The Case Against Default Libraries

Windows has a sort of handy feature, but nobody has ever found it. Well, yeah, this one is ubiquitous. The “libraries.” Simple enough, a link to default folders for documents,…

Comments Off on The Case Against Default Libraries

2021 Post-Mortem and 2022 Year of Resilience

Once upon a time, I proclaimed I had the solution to the problem. A wise man then responded by asking, “What are the trade-offs?”As the year draws to a close,…

Comments Off on 2021 Post-Mortem and 2022 Year of Resilience

Vulnerabilities, Exploits, and Payloads

Unless you’ve been living under a rock or have a life, you’ve heard more about Log4j2 than you might care to have. You’ve probably heard talk of Log4Shell, Log4j, exploits,…

Comments Off on Vulnerabilities, Exploits, and Payloads

Passphrases and the Passphrase Token Attack

Never say “passphrase” around a pedant. Peasants and pheasants are OK, but pedants will bring up the passphrase token attack, frequently overstate the threat, or flat out get it wrong.…

Comments Off on Passphrases and the Passphrase Token Attack

Must Have Uppercase, Lowercase, and Basket case.

If there’s one thing I hate more than bad password advice it’s okra. But this is about cybersecurity, not culinary mayhem.Thanks to the added security multi-factor authentication (MFA) provides, passwords…

Comments Off on Must Have Uppercase, Lowercase, and Basket case.

Content Disarm and Reconstruction: Eh, What’s Up Docx?

Previously I wrote about content disarm and reconstruction (CDR) with respect to steganography. Stego is really cool stuff, but demonstrating what CDR does with respect to documents makes things less…

Comments Off on Content Disarm and Reconstruction: Eh, What’s Up Docx?

Kaseya, Maersk, and Microsoft: Do You Do Due Diligence?

I subscribe to the Consumer Protection Law360 newsletter. Although I can’t justify a subscription to the full content, the newsletters have interesting one-paragraph blubs. Recently one such paragraph caught my…

Comments Off on Kaseya, Maersk, and Microsoft: Do You Do Due Diligence?

Content Disarm and Reconstruct

For years I have been asked by reporters about data breaches as they made the news. We “pundits” had pre-fabricated responses for everything. The story says that an IT administrator…

Comments Off on Content Disarm and Reconstruct

Fighting Diversity With Diversity

How do you fight diversity with diversity? To answer that question, we need to understand the diversity we are fighting.Flying KittenFox KittenWizard SpiderStone PandaMustang Panda (Not related to Mustang Sally)What…

Comments Off on Fighting Diversity With Diversity