In this episode of the podcast, host Paul Roberts speaks with Colin O'Flynn, CTO and founder of the firm NewAE about his work to patch shoddy software on his home's electric oven - and the bigger questions about owners rights to fix, tinker with or replace the software that powers their connected stuff.

The post Episode 252: Colin O’Flynn On Hacking An Oven To Make It Stop Lying appeared first on The Security Ledger with Paul F. Roberts.

In this spotlight edition* of The Security Ledger Podcast, Steve Hanna of Infineon joins us to talk about the growing risk of cyber attacks on industrial systems and critical infrastructure. "Industry 4.0" is poised to transform the global economy, Hanna said, but not if the issue of cyber risk can't be managed. We talk about how that might be done and the need for strong identity and hardware based roots of trust!

The post Spotlight: as Attacks Mount, how to secure the Industrial Internet appeared first on The Security Ledger with Paul F. Roberts.

In the latest Security Ledger podcast, we analyze the breach of Deloitte by talking to two people who spend a lot of time judging the security of firms by how they look to the outside world. Dan Tentler of the firm Phobos Group tells us what he found out about Deloitte doing some fast and dirty open source research. Also: we talk to Stephen Boyer of the firm BitSight about a new study that firm did of the gap between the security readiness of financial services firms and the third-party software supply chain they rely on.  The recent compromise of the CCleaner security scanning tool and MEDocs financial software raised concerns about the risk posed by vulnerable software supply chains. But companies face other, serious supply chain risks in the form of third-party service providers like law firms and technology service companies. Such firms often have carte blanche access to their […]

The post Hacker Eye on the Consultant Guy: Deloitte and the Art of spotting Vulnerable Firms from the Outside appeared first on The Security Ledger with Paul F. Roberts.

What makes a good CSO? In the wake of the Equifax breach, we talk about the controversy over that company’s CSO’s music degree. Also: we talk with Signal Sciences about why companies keep getting hacked via application vulnerabilities like the Apache Struts hole that felled Equifax. What makes a good CSO? In the wake of the Equifax breach, we are using this week’s Security Ledger podcast to talk about the controversy over that company’s CSO’s music degree.  Deidre Diamond, the CEO and founder of the placement firm CyberSN talks to us about what companies are looking for in Chief Security Officers. Also: Chris Roberts, the noted hacker known as @sidragon1 and Chief Security Architect at the firm Acalvio, talks about the convention of unconventional paths to the information security space. Roberts recounts his own twisting path to the information security space as a young hacker coming of age in the 1980s. Diamond […]

The post After Equifax: What Makes a Good CSO? Also: App Sec is a Mess. We Talk about Why. appeared first on The Security Ledger with Paul F. Roberts.

Like everyone else, we wrote extensively in the last month about the serious security vulnerability in OpenSSL dubbed “Heartbleed,” which affected many of the world’s leading web sites and services, including Facebook and Google. The large-type headlines about Heartbleed have passed. But that doesn’t mean that the danger has. As we have noted,  we are entering a phase that might be considered Heartbleed’s ‘long tail.’ Most of the well-trafficked websites that were vulnerable to Heartbleed have gotten around to fixing the vulnerability. But public-facing web servers are only the beginning of the story for OpenSSL. Chasing down the vulnerability’s long tail in third-party applications and on internal web sites and applications is a much larger task. As I’ve noted: open source components make their way into all manner of applications and bespoke products these days, often without any effort to assess the security of the borrowed code. For companies that need to protect critical IT […]

The post Podcast: Is Defense-In-Depth The Only Real Heartbleed Fix? appeared first on The Security Ledger with Paul F. Roberts.

Security problems abound in the mobile device space – and many of them have been well documented here and elsewhere. While mobile operating systems like Android and iOS are generally more secure than their desktop predecessors, mobile applications have become a major source of woe for mobile device owners and platform vendors. To date, many of the mobile malware outbreaks have come by way of loosely monitored mobile application stores (mostly in Eastern Europe and Russia). More recently, malicious mobile ad networks have also become a way to pull powerful mobile devices into botnets and other malicious online schemes. But my guests on the latest Security Ledger podcast point out that mobile application threats are poised to affect much more than just mobile phone owners. Jon Oberheide, the CTO of DUO Security and Zach Lanier, a researcher at DUO, note that mobile OS platforms like Android are making the leap […]

The post Perverse Security Incentives Abound In Mobile App Space appeared first on The Security Ledger with Paul F. Roberts.

The Internet of Things leverages the same, basic infrastructure as the original Internet – making use of protocols like TCP/IP, HTTP, Telnet and FTP. But the devices look and act very differently from traditional PCs, desktops and servers. Many IoT devices run embedded operating systems or variants of the open source Linux OS. And many are low-power and many are single function: designed to simply listen and observe their environment, then report that data to a central (cloud based repository).   But IoT devices are still susceptible to hacking and other malicious attacks, including brute force attacks to crack user names and passwords, injection attacks, man in the middle attacks and other types of spoofing.  Despite almost 20 years experience dealing with such threats in the context of PCs and traditional enterprise networks, however, too many connected devices that are sold to consumers lack even basic protections against such threats. […]

The post How Connected Consumer Devices Fail The Security Test appeared first on The Security Ledger with Paul F. Roberts.

Faced with the prospect of being forced to turn over metadata from their customers’ private correspondence to secret courts in the U.S. or other countries, two prominent secure e-mail services decided this week to cease operation. The secure email service Lavabit – lately the choice of NSA leaker Edward Snowden – announced that it was ceasing operations on Thursday after ten years of operation. The announcement was followed, on Friday, by a similar one from the security firm Silent Circle, which operated Silent Mail. Both companies cited the difficulty of securing e-mail communications and the prospect of secret government subpoenas to obtain information on the activities of their customers as the reason for deciding to stop offering secure email services. In a message posted on the Lavabit.com web site, owner and operator Ladar Levison said that he was being forced to “become complicit in crimes against the American people or […]

The post Anonymous Email Services Shutter In Wake Of Snowden appeared first on The Security Ledger with Paul F. Roberts.