Cybersecurity Expert

Today is the fifth annual "Safer Internet Day", which has a focus on promoting safe internet usage awareness to children and their parents, a cause which I'm well and truly behind. It still troubles me that some parents don't seem to understand the Internet can be a dangerous place for children. I've seen parents who strictly don't allow their children to watch inappropriately age certified movies, play Cert 15/18 computer games, but when it comes to Internet usage, just leave their kids to it, completely oblivious that their children could be viewing inappropriate material, posting personal info and pictures on social networking sites, or chatting with complete strangers. http://www.saferinternet.org

Post Updated - See  WinZip Encryption Password Security (2017) Recently I have received several Emails asking about WinZip encryption, and specifically, whether it is good enough for business use, especially in light of the current climate of data breaches in the UK, where serious data breaches involving public information are announced almost on a weekly basis. So can WinZip do the job to encrypt sensitive data held on disks posted through public postal systems? Well, the answer is Yes, but only if used properly… With WinZip encryption, it is important to understand older versions of WinZip, pre-version 9, uses its own proprietary encryption, which simply broken. Essentially data archived with WinZip version 8 or below, using “WinZip Encryption” with passwords of any strength can very easily be recovered. WinZip version 9 and above has the option to use an industry strength and NIST approved encryption algorithm, namely AES (Advance Encryption Protocol). The application provid...

Perhaps I am being a little naive but I would of thought all MOD laptops would be deployed with hard disk encryption, but apparently not so, as the MOD laptop stolen last week from a parked car in Birmingham didn’t have any hard disk or file level encryption, despite holding masses of private data. This MOD laptop held 600,000 records of military personnel, personal data including passport numbers, national insurance numbers, drivers' licence details, family details, doctors' addresses and bank details, which is probably why we know about this breach, I'm sure the MOD would rather this incident to be kept out of the public eye. Organisations which use thousands of laptops in the field (should) accept and understand that a certain percentage of laptops will be stolen. Sure you can try to reduce the numbers stolen and the risk by educating users, but it inevitable that a minor quantity of laptops will be stolen, it's the way of the world. This is nothing new either, the...

BBC TV Top Gear presenter Jeremy Clarkson who writes for the Sun newspaper, was so convinced the HMRC Data breach in his own words "was a fuss about nothing" published his own bank account and sort code details in the newspaper, and I quote "All you'll be able to do with them is put money into my account. Not take it out. Honestly, I've never known such a palaver about nothing," he told Sun readers However when he next checked his bank statement he saw someone had set up a direct debit which automatically removed £500 from his bank account, apparently transferring the money to a charity, now that's what I call ethical hacking! To quote Clarkson further after discovering this, "The bank cannot find out who did this because of the Data Protection Act and they cannot stop it from happening again. I was wrong and I have been punished for my mistake." I think it just goes to show that there are many people who just don't care that their pe...

I said I would blog about my own progress in obtaining answers and info on the improvements with the initial incident with HMRC when they lost the Standard Life CD with my data on it on 8th November, two weeks prior to the 25 Million record breach. I wrote several letters at that time to the powers that be and I have received several replies so far. I had a reply from my local Member of Parliament, David Borrow, who said "I am looking into the points you have raised and I will contact you again as soon as I have more information. I had a letter receipt acknowledgement from Michael Wills MP, the government minister for Data Protection. I've also had an interesting response from The Information Commissioner’s Office (ICO)... "Thank you for your correspondence dated 8th November 2007 regarding the security breach by HM Revenue and Customs which involved the loss of a computer disc containing Standard Life customer details. The Information Commissioner’s Office (ICO...

On the Twelve Day of Christmas the Information Commissioner disclosed to me... 12 hundred wrongly addressed questionnaires ( DVLA Dec 07) 802. 11 Wifi WEP is broken (now takes just a minute to crack) 1 to 10 UK companies PCI compliant (Survey by Logic Group in Sept'07 revealed that only one in ten UK companies have the proper security standards to handle our card payments securely) 9 NHS Trust Breaches (Dec 2007) 8 "Significant" HMRC Security Incidents ( HMRC revealed further "significant" breaches in Nov/Dec 07) 7 out of 10 websites vulnerable ( Cenzic Study Finds Web Applications Vulnerable to attack May 07) 6 ,000 personal records mislaid (by N.I. Driver and Vehicle Agency - Nov 07) " Twenty-Five " Million Records Lost ( HMRC Nov 07) 4 in 10 WiFi routers unsecure (according to a report by Moneysupermarket .com Apr 07) 3 Million Learner Drivers Lost (by Driving Standards Agency Dec 07) 2 Discs Missing ( HMRC discs holdin...

It appears this time of year coupled with the spectre's shadow of the 25 Million unprotected records lost by the HMRC last month, makes an ideal time to disclose data breaches to the UK public. We really need proper California style data breach disclosure laws in this country. So what's new in the last 7 days... Well the NHS disclosed 10 (ten) data breaches at various NHS trusts around the country, one of which involved the loss of 168,000 records of which most were children’s records. In a statement they said "extremely high level of security", but typically do not explain any details about the security measures. It would appear it's the old recipe of sending data on discs again. Fair play to the NHS if proper encryption was used, but so far I haven't really seen any details about each of these 10 incidents and when they actually occurred. I suspect the NHS powers that be choose not to disclose these incidents when they were discovered, but have been forc...