The InfoSec Blog

http://www.itworldcanada.com/a/Daily-News/03b813a2-f13b-4c3e-9494-ae9064f25da3.html

“When they outlaw X only criminals will have X”

… for many values of the members of the set of Y.

There’s the old saw:

People who won’t quit making the same mistake over
and over are what we call conservatives.

No, they are politicians.

He added that making it easier for law enforcement to tap into wireless
transmissions will probably bring those same capabilities into the hands
of the cyber criminal community. This is certainly not the
business-friendly message you want to be sending out to encourage
investment in technology during the recession, Levy said.

“Especially since the very same government has placed organizations in
the financial services, health care and public sector under increasing
regulatory scrutiny to lock down their own security infrastructure.”

In reality, judging by history, if there’s going to be a way to hack into things like the Blackberry the the criminals will have it long before the LE, and the LE will probably be denied funding for it by the government.

Related articles by Zemanta

• B.C. will outlaw auto secret compartments in gang fight (calgaryherald.com)
• Copyright bill would outlaw breaking digital locks (cbc.ca)

The article is at

http://securitywatch.eweek.com/flaws/vulnerability_management_payoff_requires_roadmap.html

but I find it ominous.

Vulnerability management may be the next big thing in terms of IT
security strategy, but deriving the maximum value out of your efforts
requires hard work and a comprehensive plan, industry insiders
recognize.

Well at least the author admits its not the next “Silver Bullet“!

Speaking at the SOURCE Boston conference this week, scanner maker
Tenable Security’s Carole Fennelly outlined some of the best practices
that organizations should observe as they attempt to identify and
remediate security weaknesses that exist throughout their IT systems and
applications.

Well that sounds good, but where does it lead to?
Personally I find it deceptive and not a good use of resources.
At the bottom, its too much like reactive fire-fighting.

We’ve discussed – or at least some of the more outspoken of us security blogers and professionals – of techniques for compartmentalization, being proactive in protection and using architectural and strategic decisions rather than ‘bug-hunting’.

We all know that you’ll never find the last bug, but its often easier to build things so that the effect of bugs, or failures, or attacks, is minimized.

What makes me despair though is when the old shibboleths get spouted:

“Organizations need to create asset lists that define their critical
business systems to help prioritize their efforts;

Without wanting to sound like I have it in for Ko-ko and his little list (heck, I have my own to-do list and GTD page), this is still reactive rather than proactive. In the last 15 years I’ve seen such revolutionary concepts as firewalls and DMZ become accepted by the mainstream, but the we can still see many people “don’t get it”. As evidence of this I would point towards the PCI documents. Implicit in them is the subtext that there are IT shops that are too stupid (or recalcitrant) to implement very basic good practices without being lead though them by the nose.

… they need to have the
support of different internal groups to create these lists that will
help them mitigate their most critical problems,” said Fennelly,

I wonder. Many security practitioners, and I think a lot of IT, would say that the most critical problems are not technical ones but rather have to do with people, management and strategy.

Scanners are useful tools, but they are also the kind of geek toy that can suck you in. This article touches on prioritizing those lists, but I’d say reality is that you have to deal with many things all at once, and getting stuck ‘head down’ with something like this and dealing reactively with the issues it raises will distract you from the more strategic matter that might just sweep away many of these problems.

Related articles by Zemanta

• Securing the corporation (theregister.co.uk)
• More on PCI and Tiers 1, 2 and 3 (pindebit.blogspot.com)
• Defending the U.S. Cyber Castle: Core Security’s Tom Kellermann on Internet Attacks and Obama’s Strategy (xconomy.com)
• New “Breach Driven” Compliance Rules for HIPAA (pindebit.blogspot.com)

An independent security consultant describes how vulnerabilities in
unpatched releases of the Zeus crimeware kit are being exploited by
hackers in order to steal resources from their fellow criminals. The
security researcher has come across an interesting posting made by a
botnet runner, who asks for help to secure his infrastructure after
being compromised several times by other hackers.

http://news.softpedia.com/news/Cyber-criminals-Target-Their-Own-Kind-105728.shtml

Forty-one percent of small businesses surveyed by Visa Canada said they
don’t believe data thieves and hackers will target them because of their
size.

Where have we heard that before?
Isn’t there some security adage about the hackers (aka criminals) going or “the low hanging fruit” – the easy to get at stuff – first?