Scott Wright’s Security Views

Instead of doing a “security year-in-review” article, or trying to make predictions for the coming year in security, I thought I would go in a slightly different direction for my last article of 2007.
Most security authors and bloggers are doing a great job at this time of year in covering all the industry trend stuff. You know, “How many security holes does Vista still have, and how many will it have next year at this time?” or “The Top 10 Cross-Site Grocking Attacks of 2007!” So in this article, (mostly because I don’t have the time to sit down and crunch through such data), I would like to simply share with you some of my thoughts on improving your personal focus and productivity, in whatever field you are in. I’m told that it’s a good time of year to do this kind of thing.

Continue Reading »

Even people with the best of intentions can be fooled by SPAM e-mails, browser pop-ups or dialogs that try to scare them into doing something you wouldn’t otherwise do on the Internet.

This article in CNET’s “Spyware Horror Stories” series (click HERE) is an example of something that probably happens to a lot of people, and they don’t even know it.

Continue Reading »

If you are an executive in your organization, here’s an exercise that might open your eyes to what the real problems are with security in your organization. Randomly stop and ask people in the hall or in meetings what information they handle in their jobs that could be valuable to an outsider… You know, something worth stealing.

Chances are, you will find a lot of people who would say things like “I don’t know”, “nothing”, or “that big, expensive software program we bought last year”. Maybe you were expecting them to say things like “customer lists”, “power supply designs”, “process descriptions”, “corporate strategies”, “financial plans”, “hiring plans”. How about you get back to me and let me know (anonymously, if you like) what percentage identified the real Intellectual Property (IP) that your organization’s business systems depend on to operate from day to day.

Continue Reading »

I have been hearing the name Alan Calder from several sources lately. So, I ordered the book above (Here). It’s definitely worth having on the shelf, even if it does have a fairly high “price per page”.

I found the book to be packed with relevant references for everything from standards to market surveys. I marked it up pretty well inside, making notes to myself on how the information could be used. Continue Reading »

What’s interesting to me is the difference between what we think we need now, and what will help us get to a better place. The questions we ask may be what determines how soon we get there. (Deep, I know, but there is a simple point I’m leading to.) To paraphrase Bruce Schneier, we shouldn’t worry too much about the bad things in the news because they hardly ever happen… that’s why it’s called NEWS.

If we had a better security awareness model, we might start asking better questions. Continue Reading »

One aspect of IT Security that always seems lacking is in the treatment of Security Awareness, both within organizations and with individual citizens. The book that led me to create this blog, What No One Ever Tells You About Blogging and Podcasting : Real-Life Advice from 101 People Who Successfully Leverage the Power of the Blogosphere by Ted Demopoulos, had a lot of great ideas that can apply to creating a blog on IT Security. One valuable use of blogs can be to enhance Security Awareness within an organization. Continue Reading »

The title above is the name of a book by Bruce Schneier, well known author and commentator on the field of security.

I just listened to a podcast of an interview with him on ITConversations.com which was quite interesting. Bruce has evolved from being a cryptography expert to a network security expert, now to a security generalist. He has some great insights and analogies for security problems. I haven’t read the book, but intend to.

- Scott