-
22 Jul 2009My latest security content
Here's my latest information security content you may be interested in:E-discover the gaps in your information management processWeb security problems: Five ways to stop login weaknessesFixing four Web 2.0 input validation security mistakesSpotting rich Internet application security flaws with WebGoatCommon causes of Windows server security vulnerabilitiesManaging multiple passwords in WindowsAs always, be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, screencasts, my Twitter updates, ...
Continue Reading... -
16 Jun 2009
Getting back to the basics – what’s it going to take?
With all the worry about budgets and all the marketing hype over some of these fancy vendor security solutions, I still see so many simple/silly/stupid things related to IT that need to be fixed before a penny is ever spent or a single new technology is ever deployed. Things like: --Network shares sharing out entire drives full of sensitive files - accessible by anyone with just a basic network login ...
Continue Reading... -
21 Apr 2009
RSA news: virtual machine security, finally!?
Now vendors and developers have a way to ward off down those dreaded virtual machine vulnerabilities plaguing every network. It's VMware's VMsafe API to the rescue. Finally a virtual machine security solution!Now if we can just find a way to get people to:Require strong passwords on their virtual machinesPatch their virtual machinesDisable unnecessary and unsecured network shares on their virtual machinesTurn off unneeded services on their virtual machinesEncrypt the drives ...
Continue Reading... -
01 Apr 2009
WebInspect – the Mac Daddy Web app scanner?
I've recently covered two of my favorite, yet lesser-known, Web vulnerability scanners: Acunetix Web Vulnerability Scanner and N-Stalker Web Application Security Scanner. Two worthy products indeed. Now I'd like to shed some light on HP's WebInspect. I've been using WebInspect since before testing Web sites/apps was cool. In fact, WebInspect was one the original commercial Web scanners. It may have even been the first. Anyway, I started a relationship with ...
Continue Reading... -
20 Mar 2009
Another Web security scanner to check out
OK, I covered Acunetix Web Vulnerability Scanner in a previous post and now it's time to share a bit about another Web vulnerability scanner called N-Stalker Web Application Security Scanner 2009. I've used N-Stalker for a while dating back to when it was a free product nearly 10 years ago. Compared to the competition I must to admit that I haven't been really impressed with the tool until now. Thiago ...
Continue Reading... -
16 Mar 2009
Is not patching being negligent?
Well, Microsoft's Roger Halbheer thinks so - at least related to the Conficker worm as discussed here. By and large I agree.Everything in business and everything in life depends on us making choices. We choose the behavior - in this case not applying a highly-critical patch - we choose the consequences....especially if it's an oversight because someone in IT was goofing off.With all the talk about the importance of patching ...
Continue Reading... -
26 Jan 2009
A primer on WEP/WPA hacks & why it doesn’t matter
If you can't justify spending $18.99 on the book I co-authored Hacking Wireless Networks For Dummies, then there's an alternative resource for you to at least be able learn about how WEP and WPA can be exploited. In this recent SearchNetworking.com tip, Lisa Phifer has taken the volumes and volumes of technical jabber about the known attacks against WEP and WPA and distilled them into a simple 5 minute read. ...
Continue Reading... -
28 Aug 2008
Crazy things people do to get a Wi-Fi connection
Here's a funny bit about things people have done to get wireless Internet access. Some of these are pretty stupid when you consider the consequences of connecting to a rogue AP where someone's watching your every move on the other end (i.e. web sites browsed, passwords entered, emails sent, etc.). Not to mention exploiting your system for remote access.Reminds me of how much I love my air card.......
Continue Reading... -
26 Aug 2008
Finally…someone gets their Web security policy right!
When most companies claim Web "security" they tout SSL like I mentioned here. I've had trouble figuring out why the buck stops there...maybe because they're being written by people in marketing??Anyway, LinkedIn finally got it right. The security stipulation in their privacy policy goes beyond SSL:In order to secure your personal information, access to your data on LinkedIn is password-protected, and sensitive data (such as credit card information) is protected ...
Continue Reading... -
20 Aug 2008
Can’t wait to try this tool out…
...it's been out for a few weeks and wow, it looks really neat. Great way to demonstrate the vulnerabilities associated with Wi-Fi in the enterprise. I've actually been wondering when someone would come up with a tool like this.http://metasploit.com/dev/trac/wiki/KarmetasploitKarmetasploit acts as a wireless access point serving up legitimate-looking services such as SMTP, DNS, etc. It can be used to capture email passwords, retrieve info from Web form fields, exploit Web ...
Continue Reading...
Resources
Client Testimonials
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”
(IT managed services firm)
Kevin has written/co-written 12 books on information security including one of the best-sellers of all time:
