Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Uri Kreisman
How We Can Secure The Energy Grid and the Smart Home Of The Future
by Uri Kreisman, COO, Bluechip Systems On August 15th, 2012, the Saudi Arabian group Saudi Aramco suffered a malware attack called “Shamoon” that damaged about thirty thousand computers. The state-owned group runs the entire nation’s oil production, and the attack sent the nation’s entire economy into disarray. In total, eighty-five percent of Saudi Aramco’s hardware was compromised. Shamoon highlights how a cyber attack on an energy entity could cripple an entire nation.
What Federal Mobile Security is Missing
Leading U.S. intelligence agencies recently issued a warning to Americans to not buy Chinese-made smartphones. Companies like Huawei and ZTE are known to have close ties to the Chinese government, and U.S. agencies appear to have reason to suspect these companies of cyber espionage. Recent developments show increasing the determination of foreign powers to disrupt as much as possible the U.S. political, military and social systems.
SSD Advisory – CloudMe Unauthenticated Remote Buffer Overflow - Security Boulevard
The following advisory describes one (1) vulnerability found in CloudMe. CloudMe is “a file storage service operated by CloudMe AB that offers cloud storage, file synchronization and client software.
Weekly Cyber Risk Roundup: Cryptocurrency Attacks and a Major Cybercriminal Indictment - Security Boulevard
Cryptocurrency continued to make headlines this past week for a variety of cybercrime-related activities. For starters, researchers discovered a new cryptocurrency miner, dubbed ADB.Miner, that infected nearly 7,000 Android devices such as smartphones, televisions, and tablets over a several-day period. The researchers said the malware uses the ADB debug interface on port 5555 to spread and that it has Mirai code within its scanning module.
The Joy of Tech®, 'Liftoff!' - Security Boulevard
Click to email this to a friend (Opens in new window)
Security Mindset: Balancing Firmness and Flexibility - Security Boulevard
Navigating the noise, complexity and uncertainties of the cybersecurity landscape demands clear thinking. But that’s no easy task. The security professional today has to be knowledgeable about the organization’s own environment, business needs and risks, compliance requirements, best practice frameworks, internal policies and procedures, and the crowded market of product vendors and service providers.
NDC Security 2018, Zoë Rose's 'Hear no evil, See no evil, Code no evil();' - Security Boulevard
Home » Cybersecurity » Events » NDC Security 2018, Zoë Rose’s ‘Hear no evil, See no evil, Code no evil();’ NDC Security 2018, Zoë Rose’s ‘Hear no evil, See no evil, Code no evil();’
How Plant Operators Can Overcome the Language Barrier to Securing OT Environments - Security Boulevard
Securing industrial operations is a unique challenge. The same approach used to secure information technology (IT) networks can’t effectively secure plant floors. That’s because operational technology (OT) has evolved tremendously over the years, creating very complex environments consisting of a dizzying variety of devices from different makes, models and generations communicating through different protocols.
SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities - Security Boulevard
Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in Cisco RV132W Wireless N VPN version 1.0.1.8 The Cisco RV132W Wireless-N ADSL2+ VPN Router is “easy to use, set up, and deploy.
Black Hills Information Security, 'Cubicles and Compromises' - Security Boulevard
Home » Security Bloggers Network » Black Hills Information Security, ‘Cubicles and Compromises’ Black Hills Information Security, ‘Cubicles and Compromises’
3 unique and unusual Valentine’s gift ideas to make digital hearts sing - Security Boulevard
If you are having a hard time thinking beyond a dozen roses and a box of chocolates for February 14th, we’re here to help. Sure, those classic gifts can still bring a smile and a swoon, but chocolates disappear within a few hours (reappearing on our waistlines), and roses don’t last long enough to justify how expensive they are this time of year.
J4vv4D & Space Rogue's 'How To Be A Infosec Thought Leader' - Security Boulevard
Home » Cybersecurity » Humor » J4vv4D & Space Rogue’s ‘How To Be A Infosec Thought Leader’ J4vv4D & Space Rogue’s ‘How To Be A Infosec Thought Leader’
XKCD, The History of Unicode - Security Boulevard
Click to email this to a friend (Opens in new window)
Black Hills Information Security, 'A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems' - Security Boulevard
Home » Blockchain » Digital Currency » Black Hills Information Security, ‘A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems’ Black Hills Information Security, ‘A Look Into Emerging Security Issues Within Cryptocurrency Ecosystems’
Lenovo Warns ThinkPads Vulnerable to Wi-Fi Flaws - Security Boulevard
Lenovo has warned customers that 24 models of its ThinkPad laptops, which are popular with business users, are affected by two critical vulnerabilities in Broadcom wireless controllers. The flaws, tracked as CVE-2017-11120 and CVE-2017-11121, were discovered last year by researchers from Google’s Project Zero and were patched in both Android and iOS devices in September. The vulnerabilities can be exploited remotely by unauthenticated users to achieve remote code execution on devices.
CRISC Domain 4: Risk and Control Monitoring and Reporting - Security Boulevard
Home » Security Bloggers Network » CRISC Domain 4: Risk and Control Monitoring and Reporting CRISC Domain 4: Risk and Control Monitoring and Reporting What is Risk and Control Monitoring and Reporting? Risk monitoring and control are two elements that are responsible for keeping track of identified risks, residual risks, and new and emerging risks…. Go on to the site to read the full article Related This is a Security Bloggers Network syndicated blog post authored by Graeme Messina.
CRISC Domain 3: Risk Response and Mitigation - Security Boulevard
Home » Security Bloggers Network » CRISC Domain 3: Risk Response and Mitigation CRISC Domain 3: Risk Response and Mitigation What is Risk Response and Mitigation? In order to understand Risk Response and Mitigation, we first need to separate the two definitions and define them properly. The two work together hand in hand,… Go on to the site to read the full article Related This is a Security Bloggers Network syndicated blog post authored by Graeme Messina.
Apple’s iOS source code leak – what you need to know - Security Boulevard
Earlier this week someone anonymously published a key piece of Apple’s iOS source code onto GitHub. Which bit of iOS was it? It was an integral part of iOS known as “iBoot” – the section of code which controls the security of your iPhone or iPad as it starts up. So it’s an important part of iOS? Very important and highly sensitive. The secure boot firmware ensures that iOS will only run apps digitally signed by Apple, and checks that the operating system has not been tampered with by a hacker.
Incident Responder Career Roadmap: From Entry Level to Executive - Security Boulevard
Home » Security Bloggers Network » Incident Responder Career Roadmap: From Entry Level to Executive Incident Responder Career Roadmap: From Entry Level to Executive Introduction Finding a career as an incident responder has never been more possible than it is today. Practically every medium- to large-sized company should have either an in-house dedicated team of… Go on to the site to read the full article Related This is a Security Bloggers Network syndicated blog post authored by Graeme Messina.
Daniel Stori's 'My Adorable, Useless Code' - Security Boulevard
Home » Cybersecurity » DevOps » Daniel Stori’s ‘My Adorable, Useless Code’ Daniel Stori’s ‘My Adorable, Useless Code’
TCG TSS 2.0 Enhanced System API (ESAPI) Specification - Security Boulevard
The following TSS Work Group specification has been posted for public review. This document is a preliminary draft. It is for use in comment only and is subject to change without notice. Any comments regarding this specification may be submitted to TCG Administration at admin@trustedcomputinggroup.org. Revision Under Public Review: This is a Security Bloggers Network syndicated blog post authored by TCG Admin. Read the original post at: Trusted Computing Group
Calling Squid "Calamari" Makes It More Appetizing - Security Boulevard
Home » Security Bloggers Network » Calling Squid "Calamari" Makes It More Appetizing Calling Squid "Calamari" Makes It More Appetizing Research shows that what a food is called affects how we think about it. Research paper. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here. Related This is a Security Bloggers Network syndicated blog post authored by Bruce Schneier.
How to Perform Qualitative & Quantitative Security Risk Analysis - Security Boulevard
Home » Security Bloggers Network » How to Perform Qualitative & Quantitative Security Risk Analysis How to Perform Qualitative & Quantitative Security Risk Analysis This article describes two type of risk analysis (quantitative and qualitative) and presents five practical examples of calculating annualized loss expectancy (ALE).
Bank robbers 2.0: digital thievery and stolen cryptocoins - Security Boulevard
Imagine running down the street (and away from law enforcement) with 2,000 pounds of gold bars. Or 1,450 pounds in $100 bills. With both of these physical currencies amounting to roughly US$64 million, you’d be making quite a steal…if you could get away with it. That’s exactly what the next generation of thieves—bank robbers 2.0—did in December 2017, when they stole more than $60 million in Bitcoin* from the mining marketplace NiceHash. It turns out stealing Bitcoin is a lot less taxing on the body.
Parity Technologies engages Trail of Bits - Security Boulevard
We’re helping Parity Technologies secure their Ethereum client. We’ll begin by auditing their codebase, and look forward to publishing results and the knowledge we gained in the future. Parity Technologies combines cryptography, cellular systems, peer-to-peer technology and decentralized consensus to solve the problems that have gone unaddressed by conventional server-client architecture.
Simplifying PCI DSS 3.2 Compliance with Preempt - Security Boulevard
If your organization handles credit cards, you are no doubt familiar with Payment Card Industry Data Security Standard (PCI DSS) compliance. PCI DSS is a set of requirements and procedures that have been established in order to strengthen security of cardholder transactions and data in order to reduce fraud. PCI DSS controls have been implemented for many years but as hackers have advanced their efforts, new requirements continue to emerge with updates to existing controls and reporting.
Automation is a dish best served precisely, no? - Security Boulevard
Automation is a dish best served precisely, no? I discuss in my latest DarkReading piece: https://www.darkreading.com/operations/20-signs-you-need-to-introduce-automation-into-security-ops/a/d-id/1331005 . In the piece, I offer different pinpointed areas within security operations where it may make sense to introduce automation. This is in contrast to how some approach automation, which is to settle on an automation solution and then go looking for a problem to solve with it.
2018 Cyber Security Trends: Where are We Headed This Year? - Security Boulevard
We’re only a month into 2018 and we’ve already seen a flurry of security incidents. Meltdown and Spectre grabbed headlines early, bringing attention to a serious design flaw in Intel processor chips. Ransomware breaches that hit Allscripts and Hancock Health were born from the SamSam variant, which has only gained strength as a major threat across all sectors. What else is in store for 2018? Here are the trends you should expect to shape the industry this year.
Cryakl Ransomware Decryption Keys Released by Belgian Federal Police - Security Boulevard
The Belgian federal police has released free decryption keys for Cryakl ransomware following an international law enforcement operation. On 9 February, the European Union Agency for Law Enforcement Cooperation (Europol) announced the release of the keys through No More Ransom. The move represents the culmination of an investigation that involved Belgian police, the Dutch National Police, and internet security companies.
Strong, streamlined and secure: How to get the most out of centralized key management - Security Boulevard
With organizations around the world now deploying ever-increasing amounts of encryption solutions in an effort to ward off cybercrime, businesses are facing a combination of challenges. Whether it’s varying protection levels, differing operational techniques and policies, or juggling multiple keys, managing more than one encryption system can quickly turn into a complex web that demands time, expertise and money to manage effectively.
WhatsApp tests viability of digital payment feature in India - Security Boulevard
After working on its development since last year, WhatsApp has introduced a beta version of its digital payment feature on Android and iOS in India. The network’s peer-to-peer payment specification will be available to an exclusive group of testers and, if all goes well, it will be released for wide adoption in India. The company hasn’t said whether it will expand the feature to Europe or North America. WhatsApp is the preferred communication network, with some 200 million daily users.
Quantum Skepticism - Security Boulevard
Quantum computing gives us a way in theory to quickly crack certain types of cryptography. Well-funded startups are working on prototype quantum circuits, as are big guns like Intel, Microsoft, and IBM. Success could render a lot of today’s encryption obsolete. In theory. Academic and industrial research labs have built basic quantum circuits. If Moore’s … Continue reading Quantum Skepticism ? This is a Security Bloggers Network syndicated blog post authored by cryptosmith.
NEWS WRAP-UP: Meltdown, Spectre discovered in the wild – live hardware attacks one step closer - Security Boulevard
Week ending Feb. 9, 2018. We’re now one step closer to witnessing cyber criminals exploiting a new class of vulnerability that exists in the hardware level of virtually every computing device in active use. Nearly 140 samples of malware that exploit the Meltdown and Spectre vulnerabilities have been discovered by AV-TEST. Most of these are on existing proof-of-concept code, which is probably originating with white hat researchers.
New ‘UDPoS’ Malware Exfiltrates Credit Card Details via DNS Server - Security Boulevard
Researchers have identified a new strain of point-of-sale (PoS) malware that impersonates a LogMeIn service pack to steal credit card data via a DNS server. According to security firm Forcepoint, the malware – dubbed “UDPoS” – is unusual in that it generates a large amount of UDP-based DNS traffic to exfiltrate magnetic strip payment card details.
5 Steps to Conducting an Enterprise Security Risk Analysis - Security Boulevard
Home » Cybersecurity » CISO Suite » 5 Steps to Conducting an Enterprise Security Risk Analysis 5 Steps to Conducting an Enterprise Security Risk Analysis In the world of cybersecurity, identifying risks and how they will impact the organization is of paramount importance.
Is there a SaaS Alternative to Active Directory®? - Security Boulevard
Microsoft® Active Directory® (AD) is one of the most popular IT management tools on the planet. Arguably, Microsoft has more market share with AD than with any other solution that they sell. As IT organizations make the shift to the cloud, the question becomes whether there is a SaaS alternative to Active Directory. The short answer is yes. There is a next generation cloud-based directory service that is an alternative to the on-prem AD solution, and it’s called JumpCloud® Directory-as-a-Service®.
Netsparker's Weekly Security Roundup 2018 – Week 05 - Security Boulevard
What do Joomla!, Typo3, MediaWiki and Matomo (formerly known as Piwik) have in common? Aside from the fact that all of them are popular, open source PHP projects with a large number of users, there is one similarity that you will only notice if you try to install the projects yourself, or if you look at their github accounts. As you might have noticed, each project repository contains a composer.json file. What does it do?
Living in a Smart Home - Security Boulevard
In “The House that spied on Me,” Kashmir Hill outfits her home to be as “smart” as possible and writes about the results. This is a Security Bloggers Network syndicated blog post authored by Bruce Schneier. Read the original post at: Schneier on Security
The Road for Cybersecurity in 2018 - Security Boulevard
Every year, global investment in cybersecurity increases and pretty much so does investment in cyber startups. And so the inevitable question arises: Are we approaching or already in a cybersecurity bubble, fueled in part by venture capitalists? The quick answer is yes and no. According to Gartner Inc. worldwide spending on cybersecurity exceeded $86 billion in 2017, an increase of 7%, and will grow to $96 billion in 2018, an increase of 8%.
Meet InfoSec Institute at HIMSS18 - Security Boulevard
Home » Cybersecurity » Careers » Meet InfoSec Institute at HIMSS18 Meet InfoSec Institute at HIMSS18 The InfoSec Institute team will be at HIMSS18 on March 6-8. Come find us in the Cybersecurity Command Center at booth #8600-47 to learn how our award-winning training services will help you secure… Go on to the site to read the full article Related This is a Security Bloggers Network syndicated blog post authored by Megan Sawle. Read the original post at: InfoSec Resources
Micron's IP was Stolen and The Company Wants It Back - Security Boulevard
In a sequence of events we don’t see with regularity, a U.S. company’s intellectual property (IP) is being protected by the laws and courts of another country. This is exactly what Boise, Idaho-based Micron Technology is experiencing in Taiwan, Republic of China, where three of United Microelectronics Corporation (UMC) employees were indicted for the alleged theft of Micron’s trade secrets, specifically the DRAM chip manufacturing technologies.
BlueHat IL 2018, Jordan Rabet's 'Browser Security Beyond Sandboxing' - Security Boulevard
Home » Cybersecurity » Events » BlueHat IL 2018, Jordan Rabet’s ‘Browser Security Beyond Sandboxing’ BlueHat IL 2018, Jordan Rabet’s ‘Browser Security Beyond Sandboxing’
Cyber News Rundown: Scarab Ransomware Strikes Back - Security Boulevard
The Cyber News Rundown brings you the latest happenings in cybersecurity news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst and a guy with a passion for all things security. Any questions? Just ask. With a few interesting changes to the original Scarab ransomware, Scarabey is quickly targeting Russian-speaking users with brute force attacks on unsecured RDP connections, rather than with the spam email campaigns used by its predecessor.
Alert the Media: NIST Ponders Blockhain - Security Boulevard
via George V. Hulme, writing at DXC.Technology, comes a superlative blog post targeting Blockchain, and it’s meteoric rise to the top of the bright and shiny things list (at least for those interested in such baubles…). At any rate, George’s fine article details the National Institute of Science and Technolgy’s (NIST) take on that rise. Today’s Must Read. This is a Security Bloggers Network syndicated blog post authored by Marc Handelman. Read the original post at: Infosecurity.US
Fraudsters made off with a record $17 billion worth of personal data in 2017 - Security Boulevard
Despite renewed efforts to combat the spread of identity fraud, businesses in 2017 saw fraudsters steal even more records compared to the previous year. Cybercriminals made off with a whopping $16.8 billion worth of personal data, according to researchers. A recent identity fraud study reveals that the number of victims increased by eight percent in the last year, reaching 16.7 million in 2017 – the highest recorded since the firm began measuring the phenomenon some 15 years ago.
Unpatched Vulnerability Exposes WordPress Sites to Denial-of-Service Attacks - Security Boulevard
Attackers can render many WordPress websites unresponsive by exploiting an unpatched vulnerability in core modules that loads JS and CSS files to improve performance. The issue stems from the “load” parameter in the load-styles.php and load-scripts.php modules that can be used to fetch an array of scripts when a page is loaded.
Intel Releases Microcode Spectre Patches for Skylake CPUs - Security Boulevard
Intel continues to release CPU microcode updates that include mitigation for the Spectre vulnerability announced in January. This week the company released fixes for several CPUs on the Skylake platform.
SSD Advisory – Multiple IoT Vendors – Multiple Vulnerabilities - Security Boulevard
Vulnerabilities summary The following advisory describes three (3) vulnerabilities found in the following vendors: Lorex StarVedia Eminent Kraun The vulnerabilities found: Hard-coded credentials Remote command injection (2) It is possible to chain the vulnerabilities and to achieve unauthenticated remote command execution.
Introducing CylancePROTECT® Home Edition Employee Purchase Option - Security Boulevard
Home » Security Bloggers Network » Introducing CylancePROTECT® Home Edition Employee Purchase Option Introducing CylancePROTECT® Home Edition Employee Purchase Option CylancePROTECT Home Edition, the first next-generation security product designed for consumers that uses artificial intelligence to protect employees and their personal Windows and Mac devices, is now is now available for individual purchase by employees of Cylance corporate customers.
4 tips for parents of the smartphone generation - Security Boulevard
Home » Cybersecurity » Mobile Security » 4 tips for parents of the smartphone generation 4 tips for parents of the smartphone generation Today’s children are known as “digital natives.” That is, they were born into a world where “phone” is short for “smartphone,” not “telephone,” and staring at screens is more necessity than luxury. But at what saturation point does phone usage get unhealthy? How much is too much?
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Uri
Contact Uri, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack