Paul Wagenseil

1 week ago | scworld.com | Paul Wagenseil

Using regular expressions, or regex, was once a convenient and powerful way for web application firewalls (WAFs) to find malicious code in web requests. Sadly, it doesn't work that well anymore. Regular expressions need far too much tuning, require overly complex matching rules and fail to understand context, resulting in a high rate of false positives and an unacceptable rate of letting actual malicious code get through.

3 weeks ago | scworld.com | Paul Wagenseil

As cybercriminals and nation-state adversaries turn to increasingly sophisticated tools and techniques, including deeply buried supply-chain intrusions and AI-powered phishing campaigns, attaining total immunity against online attacks becomes ever more distant. If 100% protection is out of reach, then what matters more is flexibility, adaptability and survival. What matters is cyber resilience, the ability to quickly bounce back from a potentially crippling information-technology outage.

1 month ago | scworld.com | Paul Wagenseil

For 30-some years, cybersecurity has focused on prevention and defense, on stopping attackers from getting into networks and PCs, from stealing passwords and personal information, and from locking up files and holding them for ransom. Prevention is very important, but it can never be totally achieved. Every system can be broken into if an attacker is determined enough, if not via a security vulnerability then by using a stolen password or by simple human error.

1 month ago | scworld.com | Paul Wagenseil

Companies that align their cybersecurity and business goals are far more likely to achieve cyber resilience, their ability to withstand a major disruption of their information-technology processes and infrastructure. That's the gist of the newly released 2025 Futures Report from LevelBlue, a joint venture between AT&T and WillJam Ventures.

1 month ago | scworld.com | Paul Wagenseil

Much of the thinking around artificial intelligence (AI) doesn't truly reflect what AI is or what it does, two researchers said in different presentations at the BSides SF and RSAC cybersecurity conferences in San Francisco last week. "The people who are talking about AI are making it up," said Ira Winkler, Field CISO of CYE Security, during a talk at RSAC. "They often don't know what they're talking about, like AI is some magical entity.