Entries by Javvad Malik

The Queen Agrees

Around 2006 / 2007 I began blogging and tried to get into video blogging. Although I’d been working in information security for 7 years up to that point, I wasn’t well-connected in terms of what conferences ran, who the influencers were, or who the editors of any of the numerous security magazines or websites were. […]

Social, the final frontier

Social channels are an oft-overlooked area when it comes to information security. Social channels are left in the hands of marketing departments for customer engagement purposes. However, the adoption of social digital tools for the purposes of conducting business is widespread and largely unregulated, creating a major area of risk for organisations. If we look […]

The user awareness landscape

Overall, technologies can be pretty straightforward to secure. Teach software not to execute a certain command, block a port, or alert on a set of conditions, and it will abide. Humans, on the other hand are not as easy to harden against attacks. These attacks are frequently delivered through emails, text messages, social media, or […]

Security in the cloud

This video was prompted by discussions with someone that was adamant that they would never, never, everrrrr put their logs in the cloud. I enquired as to why they weren’t open to the option, and their response was that they don’t believe that sensitive information like logs should be in the cloud. Now that’s all […]

What is AlienVault

It’s coming up on my 3 year anniversary at AlienVault – and after a conversation with a friend, it dawned on me that I don’t think I’ve ever really explained what AlienVault does. So, when I was in Austin this last week I recruited some of my colleagues to help make this short video to […]

,

I think I’ve been hacked

A lot of individuals and companies of all sizes often use the phrase where they ‘think’ they’ve been hacked or breached, or had some form of unwanted event. There is usually a lack of conviction in this statement, and in hindsight it’s not easy to validate. Sure, one could use a service like haveibeenpwned.com to […]

Carphone Warehouse fined

via IFTTT After its 2015 breach, the Information Commissions Office (ICO) has released a very thorough report which highlights a number of deficiencies in Carphone Warehouse’s security. I’ve summed up some of the key points in dramatic fashion The report well worth a read: http://ift.tt/2AM6B7B

Uncybered

It dawned on me, that I’ve never written a browser extension before. And there are words IT Security articles continually overuse that I wish they wouldn’t. So, I combined both these together and wrote a chrome extension that would change commonly misused words to something a little more interesting. Examples: – IoT becomes ‘cheap connected […]

,

M&A Mania

2018 has kicked off with a flurry of M&A activity in the infosec space. There have been four that I’ve been aware of, Barracuda acquired Phishline Cyxtera acquired Immunity Inc Verizon acquired Niddel Threatcare acquired Savage Security I wonder how many more deals will be announced between now and RSA. Either way, it looks like […]

10 infosec conversation starters

I recently had my 17 anniversary… which is almost as long as I’ve been working in information security. Information security is great for communication, and communication is great for all relationships and friendships.

Exploiting browser password logins

The cool researchers over at freedom to tinker found two scripts that exploit browsers built in login managers to retrieve and exfiltrate ID’s. Below is the email I sent, and the reply from OnAudience     The script that OnAudience uses can be found here if you have time, check out this tweet thread between […]

Threatcare secures $1.4m seed funding

Threatcare has announced a $1.4m seed round led by Moonshots Capital and includes Flyover Capital and Firebrand Ventures. The Austin-based company was founded in 2014 by CEO Marcus Carey. Its flagship product, Violet, is a SaaS-based offering that enables continuous security validation through attack simulations. For many security departments, the question they are often faced […]

Meltdown

If everyone and their dog is talking about Meltdown and Spectre, then it would be negligent of me to not keep up with all the cool kids. Website for the vulnerabilities: Meltdown Attack Google Project Zero blog NCSC’s advice Linus Torvalds statement

Security Terminology

Work for long enough in one industry for any period of time and you end up speaking an entirely language altogether. This isn’t necessarily a bad thing, in many cases it’s convenient and allows rapid communication amongst peers. However, in Information security we need to be mindful when communicating with non security, or even non […]