Are you looking for a free and easy to use password safe? Be sure to check out KeePass. It’s a great open source product that will place all of your passwords in a database which is locked with a secure key or key file.

The result? You only need to remember one password instead of hundreds.

Some key features include:

• Full database encryption; not just the passwords

• Portability- It can be placed on a USB stick

• Multiple key support- A key file can be used (which can be carried with you), a password can be used, or a combination of both!

• It’s not just for Windows. Ports are available for Linux, OS X, Blackberry, PalmOS, and many more

Want to learn more? Check out their site at http://keepass.info/

Security with mobile devices, starts before they are added to an organization’s assets. Although it may take extra time, it will pay off in the long run if an organization researches mobile devices before purchasing. Not all devices are equal. Some, such as MP3 players, are built for a general consumer base and won’t have such security safeguards as a “smart phone.”

Here are some tips that can help decrease the possibility of a security breach:

1. Use encryption and authentication features. Create policies that will ensure encryption features are accessed and launched. Many people do not use the password function but what would happen if a smartphone fell into a stranger’s hands? Why make it easy for someone to access private data? Set up a password.

2. Create remote wipe capabilities and set up a “lost item” process. If a mobile device is lost or stolen, the IT department could remotely remove any sensitive information. Not everyone turns in a lost cell phone. Remotely wiping it of sales forecasts or strategy diagrams will keep your organization’s plans safe. Having a quick hotline for lost items will help IT staff confront a problem quickly and efficiently.

3. Be careful about third-party applications. Although some seem to be harmless, they can possibly be a back-door for attackers to access your internal network. By limiting unsigned third-party applications, an organization can close one more opportunity for data theft.

4. Create unique firewall policies. Those who have smartphones do not need to have access to all the databases in the network. Only allow access to the data that would most commonly be used.

5. Start considering software. As smartphones become more common, hackers will start to target them more often. Adding precautions such as equipping devices with intrusion prevention software is another good way to provide security. And although anti-virus software for smartphones aren’t common, it’s a good idea to keep watching for it. This type of software is bound to develop and be plentiful as more organizations use highly sophisticated smartphones, which are really small computing platforms.

IT managers may be reluctant to tackle the issue of securing mobile devices, they realize mobile devices aren’t going anywhere. Supporting a limited number of mobile devices may be the answer. Creating and enforcing a consistent review process, together with awareness programs, will help keep your company’s business, your business.

I loved this story. The idea that some “hackers” hack for political or social causes is not new. This idea stems back several years and has evolved from simple web defacements with social and political messages to the “new breed” of information theft, data disclosure and possibly even sabotage to further one’s views.

Today, all of the experts in the security field, myself included spend a great deal of time teaching people that the primary data theft threat is more organized crime than teenage vandalism. But, that said, we certainly can’t forget the idea that hacktivism is still alive and well. In fact, given the explosive growth of the Internet, the continually expanding dependence on technology for everyday life and the common availability of so much data and access, hacktivism is likely to gain in popularity, not shrink.

That brings us to a huge issue. How do we know where some of the data that hacktivists would be interested in lives? Given that people are involved today in a myriad of social activities, use of social networks and such, how do we know who might have information that a hacktivist would want and who doesn’t? The answer of course, is that we have to assume that someone in our organization might have data that is relevant to this threat, so we have to account for it when we create our threat models. If we happen to be a philanthropic organization, a government agency or a federal group, we definitely can’t overlook hacktivism as a threat, because our very existence yields reputational risk for us and a reputational trophy for many hacktivists if they make us a poster child.

While the hacktivism threat model is likely more one of opportunistic nature than dedicated, focused attacks against a given organization, that may not always hold true. One day it may not be all about what data YOU have and hold, but what data the people who WORK FOR YOU have and what roles they play in their personal lives. While this is not necessarily true today, the idea that hacktivists might one day target individuals to achieve social goals is not out of the question.

So, all of that said, how much thought have you given hacktivism? Does your risk assessment cover that as a threat? Have you done any threat models around politically or socially motivated attackers? If not, it might be a good idea to take a look at this threat vector. Their aims and goals may be different than what you had in mind when you last updated your threat models.