I’m a security minded guy, that probably comes as no surprise. Other people – not always so much and as a result you inevitably see a lot of unattended, unlocked Windows desktops around the place. Naturally the responsible thing to do when seeing such risky behaviour is to help the victi.. uh, I mean “individual” understand the risky nature of such behaviour. Having recently observed such a situation I thought I’d reach out and ask for some guidance on how one might deal with it: [https://tw...

It’s been a while since I last spoke to Carl and Richard on .NET Rocks [https://www.troyhunt.com/2012/01/net-rocks-talks-security-with-carl.html] where it was all about the OWASP Top 10 and the provisions available in ASP.NET to keep yourself on the happy side of getting hacked. I had a chance to catch up with the guys again a couple of weeks ago to record a new episode all around “Hacking Yourself First” which ties in neatly to much of the writing I’ve been doing lately and my Pluralsight cour...

There are few things more frustrating than trying to make other peoples’ code work; broken references, missing dependencies, extraneous and useless files – it’s all part of the joy of sharing the project love around. This is often tricky enough for people on the same team but throw in distance, culture and varying levels of expertise and things get ugly pretty quickly. I come across these issues pretty frequently and the pattern is constant enough that I reckon it deserves just a little bit of...

I’m sorry to be the one to break this to you, but, well, your company network is compromised. I know, I know, you thought you had firewalls and antivirus and Dropbox is blocked but somehow the nasties got in. Unfortunately that also means that all the web apps you have behind your corporate firewall are, for all intents and purposes, now public. Now you may not even be aware of the hacked state of the network you spend your nine to five hours in, many of these intrusions go entirely undetected....

One of the things people often ask me about in regards to software security is “Are there any standards that these people should be following? Any governing bodies? Any recourse for screwing things up?” Ok, that’s three things but you get the idea and people are usually pretty surprised when they learn that for the most part, no. No standards, no governing bodies, no recourse. You can go and create a new website today storing everyone’s credentials in the clear, send them around willy nilly via...

Remember view state? For that matter, do you even remember web forms?! I kid because although MVC is the new hotness in the world of building ASP.NET websites, web forms remains the predominant framework due to both the very long tail of sites already built on it and the prevalence of developers with skills in this area who haven’t made the transition to MVC (indeed some people argue that they can happily cohabit, but that’s another discussion for another day). Anyway, back to view state. When...

These real world experiences with Azure are now available in the Pluralsight course "Modernizing Your Websites with Azure Platform as a Service" [http://www.pluralsight.com/courses/modernizing-websites-microsoft-azure]Note: In this blog post I show how to load a certificate from StartCom into Azure. They've subsequently had some pretty serious issues related to WoSign [https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/] and I would not recommend getti...

Over the last few weeks I’ve been working on a piece with 4 Corners titled In Google We Trust [http://www.abc.net.au/4corners/stories/2013/09/09/3842009.htm] which went to air last night. For international readers (or local folk who just don’t watch the ABC), 4 Corners has been around for decades and has always been high quality journalism on thoroughly investigated stories without the sensationalism we get used to in many other current affairs programs. Seeing it all come together it was obvio...

Apparently the average number of apps someone has on their smartphone is 41 [http://www.networkworld.com/community/blog/average-us-smartphone-user-has-41-apps-their-device] . It sounds like a lot but do the maths on how long you’ve had the phone (or a predecessor) and it you realise it’s a pretty low frequency of taking something new from the app store. A significant proportion of these apps allow you to share sensitive personal information with them; your home address, phone number, email and p...

Well that’s my first TechEd down as both a speaker and a delegate and what better place to have it than in my home town of the Gold Coast. For international readers, think of it as having all the best bits of what you know of Australia (beaches, good weather, scantily clad [insert preference here]) whilst all the bad bits you know of cities (pollution, bad traffic, angry people) get left behind in Melbourne and Sydney. Clearly this is an entirely unbiased view. You never quite know what to expe...