Cybersecurity & Privacy
OPSEC : What should I include in my bug-out bag
Search Google for "Bug-out bag," and you will get 137M results. YouTube has a 144K videos discussing it. A Bug-out bag (also called Go Bag, BOB, 72-hour kit, grab bag, a battle box, personal emergency relocation kit) is a small personal maintenance kit that would allow you to survive 72-hours when faced with an emergency. Most emergency agencies reconnect you prepare some kind of emergency kit. Emergency Preparedness Canada has a website dedicated to building basic bug-out kits. The US Department of Homeland security offers similar suggestions on their website.
How to fix issues at hotels, airports and other public WIFI hotspots
A captive portal is the intercept page you see when trying to log into most free public WIFI hotspots (e.g. airport, restaurant, hotel, etc.) You are normally shown a page that collects your email and then asks you to agree to the provider's terms of conditions. As browsers adopt more secure protocols by defaults (iPhone, Android, Windows, Mac, iPad, etc.) there are situations when your device may not trigger the portal webpage correctly. The browser may block redirection to the portal page because it is typically transmitted using unsecured HTTP.
Fun with Shodan and IOT
Read this related article: Find phishing and malware with a simple search Search engines have become a favourite starting point for threat actors, so it should also be your starting point. Beyond Google, there are a bunch of specialized search engines that are powerful and scary. This article talks a bit about Shodan. Think of this article as a gentle introduction. What is shodan <img src="https://ekiledjian2.micro.blog/uploads/2025/cd2642f617.jpg" alt=""> Shodan is often called the world's most dangerous search engine. Shodan attempts to catalogue metadata about its targets and its targets are often Internet of Things (IOT) devices.
Find phishing and malware with a simple search
A very important function of any information security team is threat intelligence. Threat Intel can be a complicated and costly service in some cases but can be as simple a running a simple search in other cases. Here is a trick to get you started with the simple and cheap function. Did you know you can find lots of "fun" phishing and malware links using nothing more than a simple VirusTotal search? Search VirusTotal for Google Storage API (precooked link).
Honest review or NordVPN
Recently I started seeing more ads for the NordVPN service. It seems some of you may be in the same position as I've received several emails asking me for my opinion about them. After a careful review, here it is. NordVPN is best described as a good "one size fits all" VPN service. You pay one fixed price and get full access to their network endpoints (1000+ servers in 57 countries) and the full available speed. TL;DR:NordVPN offers impressively fast VPN, good security and easy to use clients.
Is TOR Private and Anonymous?
One of the most frequently asked questions I receive from readers (from this blog, Twitter and LinkedIn) is "Should I consider TOR private and anonymous?" This question is interesting with fervent activists on each side [of the issue]. On one side are TOR proponents extolling the virtues of the platform and explaining how it will save humanity from the scourge of privacy-invading networks. On the other side of the discussion are conspiracy theorists that claim TOR is nothing more than an NSA honeypot (a data collection tool).
Examples of Darknet (TOR) sites
I have received a lot of requests from readers, LinkedIn and Twitter connections to provide examples of some "interesting" darknet (TOR Onion Network) sites. I have posted over a dozen on my LinkedIn page but thought I would show a couple here. My security team and I perform internet and darknet reconnaissance work to create briefing packages on cyber crime, determine trends and spot organizational dangers. As part of this research, we sometimes stumble on interesting examples that I share.
Turn your legit link into a scary one
When Google finally shut down its Goo.gl shortening service, I wrote an article about the best alternative URL shorteners. Security specialists cringe at these services because they can often be used to hide attacks, but when brute forced (using a program that tries to find valid links automatically), you can usually find classified or confidential information. If you are interested in this type of research, check out this academic paper entitled "Gone in Six Characters: Short URLs Considered Harmful for Cloud Services.
What makes a good Chief Information Security Officer (CISO)
Only five years ago, the title of Chief Information Security Officer was likely awarded to an employee that had worked hard and was dedicated to the company. It was an honorific title often given as a reward. Times have changed and companies need a new breed of CISO. The number, severity, and impacts of cyber threats are continually increasing. Companies now rely on complex highly integrated IT systems whose confidentiality, availability and integrity are paramount. The WannaCry ransomware was a good example of how poorly managed security can cripple an organization.
Canadians can find out what data a company stores about them
The average consumer is starting to realize how much personal data companies collect about them. RELATED: How Target knows you are pregnant through data analytics Consumers should be concerned about what data is collected, how is is used and who it is shared with. Canadian privacy laws ( like Personal Information Protection and Electronic Documents Act) allow consumers to access their information (aka companies must respond to a request for personal information held by the company). “Principle 4.9: Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and be given access to that information.