Stories by Ian Paul

Online security: your two-factor authorization checklist

By Ian Paul | 24 April, 2013 23:36

Twitter reportedly is getting ready to roll out two-factor authentication in the coming weeks--a development that comes not a moment too soon as the company's current security efforts fall short.

Bush family email hacked: Here's a security refresher

By Ian Paul | 08 February, 2013 21:40

Thanks to an anonymous hacker self-identified as Guccifer, we now know that former President George W. Bush likes to paint self-portraits in the bath. That's one of the tidbits revealed when at least six email accounts belonging to Bush family members were hacked and their contents shared online. The high profile hack underscores, once again, the importance of a strong password when it comes to your email account - whether you are the former President of the United States or an average Jane or Joe Gmail user.

Adobe releases emergency patch for Windows and OS X systems

By Ian Paul | 08 February, 2013 17:52

Adobe recently released an emergency update for Flash Player on all platforms after two zero-day bugs were discovered in the wild targeting Windows and Mac OS X computers. The vulnerabilities allowed hackers to hijack both Windows PCs and Macs. Adobe recommends all users to update their systems as soon as possible.

Red October malware discovered after years of stealing data in the wild

By Ian Paul | 15 January, 2013 23:43

A shadowy group of hackers has siphoned intelligence data worldwide from diplomatic, government, and scientific research computer networks for more than five years, including targets in the United States, according to a report from Kaspersky Lab.

Oracle releases Java fix, but security concerns remain

By Ian Paul | 14 January, 2013 19:30

Oracle released Java 7 update 11 (Java 7u11) on Sunday following a warning from the U.S. Computer Emergency Readiness Team (US-CERT) advising users to disable the software due to a serious and previously unknown security vulnerability. Even with the available fix, CERT, part of the Department of Homeland Security, is still advising users to disable Java on their systems unless running the software is "absolutely necessary."

Windows RT can be tweaked to run desktop apps, hacker says

By Ian Paul | 07 January, 2013 21:47

Running traditional desktop apps on Windows RT may be one step closer to reality, thanks to a vulnerability that a hacker claims lets you run any desktop app on the ARM version of Windows.

Instagram updates privacy policy, inspiring backlash

By Ian Paul | 18 December, 2012 21:30

Users and critics are growing concerned over privacy rights after Instagram recently posted online changes to its terms of service and privacy policy. The new Instagram rules aren't set to go into effect until January 16, but users are concerned over how their photos could end up in advertisements on Instagram, and possibly Facebook, Instagram’s parent company. This latest privacy flap highlights, once again, the continuing tension between privacy concerns and using a free service that lets you connect with others across the globe.

Facebook holds vote on right to vote, data-sharing policy

By Ian Paul | 04 December, 2012 17:35

Facebook opened the polls Monday for its latest user vote that could see Facebook users lose the ability to vote on future changes to the social network's privacy and site governance policies. The site's latest vote also concerns other changes to Facebook's data usage policies and its statement of rights and responsibilities. You can download the proposed revised documents from Facebook's site governance page.

Privacy groups ask Facebook to back off privacy changes

By Ian Paul | 27 November, 2012 19:34

Two consumer interest groups are asking Facebook to withdraw its proposed changes that would, among other issues, remove the ability for users to vote on modifications to Facebook's data usage and privacy policies. The company also wants to change how you filter incoming messages on Facebook, and Facebook wants to freely share user data between companies it owns, such as Instagram.

Microsoft offers one-click workaround for IE vulnerability, permanent fix coming Friday

By Ian Paul | 20 September, 2012 14:05

Microsoft has issued a one-click security workaround for Internet Explorer as a stopgap measure until the company releases a full security update for its Web browser on Friday. The new "Fix it" solution helps protect users of Internet Explorer 6, 7, 8, and 9 from a recently disclosed memory corruption issue that several security experts have seen in active use. The vulnerabilities could allow a hacker to gain remote access to your system with the same user privileges as you including the ability to install or remove programs, modify files, and create new user accounts.

Dump Internet Explorer until Microsoft issues patch, security experts warn

By Ian Paul | 18 September, 2012 19:37

If you use Internet Explorer 6, 7, 8 or 9 as your default browser on a Windows PC, security experts are advising you to use a different Web browser until Microsoft patches a critical vulnerability in IE. Microsoft on Monday confirmed that hackers were actively exploiting an IE vulnerability that could allow an attacker to take over your PC. The exploit does not affect users running IE10 on the Windows 8 Release Preview.

Emma Smith 'Most Dangerous' Web Celeb

By Ian Paul | 10 September, 2012 15:41

You'd better stop searching for Emma Watson online, because trying to find news or photos about the Harry Potter star gives you a more than 12 percent chance of getting infected with malware.

Mobile security threats rise

By Ian Paul | 07 September, 2012 18:13

Security threats to your mobile device lurk as malware, fraudulent lures such as SMS spoofing, and toll fraud, but they're all becoming favorites of digital crooks as people move away from using PCs and toward smartphones and tablets, according to a new report.

Dropbox Two-Step Verification: Hands On

By Ian Paul | 27 August, 2012 15:06

Two-step account verification is a hot topic after hackers nearly wiped out the digital life of tech journalist Mat Honan recently, and Dropbox is the latest online service to enable the added security measure.

Blizzard Hack: A Security Guide For Battle.net Users

By Ian Paul | 10 August, 2012 15:25

If you play PC games from Blizzard Entertainment such as Diablo III and World of Warcraft you need to review your account security as soon as you can.

CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Webroot SecureAnywhere Business

The lightest, fastest, easiest-to-manage, and most effective endpoint protection.

Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.