The InfoSec Blog

System Integrity: Without Integrity you don’t have Security

December 29th, 2006

Can-Spam Law A ‘Big Disappointment’

http://www.crn.com/nl/crndailynews/showArticle.jhtml?articleId=196800022

The article opens

As the federal Can-Spam Act nears its third anniversary, a spam researcher calls it a “big disappointment” and says it hasn’t been a deterrent to junk e-mailers, who have stepped up their efforts in the last few months to flood inboxes with an unprecedented volume of spam.

Indeed.

This last week I have been seeing about 300 to 500 items of spam compared to around 50 legitimate items of e-mail in my mailboxes each day.

Or truth be told I don’t see them. I run SpamAssassin and it catches them and puts them in a junk folder.

Read the rest of this entry »

December 28th, 2006

UK Health Minister makes U-turn on medical record database

The following from Dr Gordon Atherly.


Minister admits U-turn on NHS database amid privacy fears

John Carvel, social affairs editor
Tuesday December 19, 2006
The Guardian

The government gave a categorical assurance yesterday that NHS patients would have an absolute right of veto on any part of their medical records being uploaded to a national database.

The health minister Lord Warner confirmed a report in the Guardian on Saturday that the government was abandoning an attempt to oblige GPs to provide a medical summary on every patient for a centralised electronic record.

He acknowledged changing the policy over the past few weeks in response to the concerns of patients who feared unauthorised disclosure of their medical histories. He said the fears were groundless but offered assurances that were firmer than in the briefing to the Guardian last week.

Read the rest of this entry »

December 11th, 2006

What exploitation of “Child Labour”?

http://news.bbc.co.uk/1/hi/technology/6220416.stm

We’ve seen the reports in the glossy weeklies about the revolutionaries in Africa recruiting young children. Our Western sensibilities are offended by this “corruption of innocents”. But here’s something more like the criminal ‘child labour’ gangs of Dickens.

Dickens had a unique perspective on the subject of child labour, reflecting upon his own experience working at Warren’s Blacking Factory at the age of twelve when his father was held in debtor’s prison. Completely on his own, working long hours in rat-infested quarters, young Dickens felt abandoned by his family, and his bitterness over this period of his childhood continued to influence his life and writings

How different from the well educated, well fed modern child of middle-class parents in a room of his own in suburbia surrounded by the trappings of modern adolescence and with all that computing power. Dickens would be hard pressed to pen a novel that fostered enough sympathy for the plight of such children as to press for social reform.

The boom in cyber crime is forcing criminals to go to great lengths to recruit skilled hackers, says a report.Some criminal gangs are paying students while they study to ensure they have a pool of tech-savvy workers to call on, says the report from McAfee.

Others are cashing in on the glamour of the hi-tech world to tempt youngsters into embarking on a life of crime.

McAfee said children as young as 14 years old were being targeted by some criminal gangs.

What a contrast from Dickens’s time when the children were forced by economic circumstance to work long hours under dreadful conditions with a high mortality rate.

Personally, I feel the media has a lot to be accountable for with the way it glamorizes “hackers” and criminal activity. The movie “Swordfish” probably rolls all these factors into one better than any other I can think of.

Swordfish

As well as the direct route of targeting students, some organised crime gangs were trading on the glamour surrounding the “hacker” label to help them recruit impressionable youngsters, revealed the report.

The aura of rebellion the name conjured up helped criminals ensnare children as young as 14, suggested the study.

So what will this lead to? More parental paranoia and control? By some, probably, but more likely not by those whose children are most at risk. The practice of instilling fear in parents about their children for any number of reasons, academic achievement, exposure to physical and on-line predators, that they don’t get enough ‘ice time’, and so many other factors is getting to be unhealthy.

But what are we to do?

December 8th, 2006

US-CCU Check List

US-CCU has just finished the final release version of their cyber-security check list. A bookmarked pdf copy of it is temporarily available for download from http://www.cyberunitss.com/files/cybersecuritychecklist2007.pdf.

Here’s the press release:

Read the rest of this entry »

December 1st, 2006

Denial - Software Quality and the C-I-A of Security

There is only one really meaningful light-bulb joke:

Q: How many psychiatrists does it take to change a lightbulb?
A: Only one, but the lightbulb has to really want to change.

The last few decades have shown that developing software is hard and costly. Repeated surveys highlight overruns of 75% to 100%, cancellations and unsatisfactory results. These figures are well known, and haven’t changed, indicating either we don’t know how to “fix it” or aren’t willing to change. Since there are some industry segments and individual organizations that do seem to be able to deliver on-time, on-budget, there must be a method that works.

Read the rest of this entry »

|