278 reputation
25
bio website
location Toronto, Canada
age
visits member for 3 years
seen Sep 14 '13 at 18:58

Nov
17
awarded  Nice Answer
Sep
14
asked Does an equivalent for netconf exist in the Cisco ASA world?
Apr
24
awarded  Yearling
Sep
6
awarded  Necromancer
May
17
comment Can you get virus just by visiting a website in chrome
@Rook that's what I said, but less succinctly
May
16
comment Looking for an open risk assessment methodology
(who's Bob?) The Ravs do look interesting
May
16
answered Can you get virus just by visiting a website in chrome
May
15
comment Is there a strong challenge to be made against the startup executive that believes security must be delayed?
I agree, it rarely works but it's also the most likely to succeed of all approaches if you've got a startup exec who's not interested in rational arguments or swayed by FUD. This of course assumes time and not money is the primary constraint.
May
15
comment How is “something you have” typically defined for “two-factor” authentication?
@john I was referencing @nealmcb password on paper concept. I can easily remove the paper from the user's wallet, copy the password (memorize it, take a picture, write it down etc...) and replace the paper in the wallet. The user is unaware of its absence, specifically that two copies can exist and be equally usable.
May
15
comment Looking for an open risk assessment methodology
good suggestion, the OML 3 reads almost like a BSD license. However, the OSSTMM is less about risk assessment and more about testing. Still some usable bits.
May
15
awarded  Supporter
May
15
comment How is “something you have” typically defined for “two-factor” authentication?
@nealmcb you're right, that was the intention with possession proves identity, you want a strong binding capability, something that demonstrates you truly possess it (like a PIN)
May
15
awarded  Teacher
May
15
comment Looking for an open risk assessment methodology
thanks, SOMAP's a possibility although a little hand-wavey and unfinished. The other thread covers FAIR, GAIT and FISAP - both have restrictive licensing. SP800-37 is more of a guide to applying risk management, not a quantitative technique itself. I think anything in a book is going to be covered by some licensing restriction.
May
15
answered 2 factor authentication - cost effective solution for a web startup
May
15
answered Is there a strong challenge to be made against the startup executive that believes security must be delayed?
May
15
revised How to persuade average people that security matters?
added reference
May
15
awarded  Editor
May
15
answered How to persuade average people that security matters?
May
15
revised Looking for an open risk assessment methodology
added notes on already covered ground