Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Patrick Nohe
Security Boulevard
NIST Releases New Report on Crypto-Agility – What You Need to Know Now | | crypto-agility, NIST, Post-Quantum Cryptography, PQC migration, PQC readiness, SHA-1 to SHA-2, TLS 1.1, TLS 1.2, TLS 1.3 If you’re keeping up with post-quantum cryptography (PQC), here’s some big news: The U.S. National Institute of Standards and Technology (NIST) has released a fresh initial public draft of a Cybersecurity Whitepaper ...
Security Boulevard
NIST Releases New Report on Crypto-Agility – What You Need to Know Now | | crypto-agility, NIST, Post-Quantum Cryptography, PQC migration, PQC readiness, SHA-1 to SHA-2, TLS 1.1, TLS 1.2, TLS 1.3 If you’re keeping up with post-quantum cryptography (PQC), here’s some big news: The U.S. National Institute of Standards and Technology (NIST) has released a fresh initial public draft of a Cybersecurity Whitepaper ...
SSL/TLS Certificates Archives
By Krupa Patil,Ramachandiran Thangaraj,Patrick Nohe Microservices and containers are changing the way businesses build, deploy, and manage their applications. Within a short span, these technologies have become the de facto standard for software development and distribution. Kubernetes, ...
90-Day SSL/TLS Validity Is Coming
Sometime in the next few months, Google will announce a deadline for the public Internet to begin using 90-day SSL/TLS certificates. It will likely be sometime in 2024. It probably won’t go over well. There was a time, a decade ago, when SSL/TLS certificates could stay valid for up to five years. Unfortunately, that laid bare an inconvenient reality: the longer a certificate stays valid, the less reliable and secure it is—or, to put it another way, the chances it can be misused grow with each day.
New Report Explains COVID-19's Impact on Cybersecurity | CRYPTOID
Diante das preocupações crescentes acerca do Coronavírus, tomamos a decisão de alterar a data da Brazil Cyber Summit (BCS 2020) para o período de 29 de setembro a 1º de outubro de 2020, de modo a priorizar a saúde e a segurança de nossos visitantes, palestrantes, apoiadores, patrocinadores, parceiros, funcionários e todos que ajudam a colocar a BCS 2020 de pé.
Bluetooth Flaw Could Let Hackers Attack You Wirelessly From 800 Feet Away
Diante das preocupações crescentes acerca do Coronavírus, tomamos a decisão de alterar a data da Brazil Cyber Summit (BCS 2020) para o período de 29 de setembro a 1º de outubro de 2020, de modo a priorizar a saúde e a segurança de nossos visitantes, palestrantes, apoiadores, patrocinadores, parceiros, funcionários e todos que ajudam a colocar a BCS 2020 de pé.
Security Boulevard
Fixes for the SSL/TLS handshake failed error for both internet users and site owners It’s time for another technical article. Today, we’re going to discuss the SSL/TLS handshake failed error and the ways to fix it. Like many SSL error messages, the SSL handshake error can be triggered from both the client-side and the server-side, so sometimes it can be fixed by regular internet users and other times it’s indicative of a configuration issue on the website’s part.
Can The EU Create It’s Own Cloud Platform?
The EU is forming an alternative to US and Chinese cloud platforms called Gaia X. This effort will fail on so many fronts By Richard Stiennon It reminds me of Australia’s National Broadband Network (NBN) which still struggles for viability after spending an estimated $51 billion.
Hacker leaks passwords for 900+ enterprise VPN servers
Cibersegurança Destaques Notícias 05/08/2020 A hacker has published today a list of plaintext usernames and passwords, along with IP addresses for more than 900 Pulse Secure VPN enterprise servers ZDNet, which obtained a copy of this list with the help of threat intelligence firm KELA, verified its authenticity with multiple sources in the cyber-security community.
Industrial VPN Flaws Could Let Attackers Target Critical Infrastructures
Todos 1 Hotel South Beach A transmissão é ao vivo e o acesso é gratuito pela plataforma noomis Actuall Convention Hotel Anhembi - Centro de eventos ATI - Agência Estadual de Tecnologia da Informação AUDIO Auditório Ruy Barbosa Auditório Uninove - Campos Vergueiro Avenida das Nações Unidas, 12551 Caesars Place Las Vegas Câmara Municipal de São Paulo Carapina Centro de Eventos ccc Centro Centro de Convenções de Bogotá Gonzalo Jiménez de Quesada Centro de Convenções do Amazonas - CCA Vasco...
The Future of Privacy - Why Using and Protecting Personal Data Is a Vital Business Imperative
While some have expressed that privacy is dead in the era of big data, data leaders I recently spoke with about the future of privacy believe there’s nothing further from the truth By Bernard Marr In our discussion, Aoife Sexton, Chief Privacy Officer of Truata; Caroline Carruthers, Chief Executive of Carruthers and Jackson and co-author of The Chief Data Officer’s Playbook and Data Driven Business Transformation; and Roberto Maranca, Data Excellence Vice President of Schneider Electric...
Safe handling of digital identities: 5 key questions.
During the coronavirus crisis, the subject of digital identities has come to the forefront By Jordan Van Den Akker Jordan Van Den Akker – Business Security Consultant from AET Europe On one hand, increased homeworking has meant we need to communicate digitally on a whole new level while still maintaining security and privacy. On the other hand, track and trace systems aim to use digital identities to follow society’s movements in unprecedented ways. But what are digital identities?
Privacy By Design: Responding To The EU-US Privacy Shield Ruling
Last week, the EU Court of Justice struck down the EU-US Privacy Shield agreement This agreement was the mechanism under which US companies were able to process and use privacy-related data since a similar ruling in 2015 with respect to the old Safe Harbor mechanism.
17-Year-Old Critical 'Wormable' RCE Vulnerability Impacts Windows DNS Servers | CRYPTOID
Cybersecurity researchers today disclosed a new highly critical “wormable” vulnerability—carrying a severity score of 10 out of 10 on the CVSS scale—affecting Windows Server versions 2003 to 2019 The 17-year-old remote code execution flaw (CVE-2020-1350), dubbed ‘SigRed’ by Check Point, could allow an unauthenticated, remote attacker to gain domain administrator privileges over targeted servers and seize complete control of an organization’s IT infrastructure.
Performance Improvements via Formally-Verified Cryptography in Firefox
Blockchain Cibersegurança Destaques International News Notícias 07/07/2020 Spotlight Cryptographic primitives, while extremely complex and difficult to implement, audit, and validate, are critical for security on the web To ensure that NSS (Network Security Services, the cryptography library behind Firefox) abides by Mozilla’s principle of user security being fundamental, we’ve been working with Project Everest and the HACL* team to bring formally-verified cryptography into Firefox.
The Smart Cities Of The Future: 5 Ways Technology Is Transforming Our Cities
Cibersegurança Destaques International News Mercado Notícias 02/07/2020 Spotlight How smart is your home? If it’s anything like mine, it’s a heck of a lot smarter than it was 10 or even five years ago By Bernard Marr Bernard Marr – Strategic business & technology advisor to governments and companies That’s because our homes are now stocked with intelligent devices, like smart thermostats, smart speakers, and smart lightbulbs. But the trend for intelligent spaces extends far beyond our homes.
Maximum SSL/TLS Certificate Validity is Now One Year. By Patrick Nohe
Assinatura Eletrônica e Digital CERTIFICADO DIGITAL Destaques International News Notícias Proteção de dados TLS e SSL 01/07/2020 Spotlight Starting on September 1st, SSL/TLS certificates cannot be issued for longer than 13 months (397 days).
Two Critical Flaws in Zoom Could've Let Attackers Hack Systems via Chat | CRYPTOID
Blockchain Cibersegurança Destaques Eventos Notícias Pesquisas e Estudos 05/06/2020 Spotlight If you’re using Zoom—especially during this challenging time to cope with your schooling, business, or social engagement—make sure you are running the latest version of the widely popular video conferencing software on your Windows, macOS, or Linux computers No, it’s not about the arrival of the most-awaited “real” end-to-end encryption feature, which apparently, according to the latest news, would...
How Digital Identity and Biometric Technology Are Transforming Emerging Economies
Todos 1 Hotel South Beach 4–5 October 2022 ● Walter E.
Security Boulevard
It’s time for the CA/Browser Forum to focus on the other half of its mandate Let’s have a candid discussion about Extended Validation SSL. What’s working. What’s NOT. And what can be done to fix it so that all parties involved are satisfied. But first, let’s zoom out and talk big picture. The vast majority of website owners almost never think of SSL. They worry about it once every year or so when it needs to be replaced, but it’s not really a major point of consideration.
Security Boulevard
Ballot SC 22’s failure highlights the dysfunction at the CA/Browser Forum. For now, at least, SSL/TLS certificates will still have a maximum validity period of two years (or 27 months). The CA/Browser Forum ballot that sought to shorten the maximum lifespan of SSL/TLS certificates to one year failed when the voting ended yesterday afternoon. The final tally was 20 opposed, 18 in favor and two abstentions.
Security Boulevard
The story of how a scumbag named n1ghtm4r3 polluted our inbox with Bitcoin Phishing emails. Let’s have a little fun today and talk about some Bitcoin phishing emails that have been showing up in our inbox lately. They’re from a “hacker” who goes by the alias “n1ghtm4r3.” Before we get started, I need to warn you that there’s going to be some naughty language in this article. I didn’t use it, n1ghtm4r3 did. Not that I don’t use it. Just rarely on here.
Security Boulevard
A digital signature asserts identity and proves integrity – that’s never been more critical. Digital Signatures have become confusing. The concepts at play aren’t what’s confusing so much as the way digital signatures are described, marketed and regulated. That’s owing to the fact that digital signatures are so closely linked to electronic signatures and, as per usual, nobody can agree on the nomenclature. And of course there’s the patchwork of international laws that can make things even murkier.
Security Boulevard
As far as compliance goes, PCI DSS isn’t as onerous as it seems Compliance is, without a doubt, the biggest concern for most organizations when they’re handling their certificate and key management duties. Whether it’s PCI DSS compliance, GDPR, HIPAA or any other regulatory framework, non-compliance is anathema to most companies, it can result in lost trust and massive financial penalties. And frankly, if I had to guess I’d say that’s why compliance ranks so highly amongst enterprise concerns.
Security Boulevard
LinkedIn has become one of phishing’s biggest resources. As social media has evolved over the last decade and a half, LinkedIn has settled in as an integral part of the business community. It’s the platform “for professionals” and facilitates marketing, hiring and a whole range of other business. It’s terribly convenient. But there are perils associated with that convenience. One of them, in particular, is LinkedIn phishing.
Security Boulevard
The Equifax Settlement Website is easily spoofed, and it’s already happening. The Equifax Data Breach resulted in the credit bureau agreeing to a $650-700-million settlement. Those affected had a choice between free credit monitoring or a $125 payment. Unfortunately, the internet is full of cretins, some of whom have decided to re-target the victims of the Equifax data breach by creating phishing sites that dupe Equifax’s settlement page.
Security Boulevard
A planned CA/B Forum ballot would cap the max validity of SSL certificates at 397 days Stop me if you’ve heard this one before: the max validity for SSL/TLS certificates could be shortened in the near future. Once it was eight, then five, then three, then two. Now it could be one. In the coming days or weeks Google’s Ryan Sleevi that will cap the maximum validity for SSL/TLS certificates at just one year starting in March 2020.
Security Boulevard
Encryption backdoors are a terrible example, here’s a historical example to showcase why… On Tuesday, speaking at a cybersecurity conference in New York, US Attorney General William Barr paid homage to a long-standing international law enforcement tradition: making legal demands for the tech industry to break its own encryption. If you’re familiar with Hashed Out, you already know we’ve been extremely outspoken on this topic – it’s an awful idea.
Security Boulevard
How do you define phishing? The word “phishing” – despite its ubiquity – doesn’t really have a set definition. There is little to consensus on a phishing definition, either. It means many different things to many different organizations. We know this because we asked dozens of organizations how they define phishing.
Security Boulevard
TLS 1.3 has myriad improvements over its predecessors, including a new handshake and revamped cipher suites. Before anyone points out that the IETF published TLS 1.3 as RFC 8446 almost a year ago – we know. We covered that. But we realized we hadn’t done an in-depth explainer of the new protocol version yet, and given the number of questions we field about TLS 1.3 on a regular basis – we thought maybe this would be a good time. Technically, TLS 1.3 is the seventh iteration of the SSL/TLS protocol.
Security Boulevard
A powerful, new, one-stop solution for all your digital certificate and key management needs For the past decade The SSL Store™ has built its reputation as the premier SSL service in the world, working closely with some of the biggest names in the cybersecurity industry. Today, The SSL Store™ is proud to announce its newest technology partnership with ManageEngine, Zoho Corporation’s IT management products division.
Security Boulevard
All Twitter connections will require TLS 1.2 starting Monday On Monday, July 15, Twitter will drive another nail into the coffin of TLS 1.0 and TLS 1.1. The social media giant that serves as the world’s comments section will officially require all connections to use TLS 1.2 or higher starting next week. This move is part of a larger movement to deprecate the outdate versions of the TLS protocol.
Security Boulevard
Shadow IT + Digital Certificates = Ticking Timebomb When your employees use software or hardware at work that your IT or security team is unaware of – that’s Shadow IT. Calling the use of these tools “unsanctioned” might be a bit strong, but either way, employees have neglected to go through the proper channels and notify the right parties. There are risks associated with that.
Twitter will deprecate support for TLS 1.0, TLS 1.1 on July 15
All Twitter connections will require TLS 1.2 starting Monday On Monday, July 15, Twitter will drive another nail into the coffin of TLS 1.0 and TLS 1.1. The social media giant that serves as the world’s comments section will officially require all connections to use TLS 1.2 or higher starting next week. This move is part of a larger movement to deprecate the outdate versions of the TLS protocol.
Security Boulevard
Cyren reports finding over 5,334 unique phishing kits just this year Historically, phishing – like most cybercrimes – has had a technical barrier to entry. As in, you needed to have at least a moderate degree of sophistication in order to successfully mount a phishing campaign. Obviously not much. There’s no shortage of bad phish – I see two or three drop into my junk folder per day – but it still wasn’t something a layman could pull off. That is no longer the case.
Security Boulevard
An Independence Day look at encryption during the American Revolution Every now and then at Hashed Out we like to take a look at historical examples of encryption. So far we’ve covered the Babington Plot and Antoine Rossignol’s Great Cipher. Today, on the United States of America’s Independence Day, we’re looking back at another historical example of encryption: the Culper Spy Ring and the Culper Code Book. As you’re no doubt aware, encryption isn’t new at all.
Encryption helped win America's Revolutionary War
An Independence Day look at encryption during the American Revolution Every now and then at Hashed Out we like to take a look at historical examples of encryption. So far we’ve covered the Babington Plot and Antoine Rossignol’s Great Cipher. Today, on the United States of America’s Independence Day, we’re looking back at another historical example of encryption: the Culper Spy Ring and the Culper Code Book. As you’re no doubt aware, encryption isn’t new at all.
Security Boulevard
A new FireEye report shows a recent spike in URL-based HTTPS phishing attacks If you’re a regular reader of Hashed Out, you know that we have been sounding the alarm on HTTPS phishing for a couple of years now. Recently, the Anti-Phishing Working Group published a study that found 58% of all phishing websites are now served via HTTPS. Some reports put that number as high as 90%.
Security Boulevard
That end user SSL certificate is only one part of a certificate chain. Let’s talk about intermediate and root CA certificates for a few minutes. SSL (or more accurately, TLS) is a technology that most end users know little to nothing about. Even the people acquiring it typically don’t know much beyond the fact they need an SSL certificate, and they have to install it on their server to serve their website via HTTPS.
Security Boulevard
The American Medical Collections Agency’s parent company files for Chapter 11 bankruptcy. Let’s update you on a story we covered a few weeks ago: the American Medical Collections Agency’s data breach. At the time we opined that AMCA should be the one wearing this security gaffe – not just LabCorps and Quest. Now, just two weeks later, the AMCA’s parent company, Retrieval-Masters Creditors Bureau, is filling for Chapter 11 bankruptcy.
Security Boulevard
An honest discussion about whether it’s safe to use free VPNs Let’s talk about free VPNs. Typically, when we get asked about whether or not it’s safe or wise to use a free security product, it’s free SSL. And to be honest, we’re loathe to weigh in on that too heavily because as soon as we do someone accuses us of having a conflict of interest. But we really don’t have any skin in the VPN game, so we’ve got no problem discussing free VPNs and whether or not they can be trusted.
Security Boulevard
“Do not trust a website just because it has a lock icon or “https” in the browser address bar.” On Monday the FBI issued a public warning about the rise of HTTPS phishing. If you’re a regular reader here you know that’s something we talk about quite a bit. In fact, at this point it’s pretty much been talked to death. A few weeks back the Anti-Phishing Working Group issued a report that 58% of phishing websites they tracked in Q1 2019 used HTTPS. Some estimates hold that number as high as 90%.
Security Boulevard
Here are the best and worst phish we’ve seen lately – send us some of the best and worst you’ve seen! Unfortunately phishing has become so prevalent that most of us have grown sort of jaded. Case in point, we pass around phish at our office. It’s not uncommon to get an email from a coworker with a subject line like “check out teh pheesh” and a screenshot of a questionably worded request to change a password or some such nonsense.
Security Boulevard
According to Google’s Gary Illyes, you shouldn’t ignore the HTTPS ranking signal, either. Back in 2014, Google announced that HTTPS would become a ranking signal. In the five years since that announcement, the consensus seems to be that this signal has become less and less of an actual factor to the point that now it’s just a marketing claim. Turns out that’s wrong.
Report it Right: AMCA got hacked – Not Quest and LabCorp - Security Boulevard
This is just one more example of the way the media mucks up cybersecurity coverage Chances are, if you’ve had blood drawn in the US recently and didn’t pay your bills on time – your information has been compromised. Over the past couple of days both Quest Diagnostics and LabCorp, the two biggest US medical testing companies, have gone public with news of a third-party breach that will affect nearly 20 million customers (12-million for Quest, 7.7-million for LabCorp).
Security Boulevard
What happens when your SSL certificate expires? This. One of the most common questions we get asked is some variation on “what happens when your SSL certificate expires?” or “what happens if you don’t renew your SSL certificates on time?” The answer is death. Swift ignominious death. Ever wonder what happened to Jeeves? Now you know.
Security Boulevard
Automated Certificate Management Environments explained. The ACME (Automated Certificate Management Environment) protocol was originally developed by the Internet Security Research Group for its public CA, Let’s Encrypt. ACME is what facilitates Let’s Encrypt’s entire business model, allowing it to issue 90-day domain validated SSL certificates that can be renewed and replaced without website owners ever having to lift a finger.
Talking to your Boss about Cyber Security - 5 Helpful Tips
(3 votes, average: 4.67 out of 5) Loading... Talking to your Boss about Cyber Security – 5 Helpful Tips Learn to manage upwards and get your security needs met. One of the hardest things IT workers deal with is talking to your boss about Cyber Security. Maybe you report to a manager, a director or even the C-Suite itself. Regardless, this can be a struggle owing to the fact your boss probably doesn’t know, much less understand a lot of the concepts that you’re discussing.
The Healthcare Industry is lagging behind on Cybersecurity
(1 votes, average: 5.00 out of 5) Loading... The Healthcare Industry is lagging behind on Cybersecurity Healthcare ranked 15 out of 18 US industries in cybersecurity The Healthcare Industry is struggling to keep up with growing cybersecurity demands, per Security Scorecard in its 2018 report. This is especially troubling considering that Electronic protected health information (ePHI) is an extremely attractive target for hackers and cybercriminals.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Patrick
Contact Patrick, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack