Is Ransomware Protection Working?
Recently an organization I’m familiar with suffered a ransomware attack. A LockBit ransomware infected a workstation and spread to a few servers. The attack was contained thanks to a quickContinue reading
The xz Backdoor Should Not Happen Again
A few days ago a significant supply chain attack attempt was accidentally revealed – the xz utiliy was compromised, likely by a nation state, in order to plant a backdoorContinue reading
Why Facebook’s Lack of Customer Support Is a Problem
Facebook is arguably the biggest social network. The network effect makes it hard for people to leave Facebook, and so many businesses, celebrities, institutions, politicians rely on it for reachingContinue reading
Another Attack Vector For SMS Interception
SMS codes for 2FAs have been discussed for a long time, and everyone knowledgeable in security knows they are not secure. What’s more – you should remove your phone numberContinue reading
eIDAS 2.0, QWACs And The Security Of The Web
Tension has been high in the past months regarding a proposed change to the European eIDAS regulation which defines trust services, digital identity, and the so-called QWACs – qualified websiteContinue reading
MERDA – A Framework For Countering Disinformation
Yesterday, on an conference about disinformation, I jokingly coined the acronym MERDA (Monitor, Educate, React, Disrupt, Adapt) for countering disinformation. Now I’ll put the pretentious label “framework” and describe whatContinue reading
Anticorruption Principles For Public Sector Information Systems
As a public official, I’ve put a lot of thought on how to make the current and upcoming public government information systems resistant to corruption. And I can list severalContinue reading
Methodology for Return on Security Investment
Measuring return-on-investement for security (information security/cybersecurity) has always been hard. This is a problem for both cybersecurity vendors and service providers as well as for CISOs, as they find itContinue reading
Why I’m Not So Alarmed About AI And Jobs
With the advances in large language models (e.g. ChatGPT), referred to as AI, concerns are rising about a sweeping loss of jobs because of the new tools. Some claim jobsContinue reading
Nothing Is Secure [slides]
Yesterday I gave a talk on a local BSides conference in Bulgaria titled “Nothing is secure”. The point is simple: security is very hard, there are many details, many tools,Continue reading