Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.

Category Archives: Information Security News

CISOs Are Like Sheep to the Slaughter

– It took almost 10 years, but my claim that the role of the CISO is to take the blame when something goes awry, even if only marginally attributable to information security, goes awry has at last been substantially validated. Let’s scroll back to December 2004. I was a member of a panel of…

Heartbleed Lessons – FST and Lab Certification

– There has been much written following the “discovery” of the Heartbleed bug that plagues OpenSSL … some informative, some constructive, some neither. Perhaps the most useful article to date is one published on April 18, 2014, which was written by Nicole Perlroth of The New York Times…

Heartbleed, Open Source, and Internet Security

– On page A5 of the April 24, 2014 issue of The Wall Street Journal, there is a full page “Paid Advertisement” with the title “Internet Security and Heartbleed.” The ad, which is in the form of a letter from Klaus Brandstätter, CEO of software company HOB, touts HOB-SSL as a replacement for…

My Heart-bleed[s] for Open Source and Monocultures

– To all supporters of ubiquitous open-source software … my sincere condolences. Who would have thought that the innocent mistake of a volunteer programmer trying to “improve” OpenSSL, and which was subsequently missed by a volunteer tester, would have led to what may turn out to have been…

Missed by NIST

– NIST (The National Institute of Standards and Technology) issued for comments a “Discussion Draft of the Preliminary Cybersecurity Framework” on August 28, 2013, available at www.nist.gov/itl/cyberframework.cfm The draft document is the result of the Presidential Executive Order (EO) on…