<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: club]]></title>
    <link>http://securityratty.com/tag/club</link>
    <description></description>
    <pubDate>Mon, 23 Jun 2008 11:21:46 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Hype Alert: Internet Shopping Carts Are Secure]]></title>
      <link>http://securityratty.com/article/6f0706e64d78d354492017803497a079</link>
      <guid>http://securityratty.com/article/6f0706e64d78d354492017803497a079</guid>
      <description><![CDATA[My blog reader fed me a nugget today that set off my hype monitor, specifically a post entitled Internet Shopping Carts are Secure
OMG...really
To be fair, I realize the author is speaking from the...]]></description>
      <content:encoded><![CDATA[My blog reader fed me a nugget today that set off my hype monitor, specifically a post entitled <a href="http://hubpages.com/hub/Internet-Shopping-Carts-Are-Secure" taget="_blank">Internet Shopping Carts are Secure</a>. <br />OMG...really?<br />To be fair, I realize the author is speaking from the eCommerce perspective, rather than that of an information security practitioner, but here's where the trouble begins:<br /><span style="font-style:italic;">"Shopping cart service providers have developed secure ecommerce shopping cart solutions for any business owner looking to enhance their current online store, or create a new one. Some ecommerce shopping cart solution providers are even receiving PABP (Payment Application Best Practice) certification which supports PCI compliance requirements for all businesses accepting credit card payments online."</span><br />This may be true in part, but it is by no means an all-inclusive claim. Shopping carts continue to be sieve-like, even when apparently reviewed per <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" target="_blank">PCI</a> standards.<br />Allow me to elaborate.<br />We'll kick off our hype eliminating effort with a simple Google dork: <a href="http://www.google.com/search?hl=en&q=inurl%3A%22cart.cfm%22&btnG=Search" target="_blank"{>inurl:"cart.cfm"</a> (picking on ColdFusion again, but man, they make it easy)<br /><a href="http://www.gmpartsdirect.com/cart.cfm" target="_blank">GM Parts Direct: Your Shopping Cart</a> jumped right out at me for a number of reasons.<br />First, I sensed XSS vulns lurking like a Geiger counter senses radiation. Sound <a href="http://www.ringelkater.de/Sounds/2geraeusche_gegenst/geigerzaehler.wav" target="_blank">effect</a> for edification. :-)<br />Second, the page contained one of the growing number of aforementioned conversion-driving website <a href="http://sealserver.trustwave.com/cert.php?customerId=w6ordzctHpqOVGcB1cmBsViTpDGC2k&size=105x54&style=normal&language=en" target="_blank">security</a> seals. <br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://3.bp.blogspot.com/_kVOWaY1TAF0/SN1tYvapkkI/AAAAAAAAADg/6k1ncKqufL4/s1600-h/GMparts.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://3.bp.blogspot.com/_kVOWaY1TAF0/SN1tYvapkkI/AAAAAAAAADg/6k1ncKqufL4/s320/GMparts.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5250473012396397122" /></a><br /><br />Tick, tick, click...the Gieger counter is getting louder. <br />Trustwave claims that the site operator "is enrolled in Trustwave's Trusted Commerce™ program to validate compliance with the Payment Card Industry Data Security Standard (PCI DSS) mandated by all the major credit card associations including: American Express, Diners Club, Discover, JCB, MasterCard Worldwide, Visa, Inc. and Visa Europe."<br />Methinks that <a href="https://www.trustwave.com/" target="_blank">Trustwave's</a> Trusted Commerce program is missing a few fundamental security checks. Remember, XSS in PCI regulated sites, according to the <a href="https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml" target="_blank">PCI DSS</a>, indicates that a site is not compliant (see section 6.5.4) if vulnerable to XSS.<br />Uh-oh.<br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_kVOWaY1TAF0/SN1wVI4q8FI/AAAAAAAAADo/ZzFA7u8xNCA/s1600-h/GMparts_xss_trustwave.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://2.bp.blogspot.com/_kVOWaY1TAF0/SN1wVI4q8FI/AAAAAAAAADo/ZzFA7u8xNCA/s320/GMparts_xss_trustwave.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5250476249048608850" /></a><br />All it takes is a fake login page, as opposed to our friends at <a href="http://xssed.com/" target="_blank">XSSED.com</a>, and...well, you get the point.<br />Simply, this is one of an endless number of shopping cart not secure, and not PCI compliant. For shame. You need only browse the <a href="http://holisticinfosec.org/content/category/6/23/45/" target="_blank">Holisticinfosec.org Advisories</a> page to find multiple ecommerce platforms and shopping carts that are missing the mark. Trust me, these are a fraction of the <a href="http://secunia.com/advisories/search/?search=shopping+cart" target="_blank">problem</a>.<br />ecommerce<>security<br />ecommerce<><a href="http://msdn.microsoft.com/en-us/library/ms995349.aspx" target="_blank">SDL</a><br />ecommerce<>PCI<br />website security seal<>security<br />Sigh.]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 11:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ecommerce">ecommerce</category>
      <category domain="http://securityratty.com/tag/multiple ecommerce platforms">multiple ecommerce platforms</category>
      <category domain="http://securityratty.com/tag/ecommerce sdl">ecommerce sdl</category>
      <category domain="http://securityratty.com/tag/ecommerce perspective">ecommerce perspective</category>
      <category domain="http://securityratty.com/tag/pci">pci</category>
      <category domain="http://securityratty.com/tag/pci dss">pci dss</category>
      <category domain="http://securityratty.com/tag/cart solutions">cart solutions</category>
      <category domain="http://securityratty.com/tag/cart">cart</category>
      <category domain="http://securityratty.com/tag/ecommerce security">ecommerce security</category>
      <source url="http://holisticinfosec.blogspot.com/2008/09/hype-alert-internet-shopping-carts-are.html">Hype Alert: Internet Shopping Carts Are Secure</source>
    </item>
    <item>
      <title><![CDATA[Supper Club Cancelled]]></title>
      <link>http://securityratty.com/article/64e43dd60cf197d052a45c74261cfc21</link>
      <guid>http://securityratty.com/article/64e43dd60cf197d052a45c74261cfc21</guid>
      <description><![CDATA[General illness and people working from home expecting the tube strike to go ahead. Well schedule another for after the holiday season (end of...]]></description>
      <content:encoded><![CDATA[General illness and people working from home expecting the tube strike to go ahead. Well schedule another for after the holiday season (end of September).
       ]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 03:54:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tube strike">tube strike</category>
      <category domain="http://securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://securityratty.com/tag/schedule">schedule</category>
      <category domain="http://securityratty.com/tag/ahead">ahead</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/illness">illness</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/september">september</category>
      <source url="http://securitybuddha.com/2008/08/21/supper-club-cancelled/">Supper Club Cancelled</source>
    </item>
    <item>
      <title><![CDATA[London Security Supper Club Update - Its Next Thursday not Friday !]]></title>
      <link>http://securityratty.com/article/3467fb25acafad355b254e2b2e18c29b</link>
      <guid>http://securityratty.com/article/3467fb25acafad355b254e2b2e18c29b</guid>
      <description><![CDATA[Doh! I goofed. Its next Thursday the 21st at Belgo Centraal in Covent Garden. Belgian beer, steak frites and security chat. We have limited seats so if you only think you maybe able to make it or its...]]></description>
      <content:encoded><![CDATA[Doh! I goofed. 
It&#8217;s next Thursday the 21st at Belgo Centraal in Covent Garden. Belgian beer, &#8220;steak frites&#8221; and security chat. We have limited seats so if you only think you maybe able to make it or it&#8217;s &#8220;possible&#8221; you will pull out at the last minute you can just turn up for beers. Probably [...]]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 04:33:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/steak frites">steak frites</category>
      <category domain="http://securityratty.com/tag/security chat">security chat</category>
      <category domain="http://securityratty.com/tag/thursday">thursday</category>
      <category domain="http://securityratty.com/tag/belgo centraal">belgo centraal</category>
      <category domain="http://securityratty.com/tag/belgian beer">belgian beer</category>
      <category domain="http://securityratty.com/tag/21st">21st</category>
      <category domain="http://securityratty.com/tag/doh">doh</category>
      <category domain="http://securityratty.com/tag/covent">covent</category>
      <category domain="http://securityratty.com/tag/minute">minute</category>
      <source url="http://securitybuddha.com/2008/08/15/london-security-supper-club-update-its-next-thursday-not-friday/">London Security Supper Club Update - Its Next Thursday not Friday !</source>
    </item>
    <item>
      <title><![CDATA[Security Supper Club Next Friday 22nd]]></title>
      <link>http://securityratty.com/article/4ce81d0aa6566e8a88ce425fc25552c4</link>
      <guid>http://securityratty.com/article/4ce81d0aa6566e8a88ce425fc25552c4</guid>
      <description><![CDATA[We are holding a security supper club next Friday at Belgo Centraal, Covent Garden. Belgian Beer, Steak Frites and security chat. It doesnt get better. Leave your cars at home and get the train. I...]]></description>
      <content:encoded><![CDATA[We are holding a security supper club next Friday at Belgo Centraal, Covent Garden. Belgian Beer, Steak Frites and security chat. It doesn&#8217;t get better. Leave your cars at home and get the train. I have a table for 10 reserved and 3 definite&#8217;s (Bob, Yeomans and me).&#160; 
If you want to join us mail [...]]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 07:59:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security supper club">security supper club</category>
      <category domain="http://securityratty.com/tag/belgo centraal">belgo centraal</category>
      <category domain="http://securityratty.com/tag/belgian beer">belgian beer</category>
      <category domain="http://securityratty.com/tag/friday">friday</category>
      <category domain="http://securityratty.com/tag/steak frites">steak frites</category>
      <category domain="http://securityratty.com/tag/security chat">security chat</category>
      <category domain="http://securityratty.com/tag/yeomans">yeomans</category>
      <category domain="http://securityratty.com/tag/table">table</category>
      <category domain="http://securityratty.com/tag/cars">cars</category>
      <source url="http://securitybuddha.com/2008/08/12/security-supper-club-next-friday-22nd/">Security Supper Club Next Friday 22nd</source>
    </item>
    <item>
      <title><![CDATA[Black Hat wrap up - secure@microsoft, booth babes and bloggers]]></title>
      <link>http://securityratty.com/article/bd7d7b3698d05a16a10cc4d0a21e2bfd</link>
      <guid>http://securityratty.com/article/bd7d7b3698d05a16a10cc4d0a21e2bfd</guid>
      <description><![CDATA[You can read plenty of other blogs about some of the great presentations at Black Hat. So I thought I would take another angle and talk about some of the other stuff that may be important to you
1....]]></description>
      <content:encoded><![CDATA[<p></p>  <p>You can read plenty of other blogs about some of the great presentations at Black Hat.  So I thought I would take another angle and talk about some of the other stuff that may be important to you.</p>  <p>1.  <a href="mailto:secure@microsoft.com"><font face="Courier"><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/Picture%20049.jpg"><img title="Picture 049" style="border-right: 0px; border-top: 0px; margin: 5px 10px 5px 0px; border-left: 0px; border-bottom: 0px" height="184" alt="Picture 049" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/Picture%20049_thumb.jpg" width="244" align="left" border="0"></img></a></font><font face="Courier New">secure@microsoft.com</font></a> – This years hottest party was again the Microsoft party.  This year it was at the LAX club in the Luxor.  As usual there were quite a number of people at the door who thought they could talk their way in or worse yet were told they “were one the list”.  I was happy to be able to go and saw many of the usual suspects there as well. I had to leave the party early to go catch my red eye flight home, so went right to the airport from the party.  As I wrote earlier, Microsoft is trying really hard on security.  But I couldn’t help but notice the irony of this grainy, lousy picture of the DJ booth at the party.  If you can, notice the computers that the <a href="mailto:secure@microsoft.com">secure@microsoft.com</a> DJs are using. That’s right they are Macs!</p>  <p>2. A new low for booth babes – What would a Shimel review of a trade show be without a booth babe rant.  Hey I recognize it is Vegas and all, but EdgeOS went way over the line this year.  A booth babe dressed as a Las Vegas showgirl or some other type of costume makes a statement.  I personally don’t like exploiting woman to make that statement, but I understand.  However, these guys had woman who were dressed so raunchy and classless, that I could not bring myself to post a picture of them.  Come on guys!  You want to resort to the booth babe thing (and BTW I think the Black Hat crowd does not respond to that), at least have a little class.  These girls looked like street walkers and do you and your company no favors.  Is that really the image you want to promote?  Grow up!</p>  <p>3.  The Security Bloggers Network – We are back!  With the end of the Black Hat show, the SBN is going back to being the<a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/securitybloggers.gif"><img title="securitybloggers" style="margin: 5px 5px 5px 10px" height="147" alt="securitybloggers" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/securitybloggers_thumb.gif" width="112" align="right" border="0"></img></a> SBN.  The old logo is back and our promotion with Black Hat is at an end.  However, I want to personally thank so many of you SBN members who blogged about Black Hat.  The Black Hat marketing folks made it a point to come over to me and thank us for the overwhelming support and help of the community.  Our network delivered big time with them and they are already thinking about ways we can work together next year.  I will keep you all posted on that.</p>  <p>We have several new promotions we are working on with the SBN and will have more on that soon. Also, we learned some valuable lessons.  Next time we will work with the network members more closely in doing these affiliations.  Also, for any show like this we need to have an official bloggers get together.  Not because we don’t want to buy our own drinks (thanks to Chris Hoff for doing more than his share in picking up a big bar tab), but frankly we need to reserve a place that has enough space for us.  Security bloggers are big time. We have a great community of people who get together. Lets make it better.</p>  <p>I have some other ideas around the SBN I am working on too and want to form a committee to help. If you are a member and want to get involved, please drop me a line or comment.</p>  <p>Anyway, another year of Black Hat is in the books. It was a good one and I can’t wait until next year!</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=mqB9CC"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=mqB9CC" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=rP6xlK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=rP6xlK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=fhzqOK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=fhzqOK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=roBQzK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=roBQzK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=yW5ceK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=yW5ceK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=zosCbk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=zosCbk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=XDP8lk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=XDP8lk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/359668026" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 08 Aug 2008 10:46:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/booth">booth</category>
      <category domain="http://securityratty.com/tag/black hat">black hat</category>
      <category domain="http://securityratty.com/tag/booth babes">booth babes</category>
      <category domain="http://securityratty.com/tag/booth babe rant">booth babe rant</category>
      <category domain="http://securityratty.com/tag/black hat crowd">black hat crowd</category>
      <category domain="http://securityratty.com/tag/security bloggers network">security bloggers network</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/security bloggers">security bloggers</category>
      <category domain="http://securityratty.com/tag/booth babe">booth babe</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/359668026/black-hat-wrap.html">Black Hat wrap up - secure@microsoft, booth babes and bloggers</source>
    </item>
    <item>
      <title><![CDATA[When the shoe is on the other foot]]></title>
      <link>http://securityratty.com/article/70ffaafe90e77eabd152a83a018b3487</link>
      <guid>http://securityratty.com/article/70ffaafe90e77eabd152a83a018b3487</guid>
      <description><![CDATA[About to head over to morning sessions of Black Hat (OK, it started at 8am, but that is just an uncivil time for Las Vegas). Before I do, let me give you a quick recap of my first night on Black Hat....]]></description>
      <content:encoded><![CDATA[<p>About to head over to morning sessions of Black Hat (OK, it started at 8am, but that is just an uncivil time for Las Vegas).  Before I do, let me give you a quick recap of my first night on Black Hat. I didn’t get in until 10pm and got to my hotel about 11.  Looked up a few security twits and saw that Mitchell Ashley, Martin McKeay, JJ and Ryan Russell were at the Cleopatra Barge at Caesars.  I headed over there and met up.  The night was on!</p>  <p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/pussycat-dolls-lounge.jpg"><img title="pussycat-dolls-lounge" style="border-right: 0px; border-top: 0px; margin: 5px 5px 5px 10px; border-left: 0px; border-bottom: 0px" height="192" alt="pussycat-dolls-lounge" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/pussycat-dolls-lounge_thumb.jpg" width="240" align="right" border="0"></img></a> We had a quick drink and then headed over to the club Pure, where Fortify was having a party.  Some how or another JJ, Ryan and I got to the VIP entrance and were headed in.  Martin had to go upstairs and change out of his shorts.  Mitchell that Colorado country bumpkin was not allowed in because he was wearing sandals.  What to do?  Leave Mitchell outside, all of us not go in? I went back to my old club hopping days for the answer. I went  in with JJ.  Went to the bar, took off my shoes and gave them to JJ.  While I stood there in socks, she brought the shoes out to Mitchell, who put them on and got in the club.  Watching JJ sneak out the shoes and Mitchell walk in holding his sandals was pretty funny.   But it worked.  We got away from the Fortify party as it was way too crowded.  We found ourselves in my favorite part of Pure, the Pussycat Doll Lounge.  Five minutes later out came the Pussycats.  They put on a very hot show that had us all dancing and shouting.  </p>  <p>After that we went to my usual late night spot at Black Hat, the Augustus cafe for breakfast.  We met up with the Mogul and Hoff, who joined us.  By now it was like 2:30am Vegas time (5:30 east coast time) and it was time for bed.  I am staying at Paris, so had a nice walk but they did give me a LeMans suite which is very nice.  I still get a little confused by rooms with bidets, but it is fun.</p>  <p>Well off to Black Hat for some learning!</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=27Z8hl"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=27Z8hl" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jgRz8K"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jgRz8K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=5ikxYK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=5ikxYK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=EuLGtK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=EuLGtK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Se9E4K"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Se9E4K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=jXFKVk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=jXFKVk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Y2sUOk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Y2sUOk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/357490562" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 06 Aug 2008 06:16:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/uncivil time">uncivil time</category>
      <category domain="http://securityratty.com/tag/black hat">black hat</category>
      <category domain="http://securityratty.com/tag/mitchell">mitchell</category>
      <category domain="http://securityratty.com/tag/east coast time">east coast time</category>
      <category domain="http://securityratty.com/tag/mitchell walk">mitchell walk</category>
      <category domain="http://securityratty.com/tag/mitchell ashley">mitchell ashley</category>
      <category domain="http://securityratty.com/tag/pure">pure</category>
      <category domain="http://securityratty.com/tag/club pure">club pure</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/357490562/when-the-shoe-i.html">When the shoe is on the other foot</source>
    </item>
    <item>
      <title><![CDATA[Another fantasy fulfilled]]></title>
      <link>http://securityratty.com/article/26b1ea4c02200e4db5840372e4b9598b</link>
      <guid>http://securityratty.com/article/26b1ea4c02200e4db5840372e4b9598b</guid>
      <description><![CDATA[My Grandmother always told me that a lucky person can count the really good friends they have on one hand, but a small amount of good friends far outweigh having many acquaintances. That was proven to...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/landon%20and%20brad.jpg"><img title="landon and brad" height="164" alt="landon and brad" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/landon%20and%20brad_thumb.jpg" width="244" align="right" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; MARGIN: 0px 0px 5px 10px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> My Grandmother always told me that a lucky person can count the really good friends they have on one hand, but a small amount of good friends far outweigh having many acquaintances. That was proven to me once again this weekend.&nbsp; Ever since before I had my 2 sons, I had dreams of taking my children to both a Pittsburgh Steeler game and a NY Yankee game. Last year <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2007/09/my-own-pilgrima.html">I had a chance to take Landon and Bradley to Pittsburgh and see a Steeler game</a>.&nbsp; With this being the last year for the old Yankee Stadium, I wanted to take the boys to see the Yankees at home and in the old stadium.&nbsp; </p>

<p>Getting tickets to a game at Yankee Stadium is not cheap.&nbsp; In looking around StubHub, for a hundred bucks a ticket (which is all I was willing to pay), the best I was going to do was out in the bleachers somewhere. But I figured it was better than nothing and was going to go for it.&nbsp; That was when I called my best buddy from college Tyler to see if he wanted to go with us.&nbsp; Tyler still lives in NY, actually he has an apt in Trump Palace and works in advertising for a large company, handling one of the very biggest accounts.&nbsp; When I told him what I was looking at buying he said to hold on and let him see what he could do.</p>

<p>Well Tyler came through big time.&nbsp; Not sure which vendor he got them from, but we had 6th row box seats behind third base, tickets to the Stadium Club, free parking (didn???t use it as we took the subway) and to top it off, Tyler was staying at his friends place and insisted we stay in his place at Trump.&nbsp; </p>

<p>The boys and I had a blast hanging out in the city, going to Dylan???s candy store, the Empire State Building and then heading up to the Stadium.&nbsp; I am sure it will be a time both they and I will never forget.&nbsp; Like the commercial says:</p>

<p>1. 3 round trip airline tickets from Florida to NY ??? $750.00</p>

<p>2. 1 night in a hotel in NYC - $400.00</p>

<p>3. 3 field box seats to a Yankee game - $1000.00</p>

<p>4. A fried like Tyler to make it all happen for free (I used miles for the airfare) and give the kids this kind of memory??? PRICELESS!</p>

<p>Thanks Tyler!</p></div>
]]></content:encoded>
      <pubDate>Sat, 02 Aug 2008 19:25:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/game">game</category>
      <category domain="http://securityratty.com/tag/yankee game">yankee game</category>
      <category domain="http://securityratty.com/tag/pittsburgh">pittsburgh</category>
      <category domain="http://securityratty.com/tag/pittsburgh steeler game">pittsburgh steeler game</category>
      <category domain="http://securityratty.com/tag/stadium">stadium</category>
      <category domain="http://securityratty.com/tag/yankee stadium">yankee stadium</category>
      <category domain="http://securityratty.com/tag/tyler">tyler</category>
      <category domain="http://securityratty.com/tag/college tyler">college tyler</category>
      <category domain="http://securityratty.com/tag/steeler game">steeler game</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/08/another-fantasy.html">Another fantasy fulfilled</source>
    </item>
    <item>
      <title><![CDATA[Another fantasy fulfilled]]></title>
      <link>http://securityratty.com/article/793f0277fc5b82d43ebcd638f1bd83c2</link>
      <guid>http://securityratty.com/article/793f0277fc5b82d43ebcd638f1bd83c2</guid>
      <description><![CDATA[My Grandmother always told me that a lucky person can count the really good friends they have on one hand, but a small amount of good friends far outweigh having many acquaintances. That was proven to...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/landon%20and%20brad.jpg"><img title="landon and brad" height="164" alt="landon and brad" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/landon%20and%20brad_thumb.jpg" width="244" align="right" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; MARGIN: 0px 0px 5px 10px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> My Grandmother always told me that a lucky person can count the really good friends they have on one hand, but a small amount of good friends far outweigh having many acquaintances. That was proven to me once again this weekend.&nbsp; Ever since before I had my 2 sons, I had dreams of taking my children to both a Pittsburgh Steeler game and a NY Yankee game. Last year <a href="http://www.stillsecureafteralltheseyears.com/ashimmy/2007/09/my-own-pilgrima.html">I had a chance to take Landon and Bradley to Pittsburgh and see a Steeler game</a>.&nbsp; With this being the last year for the old Yankee Stadium, I wanted to take the boys to see the Yankees at home and in the old stadium.&nbsp; </p>

<p>Getting tickets to a game at Yankee Stadium is not cheap.&nbsp; In looking around StubHub, for a hundred bucks a ticket (which is all I was willing to pay), the best I was going to do was out in the bleachers somewhere. But I figured it was better than nothing and was going to go for it.&nbsp; That was when I called my best buddy from college Tyler to see if he wanted to go with us.&nbsp; Tyler still lives in NY, actually he has an apt in Trump Palace and works in advertising for a large company, handling a one of the very biggest accounts.&nbsp; When I told him what I was looking at buying he said to hold on and let him see what he can could do.</p>

<p>Well Tyler came through big time.&nbsp; Not sure which vendor he got them from, but we had 6th row box seats behind third base, tickets to the Stadium Club, free parking (didn’t use it as we took the subway) and to top it off, Tyler was staying at his friends place and insisted we stay in his place at Trump.&nbsp; </p>

<p>The boys and I had a blast hanging out in the city, going to Dylan’s candy store, the Empire State Building and then heading up to the Stadium.&nbsp; I am sure it will be a time both they and I will never forget.&nbsp; Like the commercial says:</p>

<p>1. 3 round trip airline tickets from Florida to NY – $750.00</p>

<p>2. 1 night in a hotel in NYC - $400.00</p>

<p>3. 3 field box seats to a Yankee game - $1000.00</p>

<p>4. A fried like Tyler to make it all happen for free (I used miles for the airfare) and give the kids this kind of memory– PRICELESS!</p>

<p>Thanks Tyler!</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=qJiVno"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=qJiVno" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=eFHKNK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=eFHKNK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=xIBsKK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=xIBsKK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=qhRVQK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=qhRVQK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=T3BMxK"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=T3BMxK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=4TNsWk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=4TNsWk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=42bTzk"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=42bTzk" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/354073492" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 02 Aug 2008 18:44:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/steeler game">steeler game</category>
      <category domain="http://securityratty.com/tag/game">game</category>
      <category domain="http://securityratty.com/tag/yankee game">yankee game</category>
      <category domain="http://securityratty.com/tag/yankee stadium">yankee stadium</category>
      <category domain="http://securityratty.com/tag/stadium">stadium</category>
      <category domain="http://securityratty.com/tag/pittsburgh steeler game">pittsburgh steeler game</category>
      <category domain="http://securityratty.com/tag/tyler">tyler</category>
      <category domain="http://securityratty.com/tag/college tyler">college tyler</category>
      <category domain="http://securityratty.com/tag/pittsburgh">pittsburgh</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/354073492/another-fantasy.html">Another fantasy fulfilled</source>
    </item>
    <item>
      <title><![CDATA[Simple oversight at TNS Infratest exposes participant information]]></title>
      <link>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</link>
      <guid>http://securityratty.com/article/ca9bbb88145ecdbedb20b4a7aa81936a</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/4/08

Organization
Taylor Nelson Sofres plc (TNS

Contractor/Consultant/Branch
TNS Infratest

Victims
Survey participants

Number Affected
41,000
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/tns.jpg" width="98" align="right" height="98"><font size="2"><b>Date Reported: </b><br>7/4/08<br><br><b>Organization: </b><br><a href="http://www.tnsglobal.com/">Taylor Nelson Sofres plc (TNS)</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.tns-infratest.com/">TNS Infratest</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Survey participants<br><br><span style="font-weight: bold;">Number Affected:</span><br>41,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"Name and address, date of birth, email address and phone numbers", "Some of the data included monthly income, education, bank account information, health insurance data, and which credit cards are used"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The scientific journal of the Chaos Computer Club (CCC), Die Datenschleuder, reports that market research firm TNS Infratest/Emnid has lost 41,000 private data records of their survey participants."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ccc.de/updates/2008/umfragetief?language=en">Chaos Computer Club e.V.</a> <br><a href="http://www.theinquirer.net/gb/inquirer/news/2008/07/07/hackers-claim-survey-outfit">The Inquirer</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Chaos Computer Club e.V.<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>TOP MARKET RESEARCH firm TNS Infratest/Emnid has 'lost' 41,000 private data records of its survey participants, the Chaos Computer Club (CCC) has revealed in its official organ Die Datenschleuder.<br><br>As the magazine reports [1], it was possible for participants to read master data records and consumer profiles without bypassing even basic security measures.<br><br>Access to the comprehensive survey results could be gained by simply changing the customer ID number in the browser's address bar.<br><span style="font-style: italic;">[Evan] This type of development mistake too common.&nbsp; The vulnerability is very easy to find by good pen testers and the bad guys.&nbsp; Actually, I am surprised that we don't hear about more of these types of breaches.</span><br><br>Besides name and address, the data records included date of birth, email address and phone number.<br><br>Many records also included very sensitive information: monthly income, education, bank account information, health insurance data, if and which credit cards are used, which electronic devices are used in the household, children's ages and yet more private data.<br><span style="font-style: italic;">[Evan] Clearly this is some very sensitive information, all provided by people completing surveys.</span><br><br>"TNS Infratest made a beginner's mistake in their software development. This is unprofessional, grossly negligent and above all deeply worrying," commented CCC spokesman Dirk Engling regarding the incident.<br><span style="font-style: italic;">[Evan] Mr. Engling is dead on.&nbsp; I couldn't have said it better myself.</span><br><br>"As this information is very sensitive, where abuse such as identity theft or its use in connection with burglary cannot be excluded, THS Infratest needs to inform the victims immediately," he continued<br><br>This case continues a disastrous, never-ending series of information leaks of data held by public and private sector organisations.<br><br>The need for more strict control of sensitive data collections is evidenced by the recent snooping affairs by German Telecom as well as the data leaks from the "Meldeämtern" (registration of address offices). <br><br>It is obvious here that data security only plays a minor role in companies.<br><span style="font-style: italic;">[Evan] Very sad, but very true.&nbsp; Too many organizations still take the wrong view of information security as a "cost center" instead of a business driver.&nbsp; Well designed and managed information security programs, the ones that are aligned with the business and not IT, can actually provide value to the business.</span><br><br>"Especially for companies surveying the most confidential data, the highest security standards have to apply," said Engling.<br><br>The press team of the Chaos Computer Club is available for questions at the following addresses: <br></font><ul><li><font size="2">presse@ccc.de (preferred)</font></li><li>0700-CHAOSFON (0700 - 24267366)<br></li></ul><font size="2"><br><span style="font-weight: bold;">Commentary:</span><br>TNS is a large company, a large company with resources to hire good management, programmers, and information security personnel.&nbsp; What is the excuse for making such a significant, yet simple oversight?&nbsp; There are a number of controls that could have reduced the risk of this occurring.<br><br>One a secondary note, but no less important in my opinion.&nbsp; It seems that people (in general) provide too much information willingly, without understanding what the risks could be.&nbsp; Personally, I rarely complete surveys that ask me for personally identifiable information (name, address, etc.).&nbsp; I suggest that you give some serious thought to providing any of your personal information.&nbsp; Ask yourself if you trust the organization collecting your information.&nbsp; If so, question what your trust is based on.&nbsp; Do NOT hesitate to ask questions and err on the side of caution. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br><script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/09/tns.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 09 Jul 2008 19:37:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/master data records">master data records</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/sensitive">sensitive</category>
      <category domain="http://securityratty.com/tag/information leaks">information leaks</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bank account information">bank account information</category>
      <source url="http://breachblog.com/2008/07/09/tns.aspx">Simple oversight at TNS Infratest exposes participant information</source>
    </item>
    <item>
      <title><![CDATA[Googles Culture of Yes]]></title>
      <link>http://securityratty.com/article/e615947c2baeb07b85af246f8d822bd5</link>
      <guid>http://securityratty.com/article/e615947c2baeb07b85af246f8d822bd5</guid>
      <description><![CDATA[Recently, Eric Schmidt gave quite an inspirational speech at the Economic Club of Washington . It was so interesting; I wanted to share this with you in case you missed it. The entire speech is rather...]]></description>
      <content:encoded><![CDATA[<p>Recently, Eric Schmidt gave quite an inspirational speech at the <a href="http://www.economicclub.org/" onclick="javascript:pageTracker._trackPageview('/outbound/article/www.economicclub.org');" target="_blank">Economic Club of Washington</a>.  It was so interesting; I wanted to share this with you in case you missed it. The entire speech is rather long but here’s the <a href="http://fora.tv/2008/06/09/Eric_Schmidt_Explains_Google_s_Culture_of_Yes" onclick="javascript:pageTracker._trackPageview('/outbound/article/fora.tv');" target="_blank">section on Google’s Culture of Yes</a>.</p>
<p>After hearing his speech, I thought about how Eric and Google are impacting the digital revolution after so many others have tried unsuccessfully over the last 25 years. He has led the company through a period of explosive growth from $1 Billion to over $16 Billion in the past year, while keeping the young, fun, irreverent culture intact. Considering the meteoric rise of Google’s popularity in a reasonably short period of time, to the point that the company name is now actually a verb!</p>
<p>The point that I found enlightening was his summary, which you can scroll to at the 26 - 30 minutes timeframe in the presentation, where he shared an interesting glimpse into the culture of Google. “Creating more luck, giving yourself more at bats, being out there… to think big and inspire a culture of YES.” The culture of Yes inspires people to aim higher and be ambitious in their reach and goals.</p>
<p>That is a very interesting point in which I really believe. If there is one thing that all companies and especially small companies struggle with because of natural resource constraints, it is building a strong culture of Yes. We have tried to do this from the very inception of ScienceLogic, but it continues to get harder and harder the larger the business grows. To consistently inspire a principle of Yes, without agreeing to every idea that flows across my desk is amongst the most challenging parts of our daily jobs. However if I could create the perfect scenario, we would intuitively strive for a principle of Yes and inspire our associates and our ecosystem of partners and customers to use this simple concept to confidently go forward.</p>
<p>Eric says, “It is possible to build a culture around innovation. It is possible to build a culture around leadership, and it is possible to build a culture around optimism.” Google is a great example, but by no means the only example. I agree with Eric’s summary and hope to lead ScienceLogic according to these very basic but essential principles. “Let’s be revolutionaries. Let’s take this opportunity, this huge change that is before us with technology and let’s change our businesses, our communication and the way we interact on some new principles that reflect the very best in America.”</p>
<p><a href="http://sharethis.com/item?&wp=2.5.1&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Google%26%238217%3Bs+Culture+of+Yes&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fgoogles-culture-of-yes%2F06%2F2008" onclick="javascript:pageTracker._trackPageview('/outbound/article/sharethis.com');">ShareThis</a></p>]]></content:encoded>
      <pubDate>Mon, 23 Jun 2008 11:21:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/culture">culture</category>
      <category domain="http://securityratty.com/tag/googles culture">googles culture</category>
      <category domain="http://securityratty.com/tag/strong culture">strong culture</category>
      <category domain="http://securityratty.com/tag/irreverent culture intact">irreverent culture intact</category>
      <category domain="http://securityratty.com/tag/inspirational speech">inspirational speech</category>
      <category domain="http://securityratty.com/tag/speech">speech</category>
      <category domain="http://securityratty.com/tag/inspire">inspire</category>
      <category domain="http://securityratty.com/tag/consistently inspire">consistently inspire</category>
      <category domain="http://securityratty.com/tag/eric">eric</category>
      <source url="http://blog.sciencelogic.com/googles-culture-of-yes/06/2008">Googles Culture of Yes</source>
    </item>
  </channel>
</rss>
