Scott Wright’s Security Views

Facebook and other social networking sites such as Twitter are fast becoming a thorn in the side of security professionals. Management has quickly identified value in their ease of communicating and connecting with other colleages. However, they seem to have been a little slower on appreciating the risks involved to their organization in this type of activity.

Are we just being paranoid about the harvesting of information on these sites by hackers, spammers and social engineering fraudsters?

Take the poll, below, or view other polls by clicking HERE.

NOTE: I am trying a new survey mechanism to replace the previous one which did not work with this version of my Web server.

The following link goes to a Zap Survey poll that I have set up. Please follow the link and complete the poll. Zap Survey says they can not identify individual users. The technology is not under my control, so I can not vouch for what privacy provisions they may have in place.

I will post the results when I have a significant amount of data, or provide a link to the report page.

Even people with the best of intentions can be fooled by SPAM e-mails, browser pop-ups or dialogs that try to scare them into doing something you wouldn’t otherwise do on the Internet.

This article in CNET’s “Spyware Horror Stories” series (click HERE) is an example of something that probably happens to a lot of people, and they don’t even know it.

Continue Reading »

Having weak passwords certainly can make life difficult for everyone. Nobody likes having to recover or change all their identity cards and information when their password gets compromised. But there is a point of diminishing returns when adding rules to user-chosen passwords.

In general, the more sensitive the information that an account has access to, the stronger the authentication method should be. Passwords are the most convenient method for most organizations, and for their users. They work well most of the time, especially with accounts that have limited functionality that can be exploited, or limited useful information.

Continue Reading »

With all the sites and programs that require you to have passwords, it is becoming a necessity to have a strategy for choosing good passwords that you can remember, yet are strong enough for protecting your sensitive information online.

You may have noticed that password rules vary from site to site. (I’ll talk about Web sites in this article, but this could just as easily apply to programs that run on your computer.) Usually, the strictness of the password rules increases with the sensitivity of the information being protected by the password.

Continue Reading »

Have you been invited to participate in helping create or celebrate a miracle today by email; or maybe contribute to a new Guiness World Record, or to support a cause by forwarding an email to show your support?

As tempting as it may be to participate, or to avoid feeling guilty for not passing on email chain letters, please don�t do it! Despite the feelings of guilt that you may have in not forwarding an email from a friend (because it warns of dire consequences if you don�t, or good luck if you do!), there are too many very good reasons not to comply, and to ask them politely to stop being part of the problem. Continue Reading »

Just to ad a little bit of confusion to the question of “Who are the bad guys and who are the good guys?”, there has been discussion of how some dangerous links are able to get into the Google Adwords ads on the right side (and sometimes first few search results) of a Google search results page.

Didier Stevens did an interesting experiment to demonstrate how easy it was for a malicious site to get an ad in a high position, where it might infect people with inadequate security on their systems if they click on them. Continue Reading »