You can't secure what you don't acknowledge.SM

Friday, February 8, 2008

My articles from this week

Here are my information security articles from this week that you may be interested in:

Get your SQL Server security goals in order

Security tools that limit user logons in Windows

For all of my past information security tips and tricks be sure to check out


Thursday, February 7, 2008

Be careful with old/backup files on your Web server

If you're running an ASP-based site on an IIS server (of course), check for any old or backup .asp files that have been renamed with a .old, .bak, or similar extension. If present, the pages won't be rendered and delivered as the original ASP files would be. Instead, the actual source code is revealed. Not good for business.

Oh, this could just as easily happen other platforms. I just had Microsoft on the brain and wanted to get this out there.

Wednesday, February 6, 2008

Be careful co-mingling passwords

With all things being electronic today and us having to manage a hundred different computer accounts between home and work, here's one of those 'haven't thought of before' security issues that can come back and bite hard when the opportunity arises.

First, have one set of common passwords you use for business purposes...You know - the account password(s) you use on the network, email, local computer, PGP, your HR portal - you name it. Sure, in an ideal world, we'd have separate passwords for every single account. That's not reality. All of us have re-used the same password on different least at some point.

Second, have another set of common passwords you use at home for things like, eBay, your personal email account, online banking, etc. When you're at home, at friend's houses, or just goofing off on vacation, you're likely to be using less secure systems and communications channels which increases the chances of password exposure.

Sure, it may be convenient to co-mingle work and personal passwords, but in the end it will only serve to increase the odds for an incident and exposure where you don't need it - either professionally or personally.

Most importantly - make it policy (I'd be next to impossible to enforce - but still) and then get the word out to your users. They're you're biggest vulnerability in all of this after all.

Tuesday, February 5, 2008

RSA during Spring Break! What were they thinking?

I just received my fancy conference booklet for RSA 2008. If you didn't get one, you'll likely start seeing/hearing more and more buzz leading up to the show that's scheduled for April 7-11 this year.

Since RSA's normally in February, I started thinking about this timeline and it hit me. That week happens to be Spring Break for the Atlanta metro area and likely a *lot* of the U.S. What were they thinking!?.

I can understand people wanting to get away on business - especially to this show. I even have an incentive myself since I can get in for free on a "press" pass. But missing my child's entire Spring Break over it...??

Maybe their motivation was for attendees to drag along the entire family to hang out in 'Frisco for a week ...Whew, not my (or my family's) idea of fun.

Maybe I'll see you on the beach instead!

Monday, February 4, 2008

Commonly overlooked safeguard for laptops

They're cheap and easy to use but lots of people don't think about them until it's too late. I'm talking about laptop locks like what the folks at office/computer stores and the folks at PC Guardian sell:

They're not 100% foolproof -nothing in security is. But they add an excellent layer of defense in public places, hotel rooms, your own office, and even the trunk of your car beyond what endpoint security and drive encryption can do to keep those precious laptops locked down. Much better to invest in these and require your employees to use them than end up on the Chronology of Data Breaches!