Nov 21, 2019
Posted in blog, Information Security, privacy, security awareness, social engineering, Uncategorised
Google Loves Your Data
Google has been following people around for ages. I always point out to people the fact that they state how they would use Google for everything. Whether it’s for using email, spreadsheets, google drive for file storage, chrome as a browser etc… Yet, none of them ever questioned how Google is not charging them for these services? Let’s face it, no company can provide free services, and yet eat up expenses for too long. When I tell people the fact that Google indeed profits off the data from each user. That is truly when people start to realize, and even question that they may be sharing more than they want with Google.
What do I think about Google keeping tabs?
Read more About This Post
Jul 22, 2019
Posted in blog, Breaches, Information Security, News
Equifax Breach Lessons Learned
After reading the Equifax breach report released by U.S. House of Representatives Committee on Oversight and Government Reform. This would be a great post to summarize and list out key items that went wrong in the Equifax breach. Hopefully, it will lead to a wake up call for other companies in order to better their own information security.
Security Representative on the Core team
It’s highly important to have someone that understands information security on your core team. Many times, the task gets pushed to the Legal or IT team core team members. This is one of the reasons that led to the breach. IT operational tasks and security tasks need to fall under a specific leader. Ideally, someone that understand security and not just IT. In Equifax’s case, security was represented by the IT team core member. However, their views were not in line with the security team leader. Therefore, something that may be of risk may not reach the CEO’s level and will get missed. However, Read The Full Post
Jul 14, 2019
Posted in blog, Cloud, Featured, Information Security, Reviews
SEC545: Cloud Security Architecture and Operations
Just recently I went to attend a local SANS Community class in my city. For those that are not aware, SANS Community classes are usually smaller classes with 5-10+ students. It’s a small venue with more of a small class size, but the material would be the same that SANS would teach on vLive, OnDemand, or at a SANS conference.
I can say that the SEC545: Cloud Security Architecture and Operations class is VERY popular. There were many students there that were not hardcore SANS enthusiasts such as myself. Many people were there on the basis that companies are all now starting to move to the cloud. And, many companies are worried about the security implications of moving, and with larger concerns on if the architecture is not setup and configured correctly.
The class was very much AWS focused, which was great for me in terms of learning AWS. However, Read The Full Post
Nov 4, 2018
Posted in blog, Information Security, Reviews
SEC 542 SANS Course Review
So I wanted to post a blog post on my experience related to the SEC 542 course. This way I can share my experience out there with others, and hopefully give others insight to see if the course is a right fit for them too.
Now because I took the vLive course, my course was not a 4-6 day course. This course was actually completed over 6+ weeks with 2 class sessions per a week. This was an excellent course, very well designed and presented out to students. There were things I already knew and had experienced. But, there were a lot of tools that were introduced in the course, which I had not used or heard of before. And, these tools definitely help save some time especially when it comes down to recon.
I’ll briefly list some of the things you learn during each week, but for the full list you’ll have to take the course for yourself. Trust me, it’s an awesome course! Read The Full Post
Sep 28, 2018
Posted in blog, Breaches, Information Security
NCIX Data Breach
One of the biggest news items around recently has been the NCIX Breach. I was notified of it through a colleague prior to the media finding out about it through the following blog –> (https://www.privacyfly.com/articles/ncix_breach/). The blog details events that took place where a person uncovered hard drives left by the now bankrupt NCIX computer retailer. The warehouse housing these drives, and left over computers that belonged to NCIX were being sold off by the warehouse landlord. The information based off privacyfly’s blog seems to point towards the landlord illegally selling the data on the drives to recuperate lost rent. The big question here is how NCIX, or the team taking care of their assets after bankruptcy could allow this information to be sold. And, this also goes to show how NCIX has very weak security procedues in place to safeguard their most vital data (customer and employee data). Read The Full Post