Cybersecurity Expert

Final Fantasy XIV, is a new online multi-player role playing game (MMORPG) which was launched on the Sony PlayStation 3 and PC this week by Square Enix. Gaming accounts on such games are actively targeted by cyber thieves, as they look to profit from victims by selling off in game character equipment in exchange for real life money, and to even also harvest personal. Protection of the Square Enix user account by the gamer, is the key to the games security, and it is much the responsibility of the gamer, not Square Enix, to ensure it is kept secure, which will become clear in the rest of this post.   I f a bad guy gains access to this account, he will have achieved his objective, and can go on to steal. Many victims don't understand how their accounts were compromised by hackers, and consider the hackers to be super clever, and the gaming company to be at fault. However the attacks are old techniques and fairly simple, and in the vast majority of ca...

A hot topic of discussion amidst security professionals is the Bradley/Chelsea Manning case , the US soldier who was today convicted for 35 years for leaking classified cable documents and media footage to WikiLeaks. The question security professionals are asking, is how come one guy, seemingly at a lower rank level, had access to so much classified information in the first place?  Where was the ‘need to know’ access doctrine? And where was the information access controls? The answer to these questions is simply 911.  As a result of the soul searching in the aftermath of terrorist attacks on the World Trade Centre and Pentagon in 2001, US politicians decreed the military and their various security service agencies had a communication disconnect, and had failed to share vital information between each other, which may of prevented the attacks, as concluded in post 911 reports such as  The 911 Commission Report. In the decade since 911, much of the ‘need to know’ ...

Even in 2013 reporting internet crime to the UK police force is a hit and miss exercise, and is certainly more miss unless you are a celebrity, or report the crime in the right way.  Here is my advice on reporting continued (persistent) web based harassment. If you are aged 16 and under, and are suffering from online harassment, you must tell your parents, teacher or legal guardian. 1. Identify your harasser If you are subjected to weeks and months of persistent anonymous harassment over the web, 9 times out of 10, it will be by someone you know. You can work out who it is likely to be, by examining the nature of the harassment;  the type of language used, the subjects they harass you about, the websites they harass you on, and your own recent history in disagreeing and falling out with people, these are all clues to who your harasser is. They tend to be people who likely will bare a grudge against you; ex-boyfriends are very typical. I...

PayPal launched a new smartphone payment service in the UK, where the customer pays using their smartphone. The merchant (shopkeeper) receives the customer's name and a photo of the customer's face, and then verifies the customer is the owner of the smartphone and PayPal account, by comparing the PayPal sent photo of the customer on the shop's smartphone, with the face of the person stood in front of the till.  This is a passport control type facial recognition authentication, in other words biometric verification. There is a video of it in action on the BBC website -  http://www.bbc.co.uk/news/business-23605025 The fly in the ointment which the BBC report neglected to mention is privacy. A lot of people who value their right to privacy and personal information, will simply not want to have a photo of their face together with their full name sent to shopkeepers mobile phones. There is also the age old problem with any biometric verification, it just...

I specialise in information security awareness, so I am often asked about simple awareness techniques. One easy and free way to delivery security awareness training, especially to those in the dark, whether they are at home or in the workplace, is to use online videos. These are often free, simple to deliver anywhere, and can be a highly effective awareness tool, as long as they are of a decent standard.  By a 'decent standard' I mean videos which aren't going to bore folk to death, of amateur (blogger!) quality, or cringely cheesy to watch. Here are some of my recommended UK favourites: UK ICO ; as you might expect these are personal Data Protection focused, but the ICO have done a good job with these videos, especially with "The Lights are On"    http://www.youtube.com/icocomms UK CPNI ; recently released security awareness videos, interesting watch as well http://www.youtube.com/user/UKCPNI If you know of any other 'decent' free onl...

Social networking are getting hammered by the press following several high profile cyber-bullying cases on Twitter and Ask.fm. Politicians and parents are being vocal, wanting to ban social networking usage, and pass laws to regulate the internet, both of which are pointless and rather concerning exercises. The answer is education, and "privacy on" default settings.   It should be mandatory for all UK primary school children to be properly educated on how to use the internet safety,  learning about their online privacy and how to use social networking safely.This should be akin to the cycling proficiency test, as with kids riding bikes, all kids are online. Indeed many UK primary school aged children are using social network sites despite the teenage age limits, the problem is some parents are complete luddites, and are alien to such communication technologies, so cannot teach their sons and daughters even the very basics of online safety. Default privacy ...