Cybersecurity Expert

Recently I was approached to write a security tutorial for the IBM developerWorks website, specifically about IBM Rational AppScan. AppScan is the leading commercial Web Application (and infrastructure) vulnerability scanning tool, which IBM acquired from WatchFire last year. I ended up writing a fairly lengthy tutorial, 7000 words plus, which goes to explain why my blog entries have been relative sparse in recent weeks. The Tutorial is called; “ Create secure Java applications productively, Part 2” has been uploaded on the IBM developerWorks website. http://www.ibm.com/developerworks/edu/r-dw-r-appscan2.html . Or you may download a copy directly from here r-appscan2-pdf.pdf The tutorial follows on from an initial tutorial, which involved the creation of an Internet facing Java Web Application using IBM Rational Application Developer and Data Studio. To briefly sum up my Tutorial there is a Web Application Security Overview, how to install AppScan, how to configure a scan, int...

No matter the profession or walk of life we are all in, we all have our heroes and mentors, for some it is the likes of Einstein, Winston Churchill, Lance Armstrong, Tiger Woods or Richard Branson, for others it’s Elvis or Amy Winehouse. For me it’s Bruce Schneier, who first made a name for himself as a predominant cryptography expert in 1960s and in recent times has evolved into a fresh and forward thinking security guru. Sure this proves that I’m geek for sure, but for those who have ever read any of Schneier’s recent books, blog entries or heard him speak will understand where I coming from. I can’t say I agree with absolutely everything Bruce says, but what grabs me is his unique approach, perspective and understanding of security and the information security industry. Bruce takes a large step back, then cuts out all the politics, security company marketing and associated sales hype, at which point you are left with the bare bones and the questions on what security is really supp...

Online gaming is booming at the moment, and judging by the types and number of security related questions I am asked by online gamers, I think there may well be some issues to be raised and addressed. On the face of it, gamers’ accounts hold personal information, and often their payment details, such as bank or credit card details. And then there’s the odd mythical online object, which actually can have a real value in the real world, so the stakes are high enough for concern. In this post I’ll focus on Microsoft’s Xbox Live service, I’ll deal with World of Warcraft security issues another time, believe me that could be an even longer post than this one. So I am often asked about the security of the Xbox 360 console and the Xbox Live (XBL) service. Typically whether XBL accounts and Gamertags can be hacked, what the privacy issues are, and one of the most common concerns involves the management of payment card details, especially when it comes to users trying to remove their payment ...

Internet privacy controversy in the air at the moment, as adverting company Phorm are engaged on a PR campaign to gain acceptance of their new method of Internet advising, which they plan to roll out at the ISP level with BT, Virgin Media and TalkTalk. In fact today I will be speaking on BBC Radio Coventry and Warwickshire about this very subject. Who are Phorm? Well they are an “adware” company formally know as 121Media. They were responsible for the “PeopleOnPage” desktop adware application, which gathered information about the host PC and recorded which web sites were visited by the user, before passing this information on to a third party server, in order to direct specific pop-up advertisements. In fact security company F-Secure regarded their app as Spyware, whether it is labeled officially as Adware or Spyware does really matter to me, as I believe such software is an unnecessary nuisance and any company behind duping users into installing it on their PCs should be viewed with...

These days most people think nothing of donating their old unwanted PCs to noble and worthy causes such as their local School, charities, or they do the “green thing” by sending their PCs to be recycled at their local rubbish tip or at the supermarket. This is all great and dandy, however I find more often than not personal data security is completely overlooked. So I’m going to explain these pitfalls in the form of a story… Once upon a time there were three blokes, John, Colin and James who won a regional pub quiz championship sponsored by a major computer manufacturer, each of them won a powerful super quick Windows Vista PCs. The next day all three transferred their personal data from their old dilapidated PCs to their spanking new computers and then decided to do the “green thing” and drop off their old PCs at the local supermarket for recycling or charity donation if suitable. John went through his old PC and very carefully deleted all his personal data files, and Email accoun...

Businesses are relying on the Internet more than ever, whether it’s sales through an e-Commerce website, or low cost “site to site” communications by way of Internet VPNs, Email communications or general web information gathering/distribution, there are many businesses which just can’t “do” without the Internet for a sustained period of time. In my view businesses are very complacent with their reliance on the Internet, and don't have plan B, should worst happen. Sure the Internet was originally developed to withstand a World War III nuclear attack, but businesses which heavily rely on the Internet to conduct business, should be wary of a new wave of Cyber Warfare threats as we progress into the 21st Century. The fact is there are individuals, criminal gangs and even governments and terrorist organisations which have the ability to take down websites, and effect geographic parts of the Internet, even a slow down of Internet traffic in a specific region can have a financial impact...

Today is the fifth annual "Safer Internet Day", which has a focus on promoting safe internet usage awareness to children and their parents, a cause which I'm well and truly behind. It still troubles me that some parents don't seem to understand the Internet can be a dangerous place for children. I've seen parents who strictly don't allow their children to watch inappropriately age certified movies, play Cert 15/18 computer games, but when it comes to Internet usage, just leave their kids to it, completely oblivious that their children could be viewing inappropriate material, posting personal info and pictures on social networking sites, or chatting with complete strangers. http://www.saferinternet.org