Info

You are currently browsing the archives for the security category.

March 2010
S M T W T F S
« Sep    
 123456
78910111213
14151617181920
21222324252627
28293031  
Links

Archive for the security Category

A security course in 12 slides!

Sometimes a simple visual message, even with tongue firmly in your cheek, can powerfully convey a multi-faceted message. Information security has many important messages and lessons for good security. Jim Rapoza’s 12 Ways to Be A Security Idiot is a clever on-screen slide show with important messages about:

  1. Firewalls
  2. Laptop security and data encryption
  3. Internet access from “anywhere”
  4. Anti-virus protection
  5. Phishing sites
  6. Too good to be true schemes
  7. Danger in email attachments
  8. Passwords
  9. Operating system and application patches
  10. The Web as playground
  11. Open wireless networks
  12. Trusting soul in social engineering

“Jim Rapoza ranted about how most viruses and computer security problems are made possible by stupid people doing stupid things with their computers. Unfortunately, things haven’t changed much since then. So if you’re feeling left out, read Jim’s list of 12 ways to join the ranks of the attachment-opening, virus-downloading masses. “

Flaw found in Office encryption

Update item on encryption built into commercial products. Doesn’t appear to be a very good implementation! ddv

Flaw found in Office encryption Tech News on ZDNet: “The data protection feature in Microsoft Word and Excel documents has a major flaw that could allow snoopers to decode password-protected files, a security researcher has warned. “

The Great Debates: Pass Phrases vs. Passwords. Part 2 of 3

The Great Debates: Pass Phrases vs. Passwords. Part 2 of 3
Pass phrases are coming into vogue for a number of reasons, one being the development of tools that can crack many passwords in minutes. These tools are not new. Quakenbush Password Appraiser could do this in 1998. What is new is the theory and practice behind the space-time tradeoff, advanced by Dr. Phillippe Oechslin. The time-space tradeoff means that you do not store all possible hashes, which would require more storage than exists in the universe (if you try to store NT hashes). Storing all the NT hashes up to 14 characters for the 76-character character set would require 5,652,897,009 exabytes of storage, which exceeds the capacity of any file system today. Storing all the LM hashes, which only requires 310 terabytes, is still infeasible. To solve this dilemma, Dr. Oechslin came up with a time-space tradeoff where you only store a portion of the hash and its associated passwords. This drastically cuts storage requirements, and with only 17 gigabytes of storage, you can store the LM hashes for the same character set. As we shall see, one of the primary arguments for pass phrases is that they make the storage requirements prohibitive and break the pre-computed hash attacks.

….

The Great Debates: Pass Phrases vs. Passwords. Part 1 of 3

Excellent, technical article on the dynamics of security relative to a password. ddv

The Great Debates: Pass Phrases vs. Passwords. Part 1 of 3
Information security fosters some interesting debates. The issues range in importance, but they all demonstrate that the field is still growing and exciting. I would like to summarize some of these debates, and offer my own partial entries. For the first set of these articles, I will enter the passwords fray and address the issue of pass phrases versus passwords.

OK, maybe “pass phrases versus passwords” is really “the other great debate” or the “kind of boring and few people care” debate. In any case, which is more secure, pass phrases or passwords? The answer is not as clear-cut as it may seem.

infoSync World : IEEE approves 802.11i security spec

infoSync World : IEEE approves 802.11i security spec: “The IEEE has approved yet another specification in the 802.11 family of wireless ethernet. This time it’s a new Wi-Fi security standard, dubbed 802.11i.

Adding to the alphabet soup that is the Wi-Fi family of protocols, the IEEE has approved a new wireless security protocol dubbed 802.11i, intended to finally provide sufficient security for wireless connections that users don’t need to rely on alternate security layers. “

Securityflaw’s Information Security Bible (or Bibliography!)

Securityflaw’s Information Security Bible

|