tutorial about web security computer networking

After my last few Tweets as @taosecurity on threat-centric vs vulnerability-centric security, I sketched this diagram to help explain my th...

Thanks to the great new book Metasploit (review pending), I learned of the Penetration Testing Execution Standard . According to the site,...

It's 2007 and some people still do not know the difference between a threat and a vulnerability. I know these are just the sorts of pos...

I'd hoped to not have to say anything else on FAIR, but I've decided to ask one final question. If I can't get a straight answe...

Recently I cited an Economist article in Economist on the Peril of Models . While walking through the airport this Businessweek cover story...

I intended to stay quiet on risk models for a while, but I read the following Economist articles and wanted to note them here for future re...

You knew I had risk on my mind given my recent post Economist on the Peril of Models . The fact is I just flew to Chicago to teach my last ...

Anyone who has been watching financial television stations in the US has seen commentary on the state of our markets with respect to subprim...

This evening I watched part of a show called American Greed that discussed the Wheaton Bandit , an armed bank robber who last struck in Dec...

This is just a brief post on terminology. Recently I've heard people discussing "threat models" and "attack models....

I ran across this chart at the Kentucky government security page, of all places. They must have reproduced it from a Department of Homelan...