Author: antonaylward

http://www.csoonline.com/caveat/060606.html?source=csoupdateMaybe they know something we don’t?

Maybe they do have good security, but they are doing what we say security should be, and that is being unobtrusive as far as the user is concerned.

Maybe there are hidden fiber optic cameras everywhere and those ‘tourists’ and ‘tour guides’ will casually ask someone aside and …. “poof!” There goes another terrorist.

Now that strikes me as an interesting idea.
If the terrorist organizations find their people are mysteriously disappearing with no publicity, no evidence, no trail, it might make them a bit worried.

But it does raise some question about the kind of society that would act that way.
But then who am I to talk. I grew up in one of the ultimate police states – the UK of the 60s/70s, where the police had no need to carry guns.

http://blogs.zdnet.com/hardware/?p=14&tag=nl.e539
Yea, right.
Fine for the monoculture, but what about us types for whom MS-Windows is not the ne-plus-ultra, not the first choice?

Oh, I can use Linux-specific tools to protect the USB drive, but that doens’t play well when I use them to move between Linux and Windwos and certainly doen’t ‘automount’.

Suggestions?

We’ve all read about how the Big N-1 Accounting firms have had laptops stolen with financial & personal details of their client’s employees.

Well Here’s a new twist on laptop theft.

http://www.sfgate.com/cgi-bin/article.cgi?file=/c/a/2006/04/08/MNGE9I686K1.DTL

A San Francisco finance manager stopped in at a Mission District cafe and was tapping on his laptop as he enjoyed his coffee just before noon on a Thursday. Suddenly, he was under siege.
“I looked up, and I saw this guy leaning into me as if he was asking a question,” he said. “I leaned forward, and out of the corner of my eye, I saw someone fiddling with the computer cord. I tried to stand up, and as I stepped back, he stabbed me in the chest.”
The attack marked a violent turn in a wave of crime that has hit the city — the “hot spots” frequented by wireless laptop users are becoming hot spots for laptop robberies.
The 40-year-old San Francisco victim of the March 16 attack suffered a partially collapsed lung and was hospitalized for six days. The two suspects fled with his Apple PowerBook, worth $2,500.

The punchline:

The victim in San Francisco’s Mission Creek Cafe stabbing, who requested that his name not be used, said since he was attacked, his friends from New York have urged him to go back there. It’s safer, they say.

The moral of the story is: Telecommuting is fine but telecommute from home, don’t skive off to the local coffee shop while you’re supposed to be working.

Occasionally I pluck up enough courage to read the Risks Digest.
I found this: http://catless.ncl.ac.uk/Risks/24.20.html#subj6

If you don’t read Risks Digest regularly you probably have a cheerful and upbeat disposition and positive outlook on the world and hope for mankind’s future.
If you DO read Risk Digest then you probably don’t need to read apocalyptic SF as you’d it unrealistic. Its not technology that’s going to destroy the world, not Global Thermonuclear war, no Nuclear Winter, no nanite “Green goop” scenario, not biotech poisoning.

It will be lawyers and politicians!

Now suppose that in this case Mr Citrin also kept purely personal stuff on the laptop: his calendar also included things like PTA meeting, kids baseball games, addresses of relatives … and he deleted those.

From my list of quoteable quotes – this seems apropos

The Internet is not the greatest threat to information security; stupidity is the greatest threat to information security.
– Will Spencer

Some while ago people were peruaded to give up their passwords in exchange for a chocolate bar. This goes one better

With chocolate bars you only get the password, which is not a lot of use unless you’re already behind the corporate firewall.
http://www.networkworld.com/news/2006/031306-free-cds-security-weakness.html

To office workers trudging to their cubicles, the promotion looked like a chance at sweet relief from the five-day-a-week grind.
By simply running a free CD on their computers, they would have a chance to win a vacation. But the beguiling morning giveaway in London’s financial district last month was more nefarious than it appeared.
Like flies to garbage, dozens of victims took the CD, unable to control the irresistible attraction of “free.”
Secret agents behind enemy lines, the CDs piggybacked through companies’ physical security systems tucked in the bags and pockets of their couriers. The office workers dutifully took the CDs to their desks and plopped them in their employers’ computers.

There’s a moral here.  But the implication that  people can be so easily subverted is frightening.

That assertion is the title of this article:
http://www.crn.com/showArticle.jhtml?articleID=180203279I think they used the wrong tagline!

“Just about everyone is hawking security, secure networks, secure systems, secure applications, secure websites, secure whatever,” …… It is pretty clear that most of them don’t even know what security means, but they do know one thing: Security sells.”

Why does Internet Security Systems CEO Thomas Noonan say this?

“Business enterprises are starving for the solutions that live up to this hype,” he said. “Last year alone, the financial losses resulting from online fraud, theft and business disruption proved unequivocally that trustworthy, self-defending, fearless networks are failing.”

Oh, so he’s targeting Cisco. Well that understandable, one vendor sniping at another, even though his premise and evidence are – dare I say it – statistically evident.

The conclusion – this is a vendor speaking remember – is forgone.

Best-of-breed technology and security suites are not enough to solve today’s security challenges, Noonan said. The answer is through what ISS is calling security platforms.

So, guys and gals, what do YOU think is the answer?

http://www.networkworld.com/news/2006/021406-gates-keynote-rsa-security.html

However its unclear what those four areas are from the article.

The best quote I can find relating to it is:

Gates then launched into the importance of security going forward and categorized a set of priorities under four headings: trust ecosystem, engineering for security, simplicity, and fundamentally secure platforms.

… but later …

Gates gave very little in the way of new initiatives or ideas at Microsoft for meeting his four broad goals, instead tailoring his remarks around announced features in the upcoming Windows Vista client operating system including smart card support, identity technology called InfoCard, and improvements in the Internet Explorer browser.

so I wonder what substance there is. Later on in the article: Gates used the demo to highlight his trust ecosystem, one of his four priority areas for improving security. “We have chains of trust,” Gates said. “What we need to do is track those trust relationships, to grab permissions, to revoke those trust relationships, to develop reputation over time.” He said today people live without a trust ecosystem. I’m not sure I like the idea of “grabbing” permissions. My mother always told me it was rude to grab. Do you think software and system engineering rates well on

• trust ecosystem,
• engineering for security,
• simplicity,
• fundamentally secure platforms.

Of those .. well ‘simplicity’, yes, but be careful; there are many naive approaches to that. As for fundamentally secure platforms – hogwash! We do know how to engineer secure and reliable systems from insecure and unreliable components. We’ve been doing it for years in other fields. Perhaps what we really need to do is to overthrown the mystique of computers and treat software like any other engineering discipline. Where is Steve McConnell when you need him?