Since I first published the free eBook "Improve your security" dedicated to end users, I've been asked many times to give advises for small and medium enterprises. At first, I thought that this is a very different topic than what I wrote before. However, after some thinking, I realized, that difference between the behavior of end-users at home and in the office of a small to medium companies, doesn't differ that much. After all, it is no secret that the cyber criminals are where the money are. If the targets are easy to breach, it is even better since this improves the ratio effort/outcome for them. Usually, small to medium size companies are preferred targets because they fit in this category: they do have money, more than the private users, and are very easy to infiltrate. The tips below help these companies not only to survive in the cyber world, but also keep the attackers away.   1. Make the employees understand and care about security. Teach them how to act and react. There are multiple aspects to the people problem: attitude and usability of security. First, is that the common attitude in companies: „security is IT department's business“. IT tries to…

I've been called a "security expert" many times and I've heard many times other people around me called the same. The reason I am writing this article is that I am frustrated by how some security experts are seing and implementing security in their every day jobs. But, let's start with the beginning: What does actually make someone a security expert? Or, when does someone become a security expert? The first thing that comes into my mind is, of course, his or her level of knowledge in this area. The more he knows, the better. I guess that things like certifications in IT Security, articles written, books published are counting. An important factor should also be some "on the field" experience (practical). But is it enough to just be able to get a job properly done? Getting the job done properly, is translating usually to "make the system as secure as it can be". We all know that this doesn't mean anything these days because anything you do it is only valid for a very short period of time. What about communication? It is not a secret that the biggest problem with IT security in companies is the fact that…

I've been asked a lot of times, especially when I was working for an antivirus producer, why can't we simply write a software that always protects the users. Well, there is a short answer and a long answer. Short answer: Because 100% security does not exist and because most people are hackable due to being ignorant on what security is (of course, until he/she is hacked first time, and sometimes not even after such an event). Long answer, which I massively shortened by not touching all areas and not going into details: The reason is the ignorance about everything that might happen but it is not certain that it will happen. I mean, would anyone close an insurance if it would have not been required by law or be afraid of the consequences?   By the way, you can use this article to convince your C-level people to pay for that expensive cyber security training for the entire company.   According to Webster.com, the definition of IGNORANCE is:   – a lack of knowledge, understanding, or education : the state of being ignorant [noncount] ignorance is bliss — used to say that a person who does not know about a problem does not worry…

The problem of Oracle is that they bought a technology that was stretched out to be actually “write once, run everywhere”. The Virtual Machine that provides this functionality had to be ported to all devices, and lately (in the past few years) also on mobile devices. As written in the news, even if the “run everywhere” meant initially “run on every platform” – so cross platform – this concept has been now extended to actually run on platforms used by mobile devices as well (ubiquitous computing). During the last years, Java evolved while it has been ported to the new platforms and devices. Each version of Java brought improvements and changes, sometimes not backward compatible. During this time, the applications that were created against a certain version of Java, for different reasons, were never updated to use the latest version. So, the users of these applications never upgraded their application and therefore they didn't have to update the Java version required by these programs.   The difference between updating and upgrading is a matter of interpretation by the implementer. Usually, the term update means to improve an existing version by fixing bugs or adding minor functionality. The main functionality, supported platforms and…

As security professionals, we are continuously facing the challenge of smaller and smaller budgets allocated to maintain and improve the IT security. That’s probably the main reason why there is always the temptation of “Free”. Many people, sometimes even professionals, think that they can achieve a good security for free. “For free” means in this context that some programs used to achieve and improve security don’t cost any money to acquire.  Unfortunately, the analysis of the costs stops at the acquisition and it ignores other costs like the installation and maintenance costs. But, is it possible to cover all the possible attack vectors with free security products? I made a short analysis of the most common ways used to endanger the IT security and if it is possible (to my best knowledge) to cover them with free tools. I am ignoring the social engineering techniques as they, most of the time, can’t be combated with tools. The security landscape changes continuously and you have to be fully protected against the most common attack vectors: infections through files carried on USB sticks, memory cards, mobile hard drives, downloaded files network attacks (spoofing, DOS) vulnerabilities that get exploited in common software drive-by…

One of the biggest problem that most IT security experts around the world have is the fact that IT security is never taken seriously until a security incident takes place. After that, management boards start being interested in IT security. However, these managers see security not through the eyes of an expert, but through the eyes of a business man. They need to measure, to plan and probably most important of all, they need to know the costs. An easier way to talk security with management is to define security as a manager. SMART is a mnemonic with many accepted meanings, but in this article it stands for: Specific, Measurable, Achievable, Relevant, Time-oriented. The term is coming originally from project management where it is used to set objectives (called Key Performance Indicators – KPIs) and to track them. For security specialists it is important to be able to set and track KPIs for the goals they want to achieve when evaluating, designing, implementing security solutions or when doing risk assessment. Presenting SMART goals to a management board can make security goals be easier to understand and … to approve. While on the first view these terms are overlapping, they are…

If you have read news lately, you couldn’t have missed hearing how well the tablets, smart phones and smart TVs are selling, and how badly the PC market (excluding laptops) is doing. Many so called “futurists” have predicted the passing of the PC era. But is it really gone? Is the Personal Computer really dead, or are these just marketing gags? Being curious, I asked some friends what they use for their “computing” activities and how they use their devices. First of all, it is important to clarify who are my friends and what they do. My circle of friends – and I am not talking about Google Plus’ circle, but people whom I meet in person almost every day – vary from seniors (70+) with little to no IT know-how, to professionals who use computers for their work (not directly IT-related) and IT professionals who are making a living with computers. The seniors have never held a tablet in their hands, but they know what one is. They all have PCs in their homes, connected to Internet, some of them even a laptop (with WiFi) as well as a PC. All of them use their PCs only for browsing,…