Cybersecurity Expert

Post Updated - See  WinZip Encryption Password Security (2017) Recently I have received several Emails asking about WinZip encryption, and specifically, whether it is good enough for business use, especially in light of the current climate of data breaches in the UK, where serious data breaches involving public information are announced almost on a weekly basis. So can WinZip do the job to encrypt sensitive data held on disks posted through public postal systems? Well, the answer is Yes, but only if used properly… With WinZip encryption, it is important to understand older versions of WinZip, pre-version 9, uses its own proprietary encryption, which simply broken. Essentially data archived with WinZip version 8 or below, using “WinZip Encryption” with passwords of any strength can very easily be recovered. WinZip version 9 and above has the option to use an industry strength and NIST approved encryption algorithm, namely AES (Advance Encryption Protocol). The application provid...

Perhaps I am being a little naive but I would of thought all MOD laptops would be deployed with hard disk encryption, but apparently not so, as the MOD laptop stolen last week from a parked car in Birmingham didn’t have any hard disk or file level encryption, despite holding masses of private data. This MOD laptop held 600,000 records of military personnel, personal data including passport numbers, national insurance numbers, drivers' licence details, family details, doctors' addresses and bank details, which is probably why we know about this breach, I'm sure the MOD would rather this incident to be kept out of the public eye. Organisations which use thousands of laptops in the field (should) accept and understand that a certain percentage of laptops will be stolen. Sure you can try to reduce the numbers stolen and the risk by educating users, but it inevitable that a minor quantity of laptops will be stolen, it's the way of the world. This is nothing new either, the...

BBC TV Top Gear presenter Jeremy Clarkson who writes for the Sun newspaper, was so convinced the HMRC Data breach in his own words "was a fuss about nothing" published his own bank account and sort code details in the newspaper, and I quote "All you'll be able to do with them is put money into my account. Not take it out. Honestly, I've never known such a palaver about nothing," he told Sun readers However when he next checked his bank statement he saw someone had set up a direct debit which automatically removed £500 from his bank account, apparently transferring the money to a charity, now that's what I call ethical hacking! To quote Clarkson further after discovering this, "The bank cannot find out who did this because of the Data Protection Act and they cannot stop it from happening again. I was wrong and I have been punished for my mistake." I think it just goes to show that there are many people who just don't care that their pe...

I said I would blog about my own progress in obtaining answers and info on the improvements with the initial incident with HMRC when they lost the Standard Life CD with my data on it on 8th November, two weeks prior to the 25 Million record breach. I wrote several letters at that time to the powers that be and I have received several replies so far. I had a reply from my local Member of Parliament, David Borrow, who said "I am looking into the points you have raised and I will contact you again as soon as I have more information. I had a letter receipt acknowledgement from Michael Wills MP, the government minister for Data Protection. I've also had an interesting response from The Information Commissioner’s Office (ICO)... "Thank you for your correspondence dated 8th November 2007 regarding the security breach by HM Revenue and Customs which involved the loss of a computer disc containing Standard Life customer details. The Information Commissioner’s Office (ICO...

On the Twelve Day of Christmas the Information Commissioner disclosed to me... 12 hundred wrongly addressed questionnaires ( DVLA Dec 07) 802. 11 Wifi WEP is broken (now takes just a minute to crack) 1 to 10 UK companies PCI compliant (Survey by Logic Group in Sept'07 revealed that only one in ten UK companies have the proper security standards to handle our card payments securely) 9 NHS Trust Breaches (Dec 2007) 8 "Significant" HMRC Security Incidents ( HMRC revealed further "significant" breaches in Nov/Dec 07) 7 out of 10 websites vulnerable ( Cenzic Study Finds Web Applications Vulnerable to attack May 07) 6 ,000 personal records mislaid (by N.I. Driver and Vehicle Agency - Nov 07) " Twenty-Five " Million Records Lost ( HMRC Nov 07) 4 in 10 WiFi routers unsecure (according to a report by Moneysupermarket .com Apr 07) 3 Million Learner Drivers Lost (by Driving Standards Agency Dec 07) 2 Discs Missing ( HMRC discs holdin...

It appears this time of year coupled with the spectre's shadow of the 25 Million unprotected records lost by the HMRC last month, makes an ideal time to disclose data breaches to the UK public. We really need proper California style data breach disclosure laws in this country. So what's new in the last 7 days... Well the NHS disclosed 10 (ten) data breaches at various NHS trusts around the country, one of which involved the loss of 168,000 records of which most were children’s records. In a statement they said "extremely high level of security", but typically do not explain any details about the security measures. It would appear it's the old recipe of sending data on discs again. Fair play to the NHS if proper encryption was used, but so far I haven't really seen any details about each of these 10 incidents and when they actually occurred. I suspect the NHS powers that be choose not to disclose these incidents when they were discovered, but have been forc...

I was speaking to some pals of mine who where asking about deleting Internet history and removing cookies etc from their PCs for privacy. However none of them knew what “Flash Cookies” were and how to find and view them on their systems, let alone change flash settings and remove them, so I agreed to do a post about them. To recap, a regular cookie is a small text file created by websites via your web browser and stored locally on your PC. The file is tiny, which is probably why it's called a cookie. The information within the file is used to store or reference direct information about your habits and usage on a particular website, such as where you went on the website, and what you did. These cookies allows websites to be smart, so the website remembers who you are and what you like, often personalising or tailoring aspects of the website to make life easier or for directed marketing. However a lot of people have privacy concerns about having their surfing habits tracked, moni...