Around 18 months ago, a security researcher reported that he found a bug in VMDK descriptor that allows user to access all driver in a VMware hypervisor. Today VMware released another vulnerability “VMware ESXi and ESX unauthorized file access through vCenter Server and ESX, in their words “an unprivileged vCenter Server user with the privilege “Add …
VMware Virtual Machine file descriptors security Read More »
Recently, I have been involved in cloud security discussions in different occasion. As Christmas is coming, I think it is worth to repeat a point I made in 2005 via securityfocus.com mail list and still it is valid. It regarding BS7799 and its controls. “Without a Christmas tree, you can still have decorations but it …
Hong Kong going to have a new mobile payment venture, this time Jetco with Tradelink. Their platform is from a Israel company OTI which is endorsed by MasterCard. I have been following Tradelink for a few years. They are transforming from an commerce platform to a security and payment company. Well done. http://hk.finance.yahoo.com/news/貿易通-00536-hk-首推跨平台外置式流動電子錢包方案-將推廣至台灣澳門-081100918.html
The arm race on cyber security makes protecting Internet resources harder and harder. In the past, DDoS was mostly on Layer 3 and Layer 4 but reports from various sources identified Layer 7 DDoS is the prevalent threat. The slide below from Radware explains the changes in new DDoS trend. While protection on network traffic …
Layer 7 DDoS Attack : A Web Architect Perspective Read More »
The details about US NSA program Bullrun and SIGINT are now in public eyes. An atomic bomb is literally dropped. The real one dropped on Hiroshima forced Japan to end the war. This one is very different. The documents released only gave a high level overview of programs funded by US and UK government intelligence units. …
Without deviation from the norm, progress is not possible. –Frank Zappa As a risk management professional, assess risk from deviation and advice people is my daily job. However, deviation should be encouraged when it is not reckless and able to manage the outcome.
Cloud Computing industry is well developed in Singapore, so it is not a big surprise seeing MAS TRM guideline has a section only on Cloud Computing. Reading the document as whole, it seems MAS is accepting the fact that cloud computing is or will be part of financial industry development. Section 5.2 Cloud Computing is …
No caffeine is needed when you are in a meeting with intense, focus and organised discussion with cloud security professionals. We never get bored and cloud not stop your brain from working. Jet-lag is not a problem.
When capturing and storing technology are so cheap, it is tempting for Gov to store everything. In this case, car plate images. I guess car rental business has another marketing theme to explore! Soon we will see computer rental and mobile phone rental. When trust is gone, people are willing to try extreme measures. There …
Since Singapore MAS released the TRM guideline last month, I believe many people are studying them (including me). Big Four accounting firms are usually most active in publishing explanatory reports and article with a purpose to generate more business leads. However, a group of Vmware certified professionals are taking the lead this time. They worked …
VCPs technical analysis on the MAS Technology Risk Management guidelines. Read More »