<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: commonly-found]]></title>
    <link>http://securityratty.com/tag/commonly-found</link>
    <description></description>
    <pubDate>Wed, 18 Jun 2008 09:26:17 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Network skill level gap is growing, but growth opportunities abound!]]></title>
      <link>http://securityratty.com/article/a4929ca88458feb902376bc7bd38e824</link>
      <guid>http://securityratty.com/article/a4929ca88458feb902376bc7bd38e824</guid>
      <description><![CDATA[A recent IDC report sponsored by the Cisco Learning Institute reveals a huge networking skills gap is emerging in North America, which spells trouble for enterprises. Listen to this: 600,000 IT...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/exam.jpg" border="0" alt="Test Quiz" width="240" height="160" align="left" /> A recent IDC report sponsored by the Cisco Learning Institute reveals <a href="http://www.networkworld.com/newsletters/itlead/2008/080408itlead1.html" target="_blank">a huge networking skills gap</a> is emerging in North America, which spells trouble for enterprises. Listen to this: “600,000 IT workers were needed to install, configure, manage and secure networks in North America in 2007, 14% of the total IT workforce.” However, IDC reports that another 180,000 engineers with wireless as well as traditional network engineering experience will need to be added by 2011 to keep pace with advances in technology that is transforming the role of the network.</p>
<p>The convergence of voice and video traffic are quickly transforming the growing complexity of networks at a torrid pace. IDC estimates that the skills gap in VOIP should grow to 19% by 2011.</p>
<p>This changing profile in the role of the network plays a key role in the skills shortage. Network enabled collaboration tools such as social networking apps and the Webex conferencing/collaboration solutions we use in our business each and every day are demanding a new set of IT skills to deliver business value.</p>
<p>My perspective is two-fold on this issue; the first is what I have seen in the resources we have attempted to hire! We give a very straightforward quick written/oral test to all new technical hires. This requires basic networking knowledge and some Unix commands. On average, (after filters from reputable recruiting firms, some with 5-10 years experience) less than 10% pass muster for the first filter we use in our hiring process. This is a troubling fact, which has cost us considerable time and effort to secure the right resources with competent skills. So I can say from our market assessment in a very strong technological job skills market, core Unix and networking foundation skills are slipping.</p>
<p>The second is that we as an IT Operations Management (ITOM) industry need to keep pushing hard to build better proactive and intuitive solutions to aggregate instrumentation from all Data Center tools, including more work around VOIP, video streaming, and collaboration so that we can ease this transition. If ITOM solutions become more proactive across the typical Cisco infrastructure that is commonly installed in the Data Center, we can free up some additional time for advanced “emerging technologies” training where existing IT workers can enhance their core skills and re-invigorate their careers. We have to do a much better job of getting our existing IT professionals trained on emerging technologies!</p>
<p>While there’s less that ScienceLogic can do around <a href="http://www.cisco.com/web/learning/le3/learning_career_certifications_and_learning_paths_home.html" target="_blank">training</a>, we certainly strive to do our part to enhance a day in the life of the networking engineers who use our solutions to simplify monitoring of increasingly complex networking, <a href="http://www.networkworld.com/news/2008/080608-p-g.html" target="_blank">Wireless, VOIP, and collaboration needs</a>.</p>
]]></content:encoded>
      <pubDate>Mon, 25 Aug 2008 17:06:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/skills">skills</category>
      <category domain="http://securityratty.com/tag/foundation skills">foundation skills</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/skills gap">skills gap</category>
      <category domain="http://securityratty.com/tag/skills shortage">skills shortage</category>
      <category domain="http://securityratty.com/tag/intuitive solutions">intuitive solutions</category>
      <category domain="http://securityratty.com/tag/solutions">solutions</category>
      <category domain="http://securityratty.com/tag/traditional network">traditional network</category>
      <category domain="http://securityratty.com/tag/recent idc report">recent idc report</category>
      <source url="http://blog.sciencelogic.com/network-skill-level-gap-is-growing-but-growth-opportunities-abound/08/2008">Network skill level gap is growing, but growth opportunities abound!</source>
    </item>
    <item>
      <title><![CDATA[SSDs are hot, but not without security risks]]></title>
      <link>http://securityratty.com/article/f2cc3357b789721828986acd326c3a5a</link>
      <guid>http://securityratty.com/article/f2cc3357b789721828986acd326c3a5a</guid>
      <description><![CDATA[Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren't as secure as commonly...]]></description>
      <content:encoded><![CDATA[Solid-state drives are fast becoming popular replacements for hard drives, especially in laptops, but experts caution that SSDs aren't as secure as commonly thought.]]></content:encoded>
      <pubDate>Thu, 21 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/experts caution">experts caution</category>
      <category domain="http://securityratty.com/tag/popular replacements">popular replacements</category>
      <category domain="http://securityratty.com/tag/ssds">ssds</category>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/commonly">commonly</category>
      <category domain="http://securityratty.com/tag/hard">hard</category>
      <source url="http://www.networkworld.com/news/2008/082208-ssds-are-hot-but-not.html?fsrc=rss-security">SSDs are hot, but not without security risks</source>
    </item>
    <item>
      <title><![CDATA[No Trademark for Cloud Computing]]></title>
      <link>http://securityratty.com/article/4b9f7e842fb8a79ceb2a5ea157dab13c</link>
      <guid>http://securityratty.com/article/4b9f7e842fb8a79ceb2a5ea157dab13c</guid>
      <description><![CDATA[Just a couple of weeks ago, it was reported that Dell was in the final stages of being granted a trademark on Cloud Computing shocking and amusing pretty much everyone except for possibly Dell...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="157" alt="clouds-jwn6" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/clouds-jwn6.jpg" width="240" align="left" border="0" /> Just a couple of weeks ago, it was reported that Dell was in the final stages of being granted a trademark on &#8220;Cloud Computing&#8221; &#8211; <a href="http://languagelog.ldc.upenn.edu/nll/?p=434#more-434" target="_blank">shocking and amusing</a> pretty much everyone except for possibly Dell employees. But apparently the US Patent and Trademark Office paid attention to the flurry of negative responses and has since <a href="http://samj.net/2008/08/dells-notice-of-allowance-for-cloud.html" target="_blank">cancelled their &#8220;Notice of Allowance&#8221;</a> for the trademark. </p>
<p>I&#8217;d like to give everyone the benefit of the doubt here; perhaps Dell was using it in a much narrower sense. Perhaps the term has really only been used more commonly since the time Dell first applied for the trademark back in March 2007 and now. BUT&#8230;</p>
<p>- Dell&#8217;s definition is quite broad and certainly not Dell-specific. <a href="http://www.eweek.com/c/a/IT-Infrastructure/Dell-Attempts-to-Trademark-Cloud-Computing/" target="_blank">&#8220;The design of computer hardware for use in datacenters and mega-scale computing environments for others; customization of computer hardware for use in data centers and mega-scale computing environments for others; design and development of networks for use in data centers and mega-scale computing environments for others.&#8221;</a> Strike One.</p>
<p>- And according to the Wall Street Journal&#8217;s research, &#8220;<a href="http://blogs.wsj.com/biztech/2008/08/06/dells-tech-jargon-trademark/" target="_blank">cloud computing&#8221; has been in regular use since 2001</a>. Strike Two.</p>
<p>So now the &#8220;case&#8221; has been returned to examination and hopefully the PTO will follow up on everyone else&#8217;s research on this and decide that yes, cloud computing is one of those broad, ubiquitous terms that should NOT be trademarked by a single company. </p>
]]></content:encoded>
      <pubDate>Thu, 14 Aug 2008 16:01:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/trademark">trademark</category>
      <category domain="http://securityratty.com/tag/dell">dell</category>
      <category domain="http://securityratty.com/tag/time dell">time dell</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/dell-specific">dell-specific</category>
      <category domain="http://securityratty.com/tag/possibly dell employees">possibly dell employees</category>
      <category domain="http://securityratty.com/tag/trademark office">trademark office</category>
      <category domain="http://securityratty.com/tag/computer hardware">computer hardware</category>
      <category domain="http://securityratty.com/tag/data centers">data centers</category>
      <source url="http://blog.sciencelogic.com/no-trademark-for-cloud-computing/08/2008">No Trademark for Cloud Computing</source>
    </item>
    <item>
      <title><![CDATA[U.S. Government Policy for Seizing Laptops at Borders]]></title>
      <link>http://securityratty.com/article/644821439b7605896de17d8ca6d3a3de</link>
      <guid>http://securityratty.com/article/644821439b7605896de17d8ca6d3a3de</guid>
      <description><![CDATA[Amazing. The U.S. government has published its policy : they can take you laptop anywhere they want, for as long as they want, and share the information with anyone they want
Here's the actual policy:...]]></description>
      <content:encoded><![CDATA[<p>Amazing.  The U.S. government has <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/08/01/AR2008080103030.html">published its policy</a>: they can take you laptop anywhere they want, for as long as they want, and share the information with anyone they want.</p>

<p><a href="http://www.cbp.gov/linkhandler/cgov/travel/admissability/search_authority.ctt/search_authority.pdf">Here's</a> the actual policy:</p>

<blockquote>Federal agents may take a traveler's laptop or other electronic device to an off-site location for an unspecified period of time without any suspicion of wrongdoing, as part of border search policies the Department of Homeland Security recently disclosed. Also, officials may share copies of the laptop's contents with other agencies and private entities for language translation, data decryption, or other reasons, according to the policies, dated July 16 and issued by two DHS agencies, US Customs and Border Protection and US Immigration and Customs Enforcement... DHS officials said that the newly disclosed policies — which apply to anyone entering the country, including US citizens — are reasonable and necessary to prevent terrorism... The policies cover 'any device capable of storing information in digital or analog form,' including hard drives, flash drives, cell phones, iPods, pagers, beepers, and video and audio tapes. They also cover 'all papers and other written documentation,' including books, pamphlets and 'written materials commonly referred to as "pocket trash..."</blockquote>

<p>It's not the policy that's amazing; it's the fact that the government has actually made it public.</p>

<p>Slashdot <a href="http://yro.slashdot.org/yro/08/08/01/0958242.shtml">thread</a>.  My previous <a href="http://www.schneier.com/essay-217.html">essay</a> on crossing borders with laptops, and how to protect yourself.</p>

<p>Although honestly, the best thing is probably to keep your encrypted archives on some network drive somewhere, and download what you need after you cross the border.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xpja3K"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xpja3K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=vWPUNK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=vWPUNK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 01 Aug 2008 08:21:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/policy">policy</category>
      <category domain="http://securityratty.com/tag/cover">cover</category>
      <category domain="http://securityratty.com/tag/policies cover">policies cover</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/actual policy">actual policy</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/border protection">border protection</category>
      <category domain="http://securityratty.com/tag/border">border</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/us_government_p.html">U.S. Government Policy for Seizing Laptops at Borders</source>
    </item>
    <item>
      <title><![CDATA[Hundreds of Thousands of Laptops Lost at U.S. Airports Annually]]></title>
      <link>http://securityratty.com/article/c9073d10b076742bcd87430314c09618</link>
      <guid>http://securityratty.com/article/c9073d10b076742bcd87430314c09618</guid>
      <description><![CDATA[This is a weird statistic : Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon Institute survey released Monday. Laptops are...]]></description>
      <content:encoded><![CDATA[This is a <a href="http://www.pcworld.com/businesscenter/article/147739/laptops_lost_like_hot_cakes_at_us_airports.html_">weird statistic</a>:

<blockquote>Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon Institute survey released Monday. Laptops are most commonly lost at security checkpoints, according to the survey.

Close to 10,278 laptops are reported lost every week at 36 of the largest U.S. airports, and 65 percent of those laptops are not reclaimed, the survey said. Around 2,000 laptops are recorded lost at the medium-sized airports, and 69 percent are not reclaimed.

Travelers seem to lack confidence that they will recover lost laptops. About 77 percent of people surveyed said they had no hope of recovering a lost laptop at the airport, with 16 percent saying they wouldn't do anything if they lost their laptop during business travel. About 53 percent said that laptops contain confidential company information, with 65 percent taking no steps to protect the information.</blockquote>

I don't know how to generalize that to a total number of lost laptops in the U.S.; let's call it 750,000.  At $1,000 per laptop -- a very conservative estimate -- that's $750 million in lost laptops annually.  Most are lost at security checkpoints, and I'm sure the numbers went up considerably since those checkpoints got more annoying after 9/11.

There aren't a lot of real numbers about the costs of increased airport security.  We pay in time, in anxiety, in inconvenience.  But we also pay in goods.  TSA employees <a href="http://www.cbsnews.com/stories/2004/09/13/eveningnews/main643165.shtml">steal out of suitcases</a>.  And opportunists steal hundreds of millions of dollars of laptops annually.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=LSh7nJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=LSh7nJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DT8VQJ"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DT8VQJ" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 04 Jul 2008 04:20:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/recover lost laptops">recover lost laptops</category>
      <category domain="http://securityratty.com/tag/lost laptops">lost laptops</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/laptops lost">laptops lost</category>
      <category domain="http://securityratty.com/tag/commonly lost">commonly lost</category>
      <category domain="http://securityratty.com/tag/airports">airports</category>
      <category domain="http://securityratty.com/tag/lost laptop">lost laptop</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <source url="http://www.schneier.com/blog/archives/2008/07/hundreds_of_tho.html">Hundreds of Thousands of Laptops Lost at U.S. Airports Annually</source>
    </item>
    <item>
      <title><![CDATA[Google Open Sources Web Assessment Tool]]></title>
      <link>http://securityratty.com/article/128129d00191a851fc7c17a3ec3f9529</link>
      <guid>http://securityratty.com/article/128129d00191a851fc7c17a3ec3f9529</guid>
      <description><![CDATA[The folks at Google have released their own proprietary web application assessment proxy. The tool is called ratproxy and was authored by Michal Zalewski
From Google Code
Ratproxy is a semi-automated,...]]></description>
      <content:encoded><![CDATA[<p>The folks at Google have released their own proprietary web application assessment proxy. The tool is called ratproxy and was authored by <a href="http://lcamtuf.coredump.cx/">Michal Zalewski</a>.</p>
<p>From Google Code:</p>
<blockquote><p>Ratproxy is a semi-automated, largely passive web application security audit tool. It is meant to complement active crawlers and manual proxies more commonly used for this task, and is optimized specifically for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments.</p></blockquote>
<p>This tool falls into the same family as Burp and Paros, as examples. It will apparently run on Linux, FreeBSD, Mac OS X and Windows if you have Cygwin loaded. Check it out. </p>
<p><a href="http://code.google.com/p/ratproxy/">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=NkvSmj"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=NkvSmj" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=El0TEJ"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=El0TEJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=MdpCej"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=MdpCej" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=G6TZLj"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=G6TZLj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=ESE22j"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=ESE22j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=ac9LIj"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=ac9LIj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/324867361" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 08:51:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <category domain="http://securityratty.com/tag/tool falls">tool falls</category>
      <category domain="http://securityratty.com/tag/complement active crawlers">complement active crawlers</category>
      <category domain="http://securityratty.com/tag/design patterns based">design patterns based</category>
      <category domain="http://securityratty.com/tag/google code">google code</category>
      <category domain="http://securityratty.com/tag/ratproxy">ratproxy</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/michal zalewski">michal zalewski</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/324867361/">Google Open Sources Web Assessment Tool</source>
    </item>
    <item>
      <title><![CDATA[2% of all laptops sold every year are stolen from airports?]]></title>
      <link>http://securityratty.com/article/1ab2ef6a1d22f817746241dedb95ce77</link>
      <guid>http://securityratty.com/article/1ab2ef6a1d22f817746241dedb95ce77</guid>
      <description><![CDATA[Interesting analogy from NetworkWorld on rising rates of laptop loss , but it works! Apparently laptop loss is giving IHOP a run for its money. From the article

Some of the largest and medium-sized...]]></description>
      <content:encoded><![CDATA[Interesting analogy from <a href="http://www.networkworld.com/news/2008/063008-laptops-lost-like-hot-cakes.html?t51hb">NetworkWorld on rising rates of laptop loss</a>, but it works! Apparently laptop loss is giving IHOP a run for its money. From the article...<br /><br /><span style="font-style: italic;">"Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon    Institute survey released Monday. Laptops are most commonly lost at security checkpoints, according to the survey."</span><br /><br />Over 630K laptops lost each year <span style="font-weight: bold; font-style: italic;">just </span>within airports! From <a href="http://www.idc.com/getdoc.jsp?containerId=prUS20995107">IDC's Quarterly PC tracker</a> (Dec 2007) we see that over 31M laptops were projected to be sold in 2007. This means that over 2% of all laptops sold in the US were lost or stolen from airports!<br /><br />Hard to believe. Am I exaggerating or is this for real? Makes me think about how cold boot can be a weapon of choice for criminals to gain access to sensitive data.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/BitArmor1?a=nv6OGJ"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=nv6OGJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=SEPc1j"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=SEPc1j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=gkQ7qJ"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=gkQ7qJ" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/BitArmor1/~4/324203872" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 12:58:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/630k laptops lost">630k laptops lost</category>
      <category domain="http://securityratty.com/tag/laptops lost">laptops lost</category>
      <category domain="http://securityratty.com/tag/airports">airports</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/laptop loss">laptop loss</category>
      <category domain="http://securityratty.com/tag/apparently laptop loss">apparently laptop loss</category>
      <category domain="http://securityratty.com/tag/airports report close">airports report close</category>
      <category domain="http://securityratty.com/tag/31m laptops">31m laptops</category>
      <source url="http://feeds.feedburner.com/~r/BitArmor1/~3/324203872/2-of-all-laptops-sold-every-year-are.html">2% of all laptops sold every year are stolen from airports?</source>
    </item>
    <item>
      <title><![CDATA[Can you hear me now?]]></title>
      <link>http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3</link>
      <guid>http://securityratty.com/article/afde45737ad0a9346c45bdf544337ad3</guid>
      <description><![CDATA[Verizon released a very interesting Data Breach report that analyzes over 500 forensic reports on their system over a number of years. It is great work by Verizon to gather this data and to publish...]]></description>
      <content:encoded><![CDATA[<p>Verizon released a very interesting <a href="http://www.verizonbusiness.com/resources/security/databreachreport.pdf">Data Breach report</a> that analyzes over 500 forensic reports on their system over a number of years. It is great work by Verizon to gather this data and to publish it. Of course a consultant I go into lots of companies where they could learn a lot just by being more open and talking through issues with peers in other companies. Would be great to see other companies follow Verizon's lead.</p><br><div>I suggest you read their report, and I would like to add a little color to their findings from the perspective of the swamp I spend most of my time in - Web services security. Granted it is just one report, but the data run counter to a lot of conventional security "wisdom":</div><br><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>Who is behind data breaches? </p></blockquote></strong></span><blockquote><p>73% resulted from external sources<br>18% were caused by insiders <br>39% implicated business partners <br>30% involved multiple parties</p></blockquote></span><br></div><div>The internal/external divide is pretty silly these days, as is companies' recanting "inside the firewall and outside the firewall", I spend most of time hooking things up together precisely _so_ they intereoperate remotely. The firewall is a speed bump at best. At any rate external sources is a primary concern in Web services security, because - hey look our Web service front end just made your Mainframe/As400/Unix DB/ CICS/whatever accessible remotely. This is great from a functionality standpoint, but the issue is that these back end systems were never designed with anything remotely resembling an Internet threat model. Additionally, the Verizon team's findings around business parties and multiple parties strikes at the heart of a number of popular misconceptions in Web services security - "well its just B2B and its behind a firewall."</div><br><br><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>How do breaches occur? </p></blockquote></strong></span><blockquote><p><br>62% were attributed to a significant error</p></blockquote><blockquote><p>59% resulted from hacking and intrusions  </p></blockquote><blockquote><p>31% incorporated malicious code </p></blockquote><blockquote><p>22% exploited a vulnerability <br>15% were due to physical threats </p></blockquote></span><br></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">A couple of things to note here - malicious code in my opinion is likely to be the biggest problem in Web services security going forward. There is a large gap waiting to be exploited here. You have no control over the other end of the pipe plus a massive attack surface, the only thing lacking is the attacker's ability to find and exploit which I strongly suspect is just a matter of time. Wrt hacking an intrusions we have the remote, passive nature of web security to blame here in Web services world. Paraphrasing </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://www.aspectsecurity.com/">Jeff Williams</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">, the problem is that an attacker can just try an attack if it doesn't work, try again, again, and so on. This partially because of the loosely coupled nature of the systems, but it is also because </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">commonly used information security protocols have diverged from reality</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"> are modeled using an object-centric mentality, where you "own" the object you are protecting and can afford to put passive controls around.</span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-size: 12px; line-height: normal; "><span style="text-decoration: underline;"><strong><blockquote><p>What commonalities exist? </p></blockquote></strong></span><blockquote><p><br>66%  involved data the victim did not know was on the system<br>75%  of breaches were not discovered by the victim  <br>83%  of attacks were not highly difficult <br>85%  of breaches were the result of opportunistic attacks <br>87%  were considered avoidable through reasonable controls </p></blockquote></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">Many of the attacks against Web Services are not difficult, in my </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://arctecgroup.net/training.htm">training class</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;">, we'll typically execute 8-10 different attacks in a two day period. But the big one from this list is the first one - the amazing amount of attack surface offered up by Web services. </span><span style="color: #333333; font-size: 12px; line-height: normal; "><a href="http://isecpartners.com/">Brad Hill</a></span><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"> has done a good job articulating these issues in SOAP/XML/WS-*, but at an enterprise its even bigger than those standards - the thing is we use Web services to make stuff interoperate, to make stuff reusable, and to virtualize endpoints. Great stuff if what you want to do is decentralize your business, but this creates oceans of space for attackers to roam. When you look beyond the Visio and the IDE view of web services, and get to the runtime there is an amazing amount of detritus left behind by all these layers.</span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div><div><span style="color: #333333; font-family: helvetica; font-size: 12px; line-height: normal;"><br></span></div>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 06:56:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web services">web services</category>
      <category domain="http://securityratty.com/tag/web services world">web services world</category>
      <category domain="http://securityratty.com/tag/web services security">web services security</category>
      <category domain="http://securityratty.com/tag/data breach report">data breach report</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/attack">attack</category>
      <category domain="http://securityratty.com/tag/massive attack surface">massive attack surface</category>
      <category domain="http://securityratty.com/tag/companies follow verizon">companies follow verizon</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/can-you-hear-me-now.html">Can you hear me now?</source>
    </item>
    <item>
      <title><![CDATA[Latest 802.11 Standard Boosts Wi-Fi Power in New Band]]></title>
      <link>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</link>
      <guid>http://securityratty.com/article/8a175684170e876da287683bcc08e2a3</guid>
      <description><![CDATA[The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances : Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.warpspeed.com/wordpress/?p=2406"><strong>The nearly finished IEEE 802.11y could make Wi-Fi more practical over longer distances</strong></a>: Wi-Fi is a compromise. In the unlicensed bands in which it operates, it has to deal with interference from noise sources and other networks, while using very low power, and trying not to make a pest of itself. It's done very well. In the 2.4 GHz band and parts of 5 GHz, the maximum power from the radio is 1 watt (W), and the effective power (EIRP) is 4 W on an omnidirectional antenna. (You can push far more power if you narrow the antenna's beam. And parts of the 5 GHz band restrict radio power below 1 W. I wrote <a href="http://wifinetnews.com/archives/007336.html"><strong>a long rundown of 5 GHz issues</strong></a> back in Jan-2007.)</p>

<p>But there's this lovely new segment of lightly licensed spectrum in the U.S., the 3.65 GHz band. It's a non-exclusive licensed band available only in parts of the country that don't have pre-existing ground-to-satellite or radar uses that overlap. This omits most of the eastern seaboard and most major cities; Seattle is one exception.</p>

<p>The licensing mechanism allows any number of operators to obtain inexpensive licenses, and register the base stations they use by location. If interference arises among base stations, operators are required to work out the problems themselves. I wrote extensively about this band and its rules on 9-May-2008 in <a href="http://wifinetnews.com/archives/008313.html"><strong>profiling Azulstar</strong></a>, formerly a metro-scale Wi-Fi firm, but now a big proponent of WiMax in 3.65 GHz. I also <a href="http://wimaxnetnews.com/archives/2007/06/fcc_affirms_365.html"><strong>went over the rules</strong></a> for the band on 11-June-2007 when the FCC announced the arrangement. </p>

<p>Several firms offer base station and customer premises equipment for this band now, so close to the 3.5 GHz band more commonly exclusively licensed in Europe and elsewhere. WiMax equipment is available because the 3.65 GHz band can be used with WiMax without any modifications to that protocol, although limited to just 25 MHz of the 50 MHz that the FCC set aside.</p>

<p>Equipment that conforms to a more stringent set of rules about contention and other factors can use the whole 50 MHz, and that's where 802.11y comes in. It's an extension of Wi-Fi to cope with the specific needs--and to open Wi-Fi technology up to 20 W EIRP, a vastly higher power output. This could allow connections over 5 km, the group says.</p>

<p>The <a href="http://en.wikipedia.org/wiki/IEEE_802.11y"><strong>Wikipedia entry on 802.11y</strong></a>, clearly written by someone involved with the specification, notes that three specific additions are needed: a tweak to support the way in which the FCC wants contention among competing devices to work; a method for an access point to tell a station (a connecting radio) that it's about to switch its channel or its channel's bandwidth, and the station should do likewise; and a mechanism to handle a base station allowing or revoking permission to use the spectrum without uniquely identifying the user's system or broadcasting its precise GPS-based location.</p>

<p>The standard is near completion and initial approval. I don't have any knowledge about whether any mainstream Wi-Fi equipment makers or metro-scale equipment makers are looking into building 802.11y into their gear. </p>

<p>The fact is that this could be a great technology for the mostly sub-metropolitan markets that 3.65 GHz is available in, although it has the same pain as WiMax: all new gear on the towers and all new adapters for customers.</p>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 10:01:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/band">band</category>
      <category domain="http://securityratty.com/tag/power">power</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/ghz band">ghz band</category>
      <category domain="http://securityratty.com/tag/ghz">ghz</category>
      <category domain="http://securityratty.com/tag/equipment">equipment</category>
      <category domain="http://securityratty.com/tag/wimax equipment">wimax equipment</category>
      <category domain="http://securityratty.com/tag/metro-scale wi-fi firm">metro-scale wi-fi firm</category>
      <category domain="http://securityratty.com/tag/power output">power output</category>
      <source url="http://wifinetnews.com/archives/008379.html">Latest 802.11 Standard Boosts Wi-Fi Power in New Band</source>
    </item>
    <item>
      <title><![CDATA[Silver Bullet Security Podcast]]></title>
      <link>http://securityratty.com/article/763731212fa3e3e62a716c9a33b658b7</link>
      <guid>http://securityratty.com/article/763731212fa3e3e62a716c9a33b658b7</guid>
      <description><![CDATA[I did a podcast with Gary McGraw which is available here . Gary's questions were great, I could have written a ten page whitepaper in response to most of them, but tried to sum up my thoughts on &quot;what...]]></description>
      <content:encoded><![CDATA[<p>I did a podcast with Gary McGraw which is available <a href="http://www.cigital.com/silverbullet/show-027/">here</a>. Gary&#39;s questions were great, I could have written a ten page whitepaper in response to most of them, but tried to sum up my thoughts on &quot;what is security&quot;, and how you might approach security in SOA, Web 2.0, and federation spaces. Gary is always interesting to talk to since he has done a major percentage of the valuable work in security.</p><br /><div>One point I raised in the podcast is that I see a common misconception in the industry which I sum up as the &quot;what got you here won&#39;t get you there&quot; problem. We have had a long hard slog getting support for software security, and now, thanks to Gary&#39;s and others&#39; work, its finally starting to take root. It is taking root especially in financial services. One thing I see though is that vendors commonly make a big sale or three in a financial services player, then they go to an insurance company, a manufacturer, or other large player and say &quot;hey do what Ginormous globobank is doing.&quot; Problem is - their business models are different, their IT is different, and so on. We have done a decent job bootstrapping some security practices in financial services, but we need other models for other verticals.</div>]]></content:encoded>
      <pubDate>Wed, 18 Jun 2008 09:26:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/financial services player">financial services player</category>
      <category domain="http://securityratty.com/tag/player">player</category>
      <category domain="http://securityratty.com/tag/security practices">security practices</category>
      <category domain="http://securityratty.com/tag/financial services">financial services</category>
      <category domain="http://securityratty.com/tag/approach security">approach security</category>
      <category domain="http://securityratty.com/tag/gary mcgraw">gary mcgraw</category>
      <category domain="http://securityratty.com/tag/gary">gary</category>
      <category domain="http://securityratty.com/tag/podcast">podcast</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/silver-bullet-security-podcast.html">Silver Bullet Security Podcast</source>
    </item>
  </channel>
</rss>
