the isolated applications, thus creating more overhead. Overtime your whitelist will…[Read more]

This goes back to some of the things we discussed in class regarding pen testers and ethical hackers leaving in back doors after they’ve completed the test. This is worst because attackers don’t even need to authenticate themselves to get root access. For a big company like CISCO to be so negligent in this respect is definitely not good for business.

Often times when we discuss topics regarding IT and what is the right way to do something, the answer often boils down to “it depends.” In this case I believe that there might be a best practice approach if we look at the basic architecture of a client-server model. I believe that servers are better suited for white listing and clients for…[Read more]