For solutions to these and other problems please contact us at The-Techy.com
Certificate Expiry – Doh
February 8, 2020
Leave a comment
Don’t you just hate when that happens – you have a nice, professional website that is generating revenue for your company and someone forgets to renew the TLS certificate!
Packt Publishing sure does today when it seems clear that almost all of its visitors will not be able to connect to their website.
It happens to many of us and it is due to poor certificate management. Microsoft Teams announced that they had surpassed Slack as the number one platform for messaging and collaboration but recently experienced an outage due to an expired certificate. Imagine how that affected their reputation and think of the brand impact that could have resulted in incalculable loss!
Whether you have 1 SSL/TLS Certificate protecting your website or you have setup an extensive server farm both inside and outside your organization, managing certificate renewal can bite you in the A$$.
Think strongly about a certificate management program that can alert you to thinks like certificate expiry for items like websites, Internet of Things and even network devices. With the push to ensure that we adopt https everywhere, you will need to manage certificates for almost every endpoint we use for mail, for file and print services and of course for all of the applications that use web based browsers. Even some of the desktop application are just shells that use a custom shell to deliver http based content so you may also have outage associated with certificates for some of the popular applications like Slack and Teams on your desktop.
Prevent outage by discovering and being aware of all of your certificates before someone else tells you!
Are you a Secure Programmer?
December 27, 2019
Leave a comment
Happy New Year to those of you who read this blog, and to those folks who remember my predictions about going over 20,000 unique CVEs in 2019, I trust you may agree that 2019 was a banner year for vulnerabilities. Lucent/Alcatel are among the vendors who have CVEs that have taken us over 20,000 this year (CVE-2019-20047, 20048).
It’s time to ask yourself, are the hackers getting better at ‘hacking’ or are coders just getting worse? If we are going to examine how the last half of a decade has had more than 10,000 unique vulnerabilities each year and that number keeps increasing, we will all need to come to the conclusion that programmers just don’t know how to create programs that are secure by default!
Here is a chance for some of the best and brightest programmers to change course and learn how to avoid these vulnerabilities once and for all.
A California University (UCDavis) has created an online course that can help teach the Principles of Secure Coding. In a series of four courses, developers can learn about the fundamentals, identify vulnerabilities and walk on the wildside as they learn how to hack just like the a blackhat!
Take one, two or the set of four courses and really understand how pentesters can exploit how code works so you can learn how to avoid many of the common pitfalls. https://www.coursera.org/specializations/secure-coding-practices
Categories: General
hacking, secure coding, security
Snyk Found Over Four Times More Vulnerabilities in RHEL, Debian, and Ubuntu – DZone Security
November 17, 2019
Leave a comment
Impressive list of vulnerabilities this year and even the purchase of Redhat by IBM isn’t making the paid OS immune. Check out the docker images that are floating around and be careful when trusting someone else’s container build.
https://dzone.com/articles/snyk-found-over-four-times-more-vulnerabilities-la?fromrel=true
Categories: General
What’s in a container image: Meeting the legal challenges | Opensource.com
November 8, 2019
Leave a comment
Do you remember when you bought a license and installed your copy of windows X on a VM and didn’t think twice about it. You loaded your software and maybe setup a reoccurring backup for it and you were done right?
Nowadays, there are risks at even using that Windows license on a cloud provider other than Azure (but that is another story)
Today, running containers is the new thing and that software is open source right? Not always!
You could have more than just Vulnerability risk to worry about. Some container images can also have License risk and you could have legal troubles too!
https://opensource.com/article/18/7/whats-container-image-meeting-legal-challenges
Categories: General
Scotiabank does it again
October 12, 2019
Leave a comment
Beginning Jan. 1, 2020, the bank’s Canadian workforce will have a
total of five personal days and the flexibility to take them as needed,
in addition to existing sick and vacation days.
“Our people are our most important asset and their well-being is a
top priority for Scotiabank,” said Barbara Mason, chief human resources
officer, in a press release. “We strongly believe that by offering
employees greater flexibility to take time off to achieve greater
work-life balance, our employee population will be healthier and
happier, and therefore enabled to perform at their very best.”
Categories: General
Picard is back!
October 6, 2019
Leave a comment
… and he is teaming up with 7 of 9!
Go borg GO! This is going to be so exciting… https://twitter.com/WIRED/status/1180899318024163328?s=09
Categories: General
Debit cards and TD are in trouble (again)
September 30, 2019
Leave a comment
Toronto business owner loses $14K to technical glitch at mobile payment company.
https://www.cbc.ca/news/canada/toronto/mobile-payment-glitch-1.5300313
You may remember the post a few months ago that may be related…
Categories: General
Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware – Microsoft Security
September 30, 2019
Leave a comment
If you are a security operations analyst, your job just got a whole lot harder.
Lock all your doors and keep your children inside; this one is hard to find…
Categories: General
Over 1 million Google Chrome users affected by Cookie Stuffing from two popular adblockers | Cyware Hacker News
September 21, 2019
Leave a comment
If you have ever visited a webpage that took a really long time to load or was filled with ads all over the site, you may have already heard that you need an ad blocker. If you were not sure of which one to use, you might be a victim of a knock off; a piece of software that is created with a similar name to the original but one that can monetize you use of it and put you at risk.
Learn about how many Google Chrome users were tricked into installing fake extensions and why you need to be sure of the names which extensions you trust.
Categories: General
Security Analyst - Jeff Soehner CISSP, GXPN,GPYC,GMOB,GCIH 