(ISC)² Blog

Secured by SSL Not Enough

You are on the internet and you are looking to purchase the latest smart phone online. So you start off doing a search in Google. So you get a list of maybe three potential web sites selling the brand you are looking for. So now you have to decide which one to use. You check prices etc? You have an IT security background so you know the checks you have to make before you submit any personnel details. You check that the web site has an organisation and a domain validated SSL certificate, you check the key size, you check... Read more →

Android, Malware and Rehabilitation

With news breaking of a further wave of "fake malware-laden apps", let's hope that Google has seen ENISA's analysis of appstore security, and will not assume that Bouncer app review is enough... Read more →

PKI and Importance of Security Policy

For this example let us presume that the business has stipulated that users must use digital certificates to authenticate to their application. One of the main functions of a CA is to verify the identity of the entity requesting a new certificate. If how this verification occurs is not covered in a security policy and the CA issues certificates to whoever requests them there is a risk that a rogue employee will obtain a certificate. Also a PKI is based on a trust model. How will the business have confidence in the identity of the entity presenting the certificate when... Read more →