If you want to get into Information Security you HAVE to be a/have this skill... Why this is total BS. Almost daily I see someone posting on twitter, trying to be helpful to folks who are looking to get into InfoSec. Often I see "If you want to be in Information Security (Cyber Security) then you HAVE to be a programmer" or "If you want to be successful you have to be a hacker/have a criminal record/have abused systems without permission" etc. While having technical capabilities (such as programming) and having the ability to compromise a system shows a specific skillset neither are required. When talking to people who are interested in Information Security I often refer to it as a cake, there are tons of slices, many flavors, many pieces and parts you can sample, choose to focus on, will be expected to know something about, etc. Incident Response and Forensics (my current focus) is not the only part of Information Security, and certainly not the only part tha
Happy New Year to everyone! May 2018 provide you with interesting problems and the patience to solve them :) On to the recent kerfuffle about the Intel processor bugs. These vulnerabilities were identified in early January by Google (original Google security post) CVE-2017-5715 CVE-2017-5753 CVE-2017-5754 These vulnerabilities have been named "Spectre" and "Meltdown" and are causing a certain amount of anxiety in some environments. IBM has produced an excellent write up of the vulnerabilities and includes information about the impacts and includes the CVE ratings: https://exchange.xforce.ibmcloud.com/collection/c422fb7c4f08a679812cf1190db15441 Of course new vulnerabilities are bad, and often require work and remediation, but this should be part of your environment's standard vulnerability assessment and remediation program. It's not sufficient to just apply patches from a single vendor (e.g. Microsoft) on a monthly basis and consider