I recently joined the Jericho Forum in London. The Jericho Forum is the leading international IT security thought-leadership association dedicated to advancing secure business in a global open-network environment. The members include top IT security officers from multi-national Fortune 500s & entrepreneurial user companies, major security vendors, government, & academics.
I've spent some time lately in discussions around Web Application Firewalls. WAFs seem to be a hot topic in recent times and with PCI DSS 6.6, many people are now starting to look at these technologies.
Though, with the PCI SSC council watering down the 6.6 requirement, I questioned here whether they were required at all under PCI DSS:
http://tinyurl.com/4rtkdf
(It just smells different!)
Anyone remember the Cypherpunk movement?
Those were the people who invented anonymous remailers, were the first to deploy PGP on a wider scale and were generally a crypto-political movement to establish cryptography (and privacy) in the then nascent public Internet.
(This one would almost be worth a separate category on IT Security Link, called "Politics".)
Adam Boileau's release of code to take ownership of a Windows system as reported in recent press is nothing new. He first released this 18 months ago at Ruxcon 2006 when working with Security-Assessment.com (Australia/Asia Pacific now known as Securus Global and NZ now owned by Datacraft).
So why the press now?
All hail the gods of security!! We bow at the altar of our security gods : Kerberos and his father Typhon, PKI, 2FA, 17799, 27001. But ALL must bow at the altar of the greatest of these gods, Compliance.
So let's get serious – what is compliance? Literally “compliance” (from dictionary.com) is :
1. the act of conforming, acquiescing, or yielding.
