<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: clinical]]></title>
    <link>http://securityratty.com/tag/clinical</link>
    <description></description>
    <pubDate>Wed, 11 Jun 2008 10:33:41 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[OAuth for Secure Mashups]]></title>
      <link>http://securityratty.com/article/f0ebee1b88f03cd2b1ad9ff61f4608ac</link>
      <guid>http://securityratty.com/article/f0ebee1b88f03cd2b1ad9ff61f4608ac</guid>
      <description><![CDATA[Posted by Eric Sachs, Senior Product Manager, Google Security

A year ago, a number of large and small websites announced a new open standard called OAuth . This standard is designed to provide a...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Posted by Eric Sachs, Senior Product Manager, Google Security</span><br /><br />A year ago, a number of large and small websites announced a new open standard called <a href="http://oauth.net/" id="hz33" title="OAuth">OAuth</a>. This standard is designed to provide a secure and privacy-preserving technique for enabling specific private data on one site to be accessed by another site.  One popular reason for that type of cross-site access is data portability in areas such as personal health records (such as Google Health or Microsoft Healthvault), as well as social networks (such as OpenSocial enabled sites). I originally became involved in this space in the summer of 2005, when Google started developing a feature called <a href="http://code.google.com/apis/accounts/docs/AuthSub.html" id="e3yh" title="AuthSub">AuthSub</a>, which was one of the pre-cursors of OAuth. That was a proprietary protocol, but one that has been used by hundreds of websites to provide add-on services to Google Account users by getting permission from users to access data in their Google Accounts.  In fact, that was the key feature that a few of us used to start the Google Health portability effort back when it was only a prototype project with a few dedicated Googlers.  <div id="zq.s" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="zq.s1" style="margin-top: 0px; margin-bottom: 0px;"> However, with the development of a common Internet standard in OAuth, we see much greater potential for data portability and secure mash-ups. Today we <a href="http://igoogledeveloper.blogspot.com/2008/11/sign-in-to-myspace-aol-mail-and-google.html">announced</a> that the gadget platform now supports OAuth, and the interoperability of this standard was demonstrated by new iGoogle gadgets that AOL and MySpace both built to enable users to see their respective AOL or MySpace mailboxes (and other information) while on iGoogle. However, to ensure the user's privacy, this only works after the user has authorized AOL or MySpace to make their data available to the gadget running on iGoogle.  We also previously <a href="http://googledataapis.blogspot.com/2008/10/whats-that-google-data-gadgets.html" id="w6.8" title="announced">announced</a> that third-party developers can build their own iGoogle gadgets that access the OAuth-enabled APIs for Google applications such as Calendar, Picasa, and Docs. In fact, since both the gadget platform and OAuth technology are open standards, we are working to help other companies who run services similar to iGoogle to enhance them with support for these standards. Once that is in place, these new OAuth-powered gadgets that are available on iGoogle will also work on those other sites, including many of the gadgets that Google offers for its own applications. This provides a platform for some interesting mash-ups.  For example, a third-party developer could create a single gadget that uses OAuth to access both Google OAuth-enabled APIs (such as a Gmail user's <a href="http://code.google.com/apis/contacts/" id="v05v" title="address book">address book</a>) and <a href="http://developer.myspace.com/community/myspace/dataavailability.aspx" id="lewp" title="MySpace OAuth enabled APIs">MySpace OAuth-enabled APIs</a> (such as a user's friend list) and display a mashup of the combination.  </div>  <div id="d23k" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="ivuk" style="margin-top: 0px; margin-bottom: 0px;"> While the combination of OAuth with gadgets is an exciting new use of the technology, most of the use of OAuth is between websites, such as to enable a user of Google Health to allow a clinical trial matching site to access his or her health profile.  I previously mentioned that one privacy control provided by OAuth is that it defines a standard way for users to authorize one website to make their data accessible to another website. In addition, OAuth provides a way to do this without the first site needing to reveal the identity of the user -- it simply provides a different opaque security token to each additional website the user wants to share his or her data with.  It would allow a mutual fund, for example, to provide an iGoogle gadget to their customers that would run on iGoogle and show the user the value of his or her mutual fund, but without giving Google any unique information about the user, such as a social security number or account number.  In the future, maybe we will even see industries like banks use standards such as OAuth to allow their customers to authorize utility companies to perform direct debit from the user's bank account without that person having to actually share his or her bank account number with the utility vendor. </div>  <div id="pvsw" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="odub" style="margin-top: 0px; margin-bottom: 0px;"> The OAuth community is continuing to enhance this standard and is very interested in having more companies engaged with its development. The <a href="http://oauth.net/" id="q6e4" title="OAuth">OAuth.net</a> website has more details about the current standard, and I maintain a <a href="http://sites.google.com/site/oauthgoog/" id="uw8z" title="website">website</a> with advanced information about Google's use of OAuth, including work on integrating OAuth with desktop apps, and integrating with federation standards such as OpenID and SAML.  If you're interested in engaging with the OAuth community, please get in touch with us. </div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=LcHtN"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=LcHtN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=7jAKn"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=7jAKn" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~4/458667878" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 14:41:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oauth">oauth</category>
      <category domain="http://securityratty.com/tag/oauth community">oauth community</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/google accounts">google accounts</category>
      <category domain="http://securityratty.com/tag/oauth technology">oauth technology</category>
      <category domain="http://securityratty.com/tag/google security">google security</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/bank account">bank account</category>
      <category domain="http://securityratty.com/tag/gadget">gadget</category>
      <source url="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~3/458667878/oauth-for-secure-mashups.html">OAuth for Secure Mashups</source>
    </item>
    <item>
      <title><![CDATA[OAuth for Secure Mashups]]></title>
      <link>http://securityratty.com/article/dce22eb7ff2c1aceec169c6236231696</link>
      <guid>http://securityratty.com/article/dce22eb7ff2c1aceec169c6236231696</guid>
      <description><![CDATA[Posted by Eric Sachs, Senior Product Manager, Google Security

A year ago, a number of large and small websites announced a new open standard called OAuth . This standard is designed to provide a...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Posted by Eric Sachs, Senior Product Manager, Google Security</span><br /><br />A year ago, a number of large and small websites announced a new open standard called <a href="http://oauth.net/" id="hz33" title="OAuth">OAuth</a>. This standard is designed to provide a secure and privacy-preserving technique for enabling specific private data on one site to be accessed by another site.  One popular reason for that type of cross-site access is data portability in areas such as personal health records (such as Google Health or Microsoft Healthvault), as well as social networks (such as OpenSocial enabled sites). I originally became involved in this space in the summer of 2005, when Google started developing a feature called <a href="http://code.google.com/apis/accounts/docs/AuthSub.html" id="e3yh" title="AuthSub">AuthSub</a>, which was one of the pre-cursors of OAuth. That was a proprietary protocol, but one that has been used by hundreds of websites to provide add-on services to Google Account users by getting permission from users to access data in their Google Accounts.  In fact, that was the key feature that a few of us used to start the Google Health portability effort back when it was only a prototype project with a few dedicated Googlers.  <div id="zq.s" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="zq.s1" style="margin-top: 0px; margin-bottom: 0px;"> However, with the development of a common Internet standard in OAuth, we see much greater potential for data portability and secure mash-ups. Today we <a href="http://igoogledeveloper.blogspot.com/2008/11/sign-in-to-myspace-aol-mail-and-google.html">announced</a> that the gadget platform now supports OAuth, and the interoperability of this standard was demonstrated by new iGoogle gadgets that AOL and MySpace both built to enable users to see their respective AOL or MySpace mailboxes (and other information) while on iGoogle. However, to ensure the user's privacy, this only works after the user has authorized AOL or MySpace to make their data available to the gadget running on iGoogle.  We also previously <a href="http://googledataapis.blogspot.com/2008/10/whats-that-google-data-gadgets.html" id="w6.8" title="announced">announced</a> that third-party developers can build their own iGoogle gadgets that access the OAuth-enabled APIs for Google applications such as Calendar, Picasa, and Docs. In fact, since both the gadget platform and OAuth technology are open standards, we are working to help other companies who run services similar to iGoogle to enhance them with support for these standards. Once that is in place, these new OAuth-powered gadgets that are available on iGoogle will also work on those other sites, including many of the gadgets that Google offers for its own applications. This provides a platform for some interesting mash-ups.  For example, a third-party developer could create a single gadget that uses OAuth to access both Google OAuth-enabled APIs (such as a Gmail user's <a href="http://code.google.com/apis/contacts/" id="v05v" title="address book">address book</a>) and <a href="http://developer.myspace.com/community/myspace/dataavailability.aspx" id="lewp" title="MySpace OAuth enabled APIs">MySpace OAuth-enabled APIs</a> (such as a user's friend list) and display a mashup of the combination.  </div>  <div id="d23k" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="ivuk" style="margin-top: 0px; margin-bottom: 0px;"> While the combination of OAuth with gadgets is an exciting new use of the technology, most of the use of OAuth is between websites, such as to enable a user of Google Health to allow a clinical trial matching site to access his or her health profile.  I previously mentioned that one privacy control provided by OAuth is that it defines a standard way for users to authorize one website to make their data accessible to another website. In addition, OAuth provides a way to do this without the first site needing to reveal the identity of the user -- it simply provides a different opaque security token to each additional website the user wants to share his or her data with.  It would allow a mutual fund, for example, to provide an iGoogle gadget to their customers that would run on iGoogle and show the user the value of his or her mutual fund, but without giving Google any unique information about the user, such as a social security number or account number.  In the future, maybe we will even see industries like banks use standards such as OAuth to allow their customers to authorize utility companies to perform direct debit from the user's bank account without that person having to actually share his or her bank account number with the utility vendor. </div>  <div id="pvsw" style="margin-top: 0px; margin-bottom: 0px;"><br /></div>  <div id="odub" style="margin-top: 0px; margin-bottom: 0px;"> The OAuth community is continuing to enhance this standard and is very interested in having more companies engaged with its development. The <a href="http://oauth.net/" id="q6e4" title="OAuth">OAuth.net</a> website has more details about the current standard, and I maintain a <a href="http://sites.google.com/site/oauthgoog/" id="uw8z" title="website">website</a> with advanced information about Google's use of OAuth, including work on integrating OAuth with desktop apps, and integrating with federation standards such as OpenID and SAML.  If you're interested in engaging with the OAuth community, please get in touch with us. </div><div class="feedflare">
<a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=RbYKY1QI"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?d=41" border="0"></img></a> <a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=livMlZFo"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?i=livMlZFo" border="0"></img></a>
</div><img src="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~4/bEpTg1dntxU" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 14:41:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oauth">oauth</category>
      <category domain="http://securityratty.com/tag/oauth community">oauth community</category>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/google accounts">google accounts</category>
      <category domain="http://securityratty.com/tag/oauth technology">oauth technology</category>
      <category domain="http://securityratty.com/tag/google security">google security</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <category domain="http://securityratty.com/tag/bank account">bank account</category>
      <category domain="http://securityratty.com/tag/gadget">gadget</category>
      <source url="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~3/bEpTg1dntxU/oauth-for-secure-mashups.html">OAuth for Secure Mashups</source>
    </item>
    <item>
      <title><![CDATA[British Hospital System Hit by Computer Virus]]></title>
      <link>http://securityratty.com/article/f1d8bd877d349859de699cde8caa6ac4</link>
      <guid>http://securityratty.com/article/f1d8bd877d349859de699cde8caa6ac4</guid>
      <description><![CDATA[Three London hospitals that make up St Bartholomew's (Barts) and The London NHS Trust have been forced to shut down their computer systems for at least 24 hours due to a computer virus attack . The...]]></description>
      <content:encoded><![CDATA[Three London hospitals that make up St Bartholomew's (Barts) and The London NHS Trust <a href="http://news.bbc.co.uk/2/hi/uk_news/england/london/7735502.stm">have been forced to shut down their computer systems for at least 24 hours due to a computer virus attack</a>. The three hospitals are Barts in the City, the Royal London Hospital in Whitechapel and The London Chest Hospital in Bethnal Green.

Neither a BBC report nor <a href="http://www.bartsandthelondon.org.uk/formedia/press/release.asp?id=2054&sid=10">a press release from the hospitals</a> said anything about the nature of the attack or the extent of the damage or if patient services were affected, although one would think this would have to be the case. The terse press release says that "The Trust's well rehearsed emergency procedures have been activated to ensure that key clinical systems continue safely while the system is being stabilised and a solution is being found."

The problem was first detected at 12:00 GMT Monday according to a spokesman.
<p><a href="http://feedads.googleadservices.com/~a/5O7UI8F7mHF--xx0jjKhwICpCgo/a"><img src="http://feedads.googleadservices.com/~a/5O7UI8F7mHF--xx0jjKhwICpCgo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/OssPZ1W7pOw" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 06:01:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/press release">press release</category>
      <category domain="http://securityratty.com/tag/terse press release">terse press release</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/trust">trust</category>
      <category domain="http://securityratty.com/tag/london hospitals">london hospitals</category>
      <category domain="http://securityratty.com/tag/computer virus attack">computer virus attack</category>
      <category domain="http://securityratty.com/tag/hospitals">hospitals</category>
      <category domain="http://securityratty.com/tag/london nhs trust">london nhs trust</category>
      <category domain="http://securityratty.com/tag/royal london hospital">royal london hospital</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/OssPZ1W7pOw/british_hospital_system_hit_by_computer_virus.html">British Hospital System Hit by Computer Virus</source>
    </item>
    <item>
      <title><![CDATA[Biotech Platforms]]></title>
      <link>http://securityratty.com/article/45651b9a0decddecc758c652995e074f</link>
      <guid>http://securityratty.com/article/45651b9a0decddecc758c652995e074f</guid>
      <description><![CDATA[It is interesting to see the notion of tech platforms play out in other fields. Specifically, the biotech field is all abuzz on platforms. For example Exelixis' oncology platform built on kinase...]]></description>
      <content:encoded><![CDATA[<p>It is interesting to see the notion of tech platforms play out in other fields. Specifically, the biotech field is <a href="http://www.hammerstockblog.com/genentech’s-new-shiny-platform/">all </a><a href="http://www.hammerstockblog.com/exelixis-as-a-platform-company/">abuzz</a> on platforms. For example Exelixis&#39; oncology platform built on kinase inhibitors.</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal; ">Having a validated drug discovery platform is the first and most important criterion for defining a good platform company. The platform is typically comprised of a combination of technology, experienced personnel and intellectual property that can generate a stream of drug candidates. Most importantly, investing should be done only after a product of the platform&#160;<span>demonstrates</span>&#160;activity&#160;<span>in clinical trials.&#160;</span>Having a clinically validated product is not a guarantee for future success of the platform nor does it mean that the specific agent will reach the market, but it does imply that one or more of the platform’s products stand a reasonable chance of becoming a commercial drug. A validated platform may increase overall success rates, yet the odds of a particular drug candidate to make it all the way to approval are still low.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">...</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">Exelixis is active in the ever growing market of kinase inhibitors (KIs) for the treatment of cancer, that is, drugs that block the activity of kinases in cancer cells. Cancer cells are often described as cells that are out of control: They proliferate quickly, ignore death signals, invade nearby tissues and eventually metastasize to distant organs. These disease onset and advancement are associated with processes such as cell growth, motility and blood-vessel formation, which are governed by a complex network made of kinases. Thus, blocking these processes by inhibiting the relevant kinases has emerged as one of the most attractive approaches to fighting cancer.<br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">Together with monoclonal antibodies, kinase inhibitors represent a paradigm shift in cancer treatment from cytotoxic agents to targeted therapies, a trend that is constantly growing. Like antibodies for cancer, kinase inhibitors target tumors while sparing healthy cells and consequently lead to better activity with fewer side effects. Kinase inhibitors, however, possess several advantages over antibodies. The most evident advantage is that KIs can hit targets inside the cell while antibodies can only bind targets presented on the cell surface, so internal targets are approachable only by KIs. Another advantage is the fact that KIs can be given orally, which is a major factor in terms of patient convenience, especially given the typical long treatment duration associated with targeted therapies. Another advantage, which will be later discussed in the article, is the ability to produce KIs that hit several targets at once.<br /></span></p></blockquote><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">Read the whole thing </span><a href="http://www.hammerstockblog.com/exelixis-as-a-platform-company/">here</a><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">.&#160;</span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;">Speaking a software guy, the thing that is interesting to me here is that the platform approach allows a biotech to aggregate a large database of tests and test results to refine products across a range of targets and delivery mechanisms. Its just data. Cancer versus Moore&#39;s law? Puh-leeze.</span></div><div><span style="font-family: &#39;Times New Roman&#39;; font-size: 16px; line-height: normal;"><br /></span></div>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 06:08:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/drug">drug</category>
      <category domain="http://securityratty.com/tag/treatment">treatment</category>
      <category domain="http://securityratty.com/tag/cancer treatment">cancer treatment</category>
      <category domain="http://securityratty.com/tag/commercial drug">commercial drug</category>
      <category domain="http://securityratty.com/tag/platforms">platforms</category>
      <category domain="http://securityratty.com/tag/drug discovery platform">drug discovery platform</category>
      <category domain="http://securityratty.com/tag/platform">platform</category>
      <category domain="http://securityratty.com/tag/cells">cells</category>
      <category domain="http://securityratty.com/tag/cancer cells">cancer cells</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/biotech-platforms.html">Biotech Platforms</source>
    </item>
    <item>
      <title><![CDATA[Apptis and USNS Mercy Monitoring on the High Seas]]></title>
      <link>http://securityratty.com/article/32ab3189b54d8e46b467ebbf87db32e0</link>
      <guid>http://securityratty.com/article/32ab3189b54d8e46b467ebbf87db32e0</guid>
      <description><![CDATA[Meet Mike Lawson, Pre-Sales Engineer at Apptis, a leading system integrator and ScienceLogic partner that has deployed EM7 to meet the network, systems and application management needs of several...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="244" alt="mike2 (Small)" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/mike2-small.jpg" width="204" align="left" border="0"> Meet Mike Lawson, Pre-Sales Engineer at Apptis, a leading system integrator and ScienceLogic partner that has deployed EM7 to meet the network, systems and application management needs of several customers. We thought Mike would have an interesting perspective to share on EM7, having recently come from the “customer side” and already with a few deployments under his belt.
<p><b>ScienceLogic: Mike, what’s your background working with network and management system tools?</b>
<p><b>Mike Lawson: </b>Before joining Apptis, I worked for the Air Force, mainly in satellite communications for almost nine years. I’m probably most familiar with HP OpenView and BMC Remedy. I managed a team that used them but wasn’t involved in tool selection; like many other federal IT workers, we didn’t have a choice of tools because there were existing enterprise licenses and maintenance contracts.
<p>I also saw a large systems integrator do a full Remedy/Crystal Systems/OpenView installation. It took 6 weeks to stand up and customize to meet just the basic monitoring requirements, and it cost something like half a million dollars. At the time, I thought that wasn’t bad and was a pretty typical experience.
<p><b>ScienceLogic: Coming from where you did, what’s your take on EM7?</b>
<p><strong>Mike Lawson:</strong> Honestly, I didn’t believe that EM7 could really do all that it claimed. In many ways, it was the complete opposite of what I had seen first-hand with other monitoring solutions. Could it really cover that much functionality? At relatively much lower cost to the customer and without the licensing nightmare?
<p>That quickly changed when I needed to understand the system enough to run it at a customer’s site. I went back over the training docs I received during my initial training class and jumped in; now, 6 months later, I’m the EM7 expert and can tell you that it delivers on all those promises. (But I still need to show people to get them to believe it too)
<p>I preach the “EM7 gospel” and when anyone wants to talk monitoring, I ask about the universal pain points: cost, maintenance contracts and licensing, and then I explain EM7. The cost difference is real; the solution is based on capacity, so there’s no licensing and it’s easy to use. They are shocked to learn that they can buy multiple EM7 appliances and years of maintenance for what they paid for most other tools.
<p><b>ScienceLogic: Apptis won the contract for monitoring aboard the USNS Mercy. We love that you’re using EM7 for one of the Navy’s hospital ships. Can you tell us more?</b>
<p><strong>Mike Lawson:</strong> The USNS Mercy is a Military Sealift Command hospital ship. <a href="http://www.navy.mil/navydata/fact_display.asp?cid=4400&amp;tid=400&amp;ct=4" target="_blank">Some stats</a>:
<ul>
<li>849 feet long (nearly the size of a football field)
<li>12 fully-equipped operating rooms, a 1,000 bed hospital facility, digital radiological services, a diagnostic and clinical laboratory, a pharmacy, an optometry lab, a CAT scan and two oxygen producing plants
<li>Crew: 61 civilian mariners, 956 Naval medical staff, and 259 Naval support staff</li>
</ul>
<p>The USNS recently departed on a five-month humanitarian mission in the Western Pacific and Southeast Asia in support of Pacific Partnership 2008. The partnership provides international medical, dental and engineering teams this summer to provide humanitarian support and conduct joint, combined, and cooperative Civil-Military Operations in order to improve regional stability and build partner capacity to respond to natural disasters and pandemic.
<p>For the most part, the ship’s network is self-contained, but can also use a landline when docked. The network covers 400 devices, including Windows/Exchange servers and VMware for server virtualization. Prior to using EM7, none of the monitoring was integrated; each system was independently monitored through individual vendor-specific consoles.
<p>Out of the box, EM7 provided integrated systems, application and network management for all network gear, applications and virtual machines in one solution. We didn’t have to do a lot of customization – EM7 includes best-practice based thresholds, event and monitoring templates and this covered what USNS Mercy needed to monitor.
<p><b>ScienceLogic: You’re a systems integrator with a very useful “customer point of view” when it comes to looking at tools. From that perspective, can you share what you think are the biggest benefits that EM7 provides?</b>
<p><strong>Mike Lawson:</strong> First of all, EM7 stands up right away. We’re talking days, not weeks. In contrast to the lengthy installation of OpenView and Remedy I witnessed during my military career, I was able to configure, customize, and implement the EM7 solution for the USNS Mercy in three days.
<p>Second, it’s easy to train people on and the support is outstanding. This judgment is from first-hand experience. Right before the USNS Mercy departed on its latest voyage, the system administrator I had trained on EM7 left, so I had all of a day to train some new EM7 admins. I prepared a seven-page “cheat sheet” and over a 3-hour conference call, we walked through the entire EM7 solution; I haven’t gotten a support call since.
<p>And when a problem did crop up with a device being discovered incorrectly, ScienceLogic was very responsive. We contacted ScienceLogic support on a Saturday and they created and emailed us a video to help troubleshoot the same day. Within 30 seconds of watching the video, the problem was resolved.
<p>Finally, EM7 helps us be good stewards of the government’s money. This is very important to me personally and to Apptis as a company. Because EM7 is cheaper and deploys so quickly and easily, you might think that it’s just the opposite of what a system integrator would want to use. But that’s short-term thinking. We believe in deliver the most value for customers every time. It’s what creates trust and long-term relationships with our customers. Instead of that half million spent on standing up the solution and basic setup, I’d much rather (and I know the customer would rather) spend that on fine-tuning or extending the solution to do much, much more.
<p>As a former government employee, I know what it’s like to use a tool that doesn’t fit my needs. EM7 proves that the best solution can totally break the old model of costly, lengthy installations. EM7 has the right model: the right solution and the right price delivered as an appliance that is easy to deploy, train on and use. </p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Apptis+and+USNS+Mercy+%26ndash%3B+Monitoring+on+the+High+Seas&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fapptis-and-usns-mercy-monitoring-on-the-high-seas%2F08%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Thu, 07 Aug 2008 11:59:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/solution">solution</category>
      <category domain="http://securityratty.com/tag/entire em7 solution">entire em7 solution</category>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/em7 gospel">em7 gospel</category>
      <category domain="http://securityratty.com/tag/em7 proves">em7 proves</category>
      <category domain="http://securityratty.com/tag/em7 admins">em7 admins</category>
      <category domain="http://securityratty.com/tag/multiple em7 appliances">multiple em7 appliances</category>
      <category domain="http://securityratty.com/tag/em7 solution">em7 solution</category>
      <category domain="http://securityratty.com/tag/explain em7">explain em7</category>
      <source url="http://blog.sciencelogic.com/apptis-and-usns-mercy-monitoring-on-the-high-seas/08/2008">Apptis and USNS Mercy Monitoring on the High Seas</source>
    </item>
    <item>
      <title><![CDATA[Private Details Available For Months On The Centers For Osteopathic Research And Education Website]]></title>
      <link>http://securityratty.com/article/2e5301ea42e72c1d9e1330bd674544fd</link>
      <guid>http://securityratty.com/article/2e5301ea42e72c1d9e1330bd674544fd</guid>
      <description><![CDATA[The Centers for Osteopathic Research and Education (CORE) at Ohio University removed a Web document last week that inadvertently contained personal information belonging to individuals who have...]]></description>
      <content:encoded><![CDATA[The Centers for Osteopathic Research and Education (CORE) at Ohio University removed a Web document last week that inadvertently contained personal information belonging to individuals who have provided academic programming for the medical education consortium. CORE is an osteopathic medical education consortium comprising member teaching hospitals, clinical training sites and osteopathic medical schools. The Ohio [...]]]></content:encoded>
      <pubDate>Mon, 28 Jul 2008 13:57:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/education">education</category>
      <category domain="http://securityratty.com/tag/medical education consortium">medical education consortium</category>
      <category domain="http://securityratty.com/tag/osteopathic research">osteopathic research</category>
      <category domain="http://securityratty.com/tag/ohio">ohio</category>
      <category domain="http://securityratty.com/tag/ohio university">ohio university</category>
      <category domain="http://securityratty.com/tag/osteopathic medical schools">osteopathic medical schools</category>
      <category domain="http://securityratty.com/tag/core">core</category>
      <category domain="http://securityratty.com/tag/web document">web document</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <source url="http://cyberinsecure.com/private-details-available-for-months-on-the-centers-for-osteopathic-research-and-education-website/">Private Details Available For Months On The Centers For Osteopathic Research And Education Website</source>
    </item>
    <item>
      <title><![CDATA[Everyone works at home at Chorus, part one]]></title>
      <link>http://securityratty.com/article/f18dbc89c2c5dea36a726c1f9cc6d3f6</link>
      <guid>http://securityratty.com/article/f18dbc89c2c5dea36a726c1f9cc6d3f6</guid>
      <description><![CDATA[Rick Boyd used to spend US$500 a month on gas and tolls commuting 48 miles a day between his home in Westchester County, N.Y., and his office in Hasbrouck Heights, N.J. Now Boyd doesn't commute any...]]></description>
      <content:encoded><![CDATA[Rick Boyd used to spend US$500 a month on gas and tolls commuting 48 miles a day between his home in Westchester County, N.Y., and his office in Hasbrouck Heights, N.J. Now Boyd doesn't commute any more because his company, Chorus, which provides clinical and management software for community health centers, has gone virtual.]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/community health centers">community health centers</category>
      <category domain="http://securityratty.com/tag/boyd">boyd</category>
      <category domain="http://securityratty.com/tag/rick boyd">rick boyd</category>
      <category domain="http://securityratty.com/tag/chorus">chorus</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/hasbrouck heights">hasbrouck heights</category>
      <category domain="http://securityratty.com/tag/westchester county">westchester county</category>
      <category domain="http://securityratty.com/tag/management software">management software</category>
      <category domain="http://securityratty.com/tag/gas">gas</category>
      <source url="http://www.networkworld.com/news/2008/071508-everyone-works-at-home-at.html?fsrc=rss-security">Everyone works at home at Chorus, part one</source>
    </item>
    <item>
      <title><![CDATA[Australian medical information found in abandoned amusement park]]></title>
      <link>http://securityratty.com/article/5603502d0088acde782f2669d07e2fb6</link>
      <guid>http://securityratty.com/article/5603502d0088acde782f2669d07e2fb6</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/27/08

Organization
New South Wales Government (AU

Contractor/Consultant/Branch
Sydney West Area Health Service
Unnamed &quot;bankrupt contractor

Victims...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/swahs.jpg" width="165" align="right" height="58"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/27/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://nsw.gov.au/">New South Wales Government (AU)</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wsahs.nsw.gov.au/">Sydney West Area Health Service</a> <br>Unnamed "bankrupt contractor"<br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"confidential medical records"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Sydney West Area Health Service has been embarrassed by the discovery of medical records in an abandoned amusement park."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.abc.net.au/news/stories/2008/06/27/2288377.htm">ABC News</a> <br><a href="http://www.livenews.com.au/Articles/2008/06/27/Shipping_container_full_of_medical_waste_dumped_at_derelict_fun_park">Macquarie National News</a> <br><a href="%20http://livenews.com.au/Articles/2008/06/28/Dumped_medical_container_blamed_on_bankrupt_contractor">Macquarie National News (2)</a><br><br><span style="font-weight: bold;">Report Credit:</span><br>ABC NEws<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The Sydney West Area Health Service has been embarrassed by the discovery of medical records in an abandoned amusement park.<br><span style="font-style: italic;">[Evan] This is a first.&nbsp; An abandoned amusement park?&nbsp; I would be embarrassed too!</span><br><br>Pathology results and slides were found when a container dumped in the former Magic Kingdom park at Lansvale was set alight this week.<br><br>The container was discovered after it caught on fire yesterday, attracting the attention of the local fire department.<br><br>A bankrupt contractor is being blamed for dumping confidential medical records and contaminated waste in the grounds of an abandoned fun park.<br><span style="font-style: italic;">[Evan] Confidential medical records AND contaminated waste?&nbsp; Ugh.</span><br><br>Police said it was likely the container had been there for a decade.<br><span style="font-style: italic;">[Evan] A decade?&nbsp; This story keeps getting more bizarre.</span><br><br>The Health Department is reviewing waste disposal procedures following the discovery at Lansvale in Sydney's south west.<br><span style="font-style: italic;">[Evan] I presume that the waste disposal procedures have probably changed over the past ten years.&nbsp; The Health Department should be reviewing procedures on a regular basis anyway.</span><br style="font-style: italic;"><br>The health service's chief executive, Professor Steven Boyages, says it is a serious breach and the health service is reviewing its waste disposal procedures.<br><br>"There are clear policy and procedures in place to manage records and disposal of records and clear policies in place to manage and dispose of any clinical waste," he said.<br><br>"It appears at first glance that the policy and procedures weren't followed by the contractors who were engaged to do this."<br><br>“It is a huge concern, I’ve called for an immediate review to ensure our existing contractors are following standard policy and procedures so this doesn't happen again," he said <br><br>Shadow health minister Jillian Skinner said the state government also has some explaining to do.<br><br>"Why if it was know this company had gone bankrupt and wasn't carrying out its duties they didn't check to make sure this material was disposed of properly?" Ms Skinner said. <br><br><span style="font-weight: bold;">Commentary:</span><br>The landscape of information security and personal information issues has changed markedly over the past ten years.&nbsp; SWAHS should still be held accountable, but how much can you comment on something that happened ten years ago and probably does not reflect upon current practice.<br><br>This is one of the most bizarre breaches I have read about in some time. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/28/swahs.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 28 Jun 2008 09:10:55 +0000</pubDate>
      <category domain="http://securityratty.com/tag/confidential medical records">confidential medical records</category>
      <category domain="http://securityratty.com/tag/medical records">medical records</category>
      <category domain="http://securityratty.com/tag/clinical waste">clinical waste</category>
      <category domain="http://securityratty.com/tag/waste">waste</category>
      <category domain="http://securityratty.com/tag/waste disposal procedures">waste disposal procedures</category>
      <category domain="http://securityratty.com/tag/disposal">disposal</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/procedures">procedures</category>
      <category domain="http://securityratty.com/tag/amusement park">amusement park</category>
      <source url="http://breachblog.com/2008/06/28/swahs.aspx">Australian medical information found in abandoned amusement park</source>
    </item>
    <item>
      <title><![CDATA[Operational security failure]]></title>
      <link>http://securityratty.com/article/4fc894e2c296a90a0ec5e2dc0dfdcc68</link>
      <guid>http://securityratty.com/article/4fc894e2c296a90a0ec5e2dc0dfdcc68</guid>
      <description><![CDATA[A shocking article appeared yesterday on the BMJ website. It recounts how auditors called 45 GP surgeries asking for personal information about 51 patients. In only one case were they asked to verify...]]></description>
      <content:encoded><![CDATA[<p>A <a href="http://www.bmj.com/cgi/eletters/336/7656/1290#197245">shocking article</a> appeared yesterday on the BMJ website. It recounts how auditors called 45 GP surgeries asking for personal information about 51 patients. In only one case were they asked to verify their identity; the attack succeeded against the other 50 patients.</p>
<p>This is an old problem. In 1996, when I was advising the BMA on clinical system safety and privacy, we trained the staff at one health authority to detect false-pretext phone calls, and they found 30 a week. We reported this to the Department of Health, hoping they&#8217;d introduce some operational security measures nationwide; instead the Department got furious at us for treading on their turf and ordered the HA to stop cooperating (the story&#8217;s told in <a href="http://www.cl.cam.ac.uk/~rja14/Papers/SE-08.pdf">my book</a>). More recently I confronted the NHS chief executive, David Nicholson, and patient tsar Harry Cayton, with the issue at a conference early last year; they claimed there wasn&#8217;t a problem nowadays now that people have all these computers.</p>
<p>What will it take to get the Department of Health to care about patient privacy? Lack of confidentiality already <a href="http://www.aims.org.uk/Journal/Vol20No1/ChildProtection.htm">costs lives</a>, albeit indirectly. Will it require a really high-profile fatality?</p>
]]></content:encoded>
      <pubDate>Tue, 17 Jun 2008 07:29:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/health authority">health authority</category>
      <category domain="http://securityratty.com/tag/health">health</category>
      <category domain="http://securityratty.com/tag/department">department</category>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/nhs chief executive">nhs chief executive</category>
      <category domain="http://securityratty.com/tag/patient privacy">patient privacy</category>
      <category domain="http://securityratty.com/tag/clinical system safety">clinical system safety</category>
      <category domain="http://securityratty.com/tag/costs lives">costs lives</category>
      <category domain="http://securityratty.com/tag/patients">patients</category>
      <source url="http://www.lightbluetouchpaper.org/2008/06/17/operational-security-failure/">Operational security failure</source>
    </item>
    <item>
      <title><![CDATA[Metro Round-Up: Phila., Minneapolis, St. Louis Park (Minn.), Texas, Foster City (Calif.), Naperville (Ill.), Chehalis and Centralia (Wash.), Cambria C]]></title>
      <link>http://securityratty.com/article/ba9fa39ee95e3dd8fdd6d81a86d5370d</link>
      <guid>http://securityratty.com/article/ba9fa39ee95e3dd8fdd6d81a86d5370d</guid>
      <description><![CDATA[Philadelphia may find operator for Wi-Fi network: The AP reports that the City of Brotherly Love's Wi-Fi network isn't yet down, or down for the count. While it's scheduled to be flipped off tomorrow...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.forbes.com/feeds/ap/2008/06/11/ap5104811.html"><strong>Philadelphia may find operator for Wi-Fi network:</strong></a> The AP reports that the City of Brotherly Love's Wi-Fi network isn't yet down, or down for the count. While it's scheduled to be flipped off tomorrow (you can read whatever you like into the phrase "flipped off"), the city is talking to a party it won't disclose about the networks future. EarthLink sued Phila. in May to be able to remove its equipment and cap its liabilities. The city's wireless non-profit arm, Wireless Philadelphia, has made noises about what EarthLink's true liability could be; the non-profit has born some of the electrical cost, and might be seeking to have that repaid on top of penalties and other expenses.</p>

<p><a href="http://www.startribune.com/business/19726749.html?location_refer=Homepage"><strong>Minneapolis suffers the heartbreak of leafage:</strong></a> Leaves are popping in Minneapolis, and Star-Tribune columnist Steve Alexander writes that residents are seeing some Wi-Fi reception problems on that city's Wi-Fi network. This is the only big-city network that can be currently described "successful," even though its long-term success has to be proven out. The firm responsible, USI Wireless, told Alexander they're working on adjusting about 5 percent of antennas to cope with the pesky greenery.</p>

<p><a href="http://www.startribune.com/local/west/19745504.html?location_refer=Style%20+%20People"><strong>St. Louis Park sues ARINC over Wi-Fi network:</strong></a> The Minnesota town says the network never worked, and had earlier discussed a lawsuit. The city wants the value of the contract ($1.7m) plus a very modest amount in damages and fees ($50,000). The city plans to start removing gear if ARINC doesn't sometime in June. But they have to deal with 490 poles erected to hold the nodes and solar-charging gear--sunk into concrete. More recent testing showed that the network worked well in some areas, but the majority of the network did not, according to the Star Tribune.</p>

<p><a href="http://telecompetitor.com/node/671"><strong>Verizon builds out fiber in AT&T territory:</strong></a> Interesting sign of competition in otherwise monopoly-per-provider-type world. Verizon is using AT&T's hard-won statewide video franchising rules in Texas to build competitive fiber in Dallas suburbs. They're apparently not bringing telecom; they're acting like a cable TV firm with data. Verizon owns chunks of territory all over due to it encompassing GTE in a deal years ago. GTE serves suburbs west of Portland, Ore., and east of Seattle, for instance, while Qwest serves most of the rest of each state.</p>

<p><a href="http://sanmateodailynews.com/article/2008-6-7-fc-metrofi"><strong>Foster City Wi-Fi dies on June 20:</strong></a> MetroFi is unlighting its cities, and Foster City opted not to spend the nearly $200,000 asking price MetroFi put on its equipment. MetroFi might still find a buyer, but June 20 is the network's current final day. Naperville, Ill., <a href="http://www.suburbanchicagonews.com/napervillesun/news/998667,6_1_NA11_WIFI_S1.article"><strong>also expects a June 20 shutdown</strong></a>. They, too, were offered the network hardware for 200 grand.</p>

<p><a href="http://www.chronline.com/story.php?subaction=showfull&id=1213119382&archive=&start_from=&ucat=1"><strong>Chehalis lights up:</strong></a> A small city in southern Washington votes to put in Wi-Fi hotzones. The cost is about $53,000 and annual fees $15,000. Funds will come from existing tax and grant sources. The city chose to install service to make sure they're not missing a checkbox on the amenities list for visitors and businesses rather than for a particular, measurable goal.</p>

<p><a href="http://www.chronline.com/story.php?subaction=showfull&id=1213205136&archive=&start_from=&ucat=1"><strong>Nearby Centralia pulls its Wi-Fi:</strong></a> A pilot project in the larger city of Centralia, Wash., a bit north of Chehalis, is shut down when poles used to mount Wi-Fi radios are removed as electrical wires are buried. (The reporter here confuses broadband over powerlines (BPL) with broadband wireless.) The system might be restarted later.</p>

<p><a href="http://www.muniwireless.com/2008/06/10/guest-commentary-how-a-pennsylvania-county-paved-the-way-to-muni-broadband-success/"><strong>Craig Settles writes up Pennsylvania's Cambria County wireless success:</strong></a> This is a network built for particular municipal purposes, part of Settles's long-time drumbeat about having applications first and then networks built for those networks second. He notes that Cambria built a 700 sq mi network that sounds nearly cost neutral through efficiency and cost conservation--it's cheaper to get much more service with this network than it was for a smaller array of services with incumbent-provided networks. </p>

<p><a href="http://www.scsun-news.com/news/ci_9545465"><strong>Santa Fe residents oppose Wi-Fi in the library on health grounds:</strong></a> You know what I have to say about how provable this has turned out to be in clinical studies. I am, however, as always, concerned about these people's health, even if I don't believe that Wi-Fi (or EMF) causes their problems. The group opposed to library-Fi is citing the ADA in this case, uniquely I believe. Six libraries suggested that EMF triggers seizures in epileptics, something I've never heard cited before; maybe CRTs (flickering), but EMF? Wired is substantially less kind than I am, pointing out that EMF other than Wi-Fi produces <a href="http://blog.wired.com/gadgets/2008/06/santa-fe-whiner.html"><strong>vastly higher signal strength</strong></a>. (They're sort of ignoring signal strength at a given point where an individual stands in relation to a transmitter, however.)</p>]]></content:encoded>
      <pubDate>Wed, 11 Jun 2008 10:33:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/big-city network">big-city network</category>
      <category domain="http://securityratty.com/tag/residents oppose wi-fi">residents oppose wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/mount wi-fi radios">mount wi-fi radios</category>
      <category domain="http://securityratty.com/tag/wi-fi hotzones">wi-fi hotzones</category>
      <category domain="http://securityratty.com/tag/wi-fi network">wi-fi network</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network hardware">network hardware</category>
      <source url="http://wifinetnews.com/archives/008353.html">Metro Round-Up: Phila., Minneapolis, St. Louis Park (Minn.), Texas, Foster City (Calif.), Naperville (Ill.), Chehalis and Centralia (Wash.), Cambria C</source>
    </item>
  </channel>
</rss>
