WordPress is the most commonly used blogging platform. It is easy to install and has a great ecosystem of plugins and enhancements that extend its capabilities beyond simply posting pictures of your cats. Unfortunately, millions of inexperienced users means that it is also a target for attackers. There are generally two types of attacks against WordPress: Password attacks and Cross Site Scripting. Password attacks can occur in two ways. The first is simply to attempt to use the default passwords, which many users don't bother to change. The second type of password attack is a password guessing attack. WordPress, and its plugins, use a number of well-known defauly usernames (usually: admin) and many users don't look at failed password authentication attempts, making it an easy target for attackers. WordPress, and its plugins, are well-known for being vulnerable to cross site scripting attacks. Just since the beginning of 2013 Symantec has reported 12...

One of the biggest problems information security encounters is either the perception or reality of slowing down the business. I’ve encountered this myself in my career.  One of the ways I dealt with this problem is through an effective use of the risk assessment process. An effective Risk Assessment process can be the cornerstone or the hub of activity for Information Security.  Picture a group that gets involved in all projects from inception to deployment, understanding all the security needs of their customers, providing iterative security requirements, understanding the needs of the different security groups, and providing management with accept risk reduction or a decision to accept some type of risk. Risk assessment requires a robust process that keeps pace with the project and doesn’t slow it down. Security teams need to make sure all risks are known and addressed in some way prior to construction or development. This way IT/...

This was my second year at the RSA Conference. It was interesting to come back as a "veteran" to the largest security conference (24k attendees according to rumor). I consider myself a veteran since I didn't really see differences between last year and this year. Now since I was working my interactions were limited to the expo floor and sidebars. I didn't get into any talks or sessions, but the view from the outside was worthwhile if a little rote. The keynotes and expo floor focused on the same problems we had last year. Sure the scale may have changed and the awareness of threat actors has broadened but we're still fighting the same battles against a backdrop of consumerization, the cloud, and big data.

Now I understand 20 minutes in front of a passive audience or five minutes with a conference goes that wanders up to your kiosk is not the opportune time to solve the world's problems. At best you grab their attention (hopefully in a...

The United States is ranked #1 for malicious activity by source and we are responsible for just over 21% of all of the malicious activity.  Much of this has to do with my mother the innocent victim who doesn’t know any better and doesn’t even know there is a cyber war going on.  She doesn’t know to patch her PC, nor not to download the toolbar of the week.  She doesn’t even call her son when her Norton 360 subscription expires as he just happens to be a security professional and he works for the company.  Enough about my mommy issues I pay good professionals to vent about her. 
 
Adding to the mom issue is the intuitions that feel status quo is ok and don’t patch until something breaks.  Malware running around the organization salivating over that large pipe to the Internet just waiting for instructions. This isn’t just your mom and pop grocery I am referencing here, these are Fortune 100 companies...