Martine van de Merwe

0 items

What Digital Leaders can learn from peers and utilize an incident

Last week’s uproar on the Microsoft Azures database (Cosmos bug) hit the boardroom. A lot of major companies use Microsoft Cloud, so Azure customers were in for a rough surprise. Wiz's Chief Technology Officer Ami Luttwak (his company found the vulnerability) describes it as “the worst cloud vulnerability you can imagine.” 

Bloomberg says Microsoft warned thousands of its cloud computing customers, including some of the world’s largest companies, that intruders could have the ability to read, change or even delete their main databases. In this blog, I don’t describe the incident or ‘chase the ambulance.’ I give my personal take on other industry experience and elaborate on what I would do if I were a Chief Information Security Officer of a global pharmaceutical company using Azure and if the CEO asks me “What the hack happened and what do we need to do?”..

By |september 6, 2021|0 Comments

Account takeover prevention: techniques and data quality

In recent years, credential stuffing attacks have been on the rise. Cyber criminals take over accounts with username and password combinations that were stolen at third parties.

The goal of Account TakeOver (‘ATO’) prevention services is to prevent unauthorized access to your accounts. There are several types of techniques that can be used to implement ATO prevention services. The characteristics of the techniques varies widely. Furthermore the data quality of an ATO prevention service has a great effect on the effectiveness and efficiency of the service. In this article we will take a closer look at both the used techniques and data quality.

By |januari 18, 2021|0 Comments

Is Digital Security a market for lemons?

Although information security has a long history, it wasn’t really top of mind of senior management, Board or other employees until late 2010s. A “security professional” became a real job and market demand has grown ever since. Awareness about security risks increased significantly. The thriving forces for this were major security breaches such as Snowden, NotPetja and WannaCry shocking the world, but also regulators demanding companies to protect their critical assets, including non-tangible ones such as data. As a result of this, we can now state it has the Boards attention by default. 

By |november 17, 2020|0 Comments

Why account takeover prevention is important to protect against credential stuffing

Every year thousands of data breaches occur, as we can read in the daily news. The root causes of the breaches range from organizational issues to technical flaws. A new category of attacks emerged a few years ago: ‘credential stuffing’. According to F5, ‘credential stuffing and brute force attacks have been the biggest threats for financial services recently, and the trend shows no sign of slowing’. According to Akamai, ‘hackers have targeted the gaming industry by carrying out 12 billion credential stuffing attacks against gaming websites within the 17-month period analyzed’. Nowadays credential stuffing attacks are considered among the top digital threats. But what exactly is credential stuffing?

By |oktober 2, 2020|0 Comments

Digital risks to business, what do they cost?

Analyzing Business Information Security for a data breach use case

In a digital business world that is highly distributed via an eco-system, ensuring your digital assurance becomes vital. Everything needs to continuously work and Confidentially, Integrity and Auditability have to be assured, especially when your business is regulated and should demonstrate to be “in control”. Nevertheless, how do we do that when business models are under fire by hackers?.. 

By |augustus 27, 2020|0 Comments

Bcrypt password cracking extremely slow? Not if you are using hundreds of FPGAs!

Cracking classic hashes

Moore’s law is the observation that the number of transistors in a dense integrated circuit doubles about every two years. This roughly doubles computing power about every two years as well. Password hashing algorithms typically have a lifetime of many decades. This means that the level of protection of a given password hash algorithm decreases over time: attackers can crack longer and more complex passwords in the same amount of time.

By |juni 10, 2020|0 Comments

Future Roles in Information Security

We want to feel safe in this brave (and scary) new world we’re creating of machines, robots and artificial intelligence. Technological & political trends will definitely influence our profession. This new world will call for new jobs with new skillsets that address the future challenges ahead.

By |februari 27, 2020|0 Comments

A great motivation letter in five steps

"Just write a short motivation letter regarding this conversation" is a sentence that I speak to cybersecurity professionals on a regular basis. Internal research at Cqure has shown that the motivation letter does not always have the desired result, while it is apparently a good piece of text. How is that actually possible? And why is good motivation letter so important?...

By |januari 1, 2020|0 Comments

Weg met IT-pubers

Weg met IT-pubers

Veel it-spelers vertonen onvolwassen gedrag en zijn allergisch voor normen en verantwoordelijkheid. Maar het speelveld verandert en wie zich niet aanpast, zou wel eens vlot buiten spel kunnen staan.

Minister Ferd Grapperhaus zegt in te willen grijpen als beveiliging op cruciale momenten tekortschiet. Wie werkt in industrieën als de evenementenbranche, de voedselindustrie, de zorg, de onderwijssector, de bouw, scheepvaart, luchtvaart, of landbouw is inmiddels wel gewend aan die rol van de overheid. Maar sommige it-leveranciers waarschuwen dat dit kan leiden tot het afvinken van lijstjes en ‘dat moeten we met z’n allen niet willen’. Liever komt iedereen met een eigen methodiek

Dergelijke uitspraken zijn erop gericht IT als voodoo-industrie overeind te houden. Stel je toch voor dat we anders slecht of niet ontworpen en geprogrammeerde software moeten gaan aanpakken, of netwerken goed moeten gaan ontwerpen, of bij beheer alle administraties kloppend moeten krijgen en andere basics op onze lijstjes moeten zetten. Bij veel beveiligingsincidenten zie ik dat wij keer op keer dezelfde fouten maken. Daarom geven goed doordachte lijstjes inzicht in risico’s en processen.

By |december 20, 2019|0 Comments

KQL Cheat Sheet

This week I released a cheat sheet for the Kusto Query Language (KQL), which you can find on my GitHub page: kql_cheat_sheet.pdf. When I started with KQL to analyse security events, the primary resources for me to get started were the official KQL documentation from Microsoft and the Pluralsight course from Robert Cain. Something was missing: a cheat sheet. So, I created one. I hope this cheat sheet will help others in using KQL. If you have additions or remarks, please contact me.

By |december 12, 2019|0 Comments
Ga naar de bovenkant