(ISC)² Blog

Shellshock Bug Comments from (ISC)² Leadership

“Shellshock will be a test of business resolve to prioritise security. So much of the data breaches that make headlines today can be traced to old or known vulnerabilities that have not been addressed. Now that shell shock has been revealed, and the door has been thrown open, it will be interesting to see if companies take action. It is clear that the potential exposure is significant. Linux underpins the majority of webservers, network routers and Apple’s MAC PCs running OS X. It is not clear, however, whether there has been any loss through successful exploitation of the flaw. I... Read more →

eBay Breach Comments from (ISC)² Leadership

XSS – or cross site scripting— is a prolific vulnerability and has been on the Open Web Application Security Project’s ‘Top 10 most exploited vulnerabilities’ for at least five years now. The threat is very common and incredibly easy for users to fall victim to. In the OWASP’s words, we can’t afford to tolerate relatively simple security issues like this, especially for a company as massive as eBay. Fortunately the methods and remedies to reduce the threat of XSS are well-known and are readily available. Unfortunately, the development community are not recognising the need to deploy them. Developers need to... Read more →

Moving Beyond the Dangerous Denial Phase as Individuals and Organizations

I spent 25 years in the Washington, DC area, and during that time I became a National Public Radio junkie. I guess I still am. I recently listened to a report on a comprehensive study about how people in the workplace react to the news about a coworker that’s been diagnosed with breast cancer.[i] The results of the study shocked me. The worse the diagnoses and the closer employees physically worked to the diagnosed coworker, the less likely those working in close proximity were to seek cancer screening. Similarly, as the conversation about the complexities, costs, and potential breaches is... Read more →

Home Depot Breach Comments from (ISC)² Leadership

Consumers with a Home Depot credit account should log in to their account, change their password, and check the “Account Activity” section for any suspicious transactions. They should also verify that their account communication preferences (email address, cell phone number for SMS, etc.) are on file and accurate. Home Depot and other online retailers should augment their alerting service by adding an option to notify users every time a transaction is made on their account. This would help consumers learn about fraudulent charges quicker, while also saving retailers the hassle of remediating additional fraudulent charges.- Dan Waddell, CISSP, CAP, PMP,... Read more →

Where does Traditional Security Begin and Logical Security End?

By W. Hord Tipton, CISSP, Executive Director, (ISC)² and Michael Stack, Chief Executive Officer, ASIS International The mass migration of everyday objects becoming interconnected, or the “Internet of Things (IoT)” as the industry has coined it, exemplifies the merger between traditional and logical security. With the IoT, we must ask ourselves where traditional security begins and logical security ends. From security cameras to cars to medical devices and now even home appliances like refrigerators, what, if anything, can be identified as only traditional or logical security anymore? “When a device accesses the Internet, it’s given a unique IP address,” said... Read more →