Market Impact of a Data Breach
May 13th, 2013
In my Changeup post the other day, I mentioned that my colleague Paul Henry had saved an organization an estimated $10M (or roughly 15%) in market cap by showing that an intrusion had no material impact. That got me to thinking: what *is* the typical market impact of a breach? And furthermore, how good are [...]
Changeup Information Sharing
May 6th, 2013
We were talking with the CIO of a major healthcare company the other day who told us that his day had gone sideways because of the re-emergence of the ChangeUp worm / Trojan. This was news to me. I mean, yes, I’m a little behind in my reading, but I’d not heard much about ChangeUp [...]
ZIP Codes Are … PII?!
April 15th, 2013
Mr. ZIP (or Zippy to his friends) was born back in July 1963 and the soon-to-be 50-year-old is finally getting some privacy … in Massachusetts at least. The Massachusetts Supreme Court recently determined that under Mass. Gen. Laws, ch. 93, § 105(a), “personal identification information” includes a consumer’s ZIP code and decided that collecting such [...]
Is Education Key to Closing the Door on Hackers?
April 11th, 2013
I read with interest an Op-Ed piece in the New York Times the other day by Marc Maiffret (founder and CTO of BeyondTrust) entitled “Closing the Door on Hackers.” [By the way, as I’ve mentioned before, it’s interesting to see cybersecurity in the mainstream news, which seems to be happening more and more these days.] [...]
PSA for Evernote Users: Change Your Passwords
March 4th, 2013
Another day, another breach of a popular cloud-based service. This time it was Evernote, a wildly popular personal note taking app for tablets like iOS devices (iPhones, iPads and iPod Touches) and similar Android devices. The breach was apparently discovered on Thursday 02/28 and made public on Saturday (03/02) morning. Evernote is requiring all of [...]
APT1: Another Teachable Moment for Us All
February 26th, 2013
March 4, 2013 UPDATE: When I wrote this post, I was just using the email purporting to be from FedEx as an example of how one might discern a phishing attempt from a “real” one. Had I spent just a few extra moments in my RSS feed, I would have learned that this particular phishing [...]
Monday Morning Patch Blues
January 15th, 2013
Security Pros sure had a tough Monday. Two issues came to a head: the Java plug-in vulnerability and the Internet Explorer vulnerability. Both are being actively exploited, and both have seen patches rushed out on Monday. Let’s take a quick look at them both. Java 0-Day A new vulnerability in Java browser plug-in used by [...]
For Want of a Nail …
November 14th, 2012
… the kingdom was lost. This real-life cautionary tale, told to me by my colleague’s brother (let’s call him Mr. X), concerns a risk-reward decision gone awry. X’s company is a good-sized global in international construction services company with over $1B in revenue and around 5000 employees; they have about 7000 servers and endpoints under [...]
Smashing Smishing!
September 5th, 2012
A former colleague pointed me to this video by Mike Saylor, the VP of Technology at the Texas Credit Union League. ‘Smishing’ is a portmanteau of SMS (Short Message Service – so, cell phone text messaging) and phishing (attempting to acquire by subterfuge sensitive personal information such as userIDs, passwords, credit or debit card information, [...]
Data Security on Corporate Radar – But Is That Enough?
August 28th, 2012
The latest (12th annual) Legal Study Report by The Corporate Board Member / FTI Consulting entitled Legal Risks on the Radar came out in late-July and spawned an interesting headline take-away, which I’ll put this way: Data Security Ranks No. 1 on Corporate America’s List of Concerns. To quote from the report itself: [I]ncreasingly, corporate [...]







FREE Scanner
Free eBook
Over 80% of IT Directors say that mobile devices represent a security threat.



