The death of the SMS OTP

The National Institute of Standards recently issued a ruling on digital authentication that states SMS messaging as a second authentication factor should now be considered insecure. While sending an SMS for OTP is still better than having no additional authentication factors, the NIST ruling suggests that organizations wanting to raise the bar on their security standards consider more secure authentication methods.

You can read the rest of my white paper for Vasco (reg. req.) here.

Security Intelligence: Use a Malware Simulator to Better Defend Against Ransomware

If you are looking for ways to run a malware simulator to test ransomware and other forms of malware in your environment, but don’t want to deal with the actual materials to infect your systems, look no further than the Shinosec ShinoLocker suite. This is a malware simulator and target attacking suite for penetration testers and other researchers. I talk more about this innovative product in my post today for SecurityIntelligence blog.

WindowsITpro: Going beyond the password

We have a love/hate affair when it comes to using passwords. The average person has to remember dozens of them for various logins, and many of us try to cope by reusing our favorites. That just opens up all sorts of security issues: if a popular service (take your pick: Yahoo, LinkedIn, Dropbox, and many more sites all have been breached over the years) is compromised and millions of user names and passwords revealed, there is trouble ahead.

In this piece for WindowsITpro, I talk about the past, present and future of the lowly password.

iBoss blog: How Cyber-geddon Could Happen to Financial Networks


An article in the June Economist paints a dark picture of the aftermath of a fictional financial services hack. They start with some history and extrapolate based on current potential compromises to various networks. What is interesting about this piece is how cold and calculating they can be: “Processes designed to make banking safer have created new vulnerabilities: large amounts of money flow through certain key bits of infrastructure.”

What this means for the finserve industry and a more detailed description of their scenario can be found in my blog post for iBoss here.

Security Intelligence blog: The Increasing Dangers of Code Hooking

Security researchers discovered a series of implementations of an old type of exploit known as code hooking. These implementations are increasing and becoming more dangerous. Operating under the name of Captain Hook, these exploits make use of code injection techniques that could cause numerous vulnerabilities and potentially affect thousands of products.

I look at the process of code hooking and its relevance to your enterprise security in my latest post for the IBM blog Security Intelligence here.

iBoss blog: Wireless Keyboards are Vulnerable to Sniffing Attacks

One of the most vulnerable places across your enterprise (apart from the inner workings of your user’s brains, that is) can be keyboards. And recently, an innovative keylogger attack has been found by Bastille Networks that intercepts wireless keyboard transmissions. The attacker can be located up to 250 feet away from the computer and is a new twist on some old exploits. Out of 12 wireless keyboard manufacturer, the researchers found that eight (such as the one from Kensington, above) were susceptible to the attack. You can read more in my post for the iBoss blog here.