Feature Archive
Samples of our feature writing
Security through isolation
In an imperfect world, keeping yourself safe is often about damage limitation. Given that there’s no such thing as foolproof security, and the potential for compromise always exist, how do you reduce the amount of mayhem that malware or a hacking attack can do? One approach is to follow the example of the intelligence community – compartmentalisation. You keep each part of the system separate, so that a problem in one area cannot affect the others. And the technology that lets us do this is virtualisation.
Battle of the botnets
There is a continuous arms race between botnet operators and the whitehats – researchers, anti-malware companies and law enforcement organisations. The most visible manifestation of this conflict is the malware itself but there is a less obvious struggle going on for control of the infrastructure that supports the criminal activities of botnet operators. And as with malware, the way that botnet operators build and manage their infrastructures has become more sophisticated over the past few years.
Divide and conquer: the threats posed by hybrid apps and HTML5
The distinction between online and offline is becoming increasingly blurred. From Google Docs to iPhone apps, our interaction with the web has grown from simple browsing to complex interactions. There is a breed of hybrid applications that reside partly on your device – whether it's a PC or a smartphone – and partly on the net. Both application code and data may be split. But this raises some concerns over how you manage security in this schizophrenic environment.
The perils of sharing
Filesharing technologies, using Peer-to-Peer (P2P) networks, are shaping up to be one of the major threats of the coming year. They’re being exploited to spread and control malware and steal data. And attempts to limit or eliminate them could just drive the problem underground.
Fighting Forensics
Since crime began, the bad guys have tried to cover their tracks. For every advance in forensics and criminal detection, there has been a countermeasure. When fingerprinting was invented, burglars started wearing gloves. When hackers gain root on a remote system, they take care to delete log files to mask what they’ve done. And as IT forensics methods have improved, so have the anti-forensics techniques designed to defeat them.
Going over to the dark side
Darknets exploit the infrastructure of the Internet but stand apart from it. They use non-standard protocols and ports to create secure networks for groups of all kinds, from dissidents to illegal fire sharers, and from terrorists to anti-terrorists.
Multinational security
What additional IT and information security issues do US companies face when they have operations in multiple territories?
A matter of trust
Code signing would seem to provide a means by which we can verify and trust software. Yet it is currently both limited and vulnerable. However, there are ways to improve it.
Hacking the hackers
It's tempting to turn the tools and techniques of hackers on the attackers themselves. But hacking back – so-called 'active defence' – leads you into a technical and legal minefield.
The promise of whitelisting
Application whitelisting promises greater security against malware through its 'default deny' concept. But the lack of standards and the complexities of IT environments means the benefits are not easily realised.
Google Hacking 101
Google provides penetration testers and hackers alike with a surprisingly powerful tool for discovering sites with poor security – and then attacking them.
Simple website footprinting
It's possible to build a fairly detailed picture of a website's structure and architecture using nothing more than basic tools that came with your operating system.
Dangers in the cloud
Cloud computing puts your data beyond your organisation's perimeter and the systems that secure it. How can you be sure your data is safe?
Anti-Social Networking
Social networking sites have created a security nightmare of user-supplied content, open APIs and heavy use of client-side code.
Open Source Security
Open source software still hasn't entirely shaken off its renegade image. Yet accusations of poor security might not just be wrong – they might be missing some very important benefits.
