Author, speaker
Areas of Expertise:
- IT strategy
- security strategy
- application security strategy
- ethical hacking
- cloud computing
- virtualization
- consulting
- speaking
- training
- writing
Biography
Books
|
|
Blog
Suddenly Psychic: Knowing Everything About Everyone
July 15 2008
During the next few months, I will be presenting a brand-new talk titled "Suddenly Psychic: Knowing Everything About Everyone" at various conferences around the world....Currently, this talk is scheduled debut at the Microsoft Blue Hat Conference [v8] in October, followed by Hack in the Box in Kuala Lumpur. read moreMay 14 2008
I let Apple know that I'd like to discuss the 2 issues they won't be fixing with the security community and they let me know they are fine with it. read moreAmazon's Elastic Compute Cloud [EC2]: Initial Thoughts on Security Implications
April 27 2008
Based on my recent experience with Amazon's EC2, here are some initial thoughts (with bias on security). read moreInterview With [IN]Secure Magazine
April 22 2008
Issue 16 of [IN]Secure Magazine is available. Mirko Zorz interviewed me in this edition (Page 41). If you decide to read it, I'd be delighted to hear your thoughts and feedback. The magazine edition of the interview is much better looking and highly recommended (as are the other articles), but… read moreBe Secure, and You'll be Compliant
April 16 2008
Don't let a requirement like PCI drive your overall strategy. Understand your goals and needs, aim to be secure, and you will be compliant. Try the formula the other way around, and your strategy will be flawed, your security budget won't be big enough, you will struggle to keep up… read moreApril 01 2008
I presented Bad Sushi: Beating Phishers at their Own Game (with Billy) at Blackhat Europe (Amsterdam) 2008 last week. I always enjoy doing this talk, and the feedback was quite positive. For more information, check out Nate's coverage of the conference... read moreThe iPhone SDK Press Conference
March 09 2008
Apple may have a difficult time auditing applications to ensure they meet their criteria. What is the absolute definition of malicious in the given context? Malicious to whom? The end user, Apple, or AT&T? Perhaps all of the above. Now, how does Apple go about obtaining assurance whether a given… read moreBlack Hat Briefings 2008 (Washington DC)
February 26 2008
I presented Bad Sushi: Beating Phishers at their Own Game with Billy Rios last week at the Black Hat Briefings in DC. The best part of the experience was the opportunity to talk to people in the audience after the presentation, and to hear their perspectives on the subject. read moreBad Sushi: Beating Phishers at their Own Game
January 28 2008
Help Net Security has posted an interview with me and Billy Rios titled Spies in the Phishing Underground. If you enjoyed the interview, and if you want more details and screen-shots, check out our talk at the Federal Black Hat Briefings 2008 [February 20]. The title of the talk is Bad… read moreWhat Have You Changed Your Mind About? Why?
January 20 2008
I think it is extremely important for an organization to account for the reality of doing business (Risk based approach compared to the purist mentality of securing everything) when strategizing an information security plan. It is true that an individual who has a habit of perceiving security issues as purely… read moreIllogical Arguments in the Name of Alan Turing
November 12 2007
The Halting Problem described by Alan Turing in 1936 states that is impossible to come up with a general algorithm that can compute if a given algorithm will terminate (for all possible input pairs). In other words, the only way to generally determine how a program will behave is to… read moreOctober 14 2007
I’ll be speaking at the hack.lu 2007 security conference in Luxembourg on October 20, 2007. My talk is titled Breaking and Securing Web Applications. The conference agenda is here. read moreYahoo! Susceptible to Cross Site Request Forgery (XSRF) Attacks
October 10 2007
Many organizations offer Mobile and WAP enabled flavors of their web applications. These applications may appear to have restricted functionality, but a security vulnerability in these applications can allow malicious users to launch attacks whose implications may propagate to the main applications. For example, a persistent XSS issue that may… read moreSeptember 25 2007
Issue 13 of [IN]Secure Magazine is now available. It contains my article: Social Engineering Social Networking Services: A LinkedIn Example (originally a blog post, but now with cool graphics). Download it here. read moreSocial Engineering Social Networking Services: A LinkedIn Example
August 28 2007
The term Identity Theft is usually assumed to be related to a malicious entity abusing someone’s credit information to commit financial fraud. This continues to be a big problem, but I’d like to extend the problem of identity theft in the social-networking aspects of so-called Web 2.0 applications. I feel… read more
