security

Never give a cop your phone and other security tips

Dave Farquhar security
Never give a cop your phone and other security tips

The political climate in the United States means everyone, but especially marginalized groups, need to be thinking about phone security. It’s not just something security professionals and people who handle sensitive information for a living need to worry about anymore. In light of that, I present five phone security tips I wish everyone knew and followed.

Read more

How to choose a VPN service

Dave Farquhar security
How to choose a VPN service

A few years back, an acquaintance asked me if I could recommend a VPN. And I’m afraid I didn’t give the best advice, so I want to recant and remedy that now. I think there are some misconceptions about what a VPN can and can’t do for you, so you may decide you don’t actually need one. But if you do need one, there is one and only one specific VPN I recommend. In this blog post, I’ll tell you how I came to choose this specific VPN service.

Read more

Overcoming learned helplessness in security

Dave Farquhar security
Overcoming learned helplessness in security

Today I want to talk about a concept called learned helplessness, something that was widely studied and taught in the 1980s, but seems to have fallen by the wayside a bit today, although I certainly see it happening today. Computer security, especially the fields of vulnerability management and patch management, are very prone to learned helplessness. The good news is, it’s possible to overcome.

Read more

Hash collisions in computer security

Dave Farquhar Retro Computing, security
Hash collisions in computer security

Last week, Robin of the YouTube channel 8-bit Show and Tell wondered out loud on Twitter why Chrome flags Netracer 1.1, a modern indie Commodore 64 game, as malware. I think this is a classic case of hashing algorithms having gone wrong. In this blog post, I’ll explain what a hash collision is, using this collision of my hobby of retro computing and my day job of information security as an example.

Read more

Resume hacks for your first (or next) security job

Dave Farquhar security
Resume hacks for your first (or next) security job

It’s hard to get a job, especially a security job, when everyone is looking for a unicorn. What your guidance counselor in college told you probably isn’t enough to make your resume look like one from a unicorn. So in this blog post, I’ll share you the resume hacks you need to help you stand out so you get the interview, and in turn, land your first (or next) security job.

Read more

You don’t need cyber threat intelligence. Buy this instead

Dave Farquhar security
You don’t need cyber threat intelligence. Buy this instead

Last week I saw another hot take on Twitter. This Twitter influencer asserted that for most organizations, Cyber Threat Intelligence (CTI) is a waste of money and they would be better off spending that money elsewhere. In this blog post, I will dig into this argument, including what proper use of Cyber Threat Intelligence looks like.

Read more

Is CISSP worth it in 2024? How to know

Dave Farquhar security
Is CISSP worth it in 2024? How to know

I’ve had two different people ask me in the last month if CISSP is still worth it in 2024. I have mixed feelings, so in this blog post, I’ll explore this complicated question so you can decide if CISSP is still worth it for you.

Read more

Wireshark security risk and how to manage it

Dave Farquhar security
Wireshark security risk and how to manage it

A couple of social media influencers got into an argument over banning Wireshark in corporate environments because Wireshark is a security risk. While I don’t like getting involved in this type of drama, the argument does raise an important point in information security and vulnerability management. It’s very important as a security professional not to overplay the hand you’re dealt.

Read more

How Tenable sets plugin severity

Dave Farquhar security
How Tenable sets plugin severity

How Tenable sets plugin severity is a question customers have been asking me for years, dating back to the days I worked for Tenable partners. It can be a bit complicated, so in this blog post I will explain what goes into Tenable plugin severity.

Read more

What peer benchmarking is in vulnerability management

Dave Farquhar security
What peer benchmarking is in vulnerability management

Successful vulnerability management is deceptively simple. It comes down to being able to answer yes to two questions: Are you fixing the right things? And are you fixing them fast enough? But how fast is fast enough? In this blog post, I’ll explain how I use peer benchmarking to help companies figure out how fast is fast enough. I’ll also explain how to know if your security policies are less popular than speed limit laws, and why that will make them fail.

Read more