Security Blog
- 
Virtual PatchingVirtual patching, adding rules to a WAF to filter out traffic exploiting known vulnerabilities, is beneficial. While it shortens the mitigation window, the real debate lies in managing the underlying vulnerability. Some argue for fixing the specific vulnerability, while others advocate fixing the entire category of vulnerabilities for long-term benefits. 
- 
DDoS ThoughtsDDoS attack efficiency is typically measured in bits-per-second ratios. To extend this measurement, we can use “flits per second” to gauge cost and impact. Reducing attack ratios and increasing client costs are key defensive strategies. Traffic filtering and capacity increases offer potential solutions. 
- 
Compliance, Security, and the relations thereinAs an amateur hairdresser, I’ve learned that just like the diverse disciplines within information security, there are countless techniques and specialties in hairstyling. It reminds me to approach other professionals with humility, acknowledging their expertise in their respective fields. We all have valuable knowledge to contribute. 
- 
Security and hairdressingBeing an amateur hairdresser has taught me a valuable lesson about the diverse disciplines within information security. Just like braiding hair, where I’ve only scratched the surface, I’ve realized that I may only know bits and pieces about the various security specialties. It’s important to approach other professionals with humility, recognizing their expertise in their… 
- 
The Problem with Password UnmaskingThere is a disagreement regarding whether passwords should be shown in clear text or masked while being typed. One perspective argues that password masking reduces usability and offers limited protection against snoopers. However, the opposing view emphasizes the importance of security and raises questions about the effectiveness of unmasking passwords. The ultimate solution lies in… 
- 
Sanitization vs. cryptoBruce Schneier disagrees with NIST’s stance on encryption as a means of sanitization. He argues that properly implemented encryption, with secure key management, can effectively sanitize data. While NIST has removed the paragraph, Schneier acknowledges the numerous qualifications required for encryption to be fully secure, suggesting that sanitization should still be performed when possible. 
- 
Security and ObscurityThe mantra “Security through obscurity is no security at all” originated from concerns about proprietary cryptographic algorithms. However, in the context of security systems and architectures, obscurity plays a crucial role. No system is perfectly secure, so a good security professional aims to reduce vulnerabilities and make exploitation costly. Layered security and maintaining architectural details… 
- 
Social Engineering Self-trainingIn contrast to traditional security systems, social engineering has an interesting advantage: the more unsuccessful attempts made to deceive someone, the better prepared they become to resist future attacks. Each failed social engineering attempt serves as valuable training for the target, enhancing their defenses. 
- 
PhishingWhile we prioritize phishing prevention in banking, other sites like LinkedIn may become targets for identity thieves. The ease of phishing login information and the potential to exploit trust within a professional network highlight the need for heightened vigilance beyond banking. Personal experiences remind us to be more cautious. 
- 
Invisibility CloakAs the possibility of invisibility draws nearer, its potential implications become apparent. Scary applications include concealed weapons, bombs, and potential traffic hazards. However, in the cool category, it opens doors for urban renewal, architectural innovations, and even portable privacy umbrellas, although such technologies may also have concerning uses. 
Leadership Newsletter
- 
It’s Time for a ChangeLeadership Moment: Switching Sides The Boston Renegades won their fifth consecutive WFA Pro Championship, propelling QB Allison Cahill to her eighth championship ring (Tom Brady stopped at seven). The MVP however, wasn’t Cahill – it was Whitney Zelee, defensive end. This isn’t the first time Zelee has taken championship MVP honors. In 2011 and 2014,… Read this … 
- 
Sweat the Small StuffLeadership Moment: Small Acts of Leadership I recently joined in as a guest in Chris Cochran’s The Art of Cybersecurity Leadership, and it was a fantastic crowd. It was styled as an AMA (Ask Me Anything), and the participants came armed with a number of leadership questions for me (some of which I jotted down… Read this … 
- 
Make Your Reps CountLeadership Moment: “Garbage” Time This was a good weekend for Boston sports. The New England Free Jacks won their first Major League Rugby championship, and the Boston Renegades are heading back to Canton to defend their WFA Pro champion title. One of these games was close – the Freejacks won by one point – while… Read this … 
Fiction
- 
SkeletonA necromancer and an Olympic event [Read the story] 
 
- 
Albus Dumbledore and the Rituals of ImmortalityThe words that didn’t make the Harry Potter septology that fill in the blanks for what’s really going on. [Read the story] 
 





