Welcome to Ricky M. Magalhaes' Section

Ricky M Magalhaes is an International Information Security business specialist, author and consultant, working with a myriad of high profile organizations. He has been consulting in the information security field for over ten years and continues to promote information security best practice, strategic and compliance to many top international entities. He has trained the government agencies and other governmental entities on various information security disciplines and has often spoken at national and international conferences on behalf of Microsoft.

Ricky has overseen and designed implementations for large entities in excess of 32,000 users and is a trusted advisory for many fiduciary institutions and governmental agencies.

Since early 2000 he has been running his own IT services company. This business specialises in the provision of high level security consultancy, implementation and support services to local finance, government and security agencies. He sits on the boards of 6 entities and is a trustee for various international entities.

Ricky is a CISSP and has many accolades in information security and information technology. He has been personally commended by Bill Gates for security work in the Microsoft arena. He has chaired the ISC2 user group in the European region where he now resides.

Ricky now heads up a security division for an offshore entity, and has developed an online encryption ASP that helps organisations become more secure.

Ricky M. Magalhaes' Latest Contributions

Cloud Computing; The Past, The Present, The Future (Part 1): Date - Jul 22, 2009; Section - Articles / Authentication, Access Control & Encryption; What a company needs to consider when evaluating a cloud service.
Infosec Europe: Date - May 27, 2009; Section - Articles / Authentication, Access Control & Encryption; Some of the predictions and the discussions by top Security professionals at Infosec Europe 2009.
Secure Data Disposal: Date - Mar 25, 2009; Section - Articles / Authentication, Access Control & Encryption; Secure data disposal methods; how organisations that reuse media may employ countermeasures to prevent exposure.
The End of Passwords?: Date - Jan 21, 2009; Section - Articles / Misc Network Security; The end of passwords and how new technologies will keep enterprise information assets secure.
Writing an Effective Security Policy (Part 2): Date - Dec 17, 2008; Section - Articles / Misc Network Security; How to write an effective security policy, covering elements of technical controls that should be found in the majority of policies in the world of PCI DSS, SOX, Euro SoX, Hippa and ISO 127001.
Writing an Effective Security Policy (Part 1): Date - Dec 03, 2008; Section - Articles / Misc Network Security; How to write an effective security policy.
Instant Messaging: Friend or Foe?: Date - Nov 05, 2008; Section - Articles / Misc Network Security; Taking a look at the security fundamentals and IM risks associated with opening up the messaging client access to the world.
More VOIP, More Security: What needs to be done when securing VOIP: Date - Oct 07, 2008; Section - Articles / Misc Network Security; How to implement a VOIP solution whilst abiding by a security framework, and the challenges that we can expect when implementing VOIP.
Risk Analysis: Things to Consider When Working Out How Much Risk We Carry: Date - Sep 03, 2008; Section - Articles / Misc Network Security; Understanding risk is an important element of deciding on the protection mechanism selected to protect assets. This article will focus on the framework that will help justify the appropriate controls.
The Difference Between Application and Session Layer Firewalls: Date - Jun 25, 2008; Section - Articles / Firewalls & VPNs; A review of the differences between Application and Session layer firewalls.
Security compliance: Date - May 21, 2008; Section - Articles / Misc Network Security; In this article we will focus on things your organisation can do in working towards compliance. This will better improve the security posture of your company whilst reducing the attack surface area.
Security and Virtualization: Date - Apr 30, 2008; Section - Articles / Windows OS Security; What security measures to keep in mind when using Virtual Machines.
Data Leakage, preserving confidentiality: Date - Apr 16, 2008; Section - Articles / Content Security (Email & FTP); Article focusing on data leakage and how this information asset is lost and the result of exposure. This vulnerability may be the result of inadequate measures, or poorly implemented controls that expose organizations and their clients.
Windows XP SP3 Security: Date - Feb 27, 2008; Section - Articles / Windows OS Security; In this article we will focus on Windows XP Service Pack 3 security features and Operating System changes.
PCI DSS Compliance (Part 2): Date - Jan 23, 2008; Section - Articles / Authentication, Access Control & Encryption; Maintaining a vulnerability management program, implementing strong access control measures and maintaining an information security policy.
PCI DSS Compliance (Part 1): Date - Jan 02, 2008; Section - Articles / Authentication, Access Control & Encryption; We will cover PCI DSS compliance and how to form solutions that help your organisation become complaint.
Security Market Trends for 2007: Date - Nov 07, 2007; Section - Articles / Windows OS Security; What leading organizations are doing this year to better secure their environments.
Privacy - Keeping your information confidential: Date - Oct 16, 2007; Section - Articles / Authentication, Access Control & Encryption; Important tips on keeping your information confidential when using the net.
Authentication: The Next Frontier: Date - Sep 11, 2007; Section - Articles / Authentication, Access Control & Encryption; Understanding Authentication.
Encryption Key Management: Date - Aug 22, 2007; Section - Articles / Authentication, Access Control & Encryption; What needs to be done to effectively store the keys to your encrypted data.
Secure Socket Tunneling Protocol: Date - Apr 17, 2007; Section - Articles / Firewalls & VPNs; SSTP (Secure Socket Tunneling Protocol) and the VPN capabilities it will offer in future.
An Introduction to Microsoft Forefront (Part 2): Date - Aug 09, 2006; Section - Articles / Misc Network Security; In part two of this series we will cover other parts of the Comprehensive Microsoft Forefront security suite.
An Introduction to Microsoft Forefront (Part 1): Date - Jul 05, 2006; Section - Articles / Misc Network Security; This article will take us through the comprehensive Microsoft Forefront security suite.
Security Series: Final countdown tips for Disaster Recovery and Business Continuity (Part 6 of 6): Date - May 12, 2005; Section - Articles / Misc Network Security; This article completes the DR BC series and we have covered many aspects that need to be taken into consideration when designing both a Disaster recovery and business continuity plan. WE covered documentation and the need for change control and skilled people for managing the process. We also cover some steps that can be taken now by the organization to mitigate the risk and reduce the loss of valuable data.
Security Series: Building Preparation (Part 5 of 6): Date - Apr 21, 2005; Section - Articles / Misc Network Security; In part five we take the IT professional through strategies of offsite recovery and potential solutions that could be recommended to businesses for recovery. The importance of pre-disaster preparation is highlighted and the fact that just basic preparedness is done in the event of disaster proves to be worth the time and cost invested.
Security Series: Disaster Recovery Objectives and Milestones (Part 4 of 6): Date - Mar 31, 2005; Section - Articles / Misc Network Security; In part four of the Disaster Recovery series the important project definition phase is covered, disaster recovery strategy as well as project mile stones. Importantly materials that should be stored offsite and best practice has also been highlighted.
Security Series: Formulation of the Business Continuity Plan (Part 3 of 6): Date - Mar 01, 2005; Section - Articles / Misc Network Security; In part three of the Disaster Recovery series, hardware selection, potential solutions, recovery strategies and centralization of information storage have been covered. Different levels at recoveries will take place at will help organizations to become effective when a true disaster occurs are also worked through.
Security Series: Disaster Recovery Target (Part 2 of 6): Date - Feb 01, 2005; Section - Articles / Misc Network Security; In part two of the Disaster Recovery series, we will discuss information pertaining to the organization's stance on disaster recovery. Planning of DR, potential requirements, terms of availability, business continuity, the documentation there of and the continual updating of the documentation are also covered.
Security Series: Disaster Recovery Tactics that Ensure Business Continuity (Part 1 of 6): Date - Jan 11, 2005; Section - Articles / Misc Network Security; In part one of the Disaster Recovery series potential disasters, possible events and the reason that it is vital to have a disaster recovery plan and Business continuity plan in place like an insurance policy on any valuable items are covered.
Removing Pests from Windows (Part 2): Date - Sep 28, 2004; Section - Articles / Misc Network Security; In this two part article I will discuss pests and potential issues associated with pests that may be encountered within windows. These pests are like parasites of the digital world. These parasites feed off the electronic resources of the host machine, eventually draining the machine to standstill point.
Removing Pests from Windows (Part 1): Date - Sep 22, 2004; Section - Articles / Misc Network Security; In this two part article I will discuss pests and potential issues associated with pests that may be encountered within windows. IT security professionals are faced with these resource and information divulging threats daily and because at his point there is not mature technology to deal with the problem officially it is challenging to remove these pests form the computer or server manually. These pests are like parasites of the digital world. These parasites feed off the electronic resources of the host machine, eventually draining the machine to standstill point.
How spyware & adware programs threaten network security & performance: Date - Dec 17, 2003; Section - Articles / Viruses, trojans and other malware; This article will focus on the applications that are installed on your network and home computers, which many security professionals and organizations do not know exist. These applications run in a discrete background operation and function as a spy reporting on user activity and habits that are recorded in day to day use of the computer system.
Using passwords as a defense mechanism to improve Windows security (Part 2): Date - Oct 21, 2003; Section - Articles / Authentication, Access Control & Encryption; In this article I will focus more on the global settings of password policies and where to change them to incorporate the 20 Golden rules of good password management in Part 1. This article will describe the possibilities of these policies and will run though real world reasons where these global settings should be applied. Different ways of generating passwords will also be described to make it easier for your users to come up with new passwords in a quick trouble free way.
Using passwords as a defense mechanism to improve Windows security (Part 1): Date - Sep 30, 2003; Section - Articles / Authentication, Access Control & Encryption; This two-piece article highlights the need for strong passwords. Passwords are an essential means in achieving maximum security; passwords truly serve as a first layer of defense complimenting any security strategy. Once the decision has been made to enforce the usage of passwords as part of ones goal to security achievement a further decision must be made on the type of password policy one would prefer to use. The password policy should be strict and no exemptions should be allowed.
Hardening Windows NT/2000/XP Information Systems: Date - Jul 31, 2003; Section - Articles / Windows OS Security; This article is written as a security guideline to help administrators and security professionals to be able to configure windows in a more robust way. The recommendations in this whitepaper assume that the computer is physically secure.
Host-Based IDS vs Network-Based IDS (Part 2 - Comparative Analysis): Date - Jul 17, 2003; Section - Articles / Intrusion Detection; The second paper in this two part series, this white paper will focus on HIDS (Host Based Intrusion Detection System)and the benefit of a HIDS within a corporate environment. A comparative analysis will also be done representing the industry leaders and will conclude by deriving at a calculated recommendation. This will aid organizations when deciding on a comprehensive HIDS or NIDS solution.
Host-Based IDS vs Network-Based IDS (Part 1): Date - Jul 10, 2003; Section - Articles / Intrusion Detection; This white paper will highlight the association between Network Based and Host based intrusion detection. A product comparison will be incorporated in a following white paper part 2 to assist in the selection of the appropriate IDS for your organization. Important facts and consideration will be highlighted to assist when selecting a sound intrusion detection system. This white paper will give you a better understanding of the differences between NID and HIDS and will highlight the strengths and weaknesses of both concurrently extending your knowledge and increasing your understanding of the IDS systems.
The Ins and Outs of Network Analyzers (Part 2): Date - Jul 02, 2003; Section - Articles / Misc Network Security; The second installment in this two part series, in this article I have focused on the ideas and workings of most well known industry sniffers. The article is written to assist you in making a more educated decision when picking the sniffer of your choice and will definately aid you when it comes to hunting for value features.
The Ins and Outs of Network Analyzers (Part 1): Date - Jun 10, 2003; Section - Articles / Misc Network Security; In this two part article I will focus on Network analyzers, the different forms they come in. I will also materialize what threat they pose to the corporate network, how they can be used as a vital troubleshooting tool and what to look for when searching for a sniffer.
Using Protocol Rules to Block Specific Protocol Access to Sites: Date - Jun 03, 2003; Section - Articles / Authentication, Access Control & Encryption; In this tutorial I will cover how to block specific user accessing a resource related to a specific protocol on the internet. In most business environments it becomes important to have granular control on your domain users and your IP protocol stack. With this in mind you will find that you can use ISA to reduce specific protocol traffic at various times making more bandwidth available for other more productive activities.
Digital Signatures: Date - May 29, 2003; Section - Articles / Authentication, Access Control & Encryption; In this article I will clarify what a digital signature is and will demonstrate ways of using this technology to validate the identity of a user. The internet is filled with fraudulent villains that can take you or your organization to the cleaners, without you even knowing about it till it’s too late.
Understanding Windows Logging: Date - May 13, 2003; Section - Articles / Windows OS Security; This article will focus on the importance of monitoring your windows event logs and will highlight the information that is able to be extracted from typical windows logs that help to secure your critical servers. The importance of monitoring the logs will be stressed and creative ways to do this centrally will also be covered. Logging is a very important factor when attempting to decipher what has taken place on a server.
Minimizing the effect of DOS attacks and overflows on your DNS servers: Date - Mar 27, 2003; Section - Articles / Misc Network Security; This whitepaper will focus on strategies used when minimizing downtime caused by DOS attacks, aimed at DNS servers. To achieve high potency intruders focus their efforts on machines that have a high impact on the network, Windows 2000 networks rely a great deal on DNS. Intruders know this, and your focus should be turned to securing the organizations DNS server.
Securing Windows 2000 DNS by using configuration (Part 2): Date - Mar 20, 2003; Section - Articles / Windows OS Security; Several configuration methods and a quick configuration guide have been devised to assist organizations in the secure configuration of their DNS servers. This document is intended to provide clarification when enabling the operational configuration requirements of the organizations configuration of secure DNS.
Securing Windows 2000 DNS by design (Part 1): Date - Mar 13, 2003; Section - Articles / Windows OS Security; This white paper will focus on the importance of securing your Windows network’s DNS service and the features, functionality and security of the DNS server by using design. Several deployment methods for DNS in a Windows 2000 environment will be covered and defined. This document is intended to provide clarification when enabling the operational requirements of the organizations designing secure DNS.
Understanding Virtual Honeynets: Date - Mar 06, 2003; Section - Articles / Intrusion Detection; This white paper serves as a reference and knowledge repository on Honeynets and their function within modern interconnected organizations. Honeynets are used as a counter intrusion strategy when learning about intruder’s trends and tactics. Honeynets give you the ability to identify the tools and attack strategies that intruders use against you. Significant information like the information provided by honeynets proves to be vital and should be studied and incorporated into your counter intruder strategy.
Securing Windows 2000 Active Directory (Part 4) - Restoration: Date - Jan 29, 2003; Section - Articles / Windows OS Security; In this article I will focus on how important restoring the active directory is compared to running it securely. Having an un-restorable backup is disastrous especially if your AD has been corrupted by an attacker or a new AD targeting virus. There is no point in backing up and having thousands of dollars invested in a backup strategy if you can not restore.
Securing Windows 2000 Active Directory (Part 3) - Backup and Restoration: Date - Jan 06, 2003; Section - Articles / Windows OS Security; In this article I will focus on the active directory process. As part of securing your active directory you need to ensure that as a contingency plan you are able to restore your active directory in event of disaster.
Securing Windows 2000 Active Directory (Part 2): Date - Dec 20, 2002; Section - Articles / Windows OS Security; Protecting active directory’s integrity is paramount. This is the second article in the two part series that focuses on active directory security. Active directory is the windows 2000 information repository that needs to be kept very secure. Active directory has vital service dependencies such as DNS which changes the scope of what needs to remain secure. I will focus on actions that you can take in order to safeguard the active directory service.
Securing Windows 2000 Active Directory (Part 1): Date - Dec 02, 2002; Section - Articles / Windows OS Security; Protecting active directory’s integrity is paramount. This article will focus on active directory security and will be written in two parts. Active directory is the windows 2000 information repository that needs to be kept very secure. Active directory has vital service dependencies such as DNS which changes the scope of what needs to remain secure. I will focus on actions that you can take in order to safeguard the active directory service.
Network Security recommendations that will enhance your windows network: Date - Oct 22, 2002; Section - Articles / Misc Network Security; Securing your network should be treated with the utmost priority. Knowing that your network is being attacked is a great advantage that will serve as a powerful tool. If your network security strategy is employed correctly you should not have a major challenge with intruders.