Scott Wright’s Security Views

It’s almost like you can’t trust people these days. You’d think if someone broke into a house looking for valuables they’d at least leave the “work” stuff alone. But NO, the thieves have to go for the laptop, without any regard for how much “sensitive information” might be on it. No regard for the red tape it will put you through when it goes missing. The nerve! Why couldn’t they have just taken the kids’ iPod? It’s worth almost as much…

Folks, it’s all just becoming a bit too much for me, these breaches that could easily have been prevented. This one happened a bit closer to home for me (click HERE). Continue Reading »

You can view the archive of “The Practical Security News” and sign up for the automated e-mail distribution list by clicking HERE.

IN THIS ISSUE

1) For Executives -

What do you mean “Table Stakes”… I just want to do BUSINESS!

Canada’s Privacy Commissioner recently issued a statement about the TJX breach of Personally Identifiable Information for millions of credit card holders. Click HERE for the news release. Continue Reading »

Entering Personal Identification Numbers (PINs) has become something of an art form. Everyone has a different style and rhythm for punching in those 4 numbers (for most institutions in North America, anyway). Some banks and Point of Sale (POS) device manufacturers put little shields around the pin pad to keep people from being able to clearly see the numbers you are touching.

But do you really take the time to think about how visible your PIN is when you have a line of people waiting for service? It’s not usually the people waiting in line that you have to worry about.

Continue Reading »

As anyone who has spoken to a security professional probably knows, “Layered Security” is a must, since no single safeguard can be expected to cover all potential types of threats. There are a lot of ways to build layers into an environment.  But a sensible thing to do is pick layers that use different approaches and have overlapping coverage.

For example, to prevent insider threats from being successful, you might use a deterrent safeguard such as “login banners” that warn of the employee’s responsibilities to adhere to an acceptable use policy, where violations may result in dismissal.

Continue Reading »

Having weak passwords certainly can make life difficult for everyone. Nobody likes having to recover or change all their identity cards and information when their password gets compromised. But there is a point of diminishing returns when adding rules to user-chosen passwords.

In general, the more sensitive the information that an account has access to, the stronger the authentication method should be. Passwords are the most convenient method for most organizations, and for their users. They work well most of the time, especially with accounts that have limited functionality that can be exploited, or limited useful information.

Continue Reading »

With all the sites and programs that require you to have passwords, it is becoming a necessity to have a strategy for choosing good passwords that you can remember, yet are strong enough for protecting your sensitive information online.

You may have noticed that password rules vary from site to site. (I’ll talk about Web sites in this article, but this could just as easily apply to programs that run on your computer.) Usually, the strictness of the password rules increases with the sensitivity of the information being protected by the password.

Continue Reading »