Skip to content
PwnDefend
  • Base
  • Comms Room
    • Customer Feedback
    • Company Information
    • Security Management
  • Services
    • Consulting Services
      • Enterprise Security Posture Assessment
      • Cyber Security Assurance & Security Testing Services
      • IT Security Healthchecks
      • Active Directory Assessment Services
      • Managed Remediation Services
    • Emergency Cyber Incident Response Support
    • Our Success Stories
    • Partner Services
  • Blog
Leadership

Password Managers in a Post LastPass breach World

Can you lose maybe 25 million peoples vaults and still claim to be a secure secret management company? Does that even fly? Does it matter that you lose all the metadata (IP access logs), URLs and vast amounts of other metdata but don’t worry ~5 fields are encrypted so as long as your master password is never cracked… yawn…

Setting an Example

Read more “Password Managers in a Post LastPass breach World” →
Threat Intel

LastPass Breach – The danger of metadata

When an organisation suffers a data breach it’s usually bad. When an organisation that stores 25 million people’s passwords that’s really bad.

There are multiple risks here at play.

Firstly, when we give people our data, it’s our risk and our choice. I’m ok with that, I chose to give lastPass my data.

My vault data might be gone, but I have a strong master password, how we interpreted the theft of the basically cryptographic materials is a bit like when we full disk encrypt a drive.

If you lose a laptop that’s got FDE do you report this as a data loss to the ICO? Or do you say, it’s encrypted so actually I haven’t lost the data per say, I’ve just lost a random (ish) bunch of 0s an 1s so I don’t count that as an incident? I’m not here to be judge or jury.

Read more “LastPass Breach – The danger of metadata” →
Copyright (c) Xservus Limited