The Coalfire Blog
Welcome to the Coalfire Blog, a resource covering the most important issues in IT security and compliance. You'll also find information on Coalfire's insights into the unique IT GRC issues that impact the industries we serve, including Retail, Financial Services, Healthcare, Higher Education, Software, Government and Utilities.
The Coalfire blog is written by the company's leadership team and our highly-credentialed security assessment experts. We look forward to your comments, so please join the conversation.
War on Passwords? Check with Your QSA First!
March 14, 2013, Matt Getzelman, PCI Practice Director
Passwords have long been the workhorse of user authentication schemes, and many security experts are speaking out on the need for more effective controls. It seems like hardly a week goes by when we don’t see a password breach in the news. Read More
Posted in: passwords, PCI, Risk, security | 0 Comments
Creative Ideas for Replacing Passwords
March 08, 2013, Mike Weber, Managing Director, Coalfire Labs
Passwords have been the de facto manner of providing security for IT systems. They’ve got a bad reputation, but it’s not the passwords themselves that deserve the reputation – it’s the individuals using them and the weak standards to which these passwords are managed. In fact, a password system implemented in a secure manner – long and complex passwords that change periodically – can be (virtually) uncrackable. However, a typical user isn’t apt to embrace a system that requires 15 characters or more (including numbers, upper and lower case, and special characters) and needs to change every two to four weeks. Read More
Posted in: forensics, Labs, password, security, test | 0 Comments
BYOD Survey Results: Employees are not playing it safe with company data
August 14, 2012, Mike Weber, Managing Director, Coalfire Labs
Employers are seeing a drastic increase in the number of employees using personal smartphones and tablets in the office. This “Bring Your Own Device” (BYOD) trend is causing headaches for the IT department and there is no stopping this trend. Due to the sensitive nature of company information often accessed on those devices, it has become a growing concern for small and large businesses alike. Read More
Posted in: byod, GRC, IT, mobile, security | 1 Comments
Moving to the Cloud: Considerations for Implementing Cloud Migration Plans
May 25, 2012, Kennet Westby, President and COO
Over 60 executive level attendees came to the Omni Interlocken Resort in Broomfield, Colorado for the National Council of Higer Education Loan Programs (NCHELP) Spring convention and to hear from a panel of cloud experts on how the migration to cloud IT services could impact their business in the future. Read More
Posted in: cloud, compliance, security | 0 Comments
The hackerproof password? Tips and advice on password management
May 02, 2012, Kennet Westby, President and COO
Having some security expert tell you that you should be creating strong passwords that are unique per account and change frequently is like your dentist telling you that you should floss morning, night and after consuming any dentally dangerous foods. The majority of us say, “yeah right”. The truth is that you really must do better than what the average person is doing today. In our penetration testing and forensics practices we constantly discover, usually very intelligent, people using the same weak password or PIN across every account without ever changing them. Read More
Posted in: forensics, password, security | 0 Comments