Steve Riley on Security

Browse by Tags

Directly connect to your corpnet with IPsec and IPv6: Contrary to popular belief, the rumors of my demise have been greatly exaggerated. Well, ok, no actual rumors, but hey, one can dream, huh? My spring calendar was full of events in Asia and Australia, then TechEd US seemed to suddenly appear out of nowhere! Read More...
Posted 25 June 08 01:55 by Steve Riley | 26 Comments
Filed under Windows Vista, NAP, authentication, TechEd, Active Directory, configuration, VPN, IPsec, networking, BitLocker, encryption, group policy, SSL/HTTPS
Plan now to eliminate "power users" from your domains: I've seen some conversations lately about the Power Users group -- how powerful is it, really, and why did we remove the group from Windows Vista? That group had rights install software and drivers. And if you can install software and drivers, then you Read More...
Posted 11 February 08 10:03 by Steve Riley | 1 Comments
Filed under Windows Vista, authentication, security policies, access control
Microsoft IPsec diagnostic tool: IPsec is a wonderful technology for identifying computers and securing the exchange of data between them. I've written and spoken extensively about in the past. It is, however, a bit of a challenge to configure, especially if you're newly learning about Read More...
Posted 01 February 08 03:39 by Steve Riley | 2 Comments
Filed under authentication, configuration, IPsec, networking, encryption
Myth vs. reality: Wireless SSIDs: Do you ever wonder sometimes how it is that some ideas just won't die? Like the thought that not broadcasting your wireless network's SSID will somehow make you more secure? This is a myth that needs to be forcibly dragged out behind the woodshed, strangled Read More...
Posted 16 October 07 12:08 by Steve Riley | 25 Comments
Filed under false claims, authentication, security myths, wireless, networking, encryption
Password policies. Once again.: Recently in the newsgroups ( news:microsoft.public.security , to be specific) the question of password polices and the out-of-box defaults came up. The poster lamented a number of things: that Microsoft doesn't enable account lockout by default, that Read More...
Posted 04 September 07 03:14 by Steve Riley | 21 Comments
Filed under authentication, security policies, passwords
Why administrative passwords will never be like nuclear missile launchers: During the past few months many people have lamented that Windows lacks a nuclear missile style control option for administrator passwords. Surely you've read about or seen photographs of missile silos where two operators, separated by a distance greater Read More...
Posted 21 November 06 02:16 by Steve Riley | 11 Comments
Filed under authentication, security policies, risk mitigation, passwords, security science, Active Directory, physical security
Mythbusters beat "unbreakable" fingerprint door lock: My good friend Jamie Sharp sent me this link today. It's amazing: watch how Adam and Jamie easily defeat a fingerprint lock the manufacturer claims has never been broken. As if to snub the claims, they break it three times! Supposedly it monitors pulse, Read More...
Posted 20 September 06 10:15 by Steve Riley | 13 Comments
Filed under identity, authentication, security theater, biometrics, things that make me laugh
Security myths and passwords: I like this a lot. http://www.cerias.purdue.edu/weblogs/spaf/general/post-30/ In the practice of security we have accumulated a number of “rules of thumb” that many people accept without careful consideration. Some of these get included in policies, and Read More...
Posted 30 April 06 09:07 by Steve Riley | 3 Comments
Filed under identity, authentication, security policies, passwords, security myths
What do YOU need out of two-factor authentication?: Two-factor authentication continues to grow in popularity and emerge as a security requirement for many people I meet with. At Microsoft, we use smartcards internally for VPN access right now; soon we'll be requiring smartcards for domain logon, too. Read More...
Posted 20 April 06 03:37 by Steve Riley | 43 Comments
Filed under identity, authentication, biometrics, email, access technologies, security policies, risk mitigation, passwords
It's me, and here's my proof: why identity and authentication must remain distinct: My February Security Management column is posted: http://www.microsoft.com/technet/community/columns/secmgmt/sm0206.mspx No matter what kinds of technological or procedural advancements occur, certain principles of computer science will remain -- especially Read More...
Posted 16 February 06 09:41 by Steve Riley | 7 Comments
Filed under identity, authentication, biometrics, security policies, risk mitigation, passwords, security science
How to secure your wireless network: I'm now a contributing editor for TechNet Magazine . Everyone with a TechNet subscription automatically receives it; if you don't have one, you can still get the magazine free . The magazine's published three issues so far: Winter 2005 , Spring 2005 , Read More...
Posted 11 November 05 11:43 by Steve Riley | 4 Comments
Filed under authentication, access technologies, threats, protection, wireless
August article: 802.1X on wired networks considered harmful: Several months ago I learned from Svyatoslav Pidgorny, Microsoft MVP for security, about a problem in 802.1X that makes it essentially useless for protecting wired networks from rogue machines. Initially I was a bit skeptical, but the attack he described Read More...
Posted 11 August 05 10:55 by Steve Riley | 16 Comments
Filed under NAP, authentication, access technologies, risk mitigation, threats, protection, security science, wireless
New column -- Using IPsec for network protection: I'm now writing semi-regular articles for TechNet. These are part of the security management series, and they're also linked from the security newsletter. The first column is a two-parter about IPsec. Part 1 describes the technology: how it operates, Read More...
Posted 10 February 05 09:59 by Steve Riley | 6 Comments
Filed under identity, authentication, access technologies, protection, configuration, IPsec

Steve Riley on Security

Browse by Tags

Search

This Blog

Resources for you

Tags

Archives

Syndication