<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: airport]]></title>
    <link>http://securityratty.com/tag/airport</link>
    <description></description>
    <pubDate>Wed, 10 Sep 2008 03:12:42 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Airport 'X-ray art' courts TSA trouble]]></title>
      <link>http://securityratty.com/article/b202335b37b59498ddae3e4c28f71b45</link>
      <guid>http://securityratty.com/article/b202335b37b59498ddae3e4c28f71b45</guid>
      <description><![CDATA[Techno-artist/open-source developer Evan Roth has a message for the Transportation Safety Administration -- several messages, actually -- about what he considers excessive airport security &quot;theater.&quot;...]]></description>
      <content:encoded><![CDATA[Techno-artist/open-source developer Evan Roth has a message for the Transportation Safety Administration -- several messages, actually -- about what he considers excessive airport security "theater." He also has chosen an intentionally provocative method of delivering those messages: the TSA's own X-ray screening machines.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=89965?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=89965?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/developer evan roth">developer evan roth</category>
      <category domain="http://securityratty.com/tag/transportation safety administration">transportation safety administration</category>
      <category domain="http://securityratty.com/tag/provocative method">provocative method</category>
      <category domain="http://securityratty.com/tag/messages">messages</category>
      <category domain="http://securityratty.com/tag/tsa">tsa</category>
      <category domain="http://securityratty.com/tag/x-ray">x-ray</category>
      <category domain="http://securityratty.com/tag/message">message</category>
      <category domain="http://securityratty.com/tag/theater">theater</category>
      <category domain="http://securityratty.com/tag/machines">machines</category>
      <source url="http://www.networkworld.com/columnists/2008/100208-buzz.html?fsrc=rss-security">Airport 'X-ray art' courts TSA trouble</source>
    </item>
    <item>
      <title><![CDATA[Really Good Point From Schneier ...]]></title>
      <link>http://securityratty.com/article/224dd81351c5dcee47e6095088342c98</link>
      <guid>http://securityratty.com/article/224dd81351c5dcee47e6095088342c98</guid>
      <description><![CDATA[Read all here ; the key point is: &quot;The same is true for knitting needles [...] and whatever else the airport screeners are confiscating this week. If there's no consequence to getting caught with it,...]]></description>
      <content:encoded><![CDATA[Read all <a href="http://www.schneier.com/blog/archives/2008/09/the_two_classes.html">here</a>; the key point is: "The same is true for knitting needles [...] and whatever else the airport screeners are confiscating this week.<span style="font-style: italic;"> If there's no consequence to getting caught with it, then confiscating it only hurts innocent people.</span> At best, it mildly annoys the terrorists.  <p>To fix this, airport security has to make a choice. <span style="font-weight: bold;">If something is dangerous, treat it as dangerous and treat anyone who tries to bring it on as potentially dangerous. If it's not dangerous, then stop trying to keep it off airplanes.</span> Trying to have it both ways just distracts the screeners from actually making us safer."</p><p>Doesn't it just make sense?!<br /></p><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=IRJdM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=IRJdM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=fJCiM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=fJCiM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=Cg7RM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=Cg7RM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/408639874" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 10:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dangerous">dangerous</category>
      <category domain="http://securityratty.com/tag/hurts innocent people">hurts innocent people</category>
      <category domain="http://securityratty.com/tag/screeners">screeners</category>
      <category domain="http://securityratty.com/tag/airport screeners">airport screeners</category>
      <category domain="http://securityratty.com/tag/treat">treat</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/mildly annoys">mildly annoys</category>
      <category domain="http://securityratty.com/tag/consequence">consequence</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/408639874/really-good-point-from-schneier.html">Really Good Point From Schneier ...</source>
    </item>
    <item>
      <title><![CDATA[$20M Cameras at New York's Freedom Tower are Pretty Sophisticated]]></title>
      <link>http://securityratty.com/article/1854e20c6c17653e3ad8d28eb7bdb765</link>
      <guid>http://securityratty.com/article/1854e20c6c17653e3ad8d28eb7bdb765</guid>
      <description><![CDATA[They're trying to detect anomalies : If you have ever wondered how security guards can possibly keep an unfailingly vigilant watch on every single one of dozens of television monitors, each depicting...]]></description>
      <content:encoded><![CDATA[<p>They're trying to <a href="http://cityroom.blogs.nytimes.com/2008/09/24/unblinking-eyes-for-20-million-at-freedom-tower/">detect anomalies</a>:</p>

<blockquote>If you have ever wondered how security guards can possibly keep an unfailingly vigilant watch on every single one of dozens of television monitors, each depicting a different scene, the answer seems to be (as you suspected): they can't.

<p>Instead, they can now rely on computers to constantly analyze the patterns, sizes, speeds, angles and motion picked up by the camera and determine -- based on how they have been programmed -- whether this constitutes a possible threat. In which case, the computer alerts the security guard whose own eyes may have been momentarily diverted. Or shut.</p>

<p>An alarm can be raised, for instance, if the computer discerns a vehicle that has been standing still for too long (say, a van in the drop-off lane of an airport terminal) or a person who is loitering while everyone else is in motion. By the same token, it will spot the individual who is moving rapidly while everyone else is shuffling along. It can spot a package that has been left behind and identify which figure in the crowd abandoned it. Or pinpoint the individual who is moving the wrong way down a one-way corridor.</p>

<p>Because one person's "abnormal situation" is another person's "hot dog vendor attracting a small crowd," the computers can be programmed to discern between times of the day and days of the week.</blockquote></p>

<p>Certainly interesting.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=y6WlL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=y6WlL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=IzyVL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=IzyVL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 02:32:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/person">person</category>
      <category domain="http://securityratty.com/tag/hot dog vendor">hot dog vendor</category>
      <category domain="http://securityratty.com/tag/security guards">security guards</category>
      <category domain="http://securityratty.com/tag/individual">individual</category>
      <category domain="http://securityratty.com/tag/unfailingly vigilant">unfailingly vigilant</category>
      <category domain="http://securityratty.com/tag/constantly analyze">constantly analyze</category>
      <category domain="http://securityratty.com/tag/security guard">security guard</category>
      <category domain="http://securityratty.com/tag/detect anomalies">detect anomalies</category>
      <category domain="http://securityratty.com/tag/television monitors">television monitors</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/20m_cameras_at.html">$20M Cameras at New York's Freedom Tower are Pretty Sophisticated</source>
    </item>
    <item>
      <title><![CDATA[The Two Classes of Airport Contraband]]></title>
      <link>http://securityratty.com/article/9add41f24cfea6a99d21547a04d8fdaf</link>
      <guid>http://securityratty.com/article/9add41f24cfea6a99d21547a04d8fdaf</guid>
      <description><![CDATA[Airport security found a jar of pasta sauce in my luggage last month. It was a 6-ounce jar, above the limit; the official confiscated it, because allowing it on the airplane with me would have been...]]></description>
      <content:encoded><![CDATA[<p>Airport security found a jar of pasta sauce in my luggage last month. It was a 6-ounce jar, above the limit; the official confiscated it, because allowing it on the airplane with me would have been too dangerous. And to demonstrate how dangerous he really thought that jar was, he blithely tossed it in a nearby bin of similar liquid bottles and sent me on my way.</p>

<p>There are two classes of contraband at airport security checkpoints: the class that will get you in trouble if you try to bring it on an airplane, and the class that will cheerily be taken away from you if you try to bring it on an airplane. This difference is important: Making security screeners confiscate anything from that second class is a waste of time. All it does is harm innocents; it doesn't stop terrorists at all.</p>

<p>Let me explain. If you're caught at airport security with a bomb or a gun, the screeners aren't just going to take it away from you. They're going to call the police, and you're going to be stuck for a few hours answering a lot of awkward questions. You may be arrested, and you'll almost certainly miss your flight. At best, you're going to have a very unpleasant day.</p>

<p>This is why articles about how screeners don't catch <a href="http://www.cnn.com/2008/US/01/28/tsa.bombtest/index.html">every</a> -- or even <a href="http://www.homelandstupidity.us/2007/10/25/tsa-screeners-fail-most-bomb-tests/">a</a> <a href="http://www.homelandstupidity.us/2006/10/31/tsa-screeners-still-fail-to-find-guns-bombs/">majority</a> -- of guns and bombs that <a href="http://www.boston.com/news/local/articles/2003/10/16/logan_screeners_fail_weapons_tests/">go through the checkpoints</a> don't bother me. The screeners don't have to be perfect; they just have to be good enough. No terrorist is going to base his plot on getting a gun through airport security if there's decent chance of getting caught, because the consequences of getting caught are too great.</p>

<p>Contrast that with a terrorist plot that requires a 12-ounce bottle of liquid. There's no evidence that the London liquid bombers actually had a workable plot, but assume for the moment they did. If some copycat terrorists try to bring their liquid bomb through airport security and the screeners catch them -- like they caught me with my bottle of pasta sauce -- the terrorists can simply try again. They can try again and again. They can keep trying until they succeed. Because there are no consequences to trying and failing, the screeners have to be 100 percent effective. Even if they slip up one in a hundred times, the plot can succeed.</p>

<p>The same is true for knitting needles, pocketknives, scissors, corkscrews, cigarette lighters and whatever else the airport screeners are confiscating this week. If there's no consequence to getting caught with it, then confiscating it only hurts innocent people. At best, it mildly annoys the terrorists.</p>

<p>To fix this, airport security has to make a choice. If something is dangerous, treat it as dangerous and treat anyone who tries to bring it on as potentially dangerous. If it's not dangerous, then stop trying to keep it off airplanes. Trying to have it both ways just distracts the screeners from actually making us safer.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=bB1FL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=bB1FL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Uc79L"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Uc79L" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 23 Sep 2008 01:47:04 +0000</pubDate>
      <category domain="http://securityratty.com/tag/airport security checkpoints">airport security checkpoints</category>
      <category domain="http://securityratty.com/tag/checkpoints">checkpoints</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/screeners">screeners</category>
      <category domain="http://securityratty.com/tag/security screeners">security screeners</category>
      <category domain="http://securityratty.com/tag/liquid">liquid</category>
      <category domain="http://securityratty.com/tag/london liquid bombers">london liquid bombers</category>
      <category domain="http://securityratty.com/tag/airport screeners">airport screeners</category>
      <category domain="http://securityratty.com/tag/plot">plot</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/the_two_classes.html">The Two Classes of Airport Contraband</source>
    </item>
    <item>
      <title><![CDATA['Checkpoint friendly' laptop bags explained]]></title>
      <link>http://securityratty.com/article/02f3d5ec09ba259f89cc98595e6ed1c5</link>
      <guid>http://securityratty.com/article/02f3d5ec09ba259f89cc98595e6ed1c5</guid>
      <description><![CDATA[Back in early August, the U.S. Transportation Security Administration (TSA) announced new rules covering &quot;checkpoint friendly&quot; laptop bags. The goal of these regulations is to increase the speed and...]]></description>
      <content:encoded><![CDATA[Back in early August, the U.S. Transportation Security Administration (TSA) announced new rules covering "checkpoint friendly" laptop bags. The goal of these regulations is to increase the speed and efficiency of airport security checkpoints by allowing passengers to keep their laptop computers in their bags during X-ray screening. However, there's quite a bit of confusion about what, exactly, constitutes a checkpoint-friendly bag and the specific rules for using one. Today's Mobile Mac gives you the lowdown.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=64846?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=64846?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 21 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptop bags">laptop bags</category>
      <category domain="http://securityratty.com/tag/bags">bags</category>
      <category domain="http://securityratty.com/tag/checkpoint friendly">checkpoint friendly</category>
      <category domain="http://securityratty.com/tag/specific rules">specific rules</category>
      <category domain="http://securityratty.com/tag/rules">rules</category>
      <category domain="http://securityratty.com/tag/airport security checkpoints">airport security checkpoints</category>
      <category domain="http://securityratty.com/tag/transportation security administration">transportation security administration</category>
      <category domain="http://securityratty.com/tag/laptop computers">laptop computers</category>
      <category domain="http://securityratty.com/tag/mobile mac">mobile mac</category>
      <source url="http://www.networkworld.com/news/2008/092208-checkpoint-friendly-laptop-bags.html?fsrc=rss-security">'Checkpoint friendly' laptop bags explained</source>
    </item>
    <item>
      <title><![CDATA[TSA Employees Bypassing Airport Screening]]></title>
      <link>http://securityratty.com/article/435eb222ac241cb24d5a29dc4c967df3</link>
      <guid>http://securityratty.com/article/435eb222ac241cb24d5a29dc4c967df3</guid>
      <description><![CDATA[Airport screeners are now able to bypass airport screening : The Transportation Security Administration (TSA) rolled out the new uniforms and new screening policy at airports nationwide on Sept. 11...]]></description>
      <content:encoded><![CDATA[<p>Airport screeners are now able to <a href="http://www.9news.com/news/article.aspx?storyid=99941&catid=339">bypass airport screening<a>:</p>

<blockquote>The Transportation Security Administration (TSA) rolled out the new uniforms and new screening policy at airports nationwide on Sept. 11. 

<p>The new policy says screeners can arrive for work and walk behind security lines without any of their belongings examined or X-rayed. </p>

<p>"Lunch or a bomb, you can walk right through with it," said Mike Boyd, an aviation consultant in Evergreen. "This is a major security issue."</blockquote></p>

<p>Actually, it's not.  Screeners have to go in and out of security all the time as they work.  Yes, they can smuggle things in and out of the airport.  But you have to remember that the airport screeners are trusted insiders for the system: there are a zillion ways they could break airport security.</p>

<p>On the other hand, it's probably a smart idea to screen screeners when they walk through airport security when they aren't working at that checkpoint at that time.  The reason is the same reason <a href="http://www.schneier.com/essay-130.html">you should screen everyone<a>, including pilots who can crash their plane: you're not screening screeners (or pilots), you're screening people wearing screener (or pilot) uniforms and carrying screener (or pilot) IDs.  You can either train your screeners to recognize authentic uniforms and IDs, or you can just screen everybody.  The latter is just easier.</p>

<p>But this isn't a big deal.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=qKcBL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=qKcBL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=TjBOL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=TjBOL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 19 Sep 2008 04:01:03 +0000</pubDate>
      <category domain="http://securityratty.com/tag/airport">airport</category>
      <category domain="http://securityratty.com/tag/bypass airport">bypass airport</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/transportation security administration">transportation security administration</category>
      <category domain="http://securityratty.com/tag/airport screeners">airport screeners</category>
      <category domain="http://securityratty.com/tag/security lines">security lines</category>
      <category domain="http://securityratty.com/tag/screeners">screeners</category>
      <category domain="http://securityratty.com/tag/major security issue">major security issue</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/tsa_employees_b.html">TSA Employees Bypassing Airport Screening</source>
    </item>
    <item>
      <title><![CDATA[Security Matters: Airport Pasta-Sauce Interdiction Considered Harmful]]></title>
      <link>http://securityratty.com/article/9b6db0f25f815641ea3655ef3cb29af5</link>
      <guid>http://securityratty.com/article/9b6db0f25f815641ea3655ef3cb29af5</guid>
      <description><![CDATA[Airport security found a jar of pasta sauce in my luggage last month. It was a 6-ounce jar, above the limit; the official confiscated it, because allowing it on the airplane with me would have been...]]></description>
      <content:encoded><![CDATA[<p>
Airport security found a jar of pasta sauce in my luggage last month. It was a 6-ounce jar, above the limit; the official confiscated it, because allowing it on the airplane with me would have been too dangerous. And to demonstrate how dangerous he really thought that jar was, he blithely tossed it in a nearby bin of similar liquid bottles and sent me on my way.
</p><p>
There are two classes of contraband at airport security checkpoints: the class that will get you in trouble if you try to bring it on an airplane, and the class that will cheerily be taken away from you if you try to bring it on an airplane. This difference is important: Making security screeners confiscate anything from that second class is a waste of time. All it does is harm innocents; it doesn't stop terrorists at all.
</p><p>
Let me explain. If you're caught at airport security with a bomb or a gun, the screeners aren't just going to take it away from you. They're going to call the police, and you're going to be stuck for a few hours answering a lot of awkward questions. You may be arrested, and you'll almost certainly miss your flight. At best, you're going to have a very unpleasant day.
</p><p>
This is why articles about how screeners don't catch <a href="http://www.cnn.com/2008/US/01/28/tsa.bombtest/index.html">every</a> -- or even <a href="http://www.homelandstupidity.us/2007/10/25/tsa-screeners-fail-most-bomb-tests/">a</a> <a href="http://www.homelandstupidity.us/2006/10/31/tsa-screeners-still-fail-to-find-guns-bombs/">majority</a> -- of guns and bombs that <a href="http://www.boston.com/news/local/articles/2003/10/16/logan_screeners_fail_weapons_tests/">go through the checkpoints</a> don't bother me. The screeners don't have to be perfect; they just have to be good enough. No terrorist is going to base his plot on getting a gun through airport security if there's decent chance of getting caught, because the consequences of getting caught are too great.
</p><p>
Contrast that with a terrorist plot that requires a 12-ounce bottle of liquid. There's no evidence that the London liquid bombers actually had a workable plot, but assume for the moment they did. If some copycat terrorists try to bring their liquid bomb through airport security and the screeners catch them -- like they caught me with my bottle of pasta sauce -- the terrorists can simply try again. They can try again and again. They can keep trying until they succeed. Because there are no consequences to trying and failing, the screeners have to be 100 percent effective. Even if they slip up one in a hundred times, the plot can succeed.
</p><p>
The same is true for knitting needles, pocketknives, scissors, corkscrews, cigarette lighters and whatever else the airport screeners are confiscating this week. If there's no consequence to getting caught with it, then confiscating it only hurts innocent people. At best, it mildly annoys the terrorists.
</p><p>
To fix this, airport security has to make a choice. If something is dangerous, treat it as dangerous and treat anyone who tries to bring it on as potentially dangerous. If it's not dangerous, then stop trying to keep it off airplanes. Trying to have it both ways just distracts the screeners from actually making us safer.
</p>
<p>
---
</p>
<p><cite>Bruce Schneier is chief security technology officer of BT. His new book is </cite>Schneier on Security<cite>.

</p><br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=aefd56c11b2eee64280f816001ed44dc"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=aefd56c11b2eee64280f816001ed44dc"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=aefd56c11b2eee64280f816001ed44dc" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=K4hTL"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=K4hTL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=gnANl"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=gnANl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=7cfHl"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=7cfHl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=lizGL"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=lizGL" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=4j0mL"><img src="http://feeds.wired.com/~f/wired/politics/security?i=4j0mL" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=McKUl"><img src="http://feeds.wired.com/~f/wired/politics/security?i=McKUl" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=F517l"><img src="http://feeds.wired.com/~f/wired/politics/security?i=F517l" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=FIJtL"><img src="http://feeds.wired.com/~f/wired/politics/security?i=FIJtL" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/396484059" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/396484061" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 14:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security screeners">security screeners</category>
      <category domain="http://securityratty.com/tag/airport security checkpoints">airport security checkpoints</category>
      <category domain="http://securityratty.com/tag/checkpoints">checkpoints</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/screeners">screeners</category>
      <category domain="http://securityratty.com/tag/liquid">liquid</category>
      <category domain="http://securityratty.com/tag/london liquid bombers">london liquid bombers</category>
      <category domain="http://securityratty.com/tag/airport screeners">airport screeners</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/396484061/securitymatters_0918">Security Matters: Airport Pasta-Sauce Interdiction Considered Harmful</source>
    </item>
    <item>
      <title><![CDATA[A Wild Tangent]]></title>
      <link>http://securityratty.com/article/1fb899c4ea43a76a35b277f5db58f34b</link>
      <guid>http://securityratty.com/article/1fb899c4ea43a76a35b277f5db58f34b</guid>
      <description><![CDATA[As I sit at Dulles Airport outside DC, waiting for yet another delayed flight, I feel compelled to write a post about traveling as part of the cost of doing business. This morning I had a flight...]]></description>
      <content:encoded><![CDATA[<p>As I sit at Dulles Airport outside DC, waiting for yet another delayed flight, I feel compelled to write a post about traveling as part of the cost of doing business.  This morning I had a flight scheduled that was supposed to leave at 6:45am.  During dinner last night I got an e-mail from United stating that the flight would instead be leaving at 7:30a.  As I arrived at the airport this morning I received another e-mail saying it would instead leave at 8:15a.  Since then the flight time has been announced as 7:45, 7:10 and now 7:16.  Is there anyone left out there that wonders why the airlines are always struggling?  Who really wants to put themselves through the <a href="http://www.usatoday.com/money/industries/travel/2008-05-29-fly-delays-hassles_N.htm" target="_blank">torture of travel</a>?  I look forward to the day that we all have a <a href="http://www.cisco.com/en/US/netsol/ns669/networking_solutions_solution_segment_home.html" target="_blank">Cisco Telepresence</a> type set-up at our offices and even &#8220;face-to-face&#8221; meetings can be virtual.</p>
<p>What&#8217;s really set me off this morning is the back and forth on the flight time.  I know that there are many things that can cause a flight delay, but to move the departure time, in both directions, four times within one hour, how is that possible?  I can only imagine the reaction of ScienceLogic customers if we announced the release date for the next version of the product and then proceeded to change it four times that week.  There really isn&#8217;t another business in the world, other than the airlines, that could get away with this.</p>
<p>Assuming I eventually get to <a href="http://www.interop.com/" target="_blank">Interop NY</a>, I will be on the look out for vendors that are working on ways to send me to my next meeting over Gigabit Ethernet!</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 16:39:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/flight">flight</category>
      <category domain="http://securityratty.com/tag/flight time">flight time</category>
      <category domain="http://securityratty.com/tag/flight delay">flight delay</category>
      <category domain="http://securityratty.com/tag/dulles airport">dulles airport</category>
      <category domain="http://securityratty.com/tag/airport">airport</category>
      <category domain="http://securityratty.com/tag/sciencelogic customers">sciencelogic customers</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/departure time">departure time</category>
      <category domain="http://securityratty.com/tag/e-mail">e-mail</category>
      <source url="http://blog.sciencelogic.com/a-wild-tangent/09/2008">A Wild Tangent</source>
    </item>
    <item>
      <title><![CDATA[8 laptop bags that will speed you through airport security]]></title>
      <link>http://securityratty.com/article/d10bc44dbe55eead70e728dade66082c</link>
      <guid>http://securityratty.com/article/d10bc44dbe55eead70e728dade66082c</guid>
      <description><![CDATA[While no one questions the need to properly scan laptops when going through airport security, the requirement to remove them from their protective cases is a different story. &quot;Naked&quot; notebooks can...]]></description>
      <content:encoded><![CDATA[While no one questions the need to properly scan laptops when going through airport security, the requirement to remove them from their protective cases is a different story. "Naked" notebooks can easily get dropped, damaged, forgotten and even stolen outright. One study done for Dell estimated that about 12,000 laptops are lost in U.S. airports every week -- a claim that has been challenged by the Transportation Security Administration (TSA) . Whatever the numbers are, you don't want your machine, with all its precious data, to become a statistic.]]></content:encoded>
      <pubDate>Sat, 13 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/properly scan laptops">properly scan laptops</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/transportation security administration">transportation security administration</category>
      <category domain="http://securityratty.com/tag/precious data">precious data</category>
      <category domain="http://securityratty.com/tag/remove">remove</category>
      <category domain="http://securityratty.com/tag/tsa">tsa</category>
      <category domain="http://securityratty.com/tag/story">story</category>
      <category domain="http://securityratty.com/tag/dell">dell</category>
      <source url="http://www.networkworld.com/news/2008/091208-8-laptop-bags-that-will.html?fsrc=rss-security">8 laptop bags that will speed you through airport security</source>
    </item>
    <item>
      <title><![CDATA[It Was Sposed to Be So Eaaasy]]></title>
      <link>http://securityratty.com/article/5714e6ea5723d4a1d18b692711ca3452</link>
      <guid>http://securityratty.com/article/5714e6ea5723d4a1d18b692711ca3452</guid>
      <description><![CDATA[Earlier this year, I gave a talk with on Breaking Web Services with Brian Chess at RSA. We pointed out that adding security into Web services is an exercise left to the implementer, the standards...]]></description>
      <content:encoded><![CDATA[<p>Earlier this year, I gave a <a href="http://1raindrop.typepad.com/1_raindrop/2008/04/rsa-debrief-p-1.html">talk</a> with on Breaking Web Services with Brian Chess at RSA. We pointed out that adding security into Web services is an exercise left to the implementer, the standards bodies and vendors give you some primitives, but it is still up to you to figure out all of the items on the <a href="http://arctecgroup.net/pdf/WebServicesSecurityChecklist.pdf">Web services security checklist</a>&#160;should work together in a cohesive system. Needless to say, there are many ways to shoot yourself in the foot.</p><br /><div>So during our talk, someone from Oracle stands up and says, &quot;hey, you guys are making this stuff sound hard. Its not hard we support WS-Security...&quot; etc. Again, the whole point of our presentation was *not* that there are not very interesting general purpose security capabilities in Web services, our point was that you need to figure out the architecture yourself, and then bend the tools to your will. Oh, and deliver on time.</div><br /><div>So imagine my surprise, when I read this article <a href="http://www.ddj.com/database/209400693">&quot;Digitally Signing and Verifying Messages in Web Services&quot;&#160;</a>which talks about using Oracle&#39;s WSM tools to sign Web service messages and verify signatures in Web service messages, but only addresses integrity - absolutely nowt on authenticity! Integrity is important, but there are lots of times when it is not enough. Many times your service needs to be concerned with replay attacks, authentication policies and so on. To deal with those things, we would typically add policies and capabilities for timestamps, nonces and other primitives into the signature block, but the article is silent on those things. (Rad Mark O&#39;Neill&#39;s <a href="http://xmlnetworking.blogspot.com/2008/08/digitally-signing-and-verifying.html">post</a> on this as well)</div><br /><div>Its not about _can_ the standards do something or other, I mean given the right resources the standards can put a monkey on the moon, its about what use cases have they engineered in and what is supported in the tools today. I firmly believe SAML has such great adoption across the industry because they have a use case centric view and so gave the vendors something to engineer and optimize for. I think we&#39;ll still get there in WS-Security and other areas as well, but the use cases are not built into the spec (as with SAML) and so its taking longer.</div><br /><div>One of our points in the talk was - we want you vendors to do your job better and instead of shipping a box Legos, ship a Lego gas station, a Lego airport, and so on. Connect some dots for your customers.&#160;</div><br /><div>What I see in <a href="http://arctecgroup.net/training.htm">training</a> on this topic, is sort of the following - 1) Do I need Web service security? 2) Oh ok, well can I get by with SSL? 3) Oh wait that doesn&#39;t actually protect my assets, can I just use WS-Security? 4) Oh wait, WS-Security isn&#39;t just a checkbox for security, I need to figure out timestamps, nonces, signatures, encryption policies and so on.&#160;And finally 5) How do I accomplish this?</div><br /><div>Once we get to step 5 then the real work can begin. Its not easy to get a lot of developers through all of this, and again this is before the real work begins. Even once the lead developers and architects figure this out, there is still the little matter of transitioning it to the rest of the team.</div><br /><div>I remember I was working with an enterprise architect several years ago, and he bought a Web service XML gateway like <a href="http://www.vordel.com/">Vordel</a> to add WS-Security support into his Web services apps, but he didn&#39;t even buy it as a runtime tool, he bought it as Security API, the runtime enforcement in his opinion was a bonus! He said in effect, well I know I need to do this, but I can&#39;t expose all these security primitives directly to my developers.</div><br /><div>So yeah, I wish it was easier, but in my experience its not right now. Its not about raw capabilities its about use case realization. I think learning from what has worked well is the way to go. SAML&#39;s use case centric approach is one that has.</div><br />]]></content:encoded>
      <pubDate>Wed, 10 Sep 2008 03:12:42 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ws-security">ws-security</category>
      <category domain="http://securityratty.com/tag/support ws-security">support ws-security</category>
      <category domain="http://securityratty.com/tag/web service security">web service security</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/primitives">primitives</category>
      <category domain="http://securityratty.com/tag/security primitives directly">security primitives directly</category>
      <category domain="http://securityratty.com/tag/ws-security support">ws-security support</category>
      <category domain="http://securityratty.com/tag/security api">security api</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/it-was-sposed-to-be-so-eaaasy.html">It Was Sposed to Be So Eaaasy</source>
    </item>
  </channel>
</rss>
