Recent Posts

Securing administrative access with MFA

Securing administrative access with MFA

Now that multi factor authentication is gaining ground I thought I would write a simple guide on how to secure administrative access with MFA on Linux systems. The solution is simple and based on Google Authenticator. The good thing with Google Authenticator is that it's a typical TOTP/HOTP solution and as such does not require any internet connectivity on either the server or the client. The configuration examples provided are more or less appropriate for openSUSE Leap 15 and Ubuntu 18.04 LTS

To cyber-insure or not?

To cyber-insure or not?

Professional liability insurance has been around for long. It is not a surprise that Cyber Insurance is becoming a trend lately, considering the constantly raising number of security breaches. The post in one sentence: Cyber insurance is a good thing but be careful what you wish for.

When multi-factor will not save you

When multi-factor will not save you

There is a lot of discussion lately about multi-factor authentication and how this will upgrade everyone's security. Indeed, it is an improvement and it was about time we start becoming more conscious about the security issues related to authentication. As usually though, these discussions generated a lot of confusing and "why it didn't work" moments when we see cases such as Reddit's hack in August of 2018.

The problem with compromised software

The problem with compromised software

As everybody probably knows by now, CCleaner was compromised and malicious individuals added multi-stage malware payload on it. A typical case of compromised software if you ask me, pretty much like the one with the Ukrainian tax software that spread Not-Petya. But there is a different aspect to why compromised software is very dangerous, and it actually uses (believe it or not) social engineering in a more advanced way.

Biometrics vs Passwords

Biometrics vs Passwords

Biometrics is supposed to be the ultimate solution for access control. It is also supposed to be the best replacement for passwords, not only from the security perspective, but also from the user-friendliness perspective. People don't have to cope with the strange (and inefficient) password rules that security used to push down their throats. So all is wonderful, and we should all be using biometrics now, right?