I'm always baffled when I go to set up multi-factor authentication, and the only option is to receive one-time codes via SMS. It's certainly better than not supporting MFA at all. But it sends a message on behalf of your brand: we do the bare minimum. And it satisfies no one. Security-conscious users will be annoyed because (a) they can't use their preferred MFA approach, and (b) they understand that if someone truly wanted to take over their account, they could probably pay an...

I'm always baffled when I go to set up multi-factor authentication, and the only option is to receive one-time codes via SMS. It's certainly better than not supporting MFA at all. But it sends a message on behalf of your brand: we do the bare minimum. And it satisfies no one. Security-conscious users will be annoyed because (a) they can't use their preferred MFA approach, and (b) they understand that if someone truly wanted to take over their account, they could probably pay an...

One thing that makes the IoT risk factors I mentioned yesterday so scary is the number of devices that will be in play. The number of devices that a human can use directly on a daily basis has a practical ceiling. I use four: laptop, smartphone, tablet, smartwatch. But most individual IoT devices aren't used directly by people. They're machine-to-machine (M2M) communicators. This means that the number of them that could someday be practical for me – or an enterprise or government – ...

One thing that makes the IoT risk factors I mentioned yesterday so scary is the number of devices that will be in play. The number of devices that a human can use directly on a daily basis has a practical ceiling. I use four: laptop, smartphone, tablet, smartwatch. But most individual IoT devices aren't used directly by people. They're machine-to-machine (M2M) communicators. This means that the number of them that could someday be practical for me – or an enterprise or government – ...

Have you ever heard of Amazon Sidewalk? It's a shared network that you might already participate in if you have Echo or Ring devices in your home. (Amazon "helpfully" turns it on by default.) It offers some conveniences. After all, that Alexa speaker way out in your garage might have an easier time connecting to your neighbor's Ring floodlight than your own WiFi router. But features like this raise a big question. How much access to your devices and network is an IoT device manufact...

Have you ever heard of Amazon Sidewalk? It's a shared network that you might already participate in if you have Echo or Ring devices in your home. (Amazon "helpfully" turns it on by default.) It offers some conveniences. After all, that Alexa speaker way out in your garage might have an easier time connecting to your neighbor's Ring floodlight than your own WiFi router. But features like this raise a big question. How much access to your devices and network is an IoT device manufact...

While it's still early days, the Internet of Things (IoT) has moved from buzzy topic to real thing now. Many of the usual security risks, including the four digital supply chain security challenges I mentioned last week, are amplified by IoT. Why? Two big reasons:Low-cost devices are required to make IoT work. When product companies need to drive costs down, it's a recipe for (a) missed hardware and software vulnerabilities and (b) low incentive to invest in post-deployment support ...

While it's still early days, the Internet of Things (IoT) has moved from buzzy topic to real thing now. Many of the usual security risks, including the four digital supply chain security challenges I mentioned last week, are amplified by IoT. Why? Two big reasons:Low-cost devices are required to make IoT work. When product companies need to drive costs down, it's a recipe for (a) missed hardware and software vulnerabilities and (b) low incentive to invest in post-deployment support ...

One of the scary things about yesterday's IoT botnet example is that it doesn't take many product vendor security misfires to create one. Consider this example. In August 2021, content delivery network (CDN) provider Cloudflare absorbed an IoT botnet attack that was generating 17.2 million requests per second at its peak. Kind of a lot, right? The same botnet, known as Meris, took down Yandex (basically Russian Google) around the same time with an attack that peaked at 21.8 million ...

One of the scary things about yesterday's IoT botnet example is that it doesn't take many product vendor security misfires to create one. Consider this example. In August 2021, content delivery network (CDN) provider Cloudflare absorbed an IoT botnet attack that was generating 17.2 million requests per second at its peak. Kind of a lot, right? The same botnet, known as Meris, took down Yandex (basically Russian Google) around the same time with an attack that peaked at 21.8 million ...

​Amazon famously promotes a shared responsibility model for cloud security. The short version:Amazon is responsible for security of the cloud.The customer is responsible for security in the cloud.AWS has cloud-native security features to help with this. But it's kind of on the customer to figure out how to best apply them alongside the rest of their security stack. This is a fairly defensible way to approach things. But I do think it opens up opportunities for other cloud players to do m...

​Amazon famously promotes a shared responsibility model for cloud security. The short version:Amazon is responsible for security of the cloud.The customer is responsible for security in the cloud.AWS has cloud-native security features to help with this. But it's kind of on the customer to figure out how to best apply them alongside the rest of their security stack. This is a fairly defensible way to approach things. But I do think it opens up opportunities for other cloud players to do m...

Yesterday, I shared a few reasons why digital supply chain security should be top of mind for security leaders and vendors that support them. In addition to the challenge of extending security across company boundaries, supply chain security is complicated by the fact that it comes in many different flavors. I can think of at least four: 1. Software vulnerabilities: Does third-party software I use to build my products or run my business have vulnerabilities? (Think SolarWinds and Log4Shell.) ...

Yesterday, I shared a few reasons why digital supply chain security should be top of mind for security leaders and vendors that support them. In addition to the challenge of extending security across company boundaries, supply chain security is complicated by the fact that it comes in many different flavors. I can think of at least four: 1. Software vulnerabilities: Does third-party software I use to build my products or run my business have vulnerabilities? (Think SolarWinds and Log4Shell.) ...

Yesterday, I noted that even if a small percentage of IoT devices are hijacked, it will significantly impact the broader universe of connected devices. How do we know that? Well, we've already seen it happen. You may recall a day in October 2016 when it felt like a sizeable chunk of the Internet stopped working. Amazon? Nope. Slack? Nope. Netflix? Nope. Spotify? Nope. Twitter? Nope. And so on... This was caused by IoT botnet malware known as Mirai. Mirai scans the Internet for IoT device...

Yesterday, I noted that even if a small percentage of IoT devices are hijacked, it will significantly impact the broader universe of connected devices. How do we know that? Well, we've already seen it happen. You may recall a day in October 2016 when it felt like a sizeable chunk of the Internet stopped working. Amazon? Nope. Slack? Nope. Netflix? Nope. Spotify? Nope. Twitter? Nope. And so on... This was caused by IoT botnet malware known as Mirai. Mirai scans the Internet for IoT device...

So, it looks like we're going to get to watch a supply chain security incident unfold in real-time. As noted briefly in yesterday's email, it wasn't a great day for Okta. But rather than piling on with criticism of Okta's response, take a master class in supply chain security crisis response from Cloudflare. A major security vendor in their own right, Cloudflare was one of the Okta customers whose information was visible in the screenshots shared by the Lapsus$ hacking gro...

So, it looks like we're going to get to watch a supply chain security incident unfold in real-time. As noted briefly in yesterday's email, it wasn't a great day for Okta. But rather than piling on with criticism of Okta's response, take a master class in supply chain security crisis response from Cloudflare. A major security vendor in their own right, Cloudflare was one of the Okta customers whose information was visible in the screenshots shared by the Lapsus$ hacking gro...

Before I move on, here are a few more tidbits about the Okta breach that I found interesting: 1. The ring-leader of Lapsus$ is reportedly a teenager from the UK. 😲 2. Their techniques are very low-tech and focused on social engineering and bribery of insiders and supply chain partners, according to Microsoft (who, as you have heard, was also breached by Lapsus$). 3. In an open letter to Okta, Tenable CEO Amit Yoran provides an even better example of the power of competence + transparency tha...

Before I move on, here are a few more tidbits about the Okta breach that I found interesting: 1. The ring-leader of Lapsus$ is reportedly a teenager from the UK. 😲 2. Their techniques are very low-tech and focused on social engineering and bribery of insiders and supply chain partners, according to Microsoft (who, as you have heard, was also breached by Lapsus$). 3. In an open letter to Okta, Tenable CEO Amit Yoran provides an even better example of the power of competence + transparency tha...

Let's kick off this week's run through my top security topics with securing the digital supply chain. What does it actually mean? These days, nearly every technology product or service is built through collaboration across multiple companies. So securing them effectively requires tools and practices that extend across organizational boundaries. And guess what: this doesn't happen very much. Why is it interesting?Two of the most catastrophic security incidents of the last severa...

Let's kick off this week's run through my top security topics with securing the digital supply chain. What does it actually mean? These days, nearly every technology product or service is built through collaboration across multiple companies. So securing them effectively requires tools and practices that extend across organizational boundaries. And guess what: this doesn't happen very much. Why is it interesting?Two of the most catastrophic security incidents of the last severa...

One of the best things about working in cybersecurity is that it's always changing. There are always new things to learn and think about. Here are some of the areas of security that I'm thinking about the most right now:Securing the digital supply chainThe evolution of cloud-native securityInternet of Things (IoT) securityThe human element of securitySecuring web3 and blockchainI'll take them one by one this week and share some quick thoughts on why I think they're interes...

One of the best things about working in cybersecurity is that it's always changing. There are always new things to learn and think about. Here are some of the areas of security that I'm thinking about the most right now:Securing the digital supply chainThe evolution of cloud-native securityInternet of Things (IoT) securityThe human element of securitySecuring web3 and blockchainI'll take them one by one this week and share some quick thoughts on why I think they're interes...