RealWorldCyberSecurity

Feb 7

Off-Topic: Book Review

The Little Brown Handbook, Thirteenth Edition — This is probably the most off-topic posting I will ever make. However, “I are an engineer,” and I need all the help I can get with grammar. And, I’ve found the perfect source in The Little Brown Handbook. Like most engineers, my writing generally sucks without editing help. (If you…

American English Grammar

3 min read

Jun 9, 2020

Microcode Patches Don’t “Fix” Your Processor

Your Processor Remains Exploitable — Intel recently released yet another microcode update to fix yet another speculative execution flaw in its processors. Ars Technica has a good writeup on the flaw if you’re interested in specifics. However, I’m not concerned with this particular flaw. …

Cybersecurity

2 min read

Microcode Patches Don’t “Fix” Your Processor

Apr 24, 2020

Ever Heard of MINIX? It’s The World’s Most Widely Used Operating System

Have an Intel Processor? Then you’re a user! — MINIX: It’s the world’s most widely used operating system and another security threat that you’ve never heard of! Like all operating systems, it has bugs. Only you can’t patch the bugs in MINIX! Introductory Note If you are not familiar with the Intel Management Engine, I would recommend you first read the…

Cybersecurity

9 min read

Ever Heard of MINIX? It’s The World’s Most Widely Used Operating System

Apr 22, 2020

Negative Rings in Intel Architecture: The Security Threats That You’ve Probably Never Heard Of

Not Actual Protection Rings, But Conceptual Privilege Levels Susceptible To Exploitation — Most likely, you’re aware of the hardware “protection rings” in Intel Architecture processors — the familiar “Ring 0” for the kernel through “Ring 3” for userland. But, have you ever heard of “rings” “minus one” through “minus three”? If not, you’re missing out on three entire levels of processor vulnerabilities.

Cybersecurity

18 min read

Negative Rings in Intel Architecture: The Security Threats You’ve Probably Never Heard Of

Apr 19, 2020

You Can Help Make The Internet Safer And Faster

A New Tool Detects If Your ISP Has Implemented Route Hijacking Mitigations — The Internet runs on a protocol called BGP, which determines how your data is routed from your ISP to its destination, such as Apple or Netflix. However, BGP, in its default configuration, is insecure and subject to hijacking attacks. There are mitigations for such attacks, but your ISP must explicitly…

Bgp

4 min read

You Can Help Make The Internet Safer And Faster

Apr 14, 2020

Defining Cybersecurity

If You Can’t Properly Define Cybersecurity, How Can You Know What It Is? — It’s clear that the cybersecurity industry hasn’t been able to agree upon what cybersecurity is and isn’t. Even NIST, who is responsible for the definition of technical terms used by the U.S. Federal Government, has four different definitions of cybersecurity! At a minimum, there are dozens of different definitions of…

Cybersecurity Definition

17 min read

Apr 11, 2020

You Call That A Security Requirement?

Proper Requirements Are The First Step To Verifiable Security — All too often, organizations lack any appropriate definition of their security requirements. And, the alleged requirements documents that do exist are most likely design specifications, not requirements specifications. Serious security breaches are unavoidable without a proper understanding of what is to be secured and why. …

Cybersecurity

16 min read

Apr 7, 2020

The First Question I Ask When Interviewing Someone For A Security Role

A Guide To Learning How Well A Candidate Understands Security — The first question I ask someone in an interview for a cybersecurity position is, “What type of cellphone do you use?” The candidate’s answer can provide a deep insight into their security mindset regarding the importance of patching in managing security vulnerabilities. …

Human Resources

18 min read

The First Question I Ask When Interviewing Someone For A Security Role

Apr 3, 2020

The Internet Is Not A Seven Layer Network

RFC1122 Specifies Only Four Layers in The Internet Protocol Stack — It is a common misperception that the Internet is based upon the ISO 7-Layer Model. It is not. It is based upon a software protocol stack defined in RFC1122 that has several differences from the ISO specification. Only Four Layers! The second question I always ask someone I’m interviewing for a network security…

Cybersecurity

3 min read

The Internet Is Not A Seven Layer Network

Apr 3, 2020

Real World Cyber Security

Blog Introduction and Index — Recent Updates 2020/04/27: Added a list of recommended Security RSS blogs and newsfeeds. 2020/04/28: Added a list of recommended Security mailing lists. Welcome to the Real World Cyber Security Blog! Einstein allegedly defined insanity as “doing the same thing over and over again and expecting different results.” Well, in information security and cybersecurity, we’ve sure been doing a lot of…

Cybersecurity

11 min read