<![CDATA[[SecurityRatty] tag: brad]]> http://securityratty.com/tag/brad Fri, 27 Jun 2008 06:56:10 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[A suit of armor is needed now to protect you online]]> http://securityratty.com/article/28df93f6285f4ab9101e0e388076ab79 http://securityratty.com/article/28df93f6285f4ab9101e0e388076ab79 How many of you are fully patched? 100%?
Raise your hands.
clipped from www.sci-tech-today.com
Searching for Brad Pitt Can Lure Surfers To Malware


Malware with criminal intent tends to last for a short time, according to Green, only five to seven hours. And most of it is static and obfuscated or intentionally made difficult to read, he said.


Criminals are now shifting from SMTP to HTTP as a way to steal information from Internet users, according to F-Secure, and unless you have a fully patched browser, plug-ins and operating system, you are vulnerable.
  blog it

Feed Ads By BidVertiser.comFeed Ads By BidVertiser.com

]]> Wed, 17 Sep 2008 19:41:44 +0000 lure surfers brad pitt malware internet users short time criminal intent system smtp browser A suit of armor is needed now to protect you online <![CDATA[Brad Pitt tops list of Internet malware lures]]> http://securityratty.com/article/b66a93e34e06388159c6093f4421edbe http://securityratty.com/article/b66a93e34e06388159c6093f4421edbe Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Wed, 17 Sep 2008 09:00:00 +0000 brad pitt internet site chance engine mcafee Brad Pitt tops list of Internet malware lures <![CDATA[Brad Pitt, Beyonce and Justin Timberlake top list of celebrity names most abused by malware writers]]> http://securityratty.com/article/b2ef23822beb1c70773631f8bc78b66d http://securityratty.com/article/b2ef23822beb1c70773631f8bc78b66d Tue, 16 Sep 2008 20:00:00 +0000 brad pitt lure unwary fans names malware screensaver software mariah carey george clooney stars wallpaper Brad Pitt, Beyonce and Justin Timberlake top list of celebrity names most abused by malware writers <![CDATA[Speaking of Security Podcast #120]]> http://securityratty.com/article/6b1c0fe26bd3497e5f19544fa07502b9 http://securityratty.com/article/6b1c0fe26bd3497e5f19544fa07502b9 Click to Play
What's New with PCI

Speaking of Security co-host, Paul Joyal, discusses the latest developments in the Payment Card Industry data security standards with Brad Davenport, Compliance and Solutions Marketing Manager at RSA.

]]> Mon, 08 Sep 2008 20:00:00 +0000 brad davenport paul joyal security co-host compliance pci solutions manager rsa discusses Speaking of Security Podcast #120 <![CDATA[Web Services and XML Security Training at OWASP]]> http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc http://securityratty.com/article/6d12835067b0b2251fdc4b658b6928cc I am teaching Web Services and XML Security training at OWASP's AppSec conference in NYC, Sept 22-23. Web services provide the backbone that integrates many things in the enterprise from application servers, databases, ERP, and CRM.  Increasingly we are seeing Web services in more B2C roles with Rest, Federation and other technologies. The class looks at how Web services applications are built, what are common threats and vulnerabilities in Web services, and how to build your Web services application to defend against them.


I have often said that OWASP conferences are my favorite ones because they are in depth technically and very practical. I always look forward to teaching at OWASP and the speaker lineup for this conference looks excellent.

Here is a quick list of tools we have used in past classes

Web Services frameworks
Apache CXF - very interesting open source Web services framework with support for JMS, SOAP, and Rest
Apache Axis & Axis2
.Net
Metro - interesting framework from Sun for interop with WCF

Identity 
PingFederate - leading federation tool, we'll look at browser based SSO with SAML
PingFederate Web Services - we'll look at how to implement a STS in Web services
Bandit - Cardspace, authorization, and auditing

Security Services
VordelSecure - XML gateway, comprehensive web services security policy creation and enforcement, deploying decentralized security services
Apache Ramparts
modecurity

Testing
Soapbox - web services security testing
WebScarab - web services fuzzing

Static Analysis
Fortify SCA - how to scan your web services code for security bugs *before* you deploy


This is just a quick list, new tools are added periodically. If you are using tools of these types in your company you may find it interesting to attend.

Testimontials on past classes

"High quality detailed overview of SOA security standards and approaches. Well thought-out and structured presentation."
- Sr. IT Architect, Fortune 10 enterprise

"The knowledge and transfer was a great baseline and with the additional resources Gunnar made available, made this one of the best one day classes I've taken."
- IT Security Lead, Fortune 10 enterprise

"This class was a thorough and well-organized trek through the current Web Services Security landscape. Going beyond just describing the standards and the options available in the Web Services Security world, this class discusses real-world use cases and offers implementable solutions, best practices, even vendor choices in several key areas.  This class provided me with actionable tasks that I took back to my project teams the very next day!"
-Jesse Aalberg, Sr. Enterprise Application Architect, United Healthcare

"The class was distinctly focused on Security requirements and the strength and weaknesses of the various solution approaches we could consider. The result of the course was actionable approaches to providing security in our SOA environment."
-Brad Sillman, Director IT Security, Deluxe Corp.

"Anyone who wants up-to-date information on SOA Security, security standards and best practices should take this class."
-Kevin Beam, Senior Systems Engineer, Union Pacific Railroad

"Good comprehensive overview of subject, standards, and threats" 
- Sr.Security Consultant, Ubizen

"The class helped me get my head around what "SOA" and WS-Security is really all about"
- Mike Zusman, Independent consultant

"Topics addressed are timely and relevant. Labs are hands-on and help see concepts in action"
- Jerry Tan, Systems Analyst, DTCC

"This class was concise and covered a majority of the problem set my company is looking at and dealing with." 
- Steve Reilley, Technical consultant, Commerce Insurance

"Excellent two day overview of security topics as related to Web Services."
- Daniel Reznick, Information Security, ADP

"Issue affecting most of us today & for those that don't - will soon. Very necessary education and technology."
Aaron Delashmutt

"Great class! Effective and relevant teaching in an area without much guidance."
- Mark DiSabato, Senior Information Security Architect, Roche

"The class cut through jargon to communicate concepts and implementation details."
- Developer, Fortune 100 insurance company

"Good overview regarding SOA Security. Contains new technology like AMQP and REST" 
- Lars Loland, Statoil

"The course covered what I had to learn about Web services"
- Sven Vetsch, Dreamlab Technologies

"Very good, eye opening especially for websecurity noob."
-Michael Brandon

"Presenter has very broad and deep technical knowledge on subject. Content: good overview and comparison of SAML and WS-*"
- Security consultant, ING

"Good to learn where our application is vulnerable to attacks and how we can avoid them."
- Application Development Programmer Lead, Fortune 100 Insurance company

"Entirely thorough overview of technology surrounding the use of web services with a 1 day presentation"
- Technical consultant Contextis

"Gave a good overview of the Web services security environment"
- Francesco Degrassi, Emaze Networks

"A great entry point for securing your web services"
- Stig Kluver

"Lots of good technical information about an emerging area that's very useful"
- Rory McClune, HBOS PLC

"This class reinforced the importance of software security assurance to me as it lucidly demonstrated why being 'behind the firewall' is an outdated concept."
-Senior Support Engineer, Software Security vendor

"The area of SOA Security is complicated and youg. A course such as this helps bring it into focus."
-Jayme Frye, System Engineer, Union Pacific Railroad

"Web services security class provided application security concepts valuable for applications audits."
- Mary Ma, IT Auditor, DTCC

"Very knowledgeable coverage of security requirements for Web services."
- David Libershal, Network Security Engineer, Johns Hopkins University Applied Physics Laboratory

"WS/XML security is not a "black art", but you do need to know about it to be able to take it into consideration."
- Applications Specialist, Global 500 manufacturer

"Good overview of techniques worth considering when planning secure apps"
- EAI Specialist, Leading Mobility company

"Brought concepts in very easily understood terms."
-Glenn Bernard, Systems Engineer

"Gives ideas about the latest Web services security standards in the industry"
- Security Coordinator, Global 500 manufacturer

"Class cleared up various WS-* standards and gave great concrete examples of how to build a message using each standard. Very good general thoughts on security groups' role in IT."
- Matt Kasselman, UP Systems Engineering

"I found this very useful as an IT architect in a "security critical environment"."
- Mika Pullinen, IT Architect, Finnish Defense Forces

"Lots of useful information packed in a small amount of time. Good overall picture."
- Jari Pirhonen, Security Director, Samlink

"Gunnar is very knowledgeable about security topics and has a great ability to explain complex ideas using simple, appropriate, and amusing language and analogies."
- Scott Redd, Sr. Project Engineer, Union Pacific

"Excellent instructor who had a good pace to go through the presentation" 
- Anna Vaahtokan, Specialist, Nordea

"Good application security principles."
- Tuomas Kivinen, IT Security Specialist, Nordea

"I liked the class quite a bit. I took it in a "survey mode" where I wanted to learn about topics at a high level, and this was accomplished. It was good to listen to those in the class that were much more familiar with SAO than I."
- John Glazeski, Senior Systems Engineer

]]> Thu, 28 Aug 2008 04:55:59 +0000 security soa security standards security standards soa security soa security critical environment information security information application security principles Web Services and XML Security Training at OWASP <![CDATA[Wait, you want me to do business with you again?]]> http://securityratty.com/article/9a86e02275d3e91c5c7f10a6ab819385 http://securityratty.com/article/9a86e02275d3e91c5c7f10a6ab819385 Ya know, it wasnt just the fact that Vista kept crashing my puter,
It was the lousy customer support that make you lose me as a customer.
clipped from www.informationweek.com
Microsoft Admits Windows Vista Mistakes, Criticizes Apple Ads


“We broke a lot of things. We know that, and we know it caused you a lot of pain. It got customers thinking, hey, is Windows Vista a generation we want to get invested in?” So Brad Brooks, Microsoft’s VP of Windows Vista consumer marketing, fessed up publicly this week.
  blog it
]]> Tue, 22 Jul 2008 10:59:25 +0000 windows vista consumer windows vista windows vista mistakes vista lousy customer support customer lot brad brooks apple ads Wait, you want me to do business with you again? <![CDATA[A bloggers network to be proud of]]> http://securityratty.com/article/0d47902cfedc7535a6d946cef0d1379e http://securityratty.com/article/0d47902cfedc7535a6d946cef0d1379e

I started blogging about 2 and half-years ago because I felt like it would be fun to add my two cents to the public debate.  When Brad Feld introduced me to the Feedburner guys I was given an insiders view into the quickly developing blogging world.  When Feedburner started networks, I thought it would be interesting to start a network of all the security blogs that I was reading.  I also inherently knew in my gut that eventually there would be some common good that would benefit all of the members of the network by aggregating our content and buying power for ads. I also believed and still do believe that there are other ways that a network such as the Security Bloggers Network can be a force for good.

However, reading the SBN feed tonight I was just blown away! From being on the road, I had not read the SBN feed in my Newsgator reader for almost 2 days.  I had over 160 articles cued up in the feed.  Forget for a moment that the Security Bloggers Network now has over 160 blogs and a combined feedburner subscriber base of almost 67,000 readers!  The content is king.  Going through the articles I could not believe the total coverage, the ongoing commentary and give and take, but most of all it was the quality.  There are so many great members of the network who are just so damn smart and are writing about such important stuff.

I am humbled and incredibly proud of the what the Security Bloggers Network has become. If you are interested in security, whether it be the technical aspects of security, the business of security or the security industry, you cannot afford to miss this SBN feed. 

We are kicking around a lot of new activities and ways to publicize the member blogs of the network over the coming months.  Stay tuned for details, but in the meantime keep reading, you won't be sorry!

Zemanta Pixie
]]> Sat, 05 Jul 2008 07:54:00 +0000 network blogs security blogs security security industry security bloggers network sbn feed tonight sbn feed feed A bloggers network to be proud of <![CDATA[A bloggers network to be proud of]]> http://securityratty.com/article/dde65a2c18ee60646147982ffc29b546 http://securityratty.com/article/dde65a2c18ee60646147982ffc29b546

I started blogging about 2 and half-years ago because I felt like it would be fun to add my two cents to the public debate.  When Brad Feld introduced me to the Feedburner guys I was given an insiders view into the quickly developing blogging world.  When Feedburner started networks, I thought it would be interesting to start a network of all the security blogs that I was reading.  I also inherently knew in my gut that eventually there would be some common good that would benefit all of the members of the network by aggregating our content and buying power for ads. I also believed and still do believe that there are other ways that a network such as the Security Bloggers Network can be a force for good.

However, reading the SBN feed tonight I was just blown away! From being on the road, I had not read the SBN feed in my Newsgator reader for almost 2 days.  I had over 160 articles cued up in the feed.  Forget for a moment that the Security Bloggers Network now has over 160 blogs and a combined feedburner subscriber base of almost 67,000 readers!  The content is king.  Going through the articles I could not believe the total coverage, the ongoing commentary and give and take, but most of all it was the quality.  There are so many great members of the network who are just so damn smart and are writing about such important stuff.

I am humbled and incredibly proud of the what the Security Bloggers Network has become. If you are interested in security, whether it be the technical aspects of security, the business of security or the security industry, you cannot afford to miss this SBN feed. 

We are kicking around a lot of new activities and ways to publicize the member blogs of the network over the coming months.  Stay tuned for details, but in the meantime keep reading, you won't be sorry!

Zemanta Pixie

]]> Sat, 05 Jul 2008 06:54:00 +0000 network blogs security blogs security security industry security bloggers network sbn feed tonight sbn feed feed A bloggers network to be proud of <![CDATA[More RSA Compliance Solutions Bloggers]]> http://securityratty.com/article/30308b0aec2bc5c5c3ed8e7ae995fd33 http://securityratty.com/article/30308b0aec2bc5c5c3ed8e7ae995fd33 Dave Howell and Brad Davenport) has been joined by Andrew Maloney and John McDonald.

Please take advantage of the comments field to get answers to your compliance-related security queries!]]> Thu, 03 Jul 2008 15:30:00 +0000 includes dave howell comments field andrew maloney brad davenport security queries rsa bloggers john mcdonald advantage join More RSA Compliance Solutions Bloggers <![CDATA[Can you hear me now?]]> http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3 http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3 Verizon released a very interesting Data Breach report that analyzes over 500 forensic reports on their system over a number of years. It is great work by Verizon to gather this data and to publish it. Of course a consultant I go into lots of companies where they could learn a lot just by being more open and talking through issues with peers in other companies. Would be great to see other companies follow Verizon's lead.


I suggest you read their report, and I would like to add a little color to their findings from the perspective of the swamp I spend most of my time in - Web services security. Granted it is just one report, but the data run counter to a lot of conventional security "wisdom":

Who is behind data breaches? 

73% resulted from external sources
18% were caused by insiders 
39% implicated business partners 
30% involved multiple parties


The internal/external divide is pretty silly these days, as is companies' recanting "inside the firewall and outside the firewall", I spend most of time hooking things up together precisely _so_ they intereoperate remotely. The firewall is a speed bump at best. At any rate external sources is a primary concern in Web services security, because - hey look our Web service front end just made your Mainframe/As400/Unix DB/ CICS/whatever accessible remotely. This is great from a functionality standpoint, but the issue is that these back end systems were never designed with anything remotely resembling an Internet threat model. Additionally, the Verizon team's findings around business parties and multiple parties strikes at the heart of a number of popular misconceptions in Web services security - "well its just B2B and its behind a firewall."


How do breaches occur? 


62% were attributed to a significant error

59% resulted from hacking and intrusions  

31% incorporated malicious code 

22% exploited a vulnerability 
15% were due to physical threats 


A couple of things to note here - malicious code in my opinion is likely to be the biggest problem in Web services security going forward. There is a large gap waiting to be exploited here. You have no control over the other end of the pipe plus a massive attack surface, the only thing lacking is the attacker's ability to find and exploit which I strongly suspect is just a matter of time. Wrt hacking an intrusions we have the remote, passive nature of web security to blame here in Web services world. Paraphrasing Jeff Williams, the problem is that an attacker can just try an attack if it doesn't work, try again, again, and so on. This partially because of the loosely coupled nature of the systems, but it is also because commonly used information security protocols have diverged from reality are modeled using an object-centric mentality, where you "own" the object you are protecting and can afford to put passive controls around.

What commonalities exist? 


66%  involved data the victim did not know was on the system
75%  of breaches were not discovered by the victim  
83%  of attacks were not highly difficult 
85%  of breaches were the result of opportunistic attacks 
87%  were considered avoidable through reasonable controls 

Many of the attacks against Web Services are not difficult, in my training class, we'll typically execute 8-10 different attacks in a two day period. But the big one from this list is the first one - the amazing amount of attack surface offered up by Web services. Brad Hill has done a good job articulating these issues in SOAP/XML/WS-*, but at an enterprise its even bigger than those standards - the thing is we use Web services to make stuff interoperate, to make stuff reusable, and to virtualize endpoints. Great stuff if what you want to do is decentralize your business, but this creates oceans of space for attackers to roam. When you look beyond the Visio and the IDE view of web services, and get to the runtime there is an amazing amount of detritus left behind by all these layers.



]]> Fri, 27 Jun 2008 06:56:10 +0000 web services web services world web services security data breach report report attack massive attack surface companies follow verizon data Can you hear me now?