What website security headers are and why you cannot see mine

Details

Category: Cyber Security (Personal)

Published: 10 October 2019

Last month I moved my website to a new server and rebuilt it from scratch along with: double username/passwords, double ninja firewalling, restricted TLS configuration, security headers, two factor authentication and a SaaS WAF (website application firewall), and more of course.

Many of us technical folk have seen and used SSL Labs by Qualys which gives me a “A” rating though it states I still have TLS 1.0 available which is incorrect. SSL Security Test by ImmuniWeb gives me a “A+” (if only I got this during school GCSE’s!) and states only TLS 1.2 + 1.3. Odd Qualys gets it wrong.

The technical security controls listed in paragraph one are known apart from security headers which are less known about and used. Headers are sent/set by: WAF, load balancer, web application, web server and other devices, and they are sent from the website to the end users’ browser.

Read more …

Cyber Attacks - Most of them are not as high-tech as you'd think

Details

Category: Cyber Security (Personal)

Hackers have a reputation for using complex technical means to gain unauthorised access to digital systems. However, low-tech (or even ‘no-tech’) attacks are far more common. In this article we explore the low-tech cyber security risks, and how individuals and companies can protect themselves.

Spam, ransomware, phishing, spear phishing and SQL injection are all known attacks which can, and do, breach company and individual security. However QA finds many people do not think about the physical element (what can be physically seen and heard). Firewalls, antimalware, two factor and authentication do not protect against someone over-hearing a conversation, or seeing a screen. It is often said “people are the weakest link”.

Loose lips sink ships
A QA cyber expert was on a flight from a London airport to another location in the United Kingdom, and observed someone unlock their phone, from three rows back on the plane. This was the pattern:

Read more …

Website is back online and re-energised

Details

Category: Blog

On Sunday I took this website offline to move it to a new server. At 23.00 (10/09/2019) it was re-launched in a new minimalist style on a brand new CMS installation which makes it easier to use and of course with enhanced security around it. Enjoy!