April

The latest in information security (in English and Dutch)

2014-04-23

• Arnoud Engelfriet (Security.nl): Juridische vraag - is een digitale handtekening rechtsgeldig?
• John Shier (Naked Security): PCI DSS - Why it works | PCI DSS - Why it fails

2014-04-22

• Robert Graham (Errata Security): Heartbleed: Pointer-arithmetic considered harmful

2014-04-21

• Jaap-Henk Hoepman: Securely using a single master password on all sites you visit

2014-04-17

• Nationaal Coördinator Terrorismebestrijding en Veiligheid (NCTV): Nationaal Respons Netwerk van start | Via

Earlier / undated

• Department of Justice and Federal Trade Commission: Antitrust policy statement on sharing of cybersecurity information [PDF] | Via
• Eli Dourado and Andrea Castillo (Mercatus Center): Why the Cybersecurity Framework will make us less secure [PDF] | Overview page with link to PDF | Via
• J.Honkoop en E.P. Tamminga (IT en Recht): Competentie van partijen en rol deskundige. Reactie op het artikel van J.L.G. Dietz. [PDF] | Via
• Verizon: 2014 Data Breach Investigations Report [PDF linked from this page] | Via

[Permalink]

The latest in information security (in English and Dutch)

2014-04-16

• Micha Schimmel (SOLV): De juridische gevolgen van Heartbleed

2014-04-15

• Arnoud Engelfriet (Ius Mentis): Mag ik mensen laten checken of hun OpenSSL aan Heartbleed lijdt?
• Dan Goodin (Ars Technica): Vicious Heartbleed bug bites millions of Android Phones, other devices | Via
• Paul Mutton (Netcraft): Revoke! The time is nigh! | Via
• Arvind Narayanan (Freedom to Tinker): Bitcoin hacks and thefts - The underlying reason
• Rijksoverheid.nl: Hackathon levert oplossingen voor fraudebestrijding op

2014-04-14

• ENISA: Heartbleed - A wake-up call [PDF linked from this page] | Related blog post
• Jan-Jaap Oerlemans (OerlemansBlog): Nóg een wet computercriminaliteit?

2014-04-11

• Joseph Bonneau (Freedom to Tinker): Heartbleed and passwords: don't panic

2014-04-10

• Jeremy Epstein (Freedom to Tinker): Heartsick about Heartbleed

Earlier / undated

• Bart Blaze (Blaze's Security Blog): Ransomware: a Q&A | Via
• Andreas Junestam and Nicolas Guigo (iSECpartners): Open crypto audit project - TrueCrypt - Security assessment [PDF] | IsTrueCryptAuditedYet? project site | Via
• Netwrix: 2014 State of IT changes survey results [PDF] | Via
• Rishab Nithyanand and Rob Johnson: The password allocation problem - Strategies for reusing passwords effectively [PDF] | Via

[Permalink]

The latest in information security (in English and Dutch)

2014-04-10

• Paul Ducklin (Naked Security): "Heartbleed heartache" - should you REALLY change all your passwords right away?
• David Grant (EFF): The bleeding hearts club - Heartbleed recovery for system administrators

2014-04-09

• Ed Felten (Freedom to Tinker): How to protect yourself from Heartbleed

2014-04-08

• Paul Ducklin (Naked Security): Anatomy of a data leakage bug - the OpenSSL "heartbleed" buffer overflow
• Brian Krebs (Krebs on Security): 'Heartbleed' bug exposes passwords, web site encryption keys
• Yan Zhu (EFF): Why the web needs perfect forward secrecy more than ever

2014-04-02

• U.S. Govrnment Accountability Office: Federal agencies need to enhance responses to data breaches [PDF linked from this page] | Via

Earlier / undated

• Cyber Security Coordination Group (CSCG): Recommendations for a strategy on European cyber security standardisation [PDF] | Press release | Via
• Stefan Frei, PhD and Bob Walder (NSS Labs): Why your data breach is my problem - The risks of relying on "private" information that cannot be kept private [PDF linked from this page] | Via
• Heartbleed.com: The Heartbleed bug | Related blog post by Graham Cluley | Via
• HM Government: Cyber essentials scheme - Requirements for basic technical protection from cyber attacks [PDF] | Via

[Permalink]

The latest in information security (in English and Dutch)

2014-04-02

• Kapersky Lab: Financial cyber threats in 2013. Part 1: phishing | Via

2014-03-31

• Ot van Daalen (Security.nl): Achtergrond - Eerste hulp bij datalekken

2014-03-27

• Dan Goodin (Ars Technica): Philips smart TVs wide open to Gmail cookie theft, other serious hacks | Via

2014-03-26

• Don Jackson (Phishlabs): New man-in-the-middle attacks leveraging rogue DNS| Via
• United States Senate, Committee on Commerce, Science and Transportation: A "kill chain" analysis of the 2013 Target data breach [PDF] | Via

2014-03-25

• Mark Hammell (Facebook): Understanding online threats with ThreatData | Via

2014-03-23

• Jaap-Henk Hoepman: Dus gebruikers van openbare WiFi netwerken zijn te hacken. Nou en?

2014-03-19

• Brian Krebs (Krebs on Security): Are credit monitoring services worth it? | Via

2014-03-18

• Imperva Data Security Blog: Threat advisory - PHP-CGI at your command | Via

2014-03-17

• Brian Krebs (Krebs on Security): The long tail of ColdFusion fail
• John Shier (Naked Security): Security essentials - What is PCI DSS?

2014-03-14

• Rijksoverheid.nl: Besluit Wob-verzoek over Nationaal Detectie en Response Netwerk [links naar PDF-documenten op pagina] | Via

2014-03-13

• Nate Cardozo, Parker Higgins and Kurt Opsahl (EFF): UPDATE - Encrypt the Web report - Who's doing what
• European Commission: [...] The [European Parliament] successfully votes through the Network & Information Security (NIS) directive | Proposal from the European Commission, PDF | Via
• Brian Krebs (Krebs on Security): Blogs of war - don't be cannon fodder

2014-03-11

• Bas Bosschert: Steal WhatsApp database (PoC) | Business Insider article | Via
• NVB: Fraude betalingsverkeer opnieuw flink gedaald['Geen cookies' modus] | Via

2014-03-07

• Dan Cvrcek (Light Blue Touch Paper): Hardware scrambling - no more password leaks
• Jaap-Henk Hoepman: What is the value of verifying public keys?

2014-03-06

• Kristian van Tuil (Webwereld): 'Rabobank traag met oplossen kwetsbaarheden'

Earlier / undated

• Lillian Ablon, Martin C. Libicki and Andrea A. Golay (RAND National Security Research Division, Juniper Networks): Markets voor cybercrime tools and stolen data - Hackers' Bazaar [PDF linked from this page] | Related blog post | Via
• Olivier Bilodeau, Pierre-Marc Bureau, Joan Calvet, Alexis Dorais-Joncas, Marc-Étienne M. Léveillé and Benjamin Vanheuverzwijn (WeLiveSecurity): Operation Windigo - The vivisection of a large Linux server-side credential stealing malware campaign [PDF] | Related blog post | Via
• Sander Degen, Arjen Holtzer, Borgert van der Kluit, Harm Schotanus (TNO) et al: Testing the security of IPv6 implementations [PDF] | Via
• Steven Goldfeder, Joseph Bonneau, Edward W. Felten, Joshua A. Kroll and Arvind Narayanan: Securing Bitcoin wallets via threshold signatures [PDF] | Related blog post
• Sven Zebel, Peter de Vries, Ellen Giebels, Margot Kuttschreuter en Wouter Stol (WODC): Jeugdige daderes van cybercrime in Nederland - Een empirische verkenning [link naar PDF op pagina] | Via

[Permalink]