Securology

Bruce Schneier just echoed what I wrote back in December 2008 that the encryption key management aspects of PCI 1.2 and earlier are flat-ou...

On the heels of turning PGP corp Yellow , now Verisign is turning Yellow, too . Symantec is acquiring Verisign, too. These overpriced ...

What an interesting year 2010 is already turning out to be in technology, politics, and life as we know it. More censorship battles are goi...

Trusted Platform Modules (TPMs) are were the last hope of truly secure distributed computing endpoints. The idea behind TPMs is that they...

There have been many attacks on whole disk encryption recently: Cold Boot attacks in which keys hang around in memory a lot longer than m...

NOTE: In the name of "all things security", because this blog is intended to be about physical security, too, not just information...

I found this in RSA Security's guide for their Authentication Manager (a.k.a. RSA SecurID) application suite: "This reference gu...

I guess maybe I was born to be a security-minded person, if "fate" or "nurture" deemed thus. I just was recollecting th...

I have discussed real-time keyloggers before, as a way to defeat some online banking applications , among other things, and that in general,...

I'm not sure if this de-thrones what I previously referred to as the Stupidest PCI Requirement Ever , but it's close. Sometimes the...

Do you need to comply with some external regulations (think PCI) that require your Microsoft Active Directory (AD) passwords to be changed f...

The uninstallation program for Symantec Anti-Virus requires an administrator password that is utterly trivial to bypass. This probably isn...

Just my two cents, but if you have to dialog about the distinction between an "application" and "network" penetration te...

Here's an interesting, but commonly overlooked, little security nugget. If you are running an e-commerce application and rely on a Con...

Rubber hose cryptanalysis , xkcd -style. It's funny because it's true: Unfortunately, so much of computer security is exactly this ...

This is my blatant attempt to re-direct any aspiring, up-and-coming security professionals into another line of work, for the sake of their ...