Securosis Blog

The Month of Kernel Bugs has released their latest vulnerability.

There’s also a Metasploit exploit module.

I’m not going to post every time one of these pops up, but hopefully this puts some of the wireless flaw debates to bed. *[Email:]: Email *[Twitter:]: Twitter *[Phone:]: Phone

Bad Math- No ROI for You

Rich · November 16, 2006

To follow up on metrics, Amrit pointed out in the comments that we can’t use totally imaginary numbers.

There’s some myth out there that assumes risk models can track directly to ROI models. I’ll save the full rant for later, but here’s a little math.

My work day had a bit of an unplanned interruption today. I shut down my computer to head from the home office to a nice quiet coffee shop for a change of scenery and a little time off the Internet to get some research done.

Guidance Software sells one of the best computer forensics tools on the market. Their largest client base is law enforcement and other types who perform investigations.

No Metrics, No Budget (or Paycheck)

Rich · November 15, 2006

Oh goodie- another religious security debate! We do love our religious arguments so.

This time it’s Amrit taking on Rothman over security metrics. Amrit likes them, Rothman doesn’t. Both of them are funny looking (sorry, it’s not germane to this post, but I figure people should know).

Thanks to an independent evaluation we now know that Firefox 2.0 is slightly better than IE 7 at detecting phishing sites. Firefox detected 243 sites missed by IE while IE “only” detected 117 sites missed by Firefox.

A while back I started to wonder if my phishing providers really cared about my business. They were getting seriously lazy- using generic “Your Online Bank” instead of a real bank name, no longer personalizing my emails, and using links practically entitled, “stealmyinfo.com”.

After posting our Top Six Hints for Safe Online Holiday Shopping, Chris Pepper notified me that Firefox 2.0 is not an automatic upgrade, and Firefox 1.5 doesn’t prompt you at all to download the new version.

A new wireless exploit was released today over at the Month of Kernel Bugs affecting the Broadcom wireless chip set (one of the most widely used in the industry).

The 100th Post, and a Note to My Editor

Rich Mogull · November 11, 2006

It’s hard to believe this little side project has hit 100 posts. We’re averaging 600+ unique visitors a day, which isn’t bad for a blog that’s only been around for three months, and even hit the front page of Digg once.