Hiring competent people in cybersecurity is always important, as you cannot secure what you do not understand. The trouble is often those who are performing the hiring do not have an in-depth understanding of cyber security and what specific skills and experiences are required to perform a cyber security role well. In this article, I Read more about Detecting Cyber Security BS in CVs[…]
It appears 3rd party integrations are the flavour of the month for security incidents at the moment. The latest being Ticketek Australia, where some of its customer may have had their personal details exposed, including names, date-of-birth and email; all of which was managed by a “reputable, global third-party supplier”. In other words, a global Read more about The 3rd party security nightmare[…]
Research has been undertaken that reveals some interesting aspects of how LLMs (Large Language Models) work and how they represent knowledge. This indicates it is very difficult to successfully constrain a language model and thereby ensure that they are secure. This difficulty means it is dangerous to employee LLMs in mission critical situations where adversaries Read more about Can LLMs be constrained and secured?[…]
It seems not a day goes by without some record cybersecurity incident hitting the press, be it a data breach, a Zero Day or some malware doing its devious things… Trouble is the frequency of these events, and their scope, has been increasing significantly over the last few years and most people have not latched Read more about Houston, we have a security problem…[…]
As of 1st February 2024 Google will put in place several new requirements of those sending emails to Google based email accounts. In effect all businesses that send emails to Google based email accounts will have to implement these changes to ensure their emails will get through and will not either be deleted or put Read more about Google email changes impact small businesses[…]
In an era where digital vulnerabilities pose an ever-increasing threat to businesses worldwide, the significance of cybersecurity expertise cannot be overstated. With sophisticated cyber-attacks on the rise, the role of a cybersecurity expert has evolved from merely safeguarding digital assets to actively predicting and mitigating potential risks. To fortify your organization’s resilience against these imminent Read more about Cybersecurity Expert Sydney[…]
Recently (9th November 2021) the Australian Information Commissioner produced a ruling against Clearview AI Inc for its usage of the images of Australians scrapped from Social Media sites and found them to have failed to comply with the requirements of the Australian Privacy Principle and hence interfered with the privacy of Australian individuals, as follows: Read more about Whose Face is it anyway? The ClearView AI Ruling[…]
Those who have been following my posts know I have an evolving love/hate relationship with online security questionnaires. Done well, they can speed up the process for the client and service provider and establish a properly shared understanding of where risks lie and how those can be managed over time. Done badly, they can be Read more about Security Questionnaires online, are they safe?[…]
First off, do you know what the biggest single cause of security vulnerabilities and successful attacks against computer systems is? A lot of people think of insufficient access controls, a lack of process, SQL injection, etc but there is something more fundamental sitting behind a lot of these that often gets overlooked. I’m talking about Read more about Protecting against the biggest security vulnerability[…]
It appears that there is a growing wave of SaaS utilities that will either scan websites and internet-based services for you or provide you with access to historical information on sites and services they have already scanned, often for a fee. Unfortunately, using such services can result in your seriously falling foul of the law Read more about Web site scanning without prior permission is very likely illegal, here’s why[…]
The Defence in Depth Security Model is one of those security concepts I often see incorrectly implemented or not used to its full potential to protect services or systems. There is way more to it than first meets the eye. In this article you will learn: What is the Defence in Depth Security Model? The Read more about The Defence in Depth Security Model Explained[…]
Given that I’m seeing an increase in unauthorised, and essentially illegal, Pen Tests against business production instances, which only serve to: Test the firewalls around your production instance (rather than testing the application code directly), Put at serious risk the availability of the web service under ‘test’ by consuming resources that should be only used Read more about robots.txt Pen Test extension[…]