shostack

ZDNet Resources

• sort by:
• Relevance
• Date
• Popularity

Microsoft adds 'Skywing' to Windows defense team

Ken 'Skywing' Johnson, a well-known hacker famous for his work on bypassing several Windows anti-exploitation mechanisms, has joined the software maker to help make it harder to compromise the operating system. Johnson, who teamed up with another recent Microsoft hire -- Matt 'Skape' Miller -- on several...

Tags: Team, Microsoft Corp., Defense, Shostack, Microsoft Windows, Operating Systems, Security, Software, Ryan Naraine

Blog posts 2009-03-25

Additional Resources

Threat Modeling at Microsoft

A key component of the Microsoft Security Development Lifecycle SDL is threat modeling. Threat modeling, which occurs before coding begins, is performed to ensure that features and functionality are designed with security in mind. SDL program manager Adam Shostack discusses Microsoft's approach to threat modeling as follows: "One has a...

Tags: Security, Microsoft Corp., Modeling, Threat Modeling, Research & Development, Business Operations

White papers 2008-12-01

What is the U.S. doing about security?

I've been terrible busy lately.  Hopefully you all here haven't noticed, as I've been working hard to still keep my posts flowing, but I've just got time to catch up with several blogs that I read often.  One of those blogs is the Emergent Chaos blog...

Tags: Card, Database, President, Blog, Passport Card, RFID, Government, Security, Wireless, Biometrics, Nathan McFeters

Blog posts 2008-05-20

Try the New School approach to effective security spending

CIOs, IT managers, and security specialists all face difficult questions about security spending. This sample chapter from The New School of Information Security examines justifications for allocating resources for security, discusses ways to determine how much money you should spend, and explains how to decide where that money should be...

Tags: Online Edition, Apple Safari, Addison-Wesley, New School Of Information Security, Security

Book chapters 2008-04-10

Hackers in Seattle for Microsoft's Blue Hat, ToorCon

White hat hackers have descended on Seattle for two semi-private security conferences where new attack and exploitation techniques are being discussed.The first is the Spring 2007 edition of Microsofts Blue Hat Security Briefings where researchers are invited to Redmond "to share knowledge and to educate and help protect customers against...

Tags: Botnets, Browsers, Data theft, Digital rights management, Exploit code, Hackers, McAfee, Metasploit, Microsoft, Passwords, Patch Watch, Pen testing, Punditocracy, Responsible disclosure, Viruses and Worms, Vulnerability research, Wi-Fi security, Windows Vista, Zero-day attacks

Blog posts 2007-05-10

Meet the Security Bloggers

This week marks the first installment of a series of podcasts I am producing called “Meet The Security Bloggers”. I asked Adam Shostack and Chris Walsh to be the guinea pigs for the first one and it turned out really well. These guys write for EmergentChaos,...

Tags: security, blogging

Blog posts 2006-07-13

Maybe Firefox doesn't have a security edge after all

Kvetching about Microsoft security flaws is so 2002.That thought came to mind today when I read a misleading and disingenuous post by Firefox evangelist Asa Dotzler. Now, Asa just got back from a trip halfway around the world. So I’m going to assume that it was jet lag that caused...

Tags: Mozilla Firefox, phishing

Blog posts 2006-06-28

Is Microsoft about to release a Windows "kill switch"?

[Update, 4-Oct: Microsoft has introduced the Software Protection Platform, which contains features very similar to what I describe here. See For Vista, WGA gets tougher.] [Update 12-August: For a detailed discussion of what youll see if WGA flags your copy of Windows as "not genuine," see Busted! What...

Tags: WGA, Microsoft Windows

Blog posts 2006-06-27

Thoughts from the Summit

A few comments from the 4th Annual Detroit IT Security Summit yesterday.The presentations from the keynote speakers have been posted to the Summit website. Ridgely Evers opened the show with comments on what has gone wrong with IT Security. Evers of Tapit Partners ranks high in my esteem...

Tags: Evers, token

Blog posts 2005-10-07

Other security blogs

Where do you go every day for security information and analysis?Here are a few of the sites I make it a point to read. I always check in on the handler's diary at SANS.I also read through the security reprints at Department of Homeland Security. Lots of things in here...

Tags: security, blog

Blog posts 2005-03-23