Digital security, hacks and threat analysis
The Worst Authentication System, Except for All the Others Passwords are terrible. Users reuse them across services. They’re stolen in data breaches (HaveIBeenPwned tracks over 13 billion compromised accounts). They’re…
The Attack Vector Nobody Was Watching Supply chain attacks — compromising trusted software to reach its users — have gone from exotic theoretical risk to the most dangerous threat vector…
The Death of the Perimeter For decades, cybersecurity operated on a castle-and-moat model: build a strong perimeter (firewalls, VPNs), and everything inside is trusted. The problem with this model was…
The Business Model That Shouldn’t Exist Ransomware has evolved from a crude extortion scheme into a sophisticated criminal enterprise with professional-grade software, customer support, affiliate programs, and revenue sharing. The…
Of the roughly 15 billion credentials circulating on the dark web, the overwhelming majority are passwords. Reused, weak and phishable passwords remain the primary attack vector for data breaches, accounting…
In December 2020, the cybersecurity firm FireEye disclosed that it had been breached. Within days, the investigation revealed something much larger: the attackers had compromised SolarWinds, a widely used IT…
For decades, the dominant security model was “castle and moat”: build a strong perimeter, and trust everything inside it. Firewalls, VPNs and network segmentation kept the bad actors out, and…
The Colonial Pipeline attack of May 2021, which shut down the largest fuel pipeline in the United States for five days and triggered a $4.4 million ransom payment, was a…
