Cybersecurity Expert

This podcast is aimed at day to day people outside the IT security industry using Microsoft Windows. This podcast gives a quick over view on the types of malware (Virus, Worms & Spyware), describes how to prevent malware infection on your PC, and how to remove malware from your PC following infection. IT Security Expert Podcast - Mar2010 : Removing Viruses, Worms & Spyware ITSecurityExpert on iTunes Free Malware Removal Tools Recommended in this Podcast Microsoft Windows Malicious Software Removal Tool Spybot - Search & Destroy AVG Rescue CD There are other free malware removal tools out there, including those which run online in the web browser. If anyone wants to recommend any they have used, please go ahead and make your recommendation in this post's comments - Thanks Notes 1. "Malware" is a collective term which includes Viruses, Worms, Keyloggers, Trojans, Spyware, Adware, and apps referred to as Crimeware 2. I recommend running these tools...

I really love those new Visa World Cup Football TV and the Barclaycard Contactless Card commercials (see below). These ads depict using Visa and Barclaycard plastic to pay for small transaction amounts, such as using your credit card to pay for your lunch, and paying by card for a haircut. But these TV commercials representation does not quite match the reality on the ground in the UK, where many cardholders appear to be continually taken advantage of and are becoming frustrated by small merchants shops who either apply a surcharge, or insist on the minimum spend for payments by card. This reality is in direct conflict with Visa, MasterCard and Barclaycard's overall strategy, namely for card payments to replace all cash payments, hence the recent introduction of contactless payments in the UK. Contactless cards are not just designed for your convenience but to allow the card brands to soak up the small payment transaction space. Can Merchants Apply a Mi...

I have been asked to speak about IT Security Vulnerability Management at a Security Conference, and it got me thinking. Vulnerability Management is the good practice of finding security weaknesses, which bad guys may exploit (hack) and then fixing them. It’s an endless cycle of finding and fixing, Why? Because software code is extremely complicated and tends to be highly rushed by developers these days. Some code can even be millions of lines long, code is never perfect and so never can be bullet proof secure, it’s just a question of discovering the vulnerabilities which are present. This is the reason why Microsoft release security patches on at least a monthly basis and why Microsoft will continue to release security patches as long as they have software to support. An interesting vulnerability management game is played by security vulnerability management vendors and security researchers, as it these vendors and security researchers which tend to find the vast majori...

I thought it was about time I resurrected the IT Security Expert Podcast, so I dusted off my podcast mic and put together a podcast on using Social Networking safely. This podcast is aimed at day to day people outside the security industry. http://itsecurityexpert.co.uk/index.php?module=podcaster&PODCASTS_MAN_OP=viewPodcast&PHPWS_MAN_ITEMS[]=6 ITSecurityExpert on iTunes To go with this Podcast I have a “Parent Child Facebook Safety Guide” which I put together following my appearance on BBC Radio 5 earlier in the year. http://itsecurityexpert.co.uk/index.php?module=pagemaster&PAGE_user_op=view_page&PAGE_id=36&MMN_position=53:53 And I have a couple of relevant blog entries to this Podcast http://blog.itsecurityexpert.co.uk/2009/12/facebook-privacy-settings-change.html http://blog.itsecurityexpert.co.uk/2009/11/child-facebook-safety.html I’m considering a couple things with this Podcast, initially doing a new release once a month, and I am also cons...

The Chip & Pin man-in-the-middle weakness highlighted by the Cambridge academics last week is important to raise and to have addressed, but I’m afraid to say this weakness in Chip & Pin is nothing new, this vulnerability has been known about for years, the Cambridge boffins are right in that Chip & Pin isn't as secure as it should be. However no system ever gives 100% security, the aim of the game is about reducing risk. Chip & Pin reduces card fraud risk significantly when compared to other non-cash payment methods, such as payments by just signing and payments bycheques, even with this vulnerability. The fact is Chip & Pin drastically cut cardholder present fraud in the UK when it was introduced in 2005. The real important thing to understand here, is for the Cambridge Chip & Pin fraud to work, the fraudster needs to have possession of the original debit/credit card (which has yet to be cancelled), and seemingly a laptop. Now ...

In the information age our Police forces increasingly relies on their IT systems to help them perform their duties, these IT systems hold citizen’s most personal sensitive information. Given the nature of “Police Business” you would think Her Majesty’s finest would be pretty good at IT Security, but apparently not. One of the largest Police forces in the UK, Greater Manchester Police (GMP), were forced to disconnect their IT systems from the national Police systems, after their IT systems had been discovered to be riddled with the Conficker WORM. This nasty piece of malware has been around since 2008, however all the anti-virus systems I know of, has been protecting IT systems against it since just after Conficker’s release. From School Children and to Silver Surfers, most people realise and understand the importance of having Anti-Virus software installed on their PCs, and the importance of keeping their Anti-Virus up to date. Installing Anti-Virus protection onto all Windows ba...

In the UK much of our digital sensitive and personal information entrusted to UK government departments and their commercial partners, are supposedly protected by sets of unpublished information security standards. These non-public accessible standards, such as the Government Code of Connection (CoCo) and the required security controls around the various “Impact Levels” classifications (IL2, IL3 etc.), have only been made available to a select few bodies, some of which decide on whether organisations comply with these standards or not, all out of the public eye. Why the Secrecy? Why aren’t these important security standards concerning the protection of UK sensitive citizen information made public? What exactly are the specific requirements to which UK government departments and their commercial partners are seemingly vetted against? Are these requirements up-to-date and strong to ensure to ensure the breach risk to our information is adequately low? Why can’t the public find out ...