So the other day I get a call from the forensics team at work asking for help with some packet analysis. A client’s users had reported phishing activity, so they decided to run a full-content capture using Wireshark on the external and internal network interfaces. Upon doing so, they witnessed suspicious activity; commands such as […]

Taking care of business
Before I get into this post, I wanted to give you some updates on progress of other projects here at TS/SCI Security.
First off, I’ve been working on the OWASP Evaluation and Certification Criteria Project and hope to announce something very soon. Secondly, you’ll want to take a look at today’s post […]

Office collaboration services look like 1985
Microsoft Outlook and Exchange server have been the staple for office collaboration for over 10 years, with a model that has been around since Novell and Lotus in the mid-80’s. Collaboration services are clunky, bloaty, and every IT administrator and techie hates both of them with a serious passion. […]

An audit framework for evaluating structured security program frameworks
How many readers implemented a new security plan for 2006 or 2007? How many had clients that implemented a new security program? Which frameworks were involved?
Possible frameworks (Criteria)

No structured security program, or one based around a single vendor or regulation
Mike Rothman’s Pragmatic CSO (P-CSO)
Gunnar Peterson’s […]

I love wikis. I’ve been working on a security portal at work and it just got so much better with the addition of embedded RSS feeds. With this extension, I’ve embedded the Security Whitelist and Aggregated Vendor and Security News Sites pipes on the front page. This gives our team the ability to check the […]