I am still trying to shake this cold, plus I've been out most of the day, so not much to report. I have been looking into a new toy. What do you think?
posted by mt at 21:19

Sorry for the lack of posts, I'm a bit under the weather today and have been away from the computer. I did come across this article which discusses secure programming and college CS courses. It's an issue which should be as relevant as any other taught in class: efficiency, design, OOP, software engineering.

Here is a piece discussing some recent criticism of NASA's operational security regarding shuttle launches - it doesn't sound like they did a very good job.

Atlantis' 5:12 p.m. launch time -- one of NASA's worst-kept secrets -- officially remained confidential until Wednesday despite being known for weeks by thousands in the shuttle program and being readily available on the Internet. Under NASA's new policy, the space agency will release only a four-hour launch window until the day before liftoff. Then, all of the times for the mission's milestones, including the shuttle's landing, will be made public.

That's probably it for today, I've got to shake this cold - too much to do!
posted by mt at 12:26

Microsoft is releasing a line of security products. What can I say? Stop laughing, it's not a joke. Perhaps this is a late April Fools headline?
posted by mt at 18:27

Security in schools is difficult, especially in collegiate environments. It's hard because so many people need to do different things. And unlike a corporation, you cannot deem something unnecessary - it might be required for research. Moreover, large university networks have a history of being relatively loose on policy. Definitely one of the more challenging places I've ever addressed security.
posted by mt at 18:22

Nothing like trash talking tech giants. In this case, Checkpoint, makers of the commercial juggernaut Firewall-1 software, come out firing against Cisco - one of the largest companies in the world. I love it!

"Cisco keeps on re-inventing their security strategy every few years because they keep on failing to get it right," he said. "They should leave it to those who know. Cisco does not co-operate in the security industry either which could be one of the reasons for their products' shortcomings."

Read the rest of the insults here.


posted by mt at 11:59

For the frequent fliers - some advice on getting your technical gear through security. Laptops and other electronics are now scrutinized heavily, rightly so. This can be a hassle, especially if you're in a rush. Sadly, the article recommends not bringing them onboard altogether.
posted by mt at 11:53

There's a piece on social engineering at ZDNet. The message is good, but I don't think removing instant messaging will solve any problems - as the author suggests. Training, awareness and communication or the only things that can protect an organization from such threats.

You can't stop con artists from trying to take advantage of your employees and your business. But you can educate your workforce so they're prepared to deal with them.

posted by mt at 08:45

Anytime I see a football metaphor in a security article, I'll pass it along.

Finally, agencies should provide continual training in and enforcement of security policies and procedures, even if they seem obvious. Wright likened this to the hundreds of hours that football players spend doing basic drills at training camp.

"The idea is repetition, and the pro football players know it," Wright said. "That's how you get good at it."

posted by mt at 08:32

This Kazaa nonsense is mind boggling. Evidently they were planning on using their software to control the PC's of people who used the service. They could do all sorts of things - marketing, distributed processing and plenty of snooping. If you downloaded this - get rid of it! Switch over to Gnutella. Plenty of content and clients for several platforms. And Gnutella won't use your computer for their own gain.
posted by mt at 22:16

How true it is.


posted by mt at 11:43

According to this study, laziness is still a major element in security flaws.

There is a correlation between the increase in concern about securing the enterprise and the rise in vulnerabilities. While companies invest in protecting their business processes they are not allocating enough resources to address the true problems.

Much of these security problems can easily be addressed. The report showed many network managers fail to apply patches, or properly configure hardware and software. It said the sophistication of security technologies makes it difficult for network administrators to keep up to date.

Companies could eliminate 95% of potential threats by implementing elementary security features on new devices. Every piece of equipment should be secured before deployment.
posted by mt at 09:30

The FBI is improving its audit trails in light of an internal security review.

It will closely limit access to sensitive electronic documents to only those agents approved to look at them, and it will track who prints copies, said Chiaradio, the FBI's executive assistant director for administration. He said the FBI's current technology can't keep track of who is looking at what online.

posted by mt at 09:07

Newsforge has some examples which demonstrate the need to constantly update security.

The reason I wrote this article is for purely selfish reasons. Those people, such as ISPs, who expose themselves to attack expose us as well! I still do random checks on my subnets, and I still find weaknesses. People are not perfect and not all of them are network professionals, but we could limit attacks if people would at least do some system hardening.

posted by mt at 15:07

A quote from a story on "white collar" hacking:

Professor Piper said, “The biggest obstacle to greater Internet security is corporate complacency. Many businesses fail to protect themselves, believing that hackers are only interested in consumer crime, such as online credit card fraud..."

What's funny is that home users believe the exact opposite - hackers only care about business machines. I pointed this out in a recent article for SecurityFocus:

People often assume they possess nothing of interest to crackers. Some believe that, with millions of potential targets on the Net, they can safely slip under the security radar. Such assumptions are false. Crackers are not necessarily after secret files or valuable corporate data, many just want a machine - fast.

So there you have it, everyone on the Internet thinks crackers are after somebody else. We're all targets, big and small, corporate and broadband, every machine is a potential victim.
posted by mt at 13:25

Tales of war-driving from O'Reilly.

It wasn’t long into my trip to Charlotte before access points started popping up on my screen quicker than I could count. I found access points coming from industrial centers along the interstate's service road, along with convenience stores and other shops. Even while crossing high overpasses a few new ones would pop up.

posted by mt at 10:06

The Washington Post has an informative piece on what it takes to get a security clearance. This is something a lot of people ask me about. Unfortunately, September 11 has added to the glut of existing applicants - the average processing time is 6-18 months.
posted by mt at 09:01

A Carnivore story to start the day off. It's actually a rehash of something I posted a week ago, but this bit jumped out at me.

Regardless of whether people approved of its decision, the FBI deployed Carnivore on ISPs across the country after September 11th, according to numerous reports.

While EarthLink had resisted Carnivore deployment on its network prior to the attacks, an EarthLink spokesperson told NewsFactor shortly afterward that he assumed every large ISP in the country had been contacted by the FBI and that all of them were cooperating.

posted by mt at 08:53

There's a good look at the state of antivirus technology on SecurityFocus. The author speculates on the direction of the industry and how the virus scanner, as we know it, needs to evolve.

To keep up with constantly emerging viral attacks, vendors must devise new definition files and sometimes new scan engines. In order to design a new virus definition file, a virus researcher has to obtain a “live” copy of a new virus (sometimes not the easiest thing to do), determine its behaviors through testing, decipher its algorithms to determine precisely what it does, decompile it if its code is compiled and determine how best to detect its presence. In some cases a virus will use encryption (Hybris is a good example), and the researcher cannot decrypt the virus. This leaves behavioral verification as the only method of determining how best to detect the virus.

posted by mt at 21:57

Dorothy Denning is working on an interesting idea - an encryption scheme which uses geographic location as part of the key. Loads of commercial and military applications could make use of this.

Working with a Hollywood movie executive and an Internet entrepreneur, Denning has invented a way to keep information scrambled until it reaches a precise location, as determined by GPS satellites. Armed with Denning's geo-encryption system, which she co-patented in 1998, only people in specified locations, such as movie theaters, living rooms or corporate conference rooms, would be able to unscramble the data.

But the idea also has drawn interest from the Pentagon. Coded messages that the Defense Department sends its commanders in the field, for example, could be deciphered only in a certain room of a certain building in, say, Kandahar—greatly reducing the risk of malicious interception.

posted by mt at 13:33

This is classic - probably the funniest thing we'll read all month. I wonder if it's an April Fools Joke? It can't be true!

A Web site sponsored by Microsoft and Unisys as a way to steer big companies away from the Unix operating system is itself powered by Unix software.

posted by mt at 09:38

How has Microsoft gotten away with downplaying security for so many years? And now it's the focus of every article you see coming out of Redmond. Amazing.

In a meeting with eWEEK last week, several Microsoft executives responsible for security software development said the company is also changing the way it ships some products to make them safer and will begin developing its own line of security software.

posted by mt at 09:19

The St. Louis Post Dispatch has an article on blogs in the Sunday A&E section, check it out. They give a good introduction to this strange, new world.
posted by mt at 09:48