The Security Ledger with Paul F. Roberts

Recent Posts

This Week In Security: Ebay’s School of Hard Knocks

June 1, 2014 Paul Roberts

It’s the end of another busy week in the security world. As we’re wont to do at The Security Ledger, we had DUO Security Evangelist Mark Stanislav in to the deluxe Security Ledger Studios to talk about the events of the week. On the agenda this week: the continued fallout from the hack of online auction giant eBay. The company ran into a thicket of criticism this week for the breach and its botched response. Despite knowing about the security breach for weeks, eBay seemed unprepared for the fallout once the news became public. Beyond its statements to the press, the company hadn’t taken steps to streamline the (inevitable) flood of customers who wanted to update their password. In fact, more than a day after the news broke, eBay still hadn’t made mention of it on their home page. What lessons can we learn from the breach at online auction […]

Podcast: Is Defense-In-Depth The Only Real Heartbleed Fix?

May 30, 2014 Paul Roberts

Like everyone else, we wrote extensively in the last month about the serious security vulnerability in OpenSSL dubbed “Heartbleed,” which affected many of the world’s leading web sites and services, including Facebook and Google. The large-type headlines about Heartbleed have passed. But that doesn’t mean that the danger has. As we have noted, we are entering a phase that might be considered Heartbleed’s ‘long tail.’ Most of the well-trafficked websites that were vulnerable to Heartbleed have gotten around to fixing the vulnerability. But public-facing web servers are only the beginning of the story for OpenSSL. Chasing down the vulnerability’s long tail in third-party applications and on internal web sites and applications is a much larger task. As I’ve noted: open source components make their way into all manner of applications and bespoke products these days, often without any effort to assess the security of the borrowed code. For companies that need to protect critical IT […]

Video: The Internet of Things and Enterprise Risk

May 29, 2014 Paul Roberts

The Security Ledger recently hosted our inaugural event: The Security of Things Forum (SECOT). This was a high-energy, day long conference in Cambridge, Massachusetts, that brought together subject experts, executives and thought leaders from disparate areas like high tech, finance and industrial systems to talk about the tsunami of change that is the Internet of Things. One of the big questions hovering over the event: how will IoT technologies and services change the security paradigm that we’ve all be operating under- but especially in enterprises. In fact, IoT and enterprise was the topic of our very first discussion of the day: a panel chaired by Chris Rezendes of INEX Advisors, a leading consultancy focusing on IoT. SECoT Forum 2014 – Democratized Data, IOT and Enterprise Risk from Exhibitor Media Group on Vimeo It’s a really big and messy problem. As panelist Ken Pfeil of Pioneer Investments pointed out: the hack of […]

iPhone and iPad Hijacking: What You Need To Know

May 28, 2014 Paul Roberts

The past 24 hours has seen a spate of stories warning about a spate of ‘ransomware’ attacks on iPhones and iPads – especially in the the UK and Australia. According to the reports, compromised devices are locked and owners are instructed to email a ransom (variously: $100, $50, €100) to one “Oleg Pliss” to have their devices unlocked. These attacks aren’t really news. In fact, the Oleg Pliss scam appears to have been circulating for close to six months. However, it’s worthwhile reviewing what we do (and don’t) know about these latest attacks on mobile devices. Accordingly, Security Ledger has put together a short FAQ that tells you what you need to know about the latest mobile scam, and to dispel some of the rumors floating around in the Internet ether. What’s Going On? According to news reports and complaints on Apple Support forums, owners of iPhones and iPads are having their devices locked. […]

Report: Samsung Investing In IoT Security

May 27, 2014 Paul Roberts

South Korean electronics giant Samsung Electronics Co. said on Tuesday that it will invest heavily in security for the Internet of Things sector, citing security for IoT as a ‘key future technology’ alongside energy storage and harvesting. The report on Tuesday, from South Korea’s Yonhap News Service said Samsung, currently the world’s top maker of mobile phones, said Samsung is soliciting proposals on IoT security algorithms and protocols through the end of June. Possible applications include “biometrics, smart structures and advanced traffic networks,” according to Yonhap. The announcement comes by way of Samsung’s Future Technology Fostering Center, a research group that the company established last year to help keep it on the cutting edge in technology. According to published reports, Samsung has pledged 1.5 trillion won ($1.34 billion) over 10 years to fund the Center. Approximately 750 billion won ($670 million) will be allocated to research projects through 2017.