Securology

Rubber hose cryptanalysis , xkcd -style. It's funny because it's true: Unfortunately, so much of computer security is exactly this ...

This is my blatant attempt to re-direct any aspiring, up-and-coming security professionals into another line of work, for the sake of their ...

Wow. This is a big deal: The forged certificates will say they were issued by a CA called "Equifax Secure Global eBusiness", wh...

The Payment Card Industry (PCI) regulatory compliance goals are good, but not perfect. Some individual requirements in the Data Security St...

The Kaspersky folks have an interesting report on malware that targets the banking and financial markets that supports and echoes many of t...

I'm grateful for physicist Wietse Venema's contributions (satan, the coroner's toolkit, TCP Wrappers, and Postfix) to the comput...

It's official. We now have conclusive evidence. Computer Security is, in fact, more difficult than nuclear physics. I submit to you, ...

Google just released a new set of security features for Gmail. However, you cannot turn on the "always use HTTPS" option if you ...

By now, you may have read about a group of MIT Students who were set to present some insecurity details of the "CharlieCard" sub...

This is a break from the traditional types of posts. It's more of an instructional howto, but I hope that it is valuable nonetheless. ...

I am surprised how often I hear an organization operate under the belief that they can really, truly can control what a remote client does u...

Has Verifone created a PCI silverbullet for Point Of Sale (POS) systems with their VeriShield Protect product ? It's certainly interesti...

Now that PCI 6.6's supporting documents are finally released , a lot people are jumping on the "Well, we're getting a Web Appli...

NASA has a program where you can send your name to the moon . Just give them your name, they'll store it electronically, and send it o...

Some academic security researchers at Carnegie Mellon have released a very compelling paper which introduces the idea that just monitoring ...

If you're one of the many practitioners waiting to see how the PCI Security Council clarifies the ambiguous 6.6 requirement, then you ma...