Archive For: Access Control

#Spectre and #Meltdown – What do we do?

Seems like now about every 6 months or so every asks this same question about some new vulnerability.  The answer should be the same, do the same thing you should have been doing before this vulnerability came out. In an Assumed Breach model of security, these vulnerability would have already existed, and your other network ... Read More
 

Risk of using VNC in an Enterprise Environment

VNC is a protocol used by a number of products for remote viewing and control of devices.  I am also including services such as X11 in this discussion.  Ultimately, this includes any remote viewing software that is not native to an application that runs persistently on the end device. Identity Access Management Software like this, ... Read More
 

IaaS and the Shared Responsibility Model

  A note to vendors: Infrastructure as a Service (IaaS) != secure/compliant applications, it can, but doesn’t by default. Why are people putting their servers and applications in IaaS providers like AWS and Azure? They can get a cheap, fast and secured data center to host their servers/applications. But that doesn’t mean they get the ... Read More