Securosis Blog

Summary: Run Free

Rich · September 18, 2014

Last night I spent four hours without my iPhone. Four conscious hours, to be specific. It was wonderful.

I realize that may sound strange, but I bet the majority of you reading this nearly always have a phone within hearing range, if not actively grasped in your hand or stuffed in a pocket where you obsessively check it every now and then, when the slightest breeze triggers the vibration nerves in your upper thigh.

Incite 9/17/2014: Break the Cycle

Mike Rothman · September 17, 2014

The NFL has had a tough week. The Ray Rice stuff I mentioned last week. And uber-running-back Adrian Peterson deactivated on Sunday, due to a child abuse indictment. The stories are terrible, especially given that NFL players are explosive athletes and trained in violence. No kid or spouse has a chance in the face of an angry NFL player. And no, I’m not going to anywhere near Floyd Mayweather on this topic.

Secure Agile Development: Process Adjustments

Adrian Lane · September 17, 2014

This is the fourth installment of our Secure Agile Development research. Today’s post discusses one of the toughest parts of bringing security into an Agile program; process modification. The common waterfall development process has cleanly delineated phases, each of which provides an opportunity for security integration, and each security activity must be completed before moving on to the next phase. Agile includes whatever work gets done in the sprint – it does not bend to security so you…

Firestarter: Apple Pay

Rich · September 16, 2014

After a short break, the boys are back and here to talk about Apple. No, not the new wrist-mounted toy, but the first mobile payment system you might actually use. Or so says Rich’s Macworld editor, based on his article title.

Fix Something

Mike Rothman · September 15, 2014

Once again Wendy kills it with How to Help, saying things many of us probably think. Daily. It can get frustrating when all you hear is one person after another bitching about what’s wrong with security. And as she correctly points out, there are tools aplenty to tell you exactly how much work you have to do. But that doesn’t really help.

You read the series, now it’s time to download the collected works.

Okay, maybe you read the series of blog posts. And by “collected works” I mean “white paper”, but you get the idea.

Friday Summary: September 12, 2014

Adrian Lane · September 11, 2014

One day will be a business school case study how NFC went from handset (started with Nokia) to telcos to banks (HCE) and then to platforms

In the next couple posts we will break down our advice for adding security into Agile development. We will do this by considering the involved people, necessary processes, and technical integrations. Today’s post focuses on helping security professionals, first by outlining how Agile development works, and then by providing recommendation for how to work with development teams.

Incite 9/10/2014: Smile and Breathe

Mike Rothman · September 10, 2014

Last week I mentioned how excited I was for the NFL season to be starting. I took the Boy to the Falcons’ home opener and it was awesome. It was a great game, and coming away with a victory in overtime was icing on the cake. As predicted, my voice was a bit rough on Monday from screaming all day Sunday, but it was worth it. I don’t think my son will ever forget that game, and neither will I.

Secure Agile Development: Agile and Agile Trends

Adrian Lane · September 10, 2014

If you are a developer reading this series, you probably have a feel for what Agile development means. For those of you who don’t live it every day, or have read the exceedingly poor Wikipedia page on Agile software development, you are probably wondering what this is all about.