Packaging a Node app for Docker – from Windows

Container technologies are becoming a cornerstone of development and deployment in many software houses - including where I have my day job. Lately I've been creating a small web app with lots of vulnerabilities to use for security awareness training for developers (giving them target practice for typical web vulnerabilities). So I started thinking about … Continue reading Packaging a Node app for Docker – from Windows

How to recognize a customized spear-phishing email

Phishing is still the most common initial attack vector. Mass mailed spam is now taking cues from targeted campaigns, improving conversion rates through personalization and the use of seemingly authoritative content. Scammers are getting better at targeting. Sharpen your defenses today - including your awareness training!Here are some indicators that can help identify phishing: Sender: … Continue reading How to recognize a customized spear-phishing email

How the meltdown CPU bug adds 50 million tons of CO2 to the atmosphere

The first few days of 2018 have been busy for security professionals and IT admins. As Ars Technica put it: every modern processor has "unfixable" security flaws. There are fixes - sort of. But they come with a cost: computers will run up to 30% slower because of it, depending on the type of work … Continue reading How the meltdown CPU bug adds 50 million tons of CO2 to the atmosphere

Making your signup page safe to use – by knowing how a secure development process looks

When you are signing up to a new web service - what are the risks? Obviously, there are some things you should think about before making the decision to sign up, such as their privacy policy and if the page seems to be good at securing your personal data. Lots of sites have not done … Continue reading Making your signup page safe to use – by knowing how a secure development process looks

Why you should be reading privacy statements before using a web site

If you are like most people, you don't read privacy statements. They are boring, often generic, and seem to be created to protect businesses from lawsuits rather than to inform customers about how they protect their privacy. Still, when you know what to look for to make up your mind about "is it OK to … Continue reading Why you should be reading privacy statements before using a web site

Does cyber insurance make sense?

Insurance relies on pooled risk; when a business is exposed to a risk it feels is not manageable with internal controls, the risk can be deferred to the capital markets through an insurance contract. For events that are unlikely to hit a very large number of insurance customers at once, this model makes sense. The … Continue reading Does cyber insurance make sense?