<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: bigger]]></title>
    <link>http://securityratty.com/tag/bigger</link>
    <description></description>
    <pubDate>Fri, 05 Sep 2008 07:34:12 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[All Quiet on the CA Front]]></title>
      <link>http://securityratty.com/article/a644ba10404315a6034969475c3def4a</link>
      <guid>http://securityratty.com/article/a644ba10404315a6034969475c3def4a</guid>
      <description><![CDATA[If youve read the blog, you know that we follow the Perils of CA with much amusement. Honestly, you couldnt make up the stuff that Sanjay Kumar et al were and apparently are still making headlines...]]></description>
      <content:encoded><![CDATA[<p><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; margin: 5px; border-right-width: 0px" height="113" alt="sanjay kumar" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/sanjay-kumar.jpg" width="240" align="left" border="0" /> If you&#8217;ve read the blog, you know that we follow the Perils of CA with much amusement. Honestly, you couldn&#8217;t make up the stuff that <a href="http://java.sys-con.com/node/666065" target="_blank">Sanjay Kumar</a> et al were and apparently are still making headlines with <a href="http://digitaldaily.allthingsd.com/20080904/sanjay-kumar-goes-to-white-castle-prison/" target="_blank">&#8220;35-day months&#8221;</a>, accusations that founder Charles Wang knew and was part of the whole mess, a former US senator involved too, Sanjay&#8217;s unbelievable <a href="http://www.networkworld.com/news/2007/041307-cas-kumar-ordered-to-pay.html" target="_blank">$1 billion in restitution</a>&#8230;and <a href="http://channelmarker.blogs.techtarget.com/2008/09/03/kumar-accuses-damato-ranieri-in-ca-coverup/" target="_blank">the list goes on</a>. (<a href="http://www.nytimes.com/2006/04/25/technology/25fraud.html" target="_blank"><em>img from NYTimes.com</em></a>)</p>
<p>But I am reminded that it&#8217;s not just the titillating stuff that&#8217;s of interest. CA is still one of the Big 4 and up until a couple of years ago making headlines with some major and strategic purchases in our space &#8211; such as buying <a href="http://news.cnet.com/CA-to-buy-Concord-Communications/2100-1014_3-5658423.html" target="_blank">Concord for its e-Health software</a> in 2005 and <a href="http://www.itnewsonline.com/showstory.php?storyid=2339&amp;scatid=1&amp;contid=3" target="_blank">Wily Technology</a> in 2006.</p>
<p>I recently ran across a <a href="http://blogs.the451group.com/techdeals/" target="_blank">451 Group report</a>, &#8220;<a href="http://blogs.the451group.com/techdeals/investment-banking/ca-ghosts-of-deals-past/" target="_blank">CA: ghosts of deals past</a>&#8221; by Brenon Daly (if you haven&#8217;t read one of his takes on the M&amp;A market, you don&#8217;t know what you&#8217;re missing) that showed quantitatively just how much the acquisitions had slowed down.</p>
<p>2003 &#8211; 4</p>
<p>2004 &#8211; 3</p>
<p>2005 &#8211; 6</p>
<p>2006 &#8211; 6</p>
<p>2007 &#8211; 0</p>
<p>2008 &#8211; 0 (so far)</p>
<p>Two or three years ago (I still have the slide in our presentations), it seemed like you couldn&#8217;t go a month or two without hearing about the latest acquisition by the Big 4 &#8211; to either fill gaps in their monolithic portfolios or <a href="http://www.networkworld.com/newsletters/nsm/2008/092908nsm2.html?nladname=100108networksystemsmanagemental&amp;code=nlnsm162167" target="_blank">take out a growing threat</a>, which had built some good technology. This should sound very familiar to anyone (like me) who rubbed up against WorldCom. Growth (in revenue and technology) by acquisition. Buy your own revenue and don&#8217;t worry about the niggling details like integration.</p>
<p>But we&#8217;ve certainly seen the acquisition trend slow across the board. HP, after its mega-purchase of <a href="http://www.networkworld.com/weblogs/management/012012.html" target="_blank">Mercury Interactive in 2005 for $4.5 billion</a>, for example, went relatively silent on the acquisition front in our space. Perhaps, as it turns out, because they were too busy preparing for the even bigger <a href="http://bigtech.blogs.fortune.cnn.com/2008/05/12/why-hp-is-smart-to-gamble-on-eds/" target="_blank">purchase of EDS for $13.9 billion</a> (and <a href="http://www.networkworld.com/news/2008/091508-hp-announces-24600-layoffs-in.html?hpg1=bn" target="_blank">the layoffs, 24,600 and counting</a>, which in this worsening economy are probably just starting).</p>
]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 11:31:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/acquisition">acquisition</category>
      <category domain="http://securityratty.com/tag/acquisition front">acquisition front</category>
      <category domain="http://securityratty.com/tag/acquisition trend slow">acquisition trend slow</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/wily technology">wily technology</category>
      <category domain="http://securityratty.com/tag/founder charles wang">founder charles wang</category>
      <category domain="http://securityratty.com/tag/billion">billion</category>
      <category domain="http://securityratty.com/tag/strategic purchases">strategic purchases</category>
      <category domain="http://securityratty.com/tag/brenon daly">brenon daly</category>
      <source url="http://blog.sciencelogic.com/all-quiet-on-the-ca-front/10/2008">All Quiet on the CA Front</source>
    </item>
    <item>
      <title><![CDATA[Protect yourselves from identity fraud]]></title>
      <link>http://securityratty.com/article/2d5527de63a883eccd4dd52baa574670</link>
      <guid>http://securityratty.com/article/2d5527de63a883eccd4dd52baa574670</guid>
      <description><![CDATA[Soon youll be seeing the infomercials on late nite TV. Its becoming very profitable, easy set up, even tutoring


clipped from news.cnet.com

Behind the scenes of online fraud



Fraudsters arent just...]]></description>
      <content:encoded><![CDATA[<div > Soon you&#8217;ll be seeing the infomercials on late nite TV.<br/>Its becoming very profitable, easy set up, even tutoring. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/F3D2C488-5ECA-4C1C-9234-F72627E7787F/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/e39e0526-6ef5-4791-8146-a5dc9f35d899/F3D2C488-5ECA-4C1C-9234-F72627E7787F/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title" href="http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title" style="font-size: 11px;">news.cnet.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Behind the scenes of online fraud</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title --><P><br />
Fraudsters aren&#8217;t just targeting bank customers. They are also luring victims off social networks, where they harvest sensitive private information, and online gaming sites, where they steal accomplished avatars and accounts and sell them for money, Rivner says. </P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title --><P><br />
Online fraud tools have price tags just like any other software. For example, the Mpack Infection Kit costs $700, a Dream BotBuilder costs $500, and at just $350, the Limbo Trojan is practically a steal, according to Rivner. </P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title --><P><br />
For people who don&#8217;t have the skills to install, run, and manage their own Trojans and other tools, fraudsters are offering fraud software as a service for $299 a month, &#8220;which means anyone can do it,&#8221; he says.</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.cnet.com/8301-1009_3-10051688-83.html?tag=mncol;title --><P><br />
While online attacks get the headlines, a bigger risk is from skimmers, fake faceplates for ATM machines that steal card data from the magnetic strip. The data is then used to make forged cards.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/F3D2C488-5ECA-4C1C-9234-F72627E7787F/blog/" title="blog or email this clip"><img src="http://content9.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_290908013218"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=290908013218&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=290908013218&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=290908013218&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_290908013218" /></a></P>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 09:32:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/online fraud tools">online fraud tools</category>
      <category domain="http://securityratty.com/tag/online attacks">online attacks</category>
      <category domain="http://securityratty.com/tag/online fraud">online fraud</category>
      <category domain="http://securityratty.com/tag/tools">tools</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/fraud software">fraud software</category>
      <category domain="http://securityratty.com/tag/dream botbuilder costs">dream botbuilder costs</category>
      <category domain="http://securityratty.com/tag/card data">card data</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=633">Protect yourselves from identity fraud</source>
    </item>
    <item>
      <title><![CDATA[Gartner: Security risks rise as smart phones get smarter]]></title>
      <link>http://securityratty.com/article/ff8b6dc70506debbf40d9c136d6ff95f</link>
      <guid>http://securityratty.com/article/ff8b6dc70506debbf40d9c136d6ff95f</guid>
      <description><![CDATA[As mobile devices are increasingly used in business applications, they're becoming bigger targets for attackers, a Gartner analyst warned at an IT security...]]></description>
      <content:encoded><![CDATA[As mobile devices are increasingly used in business applications, they're becoming bigger targets for attackers, a Gartner analyst warned at an IT security conference.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:086a1f75376cb8dcd29352e6ff6bdeeb:atyT7W2s4v4O59VxhyEzplCcJEDq8xDnHvm3SHNsxE9GPFny9oTXIRl33WRYi%2BLU6SmKJhlyl%2FX6'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:fb9389412603aa623966a296bb232bcd:ZCZnmRKHQr6lTVfTngkU2jIP7MLxHggRZp7sa9wATM7wfi9gm%2BsCDc0UU%2BY6Z6aVsJrQkrybEJsNRA%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:5df9f3a9e64d40765d58e71ce150bbea:68ZBU8pYsM1CFlIdElsCIBY0kmrfO%2FKzB3s3Le22%2BGxhMEhCyp2Rtc8bDlTmo%2BTWG5iHpfnZcOcseQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:85bf31792693558910544e7b519f8883:ASsxOtjlDc3RKWpLPP22Y%2B5QPhUrHjW9oxgsWm8gB2GO%2BbtBCoXCpL3X9vyEv2ZLVD6Nc8stbFNidw%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=e8347f7b3cf6dea62109dd9cebe56220" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=e8347f7b3cf6dea62109dd9cebe56220" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 00:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security conference">security conference</category>
      <category domain="http://securityratty.com/tag/mobile devices">mobile devices</category>
      <category domain="http://securityratty.com/tag/business applications">business applications</category>
      <category domain="http://securityratty.com/tag/gartner analyst">gartner analyst</category>
      <category domain="http://securityratty.com/tag/bigger targets">bigger targets</category>
      <category domain="http://securityratty.com/tag/attackers">attackers</category>
      <category domain="http://securityratty.com/tag/increasingly">increasingly</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=e8347f7b3cf6dea62109dd9cebe56220">Gartner: Security risks rise as smart phones get smarter</source>
    </item>
    <item>
      <title><![CDATA[Five mistakes security pros would make again]]></title>
      <link>http://securityratty.com/article/820ddf7ceb22e457bf492e07ad17dc7b</link>
      <guid>http://securityratty.com/article/820ddf7ceb22e457bf492e07ad17dc7b</guid>
      <description><![CDATA[Ten years ago, Michael Riva was network administrator for a top-five American consultancy. Employees were downloading graphic pictures and videos onto the network. Riva told his boss a proxy server...]]></description>
      <content:encoded><![CDATA[Ten years ago, Michael Riva was network administrator for a top-five American consultancy. Employees were downloading graphic pictures and videos onto the network. Riva told his boss a proxy server with content filtering might be in order; his boss laughed and suggested they put in a bigger file server instead.]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/michael riva">michael riva</category>
      <category domain="http://securityratty.com/tag/bigger file server">bigger file server</category>
      <category domain="http://securityratty.com/tag/riva">riva</category>
      <category domain="http://securityratty.com/tag/network administrator">network administrator</category>
      <category domain="http://securityratty.com/tag/top-five american consultancy">top-five american consultancy</category>
      <category domain="http://securityratty.com/tag/boss">boss</category>
      <category domain="http://securityratty.com/tag/graphic pictures">graphic pictures</category>
      <category domain="http://securityratty.com/tag/proxy server">proxy server</category>
      <source url="http://www.networkworld.com/news/2008/092908-five-mistakes-security-pros-would.html?fsrc=rss-security">Five mistakes security pros would make again</source>
    </item>
    <item>
      <title><![CDATA[Of Planes and Ships]]></title>
      <link>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</link>
      <guid>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</guid>
      <description><![CDATA[Tom Barnett is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.thomaspmbarnett.com/weblog/2008/09/column_121.html">Tom Barnett</a> is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the &quot;nail it to the wall&quot; quote at the end):</p><p><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">One of the main problems in counterterrorism today is that there are so many people and vehicles, and so much data and material, moving through globalization&#39;s myriad networks that it seems virtually impossible to track it all effectively. Nowhere has this problem been more acute than on the high seas.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">In 2006, Adm. Harry Ulrich, then U.S. commander of NATO Naval Forces Europe, decided to do something about it. Despite having virtually no resources, his dream was to transpose the global air-traffic control system onto sea traffic.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Worldwide, aircraft are transparent, because they&#39;re all required to carry an identification beacon that allows them to be tracked leaving and entering airports, and monitored between airports, by a global network of sensors. Act suspiciously and somebody&#39;s fighter aircraft will soon be on your tail.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">No such pervasive system currently exists globally for maritime traffic. While bigger ships carry an ID beacon similar to aircraft, without a shared monitoring network, that&#39;s like tracking only selected commercial jets and giving everyone else a pass.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">So Ulrich, upon taking command, asked a simple question: &quot;If we can do that in the air, why can&#39;t we do it on the sea?&quot; He made a point of pioneering his sea-traffic-control effort first inside the Mediterranean, where NATO&#39;s southern naval forces have historically been concentrated, but his real target was waters off Africa -- the most ungoverned maritime space in the world.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich knew the U. S. Navy couldn&#39;t do it alone, much less bring Africa&#39;s meager coast-guard-like navies up to snuff so they could do it on their own. So he quickly created a network of assets -- both public and private -- to manage that space, modeling his monitoring system on international air-traffic control.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich began stitching together a network of shore-based sensors ringing the Mediterranean. His naval command then began initial monitoring by tapping into the International Maritime Organization&#39;s existing Automated Identification System, transforming NATO&#39;s ability to track ship traffic in the Med.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Almost overnight, NATO went from tracking dozens of ships on the Mediterranean to thousands, and instead of getting the data sometimes up to 72 hours late, now the contacts were being tracked in one to five minutes -- to an accuracy within 50 feet on the earth&#39;s surface.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When the classic big-firm systems integrators told Ulrich it would be too costly to pull it off, the admiral turned to the Volpe Center in Cambridge, Massachusetts, a U.S. Department of Transportation research center. Instead of hundreds of millions of dollars, Ulrich&#39;s initial network cost $900,000. The shore-based receivers are small, roughly the size of a radar dish you might find on a pleasure craft.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The strength of the system is a function of its reach: the more countries join, the larger the shared operational picture. By the time Ulrich retired at the end of 2007, he had enlisted 32 countries throughout the Mediterranean, the North Atlantic, along the west coast of Africa, around the Black Sea, and in the Pacific. Today, the network continues to spread around the planet.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; font-size: 14px; line-height: 20px; "><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">With Ulrich&#39;s system in place, local police, coast guards, and border patrols catch most bad guys, obviating American military responses. As Harry told me for an article I wrote about his work in a fall 2007 issue of Esquire, </span><span style="font-weight: bold; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">&quot;I don&#39;t do defense; I do security. When you talk defense, you talk containment and mutually assured destruction. When you talk security, you talk collaboration and networking. This is the future.&quot;</span></span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The admiral&#39;s legacy program, the Maritime Safety and Security Information System, earned the Volpe Center a prestigious &quot;Innovations in American Government&quot; award this month from Harvard University&#39;s Ash Institute for Democratic Governance and Innovation.</span></p></blockquote><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Security Collaboration + Networking &#160;= Federation. This is indeed the future - SAML came along just at the nick of time.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When you assume that to do access control you must have &quot;Complete Mediation&quot; in Saltzer and Schroeder&#39;s terms of the subject (users), the objects (data), the session, and the roles, then you are going to have an interesting life trying to deliver anything. And if you do it will mucho expensive.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">if you take the federated autonomous nodes approach, agree upon an attribute schema plus a protection model for same, and basic protocol, you are then free to move about the country. Security doesn&#39;t have to equal centralization or high cost. Get the attributes from point a to point b securely.</span></div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 19:04:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security architect">security architect</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/identification system">identification system</category>
      <category domain="http://securityratty.com/tag/initial network cost">initial network cost</category>
      <category domain="http://securityratty.com/tag/initial">initial</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/ulrich">ulrich</category>
      <category domain="http://securityratty.com/tag/time ulrich">time ulrich</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/of-planes-and-ships.html">Of Planes and Ships</source>
    </item>
    <item>
      <title><![CDATA[Interop NY 2008: Wrap-up]]></title>
      <link>http://securityratty.com/article/1f9f6e5f6c1183d8706458aa161f8afd</link>
      <guid>http://securityratty.com/article/1f9f6e5f6c1183d8706458aa161f8afd</guid>
      <description><![CDATA[This year was a strange year at Interop NY. While the financial industry in NY was crumbling around us, things were strangely normal at Interop . Despite entire departments being laid-off at Lehman...]]></description>
      <content:encoded><![CDATA[<p>This year was a strange year at Interop NY.  While the financial industry in NY was crumbling around us, things were <a href="http://www.networkworld.com/community/node/33059" target="_blank">strangely normal at Interop</a>.  Despite entire departments being laid-off at Lehman and elsewhere, while the show was going on, the show itself seemed mostly unaffected.  We even saw this with our annual survey - in 2007 18% of respondents were from the financial services industry, this year the sector respresented 19%.</p>
<p>Interop NY 2008 was up considerably in size from the show in 2007.  <a href="http://blog.sciencelogic.com/interview-with-lenny-heymann-interop-general-manager/09/2008" target="_blank">According to Lenny Heymann</a>, the GM of Interop, this is a trend that they expect to continue.  My personal experience was that the size of the vendors was also up this year.  I think there were so few startups that &#8220;Startup City&#8221; was pulled from the show completely.  In any case, the show floor was full and there was plenty of attendee traffic to go around.</p>
<p>Definitely helping out from a traffic and draw perspective was the addition of the Web 2.0 Expo - Interop was co-located with both Mobile Business Expo and the Web 2.0 show. It seems like that buzzword still hasn&#8217;t lost most of its luster.</p>
<p>From the InteropNet perspective, the main feeling was one of being rushed.  With the show only lasting two days, and the InteropNet team only having a couple of days of ramp up time, everything was compressed into a much shorter period than in Las Vegas.  While this would normally be a challenge, it&#8217;s an even bigger challenge at the Javits where the InteropNet team was allowed to do almost nothing ourselves because of union rules.  You&#8217;d be surprised how frustrated you can make a network guy who&#8217;s told that he has to stand there and watch the electrician plug things in, rather than just doing it himself.  The only thing faster than the InteropNet team getting the Interop NY network up, was my pedicab ride to the InteropNet Booze Cruise.<br />
<object width="425" height="344"><param name="movie" value="http://www.youtube.com/v/6h8JECK6naw&#038;hl=en&#038;fs=1"></param><param name="allowFullScreen" value="true"></param><embed src="http://www.youtube.com/v/6h8JECK6naw&#038;hl=en&#038;fs=1" type="application/x-shockwave-flash" allowfullscreen="true" width="425" height="344"></embed></object></p>
<p>In any case, everything came off without a hitch, and EM7 performed flawlessly catching a couple of power outages that last day and alerting everyone before the batteries on the UPSes had a chance to run down.</p>
<p>Over the next couple of weeks I&#8217;ll analyze the data from the show to see how many tickets were handled, amount of bandwidth consumed, etc and we&#8217;ll do a comparison to Interop Las Vegas.</p>
<p>We&#8217;re (both ScienceLogic and me personally) looking forward to Interop 2009.</p>
]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 16:48:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <category domain="http://securityratty.com/tag/las vegas">las vegas</category>
      <category domain="http://securityratty.com/tag/interop las vegas">interop las vegas</category>
      <category domain="http://securityratty.com/tag/interopnet team">interopnet team</category>
      <category domain="http://securityratty.com/tag/mobile business expo">mobile business expo</category>
      <category domain="http://securityratty.com/tag/expo">expo</category>
      <category domain="http://securityratty.com/tag/bigger challenge">bigger challenge</category>
      <category domain="http://securityratty.com/tag/traffic">traffic</category>
      <category domain="http://securityratty.com/tag/attendee traffic">attendee traffic</category>
      <source url="http://blog.sciencelogic.com/interop-ny-2008-wrap-up/09/2008">Interop NY 2008: Wrap-up</source>
    </item>
    <item>
      <title><![CDATA[John Zanni Delivers Keynote at the Tier1 Hosting Transformation Summit]]></title>
      <link>http://securityratty.com/article/e6b5db3dba618f48e7fa728ff2173006</link>
      <guid>http://securityratty.com/article/e6b5db3dba618f48e7fa728ff2173006</guid>
      <description><![CDATA[As General Manager of Worldwide Hosting, John Zanni is a key guy for every Managed Service Provider delivering Microsoft based solutions. At this years Hosting Transformation Summit , John gave a...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="244" alt="spla_image" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/spla-image.png" width="244" align="left" border="0"> As General Manager of Worldwide Hosting, <a href="http://www.microsoft.com/presspass/features/2008/jul08/07-29qazanni.mspx" target="_blank">John Zanni is a key guy for every Managed Service Provider</a> delivering Microsoft based solutions. At this year&#8217;s <a href="http://www.hostingtransformation.com/na/2008/" target="_blank">Hosting Transformation Summit</a>, John <a href="http://www.hostingtransformation.com/na/2008/agenda.php" target="_blank">gave a keynote</a> titled: &#8220;Leadership Perspective: Cloud Computing – is Virtualization Enough?&#8221;</p>
<p>John talked <a href="http://blogs.zdnet.com/BTL/?p=10007" target="_blank">about Microsoft’s mission</a>, his perspectives on key industry trends and market opportunity; he touched on <a href="http://www.betanews.com/article/Will_Microsofts_virtualization_spur_a_lot_more_cloud_computing/1221867502" target="_blank">Cloud Computing and Virtualization</a> and took some Q&amp;A from the audience of <a href="http://technet.microsoft.com/en-us/serviceproviders/default.aspx" target="_blank">Managed Service Provider</a> executives.</p>
<p>One of his first proclamations - Microsoft has really embraced the heterogeneous environment. Really? How in the world is Microsoft going to help convince IT line managers, or mid level managers to believe this statement? I think they have a long way to go to achieve this vision with any credibility in the marketplace.&nbsp; I do know that they are making small strides.</p>
<p>Microsoft has been widely credited with some very good blogs that are self critical and introspective. They have also been quite active in the standards boards within <a href="http://www.dmtf.org/home" target="_blank">DMTF</a> and many others such as <a href="http://www.openwsman.org/" target="_blank">Open WSMAN</a> and CIMON (<a href="http://www.openpegasus.org/" target="_blank">Open Pegasus</a>). Microsoft in February published 30,000 pages detailed technical specifications – protocol documentation for Exchange, since that time they have published another 15,000 pages. They have had over 224,000 downloads since February 21, 2008. Thus they are trying to be more open by making some of these <a href="http://www.microsoft.com/about/legal/intellectualproperty/protocols/default.mspx" target="_blank">secret sauce protocol resources</a> <a href="http://msdn.microsoft.com/openprotocols" target="_blank">directly available on the web</a>.</p>
<p>So for now, I will take a very cautious wait and see approach to this proclamation. Time will tell.</p>
<p><strong>Trends</strong></p>
<ul>
<li>Rapid growth continues
<li>Hosting Competition has a new face
<ul>
<li>Platform gorillas (amazooglesoft)
<li>Ad supported Web 2.0 hosters (Google, Facebook,) </li>
</ul>
<li>Utility Cloud Computing models are expanding to non-traditional hosting companies
<ul>
<li>Wells Fargo vSafe - hard to believe that a big bank would start to offer a SaaS offering
<li>New tools and markets digital ribbon, CohesiveIT </li>
</ul>
</li>
</ul>
<p><a href="http://mshostingsummit08.spaces.live.com/blog/cns!4308FE7290C0AF4!245.entry" target="_blank">IDC Data shows that growth of SaaS ISV’s is the biggest layer of growth</a>. The fastest growing services are complex, custom applications. IDC says this area will be bigger than the hosting area in the next 5 years. John said that <a href="http://blogs.msdn.com/ukisv/archive/2008/09/22/the-route-to-saas-and-beyond-final-seminar-places-remain-2nd-oct-08.aspx" target="_blank">Microsoft is spending a lot of time, money and energy on this right now</a>.</p>
<p>John said:</p>
<blockquote><p>“when Microsoft thinks about the building blocks that make-up the cloud, <a href="http://www.microsoft.com/virtualization/" target="_blank">virtualization is a core piece</a> of the puzzle. However you also need also identity services, Operating system with standard set of libraries to tap into… or remote storage that application developers will tap into.. Developers will consume these set of services, but you will also need a set of tools to manage your physical, virtual and geographically distributed datacenter infrastructure.” (that is where ScienceLogic comes in!!)</p>
</blockquote>
<p>He went on to say,</p>
<blockquote><p>“In some ways, virtualization enables decentralization – allows you to move from data centers, enables fast scaling out, business to move from on premise to the cloud and off again…. Automation is very important – this will help you scale your business – this is core to your future success.”</p>
</blockquote>
<p>He talked about a new breed of knowledge worker: He called them Digital Natives (compared to grey haired guys like me who are left out of this category).</p>
<p>Definition of a Digital natives? A young adult who has grown up with cellphone, web based applications, Facebook account, as their primary mode of communications.</p>
<p>John commented that we are 5 years into a 10 year journey. Only 12% of all servers in the world are virtualized today… in the next 4 years it will double to 25%. This is <a href="http://www.interopnews.com/news/vmware-ceo-maritz-addresses-virtualization-the-cloud-and-cha.html" target="_blank">the time to think through</a> how this business will affect you.</p>
<blockquote><p>‘Virtualization without good management is more dangerous than not using virtualization in the first place.” Thomas Bittman, Analyst Gartner</p>
</blockquote>
<p>Patching and provisioning nightmare – no scalable administration – sprawl chaos.</p>
<p>John posed a question to the audience: How do you partner to provide the ISV support in application development with specific market needs… partner by keeping the <a href="http://tarrysingh.blogspot.com/2008/09/microsofts-coo-on-cloud-computing.html" target="_blank">hosting to SaaS solution</a> providers up and running and provide the quality of service that their customers expect…. Complimentary services of storage and backup is a big win with a huge market-upside over the next 5 years..</p>
<p>John said that <a href="http://blogs.msdn.com/mhpta/archive/2008/04/10/microsoft-hosting-summit-2008.aspx" target="_blank">Microsoft continues</a> to make&nbsp; <a href="http://www.virtualization.info/2008/07/microsoft-bets-on-hosting-providers-to.html" target="_blank">huge investments with Managed Service Providers</a>.</p>
<ul>
<li>Investing in the <a href="http://www.microsoft.com/hosting/" target="_blank">windows hosting platform</a>
<li>Hyper V and SQL2008 GoLive program - getting beta code out to service provides to find as many bugs as early as possible.
<li><a href="http://blogs.msdn.com/stevecla01/archive/2008/09/22/explaining-software-plus-services.aspx" target="_blank">Software + Services (S+S)</a> incubation center program
<li>Partnering for <a href="http://tarrysingh.blogspot.com/2008/09/microsofts-coo-on-cloud-computing.html" target="_blank">cloud platform market offers</a>
<li>Cloud platform guidance and best practices </li>
</ul>
<p>During the Q&amp;A, David Burns from Cincinnati Bell asked the very best question… “when are you going to make it easier for the Service Provider market to <a href="http://www.virtualization.info/2008/09/microsoft-to-allow-3rd-parties-to.html" target="_blank">deal with the Microsoft Service Provider Licensing Agreement (SPLA)</a> quarterly statistics pull and change the SPLA pricing to be more efficient and creative for the new Virtualization and Cloud offerings you have talked about?&#8221;</p>
<p>John’s response: “We hear your frustrations loud and clear and are working on some new ideas for the future version of SPLA.” My interpretation – &#8220;Dear Service Providers don’t expect anything new or easier to deal with in the next 6 months!&#8221;</p>
<p>His closing remarks: &#8220;Cloud is evolving = very early stages, lots of hype, but think of how this evolution will effect your business and how you can plug into it.”</p>
]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 12:00:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/service provider market">service provider market</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service providers">service providers</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service provider executives">service provider executives</category>
      <category domain="http://securityratty.com/tag/john">john</category>
      <category domain="http://securityratty.com/tag/john zanni">john zanni</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/microsoft based solutions">microsoft based solutions</category>
      <source url="http://blog.sciencelogic.com/john-zanni-delivers-keynote-at-the-tier1-hosting-transformation-summit/09/2008">John Zanni Delivers Keynote at the Tier1 Hosting Transformation Summit</source>
    </item>
    <item>
      <title><![CDATA[Assets Good Until Reached For]]></title>
      <link>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</link>
      <guid>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</guid>
      <description><![CDATA[A few months back Minyanville wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised? Some smart...]]></description>
      <content:encoded><![CDATA[<p><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">A few months back </span></span><a href="http://www.minyanville.com/articles/football-bears-bulls-Credit-equities-fannie/index/a/18769"><span style="font-size: 12px; "><span style="font-family: Arial;">Minyanville</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised?

Some smart folks have been warning for a long time. Warren Buffett famously called derivatives financial weapons of mass destruction.</span></span></p><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Charlie Munger, as he is wont to do, went a bit further (from 2004):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">I think a good litmus test of the mental and moral quality at any large institution [with significant derivatives exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</span></span></p></blockquote><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have many other statements in the same direction, based on their own experience from buying companies that used deriviatives where they were unable to to unwind the books and figure out who owed who. At the last Berkshire Hathaway annual meeting someone asked Charlie Munger what we could learn from past blow ups about the present crisis</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It was a particularly foolish mess. We talked about an idiot in the credit delivery grocery business, Webvan. Internet based delivery service for groceries -- that was smarter than what happened in mortgage business. I wish we had those Webvan people back.</span></span></p></blockquote><div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
What can we learn from all this?
<br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Well Dan Geer launched a revolution with his </span></span><a href="http://catless.ncl.ac.uk/risks/20.06.html"><span style="font-size: 12px; "><span style="font-family: Arial;">famous speech</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> about risk management. He got the big picture part right on the security industry evolving into more risk management practices, however the examples we assumed that were right at the time, the financial industry are proving wrong. For one thing you can&#39;t manage a risk if you don&#39;t know the assets (back to Charlie Munger, emphasis added):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; "><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It is crazy to allow things to get too big to fail, run with knavery. As an industry, there is a crazy culture of greed and overreaching and overconfidence trading algorithms. It is demented to allow derivative trading such that clearance risks are embedded in system. Assets are all “good until reached for” on balance sheets. We had $400m of that at general re, </span></span><span style="font-weight: bold; font-size: 12px; "><span style="font-family: Arial;">“good until reached for”</span></span><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">. In drug business you must prove it is good. It is a crazy culture, and to some extent an evil culture. Accounting people really failed us. Accounting standards ought to be dealt with like engineering standards.</span></span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So, yes it is about risk management, but if you build too many abstractions on top of your assets through derivative accounting and such you may find you don&#39;t have any assets when you need them. Don&#39;t fall in love with your abstractions, </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/04/security-rules.html"><span style="font-size: 12px; "><span style="font-family: Arial;">manage your assets</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">There are some clear lessons for us in Information Security, err I mean Information Risk Management.</span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Margin of safety</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
Its our job to manage risk, but this doesn&#39;t mean that we have to build layers and layer of abstraction on top of it. It also means that we help to design, build, deploy, and operate systems with margins of safety. Understanding the failure modes and accounting for this in design. Developers (because they are supposed to) and architects (because they haven&#39;t been properly trained) focus on functional requirements, building features, but on security not so much. There are many ways to improve security in a system and they are all inadequate by themselves, but we can help find </span></span></span><a href="http://1raindrop.typepad.com/1_raindrop/2007/06/cost_effective_.html"><span style="font-size: 12px; "><span style="font-family: Arial;">cost effective improvements</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. </span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Don&#39;t fall in love with abstractions</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">If you have a 100,000 dekstops or 100,000 servers it hard to manage. You will need to automate and to do that you need to abstract, but you should also realize that its a drawing on a whiteboard not reality. You need </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2005/12/the_road_to_ass.html"><span style="font-size: 12px; "><span style="font-family: Arial;">abstraction assurance</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.&#160;</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><a href="https://financialcryptography.com/"><span style="font-size: 12px; "><span style="font-family: Arial;">Ian Grigg</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/09/if-a-tree-falls-in-someone-elses-silo.html#comments"><span style="font-size: 12px; "><span style="font-family: Arial;">commented</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> on an earlier post</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">There are distinct parallels between phishing / retail payments, and the bigger investment mess. In both cases, banks would argue these are core business. In both cases, they have applied risk-based security models, and accepted some loss. In both cases, they have the ability to apply substantial experience to the monitoring, allocating and absorbing risks and losses.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">In both cases, they watched and did nothing as the risks started from low, and migrated upwards. Are we at the point where regulation has killed the ability of banks to apply their (arguable) one core skill, to whit, risk-based analysis? Are banks that far out of banking that they no longer have it?</span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So you have to remember that top down and bottom up need to be combined.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; line-height: 14px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Design for failure</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Dan Geer has also told the story that he sat in a large bank&#39;s risk management training, and the trainer said &quot;you may wonder why this works so well. it works because there is zero ambiguity over who owns what risk.&quot; Dan&#39;s thought was - &quot;in my field we have nothing but ambiguity.&quot; Turns out the second part was right, we have nothing but ambiguity over who owns what risk; unfortunately the financial people have much more ambiguity than they thought! So we do have a lesson here after all, and it this - when the thing you thought was true isn&#39;t, the failure mode is very ugly. </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2006/01/design_for_fail.html"><span style="font-size: 12px; "><span style="font-family: Arial;">Design for failure - a</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">dd layers of protection. </span></span><span style="font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Keep it simple.</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have some smart engineers at Google to be sure, but even they had </span></span><a href="http://www.identityblog.com/?p=1011"><span style="font-size: 12px; "><span style="font-family: Arial;">incredibly basic errors in their SSO</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. I have seen other obvious fails like people signing WS-Security messages, and the recipient checks for a signature but not if they trust the signer! There are so many ways to shoot yourself in the foot in a loosely coupled systems, and we have so many abstractions layered on top of each other, part of the mantra of protecting assets has to be keeping it simple.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So that is my list, to do all these things it requires that Infosec get in the game, understand the use cases, understand the business value (it should be abundantly clear that you can&#39;t simply rely on &quot;business people&quot; to be &quot;business experts&quot;), and that you not lose sight of the asset amidst all the abstraction. Finally, the systems we build security on are very primitive, a firewall and SSL are fine, a seatbelt was fine in 1935 and its still fine today, but there are lots of other safety controls in cars. ABS, airbags, traction control, they all protect the assets far better than in 1935, that&#39;s what we need to build.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Anyone can make bad assumptions (assume you know who owns what risk) and its easy to make bad abstractions (the firewall protects the information system), but when you combine bad assumptions with bad abstractions you&#39;ll get assets that are good until reached for sooner or later</span></span></div></div></div>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 05:41:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/information risk management">information risk management</category>
      <category domain="http://securityratty.com/tag/risk management practices">risk management practices</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/assets">assets</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/business people">business people</category>
      <category domain="http://securityratty.com/tag/security industry">security industry</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/assets-good-until-reached-for.html">Assets Good Until Reached For</source>
    </item>
    <item>
      <title><![CDATA[Do ISPs pose a bigger online privacy threat than Google?]]></title>
      <link>http://securityratty.com/article/874d9048be6f49cdfcf590f8c3042218</link>
      <guid>http://securityratty.com/article/874d9048be6f49cdfcf590f8c3042218</guid>
      <description><![CDATA[A research paper published by a university professor claims that ISPs could pose a bigger threat to online privacy than Google and other online advertisers...]]></description>
      <content:encoded><![CDATA[A research paper published by a university professor claims that ISPs could pose a bigger threat to online privacy than Google and other online advertisers do.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:f68e243bdaa2e7ccd495a6aee8fbb85e:EBSBwp6OfKSqjd5M1rZd9nQHd0M%2BzlnvyhEpJ8TzYztG8vo8E0HFp1fA8YFePyM2h22OveDlqe1JsJi%2FxT7%2FBfKlchYFj7vVX2TglYMdkCw%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:c5c60a19c4a1bd1f6a7949908d2796c6:YpyCuovyoWKENplwK7g8tOZrBMJ%2FfTHWvsJlIWPMCkZ%2Fnc9pxz2s%2BE8ykjGOuLYE5EP1jVLgMsaprxMU1LuOxhg7A3Y7KihYP5vidZE9gwU%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:fb6d9c3fcceba31e190f289fd7422b30:0wO3WyloC7JMoDTejMOjmKEgssLl50tKD4WWiGDt9mOoDDIB5123rWJSm3gkdCdFttRJahCyRyVXFk9tGXon6PSn8ZTakxPM2EqdsD%2BC%2FTo%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:cfa79d62141a5fedb55c3f1a8f402e07:YDmEmFfXlwWkd8FOlczFc8x%2BFkZDA%2Bq0wZjNfuVWeabzVHfMRJlq2OIXu%2Besd9ABEcEn6GgY6cSGe52GRuvzDLYS%2BEJx%2FM4HOtZ55YPnVU4%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=bb7076d272e01a9e8491ae4e6fe38fc9" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=bb7076d272e01a9e8491ae4e6fe38fc9" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 03:39:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online privacy">online privacy</category>
      <category domain="http://securityratty.com/tag/university professor claims">university professor claims</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/isps">isps</category>
      <category domain="http://securityratty.com/tag/bigger threat">bigger threat</category>
      <category domain="http://securityratty.com/tag/research paper">research paper</category>
      <category domain="http://securityratty.com/tag/pose">pose</category>
      <category domain="http://securityratty.com/tag/online advertisers">online advertisers</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=bb7076d272e01a9e8491ae4e6fe38fc9">Do ISPs pose a bigger online privacy threat than Google?</source>
    </item>
    <item>
      <title><![CDATA[ET and IT]]></title>
      <link>http://securityratty.com/article/f7836c0e5e12bf621dfc029dec99f890</link>
      <guid>http://securityratty.com/article/f7836c0e5e12bf621dfc029dec99f890</guid>
      <description><![CDATA[Interesting piece by Tom Friedman (who has been on the green bus longer than anyone in MSM) comparing the candidates' energy stances, especially this part

Why? Because renewable energy technologies...]]></description>
      <content:encoded><![CDATA[<p>Interesting <a href="http://www.nytimes.com/2008/09/03/opinion/03friedman.html?em=&amp;pagewanted=print">piece</a> by Tom Friedman (who has been on the green bus longer than anyone in MSM) comparing the candidates&#39; energy stances, especially this part:</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p>Why? Because renewable energy technologies — what I call “E.T.” — are going to constitute the next great global industry. They will rival and probably surpass “I.T.” — information technology. The country that spawns the most E.T. companies will enjoy more economic power, strategic advantage and rising standards of living. We need to make sure that is America. Big oil and OPEC want to make sure it is not.</p></blockquote><br /><div><a href="http://money.cnn.com/2008/07/08/technology/Kleiner_bets_the_farm_Lashinsky.fortune/index.htm">Kleiner Perkins set up a $500M green growth fund</a>, which sounds like a lot, until you realize that energy is a $6 trillion industry. So Friedman is right that ET is going to be bigger than IT on the top line, now profit margins may be a different story.</div>]]></content:encoded>
      <pubDate>Fri, 05 Sep 2008 07:34:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/renewable energy technologies">renewable energy technologies</category>
      <category domain="http://securityratty.com/tag/energy stances">energy stances</category>
      <category domain="http://securityratty.com/tag/friedman">friedman</category>
      <category domain="http://securityratty.com/tag/tom friedman">tom friedman</category>
      <category domain="http://securityratty.com/tag/kleiner perkins set">kleiner perkins set</category>
      <category domain="http://securityratty.com/tag/top line">top line</category>
      <category domain="http://securityratty.com/tag/strategic advantage">strategic advantage</category>
      <category domain="http://securityratty.com/tag/economic power">economic power</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/et-and-it.html">ET and IT</source>
    </item>
  </channel>
</rss>
