(ISC)² Blog

Proxy Caches are a Challenging Threat to Internet Security

Proxy caches, combined with poorly written session management code, can easily leads to serious security flaws similar to what we highlighted in A New Security Breach in Google Docs Revealed. Web developers have no control over proxy caches in the Internet. However, developers do have control of the code they write and their admin teams have configuration control of their web servers. Developers must assume the worst case Internet scenario with aggressive Internet cache management policies that serve cached data for economic and performance reasons. As a consequence, this fact-of-life on the Internet sometimes results in multiple web clients being... Read more →

The Looming Dangers of Security Vulnerability Sensationalism

I am feeling a bit "long in the tooth" today, because like many of our honorable colleagues here at the (ISC)² blog, I remember computer security before there was an (ISC)² and before there was a World-Wide-Web. Yes, there was security professionals before terms like "firewalls" became popular, believe-it-or-not. Back in "the old days" we had to set up sniffers on both sides of a router to figure out how to set up access control lists. If we needed to change the passwords on all our network devices when someone left our "big telecom company" we launched a shell script,... Read more →

Malware trends

The anti-malware company I work for has just published its half-yearly report on threat trends, based on automated malware tracking systems. Already I hear the more cynical among you muttering "Aha! Product pitch!" and, of course, this kind of document does have a marketing purpose. However, at 50-odd pages, it's a bit more than a press release, and many of those pages actually consist of near-raw localized data (included for the benefit of our distributors). All that aside, there are some conclusions that may interest you. Well, they interested me - just as well, considering how long I spent on... Read more →

How did you learn your trade?

A study examined course descriptions on UK university websites to determine the amount of IT security content in undergraduate IT courses: "The vast majority of UK computing students receive virtually no security training when it comes to designing and developing new software applications, according to government funded research. Less than 20 per cent of all computing undergraduates in the UK receive more than five hours training in incorporating security functionality over the three to four year duration of their course. This was according to research by the Cyber Security Knowledge Transfer Network(KTN), which was created in 2006 by the government's... Read more →