Security Experts:

Alan Wlasuk's picture

Alan Wlasuk

Alan Wlasuk is a managing partner of 403 Web Security, a full service, secure web application development company. A Bell Labs Fellow award-winner with 18+ years of experience building secure web applications, Wlasuk is an expert in web security - from evaluation to web development and remediation.

Recent articles by Alan Wlasuk

  • Millions of identities, credit card numbers and user login credentials are still being compromised every year by hackers getting into web sites we believe are secure. This valuable information will, undoubtedly, end up in the wrong hands.
  • The vulnerability represented by the BEAST shouldn't be viewed as a major crime risk, rather as just one of hundreds, if not thousands, of Internet flaws that will soon to be discovered in the near future.
  • Crime follows money, and with the information on your phone representing access to potentially billions of dollars in the cyber crime world, you and your phone become a tempting target.
  • If you own a business with an investment in a web presence, whether it is the core of your e-commerce sales or just a brochure site, you should be thinking about what could be a soon-to-be personal relationship with the hackers behind your very own security breach.
  • In this “Case Study” column I will share some takeaways based on my involvement in two recent remediation engagements as a basis for understanding the reasons behind the continued trend in vulnerable web applications.
  • If you’re being honest with yourself, major successful cyber attacks on companies in the past few years should convince you of the fact that your business could eventually fall victim to a cyber attack.
  • The protection of data is far harder than most people recognize.
  • Are we ever going to get passwords right? And by “right”, I mean impossible to crack, easy and inexpensive to implement, and acceptable to a public that generally views passwords as an annoyance?
  • Until information on how the Zappos breach was executed comes to light, we can only assume Zappos was as good, perhaps better than most on-line retailers as far as security is concerned.
  • Like any well-established sub-culture, the world of script kiddies is fascinating to watch, difficult to fully understand from the outside and obviously intriguing to those within that world.
  • My brief relationship with the Morto worm lasted exactly 5 days, at least that I know of. Morto is a computer worm – one that burrows into a computer system and lives to infect other computers and take orders from her botnet herder.
  • The joy of a hacker extracting your data is similar to the excitement one experiences playing the mechanical claw arcade machines – the one where you insert a few quarters and grab a toy with a mechanical claw. Picture the hacker running scripts instead of using the arcade game joystick.
  • Protecting your website from hackers is tough. The battle between the good guys and the bad guys is an ever escalating war where a misstep on your part may mean a breached site.
  • While our attention is immediately drawn to the Internet when we think about the benign-turned-evil Matrix, a more interesting comparison can be made to the current Internet plague of botnets.
  • I recently found two great security articles from 2000 from a well-respected Microsoft security guru, Scott Culp. These laws are still very applicable to today’s security world, and I wanted to pass along 7 of my favorites with Culp’s thoughts as well as my own spin.
  • There are thousands of script kiddies, launching hundreds of thousands of automated attacks every day. Anyone who argues that their website is too small or obscure for anyone to test for flaws isn’t paying attention to the fact that everyone’s website is being tested, all the time.
  • Initially scoffed at as being "leaderless" and "directionless", the Occupying Wall Street rally appears to be moving towards focusing on defining such lofty demands as ending the death penalty, ending war and achieving wealth equality.
  • The world’s expectations of breach-proof SSL certification agencies have been shattered. As expected all of the ruling bodies that control the Internet have rallied to identify the root causes of these breaches and are working on future preventable mechanisms.
  • Watching Anonymous in action is far better than most of the programming on television. Anonymous seems to be in a never-ending battle against the “evils” that surround mere mortals.
  • With its publicly stated goal of protecting the rights of the masses against big business and government, Anonymous launched several successful attacks on the BART Web Site as well as other city Web Sites.
  • Cyber Will be part of any future conflict, whether it's a nation state or terrorism, according to a long time CIA veteran. We are looking towards a time when nations will launch online attacks and extremist groups will add cyber attacks to their tactics.
  • Most people will focus on perimeter security and think that they have it all covered. Unfortunately, network security is never enough. Just as we cant control what's on television, who is in Internet chat rooms or who is on the other end of the phone, we can't control the browsers that are interacting with your web applications.
  • I’ve approached design and development companies with the thought of pre-launch web application security scans, done on a staging server. More times than I can count, these conversations end up in an agreement that web security is essential but there is no desire to find out how really secure the target site really is.
  • Unless your company sets security as a prime requirement, your website will be one of the 70 percent on the Internet that contains major security flaws.