Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user msutton@zscaler.com

Michael Sutton

The Journey Has Just Begun
Zscaler Cloud Platform
3 Min read

The Journey Has Just Begun

In early 2008, I received a phone call that would ultimately change my career. The caller pitched his vision of the future of internet security and suggested that we should discuss the company that he was launching, then...
On the Severity of the Equifax Breach
Insights and Research
3 Min read

On the Severity of the Equifax Breach

It was recently revealed that that credit monitoring service Equifax was breached, leaking the information of 143 million customer, or about 57% of the US population over the age of 18. The potential acts of poor design,...
Recent IoT-powered DDoS attacks should serve as a wakeup call
Insights and Research
3 Min read

Recent IoT-powered DDoS attacks should serve as a wakeup call

Earlier today, a large DDoS attack disrupted a significant portion of Internet traffic, starting on the US East Coast, spreading to the West Coast and ultimately Europe. This attack was particularly damaging as it wasn't...
Yahoo breach affects half a billion users...world shrugs
Insights and Research
4 Min read

Yahoo breach affects half a billion users...world shrugs

While the press and rumor mill turn full tilt in the wake of the announcement from Yahoo last week that it had been the victim of perhaps the largest known data breach ever (more records were breached than there are citi...
2016 Security Predictions
Insights and Research
13 Min read

2016 Security Predictions

As the year comes to a close and winter sets in, we like to look back at the year that was and do our best to prepare for the year ahead. What would the holiday season be without yuletide cheer, excessive commercial...
Heartbleed Check Added To ZULU
Insights and Research
1 Min read

Heartbleed Check Added To ZULU

Many of you already regularly use ZULU, our free service for analyzing any URL to determine it's overall risk and we've just made it better by adding a 'heartbleed' check. ZULU operates by applying a variety of checks t...
Why You Should Care About The OpenSSL Heartbleed Vulnerability
Insights and Research
2 Min read

Why You Should Care About The OpenSSL Heartbleed Vulnerability

Yesterday, researchers from Google and Codenomicon made quite a splash when they revealed details of a vulnerability in OpenSSL's implementation of the heartbeat extension, which they have affectionately dubbed heart...
Scams Taking Advantage Of Malaysia Airlines 370 Disappearance
Insights and Research
2 Min read

Scams Taking Advantage Of Malaysia Airlines 370 Disappearance

I spent some time today looking for sites that are taking advantage of the disappearance of Malaysia Airlines flight 370 (MH370) to profit from the tragedy. Unsurprisingly, it was all too easy to find examples of this as...
Obama Seeks to Appease Security and Intelligence Community
Zscaler Cloud Platform
2 Min read

Obama Seeks to Appease Security and Intelligence Community

The changes that President Obama proposed today are akin to a renovation project, not an overhaul. To further the analogy, he focused on the kitchen, not the less visible basement den. Overall, few of the recommendations...
Beyond the Hype: The APT Defense Lifecycle
Zscaler Cloud Platform
2 Min read

Beyond the Hype: The APT Defense Lifecycle

Today, Zscaler announced the industry’s first comprehensive cloud-based solution for advanced persistent threat (APT) security. The big news here is not only that we’re delivering this solution through the cloud, but als...
Sutton on Security: Viewing Online Privacy through PRISM
Zscaler Cloud Platform
2 Min read

Sutton on Security: Viewing Online Privacy through PRISM

The revelation of the NSA PRISM program has a lot of people talking about online privacy. I recently spoke with USA Today and American Public Radio about PRISM and online data privacy, which got me thinking about some pr...
Super Bowl 2013 Web Traffic
Insights and Research
1 Min read

Super Bowl 2013 Web Traffic

It's always fascinating to see how a major global event can impact Internet traffic patterns. There aren't many sporting events larger than the Super Bowl, so we took a look at the web traffic that we were seeing on the ...
Mobile App Wall Of Shame: ESPN ScoreCenter
Insights and Research
4 Min read

Mobile App Wall Of Shame: ESPN ScoreCenter

ESPN ScoreCenter Price: Free Category: Sports Updated: Dec 19, 2012 Version: 3.0.0 Build 361 Size: 13.1 MB Language: English Vendor: ESPN Inc. Operating System: iOS Update: [01/18/13 4:19pm EST] Zs...
2013 Security Predictions
Insights and Research
5 Min read

2013 Security Predictions

Ah, my favorite time of the year – chestnuts roasting on an open fire, a brisk chill in the air and of course…predictions of all that await us in the coming year. Given my amazing historical accuracy (all archived ...
Introducing ZAP
Insights and Research
3 Min read

Introducing ZAP

Access ZAP - http://zap.zscaler.com View a video walkthrough for ZAP ZAP Home Page After many months of hard work by the ThreatLabZ Team, I'm very pleased to unveil ZAP (Zsca...
Introducing Project Zulu
Insights and Research
3 Min read

Introducing Project Zulu

I want to personally and publicly thank Julien, Pradeep and Mike for all of their hard work over the past several months, to make today's launch of Project Zulu a reality. Zulu is a completely free service, open to anyon...
2012 Security Predictions
Insights and Research
4 Min read

2012 Security Predictions

It’s the most wonderful time of the year. A time when we set aside our quarrels and show compassion for complete strangers, realize that it’s better to give than to receive and in the security industry, let everyo...
Malware Sites Already Capitalizing On Announcement Of Osama Bin Laden's Death
Insights and Research
1 Min read

Malware Sites Already Capitalizing On Announcement Of Osama Bin Laden's Death

Update (025/02/11 9:40am EST): A before/after comparison of the photoshopped image used in the malicious post can be found here. Within hours of the announcement of Osama Bin Laden's death, we are already seeing ...
Will Mobile Apps Be The Achilles' Heel Of Web Security?
Insights and Research
4 Min read

Will Mobile Apps Be The Achilles' Heel Of Web Security?

Inspired by a post yesterday from Alasdair Allan and Pete Warden discussing how the iPhone records and stores geo-location data, I decided to poke around to see what other interesting security issues may be lurking ...
USPS.gov Website Infected with Blackhole Exploit Kit
Insights and Research
4 Min read

USPS.gov Website Infected with Blackhole Exploit Kit

Update (04/07/2011 10:03am PST): USPS officials have taken the http://ribbs.usps.gov web site down to address the infection. A United States Postal Service website (http://ribbs.usps.gov) has been infected with t...
2011 Security Predictions
Insights and Research
7 Min read

2011 Security Predictions

It’s that time of year again. As I prepare for my annual pilgrimage to the Great White North to visit family, I also turn my attention to the annual tradition of predicting the future. The beauty of the security indust...
Latest Facebook Clickjacking Attack - This Poor Girl Killed Herself...
Insights and Research
2 Min read

Latest Facebook Clickjacking Attack - This Poor Girl Killed Herself...

Clickjacking is really starting to be embraced by attackers since Jeremiah Grossman and Robert Hansen first spoke about it at OWASP NYC AppSec 2008. One of the primary targets for Clickjacking has been Facebook and most ...
Help Contribute To The Cloud Security Alliance 'Top Threats' V2.0
Insights and Research
3 Min read

Help Contribute To The Cloud Security Alliance 'Top Threats' V2.0

In March of this year, at RSA 2010, the Cloud Security Alliance, officially unveiled the Top Threats to Cloud Computing. This was a collaborative effort that drew upon the expertise of some of the finest minds in the s...
Antivirus Struggling With Obfuscated JavaScript
Insights and Research
2 Min read

Antivirus Struggling With Obfuscated JavaScript

As part of our offline research, we regularly test various desktop antivirus (AV) solutions to determine how effective they are at catching web based threats. One segment where I feel that AV has struggled, is with ...
Fake Vancouver Winter Olympic Videos Spreading Malware
Insights and Research
1 Min read

Fake Vancouver Winter Olympic Videos Spreading Malware

It certainly didn't take attackers long to take advantage of the Olympic Winter Games, which began today in Vancouver. Within minutes of the completion of the opening ceremonies, Twitter messages were appearing from an a...
The Death Of IE 6 Is Greatly Exaggerated
Insights and Research
3 Min read

The Death Of IE 6 Is Greatly Exaggerated

Champagne bottles were popping this week as victory was declared in the war on IE6. I say not so fast. The effort to rid the world of IE6 has been going on for some time but a couple of recent high profile events have br...
What We Can Learn From Google's China Attack
Insights and Research
3 Min read

What We Can Learn From Google's China Attack

The internet has been abuzz over Google's admission that it was targeted in a coordinated and allegedly state sponsored cyber attack. Some are applauding Google's stance, while others question Google’s true motivation. T...
2010 Security Predictions
Insights and Research
4 Min read

2010 Security Predictions

2009 was the year that we learned the meaning of the word recession and looked to the cloud for answers. Budgets were slashed and security departments were forced to do more with less, all while cybercrime rates rose as ...
Twitter Follower Scams
Insights and Research
5 Min read

Twitter Follower Scams

Introduction It's cool to be on Twitter but it's cooler still to have more followers than your neighbor. Some are so desperate to move into the lead that they're pulling out their credit card to get there. Those gullibl...
Watered Down Phishing Protection In IPhone OS 3.X?
Insights and Research
3 Min read

Watered Down Phishing Protection In IPhone OS 3.X?

[Update: 09-13-09 @ 5:43pm EST - Looks like we may have finally resolved this. Apple has apparently issued a statement indicating the the anti-phishing filter doesn't take affect until the denylist is downloaded, which o...
We Used To Laugh At XSS
Insights and Research
3 Min read

We Used To Laugh At XSS

I remember at Defcon 10 in 2002, when members of GOBBLES took to the stage for their much anticipated talk about the state of the security industry. The talk turned out to be a largely incoherent, but entertaining r...
Gmail And HTML 5
Insights and Research
4 Min read

Gmail And HTML 5

If you accessed Gmail today on your iPhone or Android based phone using a web browser, you will have noticed some differences. It has a few more bells and whistles but of particular interest is the addition of offline ac...
Hugs Not Bugs
Insights and Research
5 Min read

Hugs Not Bugs

At CanSecWest last week, a group of researchers (Charlie Miller, Alex Sotirov and Dino Dai Zovi) stirred up a fair bit of controversy by pushing a "No More Free Bugs" campaign. The premise of which was that they are unwi...
Mobile Browser (In)security
Insights and Research
3 Min read

Mobile Browser (In)security

For the past couple of days, the Interwebs have been buzzing about pending new features in iPhone OS 3.0. One Item that barely received any mention whatsoever, but was pleasantly jaw-dropping for me, can be seen in the i...
The World According to TinyURL
Insights and Research
5 Min read

The World According to TinyURL

According to Wikipedia, TinyURLs have been banished from the likes of MySpace, Yahoo! Answers, Orkut and Wikipedia itself due to concerns that it is a favored tool of spammers. It's not entirely surprising given that the...
Interim Patches
Insights and Research
3 Min read

Interim Patches

On September 16, 1997, Apple named Steve Jobs Interim CEO, a year after returning to the company that he had founded. Bud Selig served as interim commissioner for six years before Major League Baseball officially handed ...
Demystifying/Abusing Flash Cookies
Insights and Research
5 Min read

Demystifying/Abusing Flash Cookies

Flash Cookies (aka Local SharedObjects) are increasingly being leveraged by developers as a powerful alternative to HTTP cookies, yet there seems to be significant confusion as to what they are capable of and what securi...
Practical Example Of CsSQLi Using (Google) Gears Via XSS
Insights and Research
4 Min read

Practical Example Of CsSQLi Using (Google) Gears Via XSS

Comment: I would like to go out of my way to thank Paymo.biz for the professionalism that they displayed in promptly responding to vulnerabilities brought to their attention to ensure that their users were protected. Wit...
Rough Week For Security Companies
Insights and Research
3 Min read

Rough Week For Security Companies

It's been a rough week for security companies, especially for their web masters. A Romanian hacking group decided to embarrass as many as possible by identifying SQL injection (SQLi) flaws in public facing websites and K...
Stepping Through JavaScript Obfuscation
Insights and Research
4 Min read

Stepping Through JavaScript Obfuscation

I've been noticing an increasing number of attacks whereby malicious IFRAMEs are injected into the pages of otherwise reputable sites. While such activity is often very obvious as you can spot an IFRAME right before the ...
Heartland Payment Systems Joins A Crowded Club
Insights and Research
2 Min read

Heartland Payment Systems Joins A Crowded Club

This week Heartland Payment Systems confessed to what may ultimately be the largest data breach ever, with some suggesting that as many as 100 million credit cards have been exposed. This makes the 2007 TJ Maxx breach of...
Why Is Conficker/Downadup Succeeding?
Insights and Research
2 Min read

Why Is Conficker/Downadup Succeeding?

It has been a while since we've seen a fast spreading worm affect a significant volume of victims. This past week however a new variant of Conficker (aka Downadup) reportedly infected millions of Windows machines. So cal...
2009 Web Security Predictions
Insights and Research
10 Min read

2009 Web Security Predictions

2009 is a year when some fundamental shifts in web technology will begin to take hold and attackers will adjust accordingly. With the emergence of revolutionary changes such as cloud computing, widespread adoption of nex...
Breaking Down Broken SSL
Insights and Research
4 Min read

Breaking Down Broken SSL

On December 30, 2008 at the 25th Chaos Communication Congress (CCC) in Berlin, seven researchers presented a talk entitled 'MD5 Considered Harmful Today: Creating a Rogue CA Certificate'. In essence, they made the theore...
Turning A Blind Eye
Insights and Research
3 Min read

Turning A Blind Eye

All too often, evil is lurking right under our noses, yet we choose to turn a blind eye. Sometimes we do this out of fear. After all, if we get involved, we too could get hurt. Other times however, we are just as much to...
Stepping Through A Mass Web Attack
Insights and Research
3 Min read

Stepping Through A Mass Web Attack

A few days ago, Kaspersky reported on yet another mass web attack. Such attacks are quickly becoming a preferred attack vector as they permit mass infection with minimal effort. We've seen this before, and not just once....
Cloud Services For Analyzing Malware
Insights and Research
3 Min read

Cloud Services For Analyzing Malware

Despite continuing promises from software vendors, malware isn't going anywhere. Analyzing malware to protect against it and repair the damage that it may have done, is a significant part of the job description for many ...
Ports Are Meaningless
Insights and Research
2 Min read

Ports Are Meaningless

I read an interesting survey today commissioned by FaceTime Communications. This is their fourth such annual report and while the overall findings were unsurprising, it highlights a growing problem - how to control appli...
Ubiquity Foreshadows Future Browser Security Challenges
Insights and Research
4 Min read

Ubiquity Foreshadows Future Browser Security Challenges

When I can, I like to investigate emerging open source projects, both to satisfy my curiosity and to gain insight into security challenges to come. I recently stumbled across one such project from Mozilla Labs, known as ...
Cloud Cover
Insights and Research
2 Min read

Cloud Cover

The term 'cloud computing' is quickly becoming a standard part of our vernacular but do security services have a place in the cloud? We have seen a handful of fundamental shifts in computing over the decades and I firmly...

Explore More Topics