(ISC)² Blog

Security “for free”?

As security professionals, we are continuously facing the challenge of smaller and smaller budgets allocated to maintain and improve the IT security. That’s probably the main reason why there is always the temptation of “Free”. Many people, sometimes even professionals, think that they can achieve a good security for free. “For free” means in this context that some programs used to achieve and improve security don’t cost any money to acquire. Unfortunately, the analysis of the costs stops at the acquisition and it ignores other costs like the installation and maintenance costs. But, is it possible to cover all the... Read more →

The evolution of support scamming

Cold-call tech support scams. Didn't they go away when the Federal Trade Commission cracked down on them in the US? Actually, while the FTC crackdown wasn't quite as comprehensive as it might have seemed, there's no doubt that the number of classic "I'm-ringing-from-Microsoft-to-tell-you-that-you-have-viruses-but-I-can-help-you-for-a-small-fee" cold-calls has declined (round here at any rate, but maybe they just figured that ringing someone who wrote as extensively as I do about the scam wasn't much of a sales prospect). Still, it seems that what is happening here is evolution, not extinction. Last month, my colleague Jean-Ian Boutin reported malware that not only combined fake... Read more →