Garry McCracken

68 posts

Garry, a CISSP, has more than 30 years of experience in data communications and information security. He has contributed to the development of WinMagic's full-disk encryption solutions for desktops, laptops, and other mobile devices. When he is not saving the world of data encryption, he takes off his cape to relax and enjoy life at the cottage. Garry writes from a position of technical expertise since we first started SecureSpeak, making him the longest running blogger at WinMagic.

Cybersecurity Insurance & MFA

Situation Many companies have found the evolving threat landscape has made cybersecurity desirable, and some companies even require their suppliers have an adequate amount of cybersecurity insurance in place before doing business with them. If you are applying for cybersecurity…

Sep 15, 2022

Garry McCracken

A Revolutionary Innovation in User Authentication

For as long as organizations have used the internet to conduct business, online security threats such as phishing emails, credential theft and malware attacks have been an unfortunate and ever-present shadow over their digital operations. One of the foundational defenses…

Feb 9, 2022

Garry McCracken

How Zero Factor Authentication Is Securing the Future

Too often, the weight of ensuring an organization’s digital security falls on the shoulders of the poor end user. Burdened with the responsibilities of remembering multiple passwords, juggling countless devices that receive codes and keys, and trying their best not…

Jan 13, 2022

Garry McCracken

What is passwordless and why does it take a journey to get there?

Let’s start the journey with the destination in mind. In a passwordless world you will no longer need to remember a complex string of letters, numbers, and special symbols for each site or server you connect to. In a passwordless…

May 5, 2021

Garry McCracken

Encryption and Authentication at the endpoint

Introduction In this blog I explain why it makes sense to use the same endpoint security solution for both encryption for data at rest on the device and authentication to servers and web services such as SaaS. First; what are…

Apr 9, 2021

Garry McCracken

Choosing the right architecture to establish and maintain a user session with the “authentic” user.

The purpose of this blog is to examine the issues related to a Relying Party (RP) authenticating a user, establishing a user session with that user, and then maintaining confidence that the user at the other end of the session…

Mar 18, 2021

Garry McCracken

FDE and the Opportunistic vs Dedicated Adversary (Do a Risk Assessment)

I have always been a proponent of doing a security risk assessment in order to determine the amount and depth of controls required to protect information appropriately. Risk is a function of the probability and the impact of a successful…

Nov 25, 2019

Garry McCracken

Linux Servers and Encryption – the Need and the Solution

In the past, I have tried to make the case for encrypting physical servers on premises. The argument for not needing to encrypt them is that these servers usually run for weeks, months, or even years without being brought down.…

Jan 24, 2019

Garry McCracken

Full Drive Encryption, Key management and MBAM

(Microsoft announces end of mainstream support for MBAM as of July 2019) WinMagic’s CEO, THI NGUYEN-HUU, has blogged in the past about the ideal architecture for Full Drive Encryption, and Key Management (Separating Encryption and Key Management). By separating key…

Dec 14, 2018

Garry McCracken

Self-encrypting deception: Weaknesses in the encryption of solid state drives (SSDs)

In the past few weeks I have been looking into the fallout from the paper [PDF] by Carlo Meijer and Bernard van Gastel from Radboud University, the Netherlands titled “Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs)”. From the…

Dec 7, 2018

Garry McCracken

The Cold Boot Attack is Back

The Cold Book Attack was resurrected last week by some researchers at f-secure https://press.f-secure.com/2018/09/13/firmware-weakness-in-modern-laptops-exposes-encryption-keys/ . I would like to provide some context for both the exploit and the mitigations because the cold boot attack is just the tip of the…

Sep 19, 2018

Garry McCracken

Do physical servers really need to be encrypted?

In the past, I have tried to make the case for encrypting physical servers on premise. The argument for not needing to encrypt them is that these servers usually run for weeks, months or even years without being brought down,…

Sep 17, 2018

Garry McCracken

Cybersecurity Insurance & MFA

A Revolutionary Innovation in User Authentication

How Zero Factor Authentication Is Securing the Future

What is passwordless and why does it take a journey to get there?

Encryption and Authentication at the endpoint

Choosing the right architecture to establish and maintain a user session with the “authentic” user.

FDE and the Opportunistic vs Dedicated Adversary (Do a Risk Assessment)

Linux Servers and Encryption – the Need and the Solution

Full Drive Encryption, Key management and MBAM

Self-encrypting deception: Weaknesses in the encryption of solid state drives (SSDs)

The Cold Boot Attack is Back

Do physical servers really need to be encrypted?