23965 shaares
177 results
tagged
incidentresponse
Over the last several weeks, while Americans have grown accustomed to working from home, home schooling, and life in lockdown during the COVID-19
At a time when other companies have turned defensive, Zoom acknowledged its mistakes — and offered a plan to fix them
How much can you trust the assertions made by an organisation regarding their security posture? I don't mean to question whether the statements are truthful or not, but rather whether they provide any actual assurance whatsoever. For example, nearly 5 years ago now I wrote about how "we take security
Dakota Nelson // Unknown Unknowns: So you’ve been pentested. Congrats! It might not feel like it, but this will eventually leave you more confident about your security, not less. The real question is – why might it not feel like it? Pentest findings can be broken down many ways, of course – the obvious one […]
This is a blog post about disclosure, specifically the difficulty with doing it in a responsible fashion as the reporter whilst also ensuring the impacted organisation behaves responsibly themselves. It's not a discussion we should be having in 2020, a time of unprecedented regulatory provisions designed to prevent precisely the
When you see something play out enough times, you start to notice patterns. I was reflecting on this today as I watched The AA rapidly digging themselves in deeper and deeper after publishing 13GB worth of customer data to the internet, including partial credit card data. Which they denied: The
A massive data breach can cause chaos within a company and put IT staff under extreme stress.
An example of a terrific postmortem that accepts responsibility while refusing to blame-and-shame.
MuleSoft deals with a sensitive security issue and sets up an example for the whole industry to follow.
Some kids play in a band after school. Bill Demirkapi hacked two education software giants.
*$ responds quickly and correctly to a vuln report.
Don’t worry. They want it to be safe.
I'm not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally it seems necessary to publish such accounts when companies respond to a breach report in such a…
The owner of Exactis, a 10-person firm that exposed a database including nearly every American, tells the story of his company's downfall.
In my years covering cybersecurity, there’s one variation of the same lie that floats above the rest. “We take your privacy and security seriously.” You might have heard the phrase here and there. It’s a common trope used by companies in the wake of a data breach — either in a “mea culpa” email to […]
Cryptocurrency recovery should be just one part of your overall strategic operations and recovery plan. These guidelines are one tool that your company may use in building its recovery plan.