Cybersecurity Expert

I have written the following article for IBM which was published on IBM's DeveloperWorks A developer's guide to complying with PCI DSS 3.0 Requirement 6 (website) A developer's guide to complying with PCI DSS 3.0 Requirement 6 (PDF) The Payment Card Industry Data Security Standard (PCI DSS) is a highly prescriptive technical standard, which is aimed at the protection of debit and credit card details, which is referred to within the payments industry as cardholder data. The objective of the standard is to prevent payment card fraud, by securing cardholder data within organizations that either accept card payments, or are involved in the handling of cardholder data. PCI DSS consists of 12 sections of requirements, and usually responsibility for compliance rests with IT infrastructure support. PCI DSS requirement 6, however, breaks down into 28 individual requirements, and sits squarely with software developers involved in the development of applications that process, store,...

From the very first moment gamers played online, their accounts have been targeted by hackers. But hacking gamer accounts is no longer just about revenge and community kudos. There is serious money to be made from stealing access to gamer accounts, ranging from selling virtual gaming items and gaming currency for real money, to stealing bank account & credit card details. It is a subject I have touched upon several times over the years: How to keep your Final Fantasy XIV Online Account Safe & Secure PlayStation Hack: PSN Gamers Security Help Is Club Penguin Safe for my Child? World of Warcraft: Does the Internet have controllable Borders? Last year's launches of Microsoft's Xbox One and Sony's PS4 consoles, have swelled the number of online gamers into millions, so is gamer security a problem that is set to raise?  Yes, and no, I think online console gaming security has improved in recent years, as Microsoft and Sony understand a secure online gaming network...

I have written the following article for IBM which was published on IBM's DeveloperWorks Scan your app to find and fix OWASP Top 10 2013 vulnerabilities (website) Scan your app to find and fix OWASP Top 10 2013 vulnerabilities (PDF) Today's modern web applications are more than a match for most desktop PC applications and continue to push boundaries by taking advantage of limitless cloud services. But more powerful web applications means more complicated code, and the more complicated the code, the greater the risk of coding flaws — which can lead to serious security vulnerabilities within the application. Web application vulnerabilities face exploitation by relentless malicious actors, bent on profiteering from data theft, or gaining online notoriety by causing mischief. This article looks at securing web applications by adopting industry best application development practices, such as the OWASP Top 10 and using web application vulnerability scanning tools.

Recent research shows 76% of enterprises analysed by Cisco has Java version 6, which Oracle stopped supporting in February 2013, 14 months before the highly publicised end of Windows XP support by Microsoft. Running unsupported Java is arguably a far more risky affair than unsupported Windows XP in the enterprise, and according the Cisco 2014 Annual Security report , the Java problem is going under the security radar. As most Cyber Security professional will tell you, you should avoid installing Java unless you really have to have it, as the exploitation of Java vulnerabilities is a typical culprit behind web-based desktop compromises. Recent data from Sourcefire  shows that Java exploits make up a staggering 91% indicators of compromise. The Java Applet Risk The highest area of risk with Java lies with Java applets (applications) which are executed within a web browser. The intent is for Java applets to operate in a safe sandbox within the confin...

The standard information security management doctrine is to consider the internal IT infrastructure as a secure trusted zone, free from any malicious third party compromise. But the reality is different, as network intrusions, malware infections, data thefts and other malicious activities are not being detected within most UK business networks. According to the Cisco 2014 Annual Security Report , 100% of business networks analyzed by Cisco, have traffic going to websites that host malware. Sophisticated and expensive security monitoring may well be implemented to detect malicious activity, but in my experience, monitoring and alerting systems are often poorly configured and not correctly base-lined. This results in the security staff being bombarded with a steady stream of false positive alerts, which completely hampers their ability to spot actual attacks. Security monitoring can also lure the business into a false sense of security, take File Integrity Monitoring (FIM), an excel...

I was privileged to speak at the SC Congress in London today. I was asked to talk about my views on Point of Sale (POS) credit card data breaches which had recently occurred stateside, the role of PCI DSS compliance with such breaches, and whether the UK could expect similar breaches despite widespread adoption of Chip & Pin (EMV), and what are the lessons to be learnt.  The following is a summary of what I said. In the United States there has been a number of high profile Point of Sale (POS) credit card data breaches, occurring at around seven shopping chains towards the end of last year. The most provident of these breaches was at Target, where hackers stole an estimated 40 million credit card details.   The hackers managed to load credit card data stealing malware onto Target’s POS systems, in each of Target’s 1800 stores. It is one of the largest and most sophisticated data breaches the payment card industry has ever seen. As Target cashiers swiped cus...

The rise of cloud computing is undeniable and unstoppable, information security professionals have to accept resistance to cloud is futile. The Cisco 2014 Annual Security Report , projects cloud network traffic will grow more than threefold by 2017, with businesses executives eyeing up cloud as the silver bullet in eliminating expensive IT hardware. This cost saving elixir means cloud solutions are often quickly steamrollered in by business, leaving information security playing second fiddle. InfoSec Resistance to Cloud is Futile More and more confidential information is moving towards the cloud, and if Cisco’s projection is correct, we can expect, if not already, vast volumes of information processed and stored by business to be typically cloud based. This data moving trend is the most radical change in information security since the dawn of the commercial Internet, and presents a major shift of the security perimeter. Blindly trusting cloud service providers to deliver a level o...