(ISC)² Blog

Image forensics

An interesting analysis of a graphic recently used by Victoria's Secret in their advertising. This gives chapter and verse of the techniques used, and results obtained, demonstrating the ability to determine if an image has been altered, and even which parts of an image have been modified, and how. I find this particularly interesting because of the apparently widely held belief that steganography is "undetectable" without comparision to the original image. Most of the "Photoshop disasters" are glaringly obvious to the naked eye. As this demonstrates, analysis and detection of modification is easily accomplished, even when the differences are not... Read more →

No apocalypse so far in 2010 ...

As New Zealand is one of the first places on Earth to enter 2010, I'm delighted to report that the new year has not caused my computer to lock up. Planes are not dropping out of the sky. The electricity is still on. The phone still works. The Internet isn't broken. Even the TV still works. Ten years ago, of course, that was newsworthy. Around the end of 1998 and early part of 1999, "Y2k" was widely predicted to cause all manner of IT disasters, and indeed it may well have done were it not for the enormous effort put... Read more →

MasterCard Throws Another PCI Grenade

1 Step Forward, 1 Step Sideways & 2 Steps Back With the recent changes by MasterCard (again) I wanted to discuss a couple of my concerns and/ or questions. In large part I have only seen one other fellow PCI blogger mention. Let’s start with; One step forward; The extension to give Merchant level 2’s more time to comply with the new rule changes from Decembers 2010 to June 2011 (not a deadline smack dab at end of year and holidays) was a good thing. One step sideways; The change to allow (starting in June 2011) a Merchant level 2... Read more →

(ISC)2 Moving to Computer-Based Testing Over Next Three Years

WPACracker

Polly wanna crack a WPA network? A cloud based cluster is offering to help out, for a small fee. You send them a data capture, and they run a 130 million word dictionary against it, in as little as 20 minutes. Do you trust them? Are they going to be used to crack WPA networks? Is this sufficient impetus to move to WPA2? Are you going to create a longer passphrase? Read more →

The Risks of Bad Communication

I have been thinking about whether there are are any risks unique to remote facilities when it comes to a company's IT security design. This could be locations in different cities, near-shoring, off-shoring, etc. From the article Bad Communication Can Create Risk, the author lists four risks mitigated by effective communication: Increased employee resignations Decreased employee productivity Overt employee subversion Inability to achieve company goals From an IT security perspective, I will add: Back doors Data leakage Malicious behavior (unintentional or otherwise) The knowledge of being observed is itself a deterrent to bad behavior. There is the Observer (or Hawthorne)... Read more →

Free (ISC)2 Webinar on Succeeding in Tough Times If you’re looking for advice on how to survive this downturn and position yourself to succeed when the turnaround comes, join us this Thursday, Dec. 3 at 2 p.m. EDT for a free, 60-minute (ISC)² Webinar titled “Advancing Your Career in a Difficult Environment.” Part of the (ISC)² ThinkTank series and co-sponsored by Alta Associates and Norwich University, the Webinar will include a panel of information security career experts discussing professional development and advancement in today’s challenging business environment. To register for the Webinar, please visit http://bit.ly/7j9QAN . For those unable to... Read more →