Cybersecurity Expert

I have written the following article for IBM which was published on IBM's DeveloperWorks Scan your app to find and fix OWASP Top 10 2013 vulnerabilities (website) Scan your app to find and fix OWASP Top 10 2013 vulnerabilities (PDF) Today's modern web applications are more than a match for most desktop PC applications and continue to push boundaries by taking advantage of limitless cloud services. But more powerful web applications means more complicated code, and the more complicated the code, the greater the risk of coding flaws — which can lead to serious security vulnerabilities within the application. Web application vulnerabilities face exploitation by relentless malicious actors, bent on profiteering from data theft, or gaining online notoriety by causing mischief. This article looks at securing web applications by adopting industry best application development practices, such as the OWASP Top 10 and using web application vulnerability scanning tools.

Recent research shows 76% of enterprises analysed by Cisco has Java version 6, which Oracle stopped supporting in February 2013, 14 months before the highly publicised end of Windows XP support by Microsoft. Running unsupported Java is arguably a far more risky affair than unsupported Windows XP in the enterprise, and according the Cisco 2014 Annual Security report , the Java problem is going under the security radar. As most Cyber Security professional will tell you, you should avoid installing Java unless you really have to have it, as the exploitation of Java vulnerabilities is a typical culprit behind web-based desktop compromises. Recent data from Sourcefire  shows that Java exploits make up a staggering 91% indicators of compromise. The Java Applet Risk The highest area of risk with Java lies with Java applets (applications) which are executed within a web browser. The intent is for Java applets to operate in a safe sandbox within the confin...

The standard information security management doctrine is to consider the internal IT infrastructure as a secure trusted zone, free from any malicious third party compromise. But the reality is different, as network intrusions, malware infections, data thefts and other malicious activities are not being detected within most UK business networks. According to the Cisco 2014 Annual Security Report , 100% of business networks analyzed by Cisco, have traffic going to websites that host malware. Sophisticated and expensive security monitoring may well be implemented to detect malicious activity, but in my experience, monitoring and alerting systems are often poorly configured and not correctly base-lined. This results in the security staff being bombarded with a steady stream of false positive alerts, which completely hampers their ability to spot actual attacks. Security monitoring can also lure the business into a false sense of security, take File Integrity Monitoring (FIM), an excel...

I was privileged to speak at the SC Congress in London today. I was asked to talk about my views on Point of Sale (POS) credit card data breaches which had recently occurred stateside, the role of PCI DSS compliance with such breaches, and whether the UK could expect similar breaches despite widespread adoption of Chip & Pin (EMV), and what are the lessons to be learnt.  The following is a summary of what I said. In the United States there has been a number of high profile Point of Sale (POS) credit card data breaches, occurring at around seven shopping chains towards the end of last year. The most provident of these breaches was at Target, where hackers stole an estimated 40 million credit card details.   The hackers managed to load credit card data stealing malware onto Target’s POS systems, in each of Target’s 1800 stores. It is one of the largest and most sophisticated data breaches the payment card industry has ever seen. As Target cashiers swiped cus...