Security Engineering
bcrypt vs Argon2 vs scrypt vs PBKDF2: A 2026 Decision Framework
Most "use bcrypt" posts are from 2014. Argon2 won the Password Hashing Competition in 2015 and nobody updated. Here is the actual 2026 decision framework for picking a password hashing algorithm ...
Cybersecurity Insights with Contrast CISO David Lindner | 12/20/24
Insight No. 1: Forget the hype. Cloud security is a battlefield, and you're woefully unprepared. Let's cut the crap. Everyone's talking about cloud security, but most organizations are still playing catch-up. You ...
Ross Anderson
Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge. I can’t remember when I first met Ross. Of course it was before 2008, when we created the ...
New Report on IoT Security
The Atlantic Council has published a report on securing the Internet of Things: “Security in the Billions: Toward a Multinational Strategy to Better Secure the IoT Ecosystem.” The report examines the regulatory ...
NIST Sets SSE Framework in Final SP 800-160 Guidance
The National Institute of Standards and Technology (NIST) published a final version of updated standards for systems security engineering (SSE) with significant content and design changes, including a renewed emphasis on the ...
Manipulating Machine-Learning Systems through the Order of the Training Data
Yet another adversarial ML attack: Most deep neural networks are trained by stochastic gradient descent. Now “stochastic” is a fancy Greek word for “random”; it means that the training data are fed ...
Purdue University’s CERIAS 2021 Security Symposium – Caroline Wong’s ‘Security Industry Context’
Our thanks to Purdue University’s The Center for Education and Research in Information Assurance and Security (CERIAS) for publishing their illuminating security symposiums, seminars, talks, and presentations on the Schools’ YouTube channel ...
Purdue University’s CERIAS 2021 Security Symposium – Ira Winkler’s ‘You Can Stop Stupid: Human Security Engineering’
Our thanks to Purdue University’s The Center for Education and Research in Information Assurance and Security (CERIAS) for publishing their illuminating security symposiums, seminars, talks, and presentations on the Schools’ YouTube channel ...
The Battle Between Linters, Scanners, and Data Flow Analysis
How to balance accuracy and scan times when it comes to application security toolsImage by Gerd Altmann from PixabayWhen it comes to security tools, you’re typically balancing two things: how much time it takes ...
SAST vs. DAST vs. SCA: A Comparison
Photo by Lukas from PexelsThere are many application security testing (AST) tools on the market. To describe them, we have several acronyms, including SAST, DAST, SCA.But, what do they mean?In this post, we’ll cover the ...
