I was asked recently to look at the security of the PhoneFactor 2-factor authentication solution. If you don't know what it is, then you can find out more here , but essentially you enter your username and password, then they phone you on your pre -defined number and press the # key to validate the authentication. The problem with just pressing the # key is obvious, but they allow you to configure entering a PIN number rather than just pressing the # key. To my mind, there should be no other option than having to type in the PIN number. However, this isn't necessarily a brilliant idea. As I've said before in this blog , a lot of phones log the digits dialled, in which case that PIN isn't secure. I was also told that the PSTN and GSM networks are secure, so this is a good solution. I'm not sure I agree that PSTN and GSM networks have good security. Analogue PSTN is easy to listen in to with proximity and GSM can theoretically be cracked, and probably will ...

Comodo Vision Video Blog Cloud Services or Cloud Computing are getting a lot of attention in IT circles, promising cost-effectiveness, flexibility, and time-to-market advantages over traditional alternatives. However, they also increase your security risk by expanding your security perimeter to include that of your service provider. This video blog poses some key questions to ask your Cloud services/Cloud Computing provider regarding data security as well as advice to reduce the risk to your business introduced by Cloud Computing. See my third video blog for Comodo Vision here .

On 27th September the APWG released their First Half 2009 Phishing Trends Report . This provides some interesting/worrying reading. Most notably is the rise and rise of rogue anti-malware programs. Rogue anti-malware programs are programs that run on a user's machine and falsely identify malware infections. They then inform users that the malware can be removed by purchasing their anti-malware program. The installed software, in many cases, does absolutely nothing. The malware author has made their money off the user and doesn't care about them or the fact that their machine is left vulnerable to other malware. However, there is another breed of rogue anti-malware that will install other malware onto the user's machine, often adding them to botnets or adding trojans and spyware. According to Panda Labs' Luis Corrons, rogue anti-malware programs are proliferating with "exponential growth. In the first quarter of 2009 alone, more new strains were created than in a...