Blog Posts Tagged with "Authentication"


Understanding Trust

May 06, 2012 Added by:Kevin W. Wall

In computer security, we should strive to make all trust relationships explicit and leave nothing to chance or misinterpretation. That's one key step in defining a trust model. At its core, information security is largely about the two goals of “ensuring trust” and “managing risk”...

Comments  (4)


NIST: Secure Biometric Acquisition with Web Services

May 04, 2012 Added by:Headlines

Researchers at the NIST have developed a new protocol for communicating with biometric sensors over wired and wireless networks, called WS-Biometric Devices (WS-BD), allows desktops, laptops, tablets and smartphones to access sensors that capture biometric data using web services...

Comments  (0)


Online Banking vs. Mobile Banking

May 03, 2012 Added by:Robert Siciliano

Mobile banking can offer additional security by enabling text-backs, as a second form of authentication. If you use your smartphone to access your bank’s website directly, it may recognize that you are using a mobile browser and automatically offer you a dedicated application...

Comments  (1)


Password Policy: Sharing Passwords

May 02, 2012 Added by:benson dana

I once worked at a place where a senior manager collected the passwords of employees. There had been resistance to giving up this policy, and the excuse was that this unit's mission was unique and that this was necessary. How often does the internal auditor hear this excuse?

Comments  (0)


Duty to Authenticate Identity: Online Banking Breach Lawsuits

April 26, 2012 Added by:David Navetta

The attenuated nature of online relationships creates an opportunity for criminals to steal or spoof online identities and use them for monetary gain. The ability of one party to authenticate the identity of the other party in an online transaction is of key importance...

Comments  (0)


Super Security Guy

April 25, 2012 Added by:Wayde York

While I was talking to the bank operator, I tried to login to my account and when I put in the username/password, I couldn’t get in. The bad guys had changed my login, or so I thought. Red lights were flashing and the bulk of my security expertise poured in to the rescue...

Comments  (1)


Social Media Security 101

April 24, 2012 Added by:Joel Harding

EVERYTHING is compromised. Every web site, every data base, every place that touches the web – I assume this at all times. There is not one among us whose network has not been compromised. The security mantra in the past was “Risk Avoidance”. That is no longer the case...

Comments  (0)


Military Evaluates SIPRNet Smart Card to Protect Networks

April 24, 2012 Added by:Headlines

"As we learned through the events of Wiki Leaks, we had a blind spot in protecting our classified networks... We have a national strategy and program to implement a Public Key Infrastructure hardware based authentication system on the classified network - hence the SIPRNet token..."

Comments  (2)


Disagreement on Password Vault Software Findings

April 12, 2012 Added by:Brent Huston

Recently, some researchers have been working on comparing password vault software products and have found some issues. However, many of the vendors are quickly moving to remediate the identified issues, many of which were simply improper use of proprietary cryptography schemes...

Comments  (1)


Pump Up Your P@$$w0rd$

April 03, 2012 Added by:Kevin Doel

The idea is to choose phrase that you will be able to remember and a simple algorithm for converting it to a strong password. Even the best encryption systems are not going to protect your data if you use weak passwords and a hacker gains physical access to your mobile device...

Comments  (2)


Malicious Exploits: Hitting the Internet Waves with CSRF Part 2

March 27, 2012 Added by:Brent Huston

Using the HTTP specified usage for GET and POST, in which GET requests never have a permanent effect, while good practice is not sufficient to prevent CSRF. Attackers can write JavaScript or ActionScript that invisibly submits a POST from to the target domain...

Comments  (0)


Howard Schmidt on Federal Cyber Security Priorities

March 27, 2012 Added by:Headlines

"Federal Departments and Agencies must defend their information systems in a resource-constrained environment, balancing system security and survivability while meeting numerous operational requirements requires robust risk management," said Schmidt...

Comments  (0)


Fifteen Unsafe Security Practices that Lead to Data Breaches

March 21, 2012 Added by:Kelly Colgan

Database security is an essential element of overall security maturity at enterprise level. Underestimating its value and not dedicating sufficient attention to developing a comprehensive data security plan can, in many instances, lead to data compromise...

Comments  (1)


Enterprise Security's Achilles Heel

March 16, 2012 Added by:Rafal Los

Have you ever wondered why enterprise security people are so downtrodden? Baffled by the impossible arrogance of penetration testers when they laugh at corporate security postures? The bottom line: people have always been and will always be the Achilles heel...

Comments  (0)


Malware Variant Signed with Valid Digital Certificate

March 16, 2012 Added by:Headlines

Kaspersky has discovered malware in the wild identified as Trojan.Win32.Mediyes accompanied by a VeriSign digital certificate which appears to be part of a click-fraud operation designed to generate revenues for the attackers from a legitimate marketing service...

Comments  (1)


Implementing Least Privilege

March 15, 2012 Added by:Ben Rothke

Least privilege is the notion that in a particular abstraction layer of a computing environment every module - such as a process, a user or a program depending on the subject - must be able to access only the information that is necessary for its legitimate purpose...

Comments  (1)

Page « < 2 - 3 - 4 - 5 - 6 > »