Securosis Blog

No Metrics, No Budget (or Paycheck)

Rich · November 15, 2006

Oh goodie- another religious security debate! We do love our religious arguments so.

This time it’s Amrit taking on Rothman over security metrics. Amrit likes them, Rothman doesn’t. Both of them are funny looking (sorry, it’s not germane to this post, but I figure people should know).

Thanks to an independent evaluation we now know that Firefox 2.0 is slightly better than IE 7 at detecting phishing sites. Firefox detected 243 sites missed by IE while IE “only” detected 117 sites missed by Firefox.

A while back I started to wonder if my phishing providers really cared about my business. They were getting seriously lazy- using generic “Your Online Bank” instead of a real bank name, no longer personalizing my emails, and using links practically entitled, “stealmyinfo.com”.

After posting our Top Six Hints for Safe Online Holiday Shopping, Chris Pepper notified me that Firefox 2.0 is not an automatic upgrade, and Firefox 1.5 doesn’t prompt you at all to download the new version.

A new wireless exploit was released today over at the Month of Kernel Bugs affecting the Broadcom wireless chip set (one of the most widely used in the industry).

The 100th Post, and a Note to My Editor

Rich Mogull · November 11, 2006

It’s hard to believe this little side project has hit 100 posts. We’re averaging 600+ unique visitors a day, which isn’t bad for a blog that’s only been around for three months, and even hit the front page of Digg once.

Yes folks, Black Friday is less than two weeks away and the silly season is upon us. As someone born and bred in good old North Jersey (until I could legally escape), land of honey and shopping malls, this is a time so deeply ingrained into my subconscious that I’ve occasionally found myself sleepwalking around the nearest parking lot, looking for our old wood-paneled station wagon.

Database Security Vulnerability Stats

Rich · November 10, 2006

These numbers are totally fascinating- check it out here.

Keep in mind that some database systems (like SQL Server) only run on a single platform, while the others (you know who) run all over the place.

Mac FileVault Encryption Update

Rich · November 10, 2006

Back in August I finally broke down and encrypted my computer using the built in FileVault feature in Mac OS X.

As a security professional I admit that I normally assume someone I’m dealing with isn’t necessarily honest; especially if they’ve done something to draw my attention. I learned early on that most humans have an unbelievable capacity for deceit, and they use it on a daily basis. In many cases the individual is so believable because they’ve convinced themselves that what they’re doing/saying is either the truth (when it’s clearly not), or they’re justified for some bullshit reason (like “the man”…