<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: dec]]></title>
    <link>http://securityratty.com/tag/dec</link>
    <description></description>
    <pubDate>Sat, 03 May 2008 11:41:18 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Sun Gives Advance Notice of Java Update]]></title>
      <link>http://securityratty.com/article/9414f2e7716938638b2c0d53ed10c6c0</link>
      <guid>http://securityratty.com/article/9414f2e7716938638b2c0d53ed10c6c0</guid>
      <description><![CDATA[Tomorrow, Dec. 2, 2008, Sun will release updates for various versions of Java. This is the first example, to my knowledge, of an advance notification of an update by Sun Microsystems. In fact, it's...]]></description>
      <content:encoded><![CDATA[Tomorrow, Dec. 2, 2008, <a href="http://blogs.sun.com/security/entry/advance_notification_of_security_updates3" target="_blank">Sun will release updates for various versions of Java.</a>

This is the first example, to my knowledge, of an advance notification of an update by <a href="http://www.webbuyersguide.com/company/2605/Sun-Microsystems&kc=eweekarticle120108&src=eweekarticle120108">Sun Microsystems.</a> In fact, it's the first advance notification I know of except for those from <a href="http://www.webbuyersguide.com/company/66/Microsoft&kc=eweekarticle120108&src=eweekarticle120108">Microsoft,</a> which started the practice to accommodate planning by IT departments.

Microsoft's advance notifications come four days in advance of the actual update release. Sun's is one day in advance, and contains only minimal information. It says the following updates will be released:
<UL><LI>JDK and JRE 6 Update 11
<LI>JDK and JRE 5.0 Update 17
<LI>SDK and JRE 1.4.2_19
<LI>SDK and JRE 1.3.1_24 </LI></UL>

It also lists Sun alert numbers for the updates, but there are no links or indications of what the alerts mean. <a href="http://sunsolve.sun.com/show.do?target=home" target="_blank">I tried to search for the numbers</a> but had no luck.

Still, advance notification is a good thing and this is a step in the right direction. I hope it's a trend.
<p><a href="http://feedads.googleadservices.com/~at/0-mNgExmBZ36eVmg64Wxi9tzm-o/a"><img src="http://feedads.googleadservices.com/~at/0-mNgExmBZ36eVmg64Wxi9tzm-o/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/RSS/cheap_hack/~4/AGW33eCacH0" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 14:52:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/advance">advance</category>
      <category domain="http://securityratty.com/tag/sun">sun</category>
      <category domain="http://securityratty.com/tag/advance notifications">advance notifications</category>
      <category domain="http://securityratty.com/tag/advance notification">advance notification</category>
      <category domain="http://securityratty.com/tag/lists sun alert">lists sun alert</category>
      <category domain="http://securityratty.com/tag/sun microsystems">sun microsystems</category>
      <category domain="http://securityratty.com/tag/jre">jre</category>
      <category domain="http://securityratty.com/tag/minimal information">minimal information</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/AGW33eCacH0/sun_gives_advance_notice_of_java_update.html">Sun Gives Advance Notice of Java Update</source>
    </item>
    <item>
      <title><![CDATA[A New Way to Back Up Digital Files on paper]]></title>
      <link>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</link>
      <guid>http://securityratty.com/article/f29b43ae964909cbeacf815e65f8018e</guid>
      <description><![CDATA[This is pretty funny a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works
PaperBack is...]]></description>
      <content:encoded><![CDATA[<p>This is pretty funny &#8212; a free open source application where you can backup your data by printing it, on paper, in a bar code format. A friend of mine says he tried it and that it even works &#8211;</p>
<blockquote><p>PaperBack is a free application that allows you to back up your precious files on the ordinary paper in the form of the oversized bitmaps. If you have a good laser printer with the 600 dpi resolution, you can save up to 500,000 bytes of uncompressed data on the single A4/Letter sheet. Integrated packer allows for much better data density - up to 3,000,000+ (three megabytes) of C code per page.</p>
<p>You may ask - why? Why, for heaven&#8217;s sake, do I need to make paper backups, if there are so many alternative possibilities like CD-R&#8217;s, DVD±R&#8217;s, memory sticks, flash cards, hard disks, streamer tapes, ZIP drives, network storages, magnetooptical cartridges, and even 8-inch double-sided floppy disks formatted for DEC PDP-11? (I still have some). The answer is simple: you don&#8217;t. However, by looking on CD or magnetic tape, you are not able to tell whether your data is readable or not. You must insert your medium into the drive (if you have one!) and try to read it.</p>
<p>Paper is different. Do you remember the punched cards? EBCDIC and all this stuff. For years, cards were the main storage medium for the source code. I agree that 100K+ programs were&#8230; unhandly, but hey, only real programmers dared to write applications of this size. And used cards were good as notepads, too. Punched tapes were also common. And even the most weird codings, like CDC or EBCDIC, were readable by humans (I mean, by real programmers).</p></blockquote>
<p>Read the <a rel="nofollow" target="_blank" href="http://www.ollydbg.de/Paperbak/index.html">whole thing here.<br />
</a></p>]]></content:encoded>
      <pubDate>Thu, 04 Sep 2008 04:28:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/source code">source code</category>
      <category domain="http://securityratty.com/tag/paper backups">paper backups</category>
      <category domain="http://securityratty.com/tag/real programmers dared">real programmers dared</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/data density">data density</category>
      <category domain="http://securityratty.com/tag/real programmers">real programmers</category>
      <category domain="http://securityratty.com/tag/flash cards">flash cards</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/383345885/">A New Way to Back Up Digital Files on paper</source>
    </item>
    <item>
      <title><![CDATA[Backup tape is stolen from Bristol-Myers Squibb]]></title>
      <link>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</link>
      <guid>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/17/08

Organization
Bristol-Myers Squibb Co. (&quot;BMS

Contractor/Consultant/Branch
Unknown

Victims
Current and former employees and some dependants
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/bms.jpg" width="198" align="right" height="160"><font size="2"><b>Date Reported: </b><br>7/17/08<br><br><b>Organization: </b><br><a href="http://www.bms.com/landing/data/index.html">Bristol-Myers Squibb Co. ("BMS")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unknown<br><br><span style="font-weight: bold;">Victims:</span><br>Current and former employees and some dependants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*Bristol-Myers Squibb had "about 42,000 employees as of Dec. 31, the last date for which work force figures were available in regulatory filings.", Source: <a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNN Money</a></font> <br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances bank account information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage.&nbsp; Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pharmalot.com/wp-content/uploads/2008/07/bms_letter.pdf">Pharmalot (copy of notification letter)</a> <br><a href="http://www.pharmalot.com/2008/07/bristol-myers-security-breach-hits-untold-thousands/">Pharmalot</a> <br><a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNNMoney</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Ed Silverman, Pharmalot<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The drugmaker sent letters over the past week saying a data tape containing reams of personal information was stolen several weeks ago<br><br>On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage. <br><span style="font-style: italic;">[Evan] This statement prompted me to list the contractor as "unknown" instead of "none".&nbsp; I presume that the data tape was being transported by a third-party vendor when it was stolen.&nbsp; I am looking for more information on this.</span><br><br>Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees, such as name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances, bank account information.<br><span style="font-style: italic;">[Evan] Ugh, this looks like very sensitive HR and benefits data.</span><br><br>The names, addresses, and Social Security numbers of some employee dependents also were included on the tape.<br><br>an untold number of current and former employees - and their dependents - could be affected<br><br>BMS has initiated an investigation of this incident.<br><br>To date, BMS has no reason to believe that any of your personal information has been inappropriately accessed from the data tape by an unauthorized party, or that any identity theft, fraud or misuse of your personal information has occurred.<br><span style="font-style: italic;">[Evan] I agree with most of this statement except for the "misuse" part.&nbsp; There may be no evidence of misuse post stolen tape, but there may be an argument for misuse by BMS themselves.&nbsp; BMS is the data custodian in this scenario, not the data owner.&nbsp; If a data custodian does not care for the owner's information in a manner that is expected or communicated, does it constitute misuse?</span><br><br>In addition, there is no evidence that the data tape or the information contained on it was the target of the theft.<br><span style="font-style: italic;">[Evan] I am interested in knowing more about who was transporting the tape and whether or not other items were taken.</span><br><br>As a precaution, to help you detect any possible misuse of your data, BMS has arranged for you to enroll in credit monitoring for one full year, at no cost to you.<br><span style="font-style: italic;">[Evan] There is that "misuse" mention again.&nbsp; One year of free credit monitoring does nothing to protect a victim against fraud that occurs after one year, supposing the victim does not renew at his/her own expense.&nbsp; I wonder how many people renew on average.</span><br><br>If you have any questions, you may call the dedicated Privacy Help Line at 1-877-214-0689.&nbsp; Our representatives will be available to assist you Monday through Friday, between 8 a.m. and 5 p.m. ET.<br><br>the drugmaker is issuing this statement: "Bristol-Myers Squibb regrets that this incident occurred and is committed to providing appropriate assistance for affected individuals who had their personal information on the stolen data tape. We are committed to protecting the privacy and security of employee and dependent information. Maintaining the trust and confidence of our employees is paramount to Bristol-Myers Squibb."<br><br>Protecting the privacy and security of your information is extremely important to us.<br><br>In this regard, BMS wishes to reiterate that it does not have any evidence indicating that your personal information has been misused.<br><span style="font-style: italic;">[Evan] Another "misuse" mention.</span><br><br>the company is taking appropriate remedial steps, including enhancing security protocols regarding the handling of personal information and our back-up data tapes.<br><span style="font-style: italic;">[Evan] Like what? Encryption maybe?</span><br><br>On behalf of BMS, I apologize for any inconvenience or concern that this matter may cause for you.<br><br><span style="font-weight: bold;">Commentary:</span><br>I couldn't find any mention about encryption or whether or not police were called.&nbsp; You would think that a large, well-repected company like Bristol-Myers Squibb encrypts confidential data on tape, right? <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/18/bms.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 07:26:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/back-up data tape">back-up data tape</category>
      <category domain="http://securityratty.com/tag/data tape">data tape</category>
      <category domain="http://securityratty.com/tag/owner">owner</category>
      <category domain="http://securityratty.com/tag/data owner">data owner</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bristol-myers squibb">bristol-myers squibb</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <source url="http://breachblog.com/2008/07/18/bms.aspx">Backup tape is stolen from Bristol-Myers Squibb</source>
    </item>
    <item>
      <title><![CDATA[You want the truth, you can't handle the truth!]]></title>
      <link>http://securityratty.com/article/5e8ee0a0eb7aec0d6393e17e6cc64b3d</link>
      <guid>http://securityratty.com/article/5e8ee0a0eb7aec0d6393e17e6cc64b3d</guid>
      <description><![CDATA[I am not sure what it is with Richard Stiennon. Maybe his mom beat him with a NAC stick when he was young. Hence his Jack Nicholson looks (more like the Joker in Batman , than Col Jessep in A Few Good...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/fewgoodmen.jpg"><img title="fewgoodmen" height="183" alt="fewgoodmen" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/fewgoodmen_thumb.jpg" width="179" align="left" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; MARGIN: 0px 10px 5px 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> I am not sure what it is with Richard Stiennon.&nbsp; Maybe his mom beat him with a NAC stick when he was young.&nbsp; Hence his Jack Nicholson looks (more like the Joker in <a class="zem_slink" title="Batman" href="http://www.dccomics.com/sites/batman/" rel="homepage">Batman</a>, than Col Jessep in <a class="zem_slink" title="A Few Good Men" href="http://www.imdb.com/title/tt0104257" rel="imdb">A Few Good Men</a>) and his total disdain for NAC.&nbsp; In any event Richard never seems to miss a chance to take a pot shot at NAC.&nbsp; I have fired back and debated him many times on this.&nbsp; In fact I am convinced that Richard's problem with NAC is that like Uncle Joe, he is just moving a little slow.&nbsp; Richard still thinks of NAC as Cisco???s network admission control, circa Dec ???03.&nbsp; He has not gotten up to speed on anything happening with NAC since.&nbsp; Richard is going to debate NAC with Joel Snyder according to <a href="http://www.networkworld.com/newsletters/vpn/2008/070708nac2.html">this article</a> by Tim Greene today. My prediction is Snyder by a knockout in 3 rounds or less.</p>

<p>Richard???s latest NAC knock comes on a comment to an <a href="http://rationalsecurity.typepad.com/blog/2008/07/security-analys.html?cid=121871540#comment-121871540">excellent article by the Hoff</a>.&nbsp; Chris takes a bold stand for someone working for a vendor and calls BS on the whole analyst thing (I will write more about that later in this article). Richard being an ex-analyst himself (lets face it, with Richard you can take the man out of the analyst job, but you can???t take the analyst out of the man), takes exception to Hoff???s ???whining??? (Richards words, not mine) and tries to tell Hoff that giving up is not the answer and the way to show up analysts, is to prove them wrong.&nbsp; Great Richard you try to prove them wrong, when because of what they report you don???t have a market, can???t get any capital and have no visibility.&nbsp; I guess that is when it is time to move on to the next gig, right? Then Richard has a bad NAC deja vu and feels it necessary to write this: </p><blockquote><p><em>???Look how easy it is to one up the analyst firms, who as near as I can tell support Network Admission Control universally. Everyone except the folks at Updata Ventures know how seriously flawed NAC is with only one viable market, edu.???</em></p></blockquote><p>I assume Richard is referring to Updata recently leading the Bradford Networks VC round. But more importantly Richard it is time to call a code red on you and give you the cold hard truth.&nbsp; Richard the fact is that the edu market is not the only viable market for NAC.&nbsp; In fact, one of the biggest customers of NAC is the DoD.&nbsp; That is right Richard at least 3 of the 4 armed forces use NAC in helping to secure their networks. To paraphrase my friend Col Jessep - Richard, you want the truth, you can???t handle the truth!&nbsp; You sleep securely under the blanket of protection that NAC provides.&nbsp; If it is good enough to help ???clean the sand??? out of laptops coming home from SWA (that is SouthWest Asia, like in Iraq and Afghanistan, in case you don???t know Richard), it should be good enough for you. Think about that next time you are about to bad mouth NAC.</p>

<p>Let me give you some other truths you may not like Richard.&nbsp; Why do you think every switch vendor (of which we partner with many of them) is lining up and bringing out NAC solutions?&nbsp; Why has Microsoft put such a big push on NAP?&nbsp; Why despite the Luddites like you does NAC still draw crowds at conferences like Interop (ask Joel about that).&nbsp; Richard we are still signing new major OEM partners.&nbsp; I am afraid you are the one sadly out of touch on this one Richard.&nbsp; Just as you are out of touch in missing Hoff???s point in his article.</p>

<p>As to Hoff???s article, as I said I give Chris credit for speaking his mind. I spend an ungodly amount of my time speaking with analysts and trying to ???learn??? from them while at the same time trying to educate them.&nbsp; I am constantly amazed that so many analysts (and press for that matter) just take a vendors word as gospel. I have seen research reports from analysts big and small, that I am sure did not have any more research done than calling a handful of vendors and listening to their spiel. Too many of these vendors if they do speak to customers, base their findings on such a small sample that it is impossible to have an accurate picture.</p>

<p>Personally, like Hoff says, who watches the watchers is the truth. I would like to see a code of conduct among analysts. I would start by dictating that vendors cannot pay analysts.&nbsp; Take the payola out of the equation the way they did to the DJ/Radio business in the late 50s. Next analyst reports have to come with metrics to back up the findings. I want to know how many customers they spoke to, how big they were, how they were found, etc.&nbsp; A vendor giving an analyst a real live???pet??? customer is not real research. I want to know if the customer pays the analyst. It is a dirty business. </p>

<p>Hey let me be clear, I play the game as well as the next guy.&nbsp; But I agree with Hoff we need to clean up the rules to make the whole analyst thing more fair, viable and valuable.</p>

<div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/e6165b9b-253e-4392-a8dd-ef9917b5dc2e/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=e6165b9b-253e-4392-a8dd-ef9917b5dc2e" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>
]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 18:50:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nac">nac</category>
      <category domain="http://securityratty.com/tag/nac stick">nac stick</category>
      <category domain="http://securityratty.com/tag/richard">richard</category>
      <category domain="http://securityratty.com/tag/richard stiennon">richard stiennon</category>
      <category domain="http://securityratty.com/tag/bad mouth nac">bad mouth nac</category>
      <category domain="http://securityratty.com/tag/importantly richard">importantly richard</category>
      <category domain="http://securityratty.com/tag/nac knock">nac knock</category>
      <category domain="http://securityratty.com/tag/assume richard">assume richard</category>
      <category domain="http://securityratty.com/tag/event richard">event richard</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/07/you-want-the-tr.html">You want the truth, you can't handle the truth!</source>
    </item>
    <item>
      <title><![CDATA[You want the truth, you can't handle the truth!]]></title>
      <link>http://securityratty.com/article/8ffe83b77278161ca4798e9097d5d497</link>
      <guid>http://securityratty.com/article/8ffe83b77278161ca4798e9097d5d497</guid>
      <description><![CDATA[I am not sure what it is with Richard Stiennon. Maybe his mom beat him with a NAC stick when he was young. Hence his Jack Nicholson looks (more like the Joker in Batman , than Col Jessep in A Few Good...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/fewgoodmen.jpg"><img title="fewgoodmen" height="183" alt="fewgoodmen" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/fewgoodmen_thumb.jpg" width="179" align="left" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; MARGIN: 0px 10px 5px 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> I am not sure what it is with Richard Stiennon.&nbsp; Maybe his mom beat him with a NAC stick when he was young.&nbsp; Hence his Jack Nicholson looks (more like the Joker in <a class="zem_slink" title="Batman" href="http://www.dccomics.com/sites/batman/" rel="homepage">Batman</a>, than Col Jessep in <a class="zem_slink" title="A Few Good Men" href="http://www.imdb.com/title/tt0104257" rel="imdb">A Few Good Men</a>) and his total disdain for NAC.&nbsp; In any event Richard never seems to miss a chance to take a pot shot at NAC.&nbsp; I have fired back and debated him many times on this.&nbsp; In fact I am convinced that Richard's problem with NAC is that like Uncle Joe, he is just moving a little slow.&nbsp; Richard still thinks of NAC as Cisco’s network admission control, circa Dec ‘03.&nbsp; He has not gotten up to speed on anything happening with NAC since.&nbsp; Richard is going to debate NAC with Joel Snyder according to <a href="http://www.networkworld.com/newsletters/vpn/2008/070708nac2.html">this article</a> by Tim Greene today. My prediction is Snyder by a knockout in 3 rounds or less.</p>

<p>Richard’s latest NAC knock comes on a comment to an <a href="http://rationalsecurity.typepad.com/blog/2008/07/security-analys.html?cid=121871540#comment-121871540">excellent article by the Hoff</a>.&nbsp; Chris takes a bold stand for someone working for a vendor and calls BS on the whole analyst thing (I will write more about that later in this article). Richard being an ex-analyst himself (lets face it, with Richard you can take the man out of the analyst job, but you can’t take the analyst out of the man), takes exception to Hoff’s “whining” (Richards words, not mine) and tries to tell Hoff that giving up is not the answer and the way to show up analysts, is to prove them wrong.&nbsp; Great Richard you try to prove them wrong, when because of what they report you don’t have a market, can’t get any capital and have no visibility.&nbsp; I guess that is when it is time to move on to the next gig, right? Then Richard has a bad NAC deja vu and feels it necessary to write this: </p><blockquote><p><em>“Look how easy it is to one up the analyst firms, who as near as I can tell support Network Admission Control universally. Everyone except the folks at Updata Ventures know how seriously flawed NAC is with only one viable market, edu.”</em></p></blockquote><p>I assume Richard is referring to Updata recently leading the Bradford Networks VC round. But more importantly Richard it is time to call a code red on you and give you the cold hard truth.&nbsp; Richard the fact is that the edu market is not the only viable market for NAC.&nbsp; In fact, one of the biggest customers of NAC is the DoD.&nbsp; That is right Richard at least 3 of the 4 armed forces use NAC in helping to secure their networks. To paraphrase my friend Col Jessep - Richard, you want the truth, you can’t handle the truth!&nbsp; You sleep securely under the blanket of protection that NAC provides.&nbsp; If it is good enough to help “clean the sand” out of laptops coming home from SWA (that is SouthWest Asia, like in Iraq and Afghanistan, in case you don’t know Richard), it should be good enough for you. Think about that next time you are about to bad mouth NAC.</p>

<p>Let me give you some other truths you may not like Richard.&nbsp; Why do you think every switch vendor (of which we partner with many of them) is lining up and bringing out NAC solutions?&nbsp; Why has Microsoft put such a big push on NAP?&nbsp; Why despite the Luddites like you does NAC still draw crowds at conferences like Interop (ask Joel about that).&nbsp; Richard we are still signing new major OEM partners.&nbsp; I am afraid you are the one sadly out of touch on this one Richard.&nbsp; Just as you are out of touch in missing Hoff’s point in his article.</p>

<p>As to Hoff’s article, as I said I give Chris credit for speaking his mind. I spend an ungodly amount of my time speaking with analysts and trying to “learn” from them while at the same time trying to educate them.&nbsp; I am constantly amazed that so many analysts (and press for that matter) just take a vendors word as gospel. I have seen research reports from analysts big and small, that I am sure did not have any more research done than calling a handful of vendors and listening to their spiel. Too many of these vendors if they do speak to customers, base their findings on such a small sample that it is impossible to have an accurate picture.</p>

<p>Personally, like Hoff says, who watches the watchers is the truth. I would like to see a code of conduct among analysts. I would start by dictating that vendors cannot pay analysts.&nbsp; Take the payola out of the equation the way they did to the DJ/Radio business in the late 50s. Next analyst reports have to come with metrics to back up the findings. I want to know how many customers they spoke to, how big they were, how they were found, etc.&nbsp; A vendor giving an analyst a real live“pet” customer is not real research. I want to know if the customer pays the analyst. It is a dirty business. </p>

<p>Hey let me be clear, I play the game as well as the next guy.&nbsp; But I agree with Hoff we need to clean up the rules to make the whole analyst thing more fair, viable and valuable.</p>

<div class="zemanta-pixie" style="MARGIN-TOP: 10px; HEIGHT: 15px"><a class="zemanta-pixie-a" title="Zemified by Zemanta" href="http://reblog.zemanta.com/zemified/e6165b9b-253e-4392-a8dd-ef9917b5dc2e/"><img class="zemanta-pixie-img" alt="Zemanta Pixie" src="http://img.zemanta.com/reblog_e.png?x-id=e6165b9b-253e-4392-a8dd-ef9917b5dc2e" style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; FLOAT: right; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" /></a></div></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=dcwJi7"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=dcwJi7" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Tb6DcJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Tb6DcJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=MtzjiJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=MtzjiJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=BbZUEJ"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=BbZUEJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=zXRM7J"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=zXRM7J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=9dGsDj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=9dGsDj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=IUwOmj"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=IUwOmj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/332294950" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 18:35:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nac">nac</category>
      <category domain="http://securityratty.com/tag/nac stick">nac stick</category>
      <category domain="http://securityratty.com/tag/richard">richard</category>
      <category domain="http://securityratty.com/tag/bad mouth nac">bad mouth nac</category>
      <category domain="http://securityratty.com/tag/richard stiennon">richard stiennon</category>
      <category domain="http://securityratty.com/tag/importantly richard">importantly richard</category>
      <category domain="http://securityratty.com/tag/nac knock">nac knock</category>
      <category domain="http://securityratty.com/tag/assume richard">assume richard</category>
      <category domain="http://securityratty.com/tag/nac solutions">nac solutions</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/332294950/you-want-the-tr.html">You want the truth, you can't handle the truth!</source>
    </item>
    <item>
      <title><![CDATA[2% of all laptops sold every year are stolen from airports?]]></title>
      <link>http://securityratty.com/article/1ab2ef6a1d22f817746241dedb95ce77</link>
      <guid>http://securityratty.com/article/1ab2ef6a1d22f817746241dedb95ce77</guid>
      <description><![CDATA[Interesting analogy from NetworkWorld on rising rates of laptop loss , but it works! Apparently laptop loss is giving IHOP a run for its money. From the article

Some of the largest and medium-sized...]]></description>
      <content:encoded><![CDATA[Interesting analogy from <a href="http://www.networkworld.com/news/2008/063008-laptops-lost-like-hot-cakes.html?t51hb">NetworkWorld on rising rates of laptop loss</a>, but it works! Apparently laptop loss is giving IHOP a run for its money. From the article...<br /><br /><span style="font-style: italic;">"Some of the largest and medium-sized U.S. airports report close to 637,000 laptops lost each year, according to the Ponemon    Institute survey released Monday. Laptops are most commonly lost at security checkpoints, according to the survey."</span><br /><br />Over 630K laptops lost each year <span style="font-weight: bold; font-style: italic;">just </span>within airports! From <a href="http://www.idc.com/getdoc.jsp?containerId=prUS20995107">IDC's Quarterly PC tracker</a> (Dec 2007) we see that over 31M laptops were projected to be sold in 2007. This means that over 2% of all laptops sold in the US were lost or stolen from airports!<br /><br />Hard to believe. Am I exaggerating or is this for real? Makes me think about how cold boot can be a weapon of choice for criminals to gain access to sensitive data.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/BitArmor1?a=nv6OGJ"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=nv6OGJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=SEPc1j"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=SEPc1j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/BitArmor1?a=gkQ7qJ"><img src="http://feeds.feedburner.com/~f/BitArmor1?i=gkQ7qJ" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/BitArmor1/~4/324203872" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 12:58:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptops">laptops</category>
      <category domain="http://securityratty.com/tag/630k laptops lost">630k laptops lost</category>
      <category domain="http://securityratty.com/tag/laptops lost">laptops lost</category>
      <category domain="http://securityratty.com/tag/airports">airports</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/laptop loss">laptop loss</category>
      <category domain="http://securityratty.com/tag/apparently laptop loss">apparently laptop loss</category>
      <category domain="http://securityratty.com/tag/airports report close">airports report close</category>
      <category domain="http://securityratty.com/tag/31m laptops">31m laptops</category>
      <source url="http://feeds.feedburner.com/~r/BitArmor1/~3/324203872/2-of-all-laptops-sold-every-year-are.html">2% of all laptops sold every year are stolen from airports?</source>
    </item>
    <item>
      <title><![CDATA[UltimateBet cheating goes undetected for almost 21 months]]></title>
      <link>http://securityratty.com/article/ab86750c9ca2ca89b4459be51f0a8dee</link>
      <guid>http://securityratty.com/article/ab86750c9ca2ca89b4459be51f0a8dee</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
5/29/08

Organization
Tokwiro Enterprises ENRG

Tokwiro Enterprises Enrg&quot; is a recognized Mohawk owned and controlled, gaming sole proprietorship,...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/ultimatebet.jpg" align="right" height="102" width="120"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>5/29/08 <br><br><span style="font-weight: bold;">Organization: </span><br>Tokwiro Enterprises ENRG*<br><br><font size="1">*"Tokwiro Enterprises Enrg" is a recognized Mohawk owned and controlled, gaming sole proprietorship, presently undergoing a licencing process with the "Kahnawake Gaming Commission" ("KGC"), which was itself established on the 10th day of June, 1996. (Source: <a href="http://www.ultimatebet.com/about-us)</font><br><br><span">www.ultimatebet.com/about-us)</font><br><br><span</a> style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ultimatebet.com/">UltimateBet</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Customers<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"hole card information during live play" resulting is financial loss<br><br><span style="font-weight: bold;">Breach Description:</span><br>"MONTREAL, CANADA (MAY 29, 2008) --- Tokwiro Enterprises ENRG ("Tokwiro"), proprietors of UltimateBet.com ("UltimateBet"), one of the world's largest online card rooms, today announced the results of its lengthy investigation into allegations of unfair play, which was triggered by concerns about an account named 'NioNio'."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ultimatebet.com/poker-news/2008/may/NioNio-Findings">UltimateBet Statement</a> (full statement text below)<br><a href="http://www.cjad.com/news/565/729153">CJAD NewsTalk Radio</a> <br><a href="http://www.cardplayer.com/poker-news/article/4279/owner-of-ultimatebet-confirms-security-breach">Card Player</a> <br><a href="http://www.pokerlistings.com/ultimatebet-wraps-investigation-of-unfair-play-27499">PokerListings</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Tokwiro Enterprises ENRG and Bob Pajich at Card Player<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Tokwiro Enterprises, the company that owns both Absolute Poker and UltimateBet, today released a statement confirming that cheating had gone on at UltimateBet by people who, according to the release, "worked for the previous ownership of UltimateBet prior to the sale of the business to Tokwiro in October 2006."<br><span style="font-style: italic;">[Evan] Shouldn't an information security and risk assessment be conducted as part of the acquisition and integration?&nbsp; If so, then wouldn't a code review of the proprietary software that came with the acquisition be included?&nbsp; This is the proprietary software that really drives the purpose of the site.</span><br><br>The player or players behind the 18 screen names that were identified as being corrupted have not been named.<br><br>Tokwiro will refund players their losses once the investigation is complete.<br><span style="font-style: italic;">[Evan] I wonder how expensive this will be.</span><br><br>The usernames that were used to cheat are: NioNio, Sleepless, NoPaddles, nvtease, flatbroke33, ilike2win, UtakeIt2, FlipFlop2, erick456, WhackMe44, RockStarLA, stoned2nite, monizzle, FireNTexas, HeadKase01, LetsPatttty, NYMobser, and WhoWhereWhen.<br><br>The cheating was able to take place because the perpetrators had access to what Tokwiro is calling an "unauthorized software code" that allowed the cheaters to see their opponents’ holecards.<br><span style="font-style: italic;">[Evan] This "unauthorized software code" use went undetected for almost 21 months!</span><br><br>The cheating took place from March 7, 2006 to Dec. 3, 2007, and it’s not known how much money the cheater(s) illicitly won.<br><br>The company refused to disclose the amount of fraudulent winnings, but poker observers have said it runs into the millions.<br><br>As soon as the cheating was suspected, Tokwiro said it contacted the Kahnawake Gaming Commission (KGC), the most used online poker regulatory commission, to start the investigation.<br><br>Tokwiro is mandated to contact KGC if any suspicious activety might be taking place.<br><br>This is the second cheating incident to hit the company since it purchased Absolute Poker and UltimateBet.<br><br>The first occurred when it was discovered that several players at Absolute Poker also had access to software that allowed them to see opponents’ holecards.<br><span style="font-style: italic;">[Evan] A link is included below</span><br><br><center>ULTIMATEBET ISSUES STATEMENT REGARDING UNFAIR PLAY</center><br><br><span style="font-weight: bold;">MONTREAL, CANADA (MAY 29, 2008)</span> --- Tokwiro Enterprises ENRG ("Tokwiro"), proprietors of UltimateBet.com ("UltimateBet"), one of the world's largest online card rooms, today announced the results of its lengthy investigation into allegations of unfair play, which was triggered by concerns about an account named 'NioNio'. Tokwiro has worked diligently in cooperation with its regulatory body, the Kahnawake Gaming Commission ("KGC"), and with independent third-party experts to conduct a thorough investigation that included a comprehensive review of hand histories and game data, thorough analyses of software and network security, and audits of its security practices and procedures.<br>&nbsp;<br>The investigation has concluded that certain player accounts did in fact have an unfair advantage, and that these accounts targeted the highest limit games on the site. The individuals responsible were found to have worked for the previous ownership of UltimateBet prior to the sale of the business to Tokwiro in October 2006. Tokwiro is taking full responsibility for this situation and will immediately begin refunding UltimateBet customers for any losses that were incurred as a result of unfair play. <br><br>The fraudulent activity was enabled by unauthorized software code that allowed the perpetrators to obtain hole card information during live play. The existence of this vulnerability was unknown to Tokwiro until February 2008 and existed prior to UltimateBet's acquisition by Tokwiro in October 2006. Our investigation has confirmed that the code was part of a legacy auditing system that was manipulated by the perpetrators. Gaming Associates, independent auditors hired by the KGC, have confirmed that the software code that provided the unfair advantage has been permanently removed.<br>&nbsp;<br>Throughout the investigation of this incident, Tokwiro's consistent priorities have been: <br></font><ol><li><font size="2">To permanently remove the ability to engage in unfair play;</font></li><li>To complete its investigation and come to a full understanding of what occurred;</li><li>To refund the affected customers; and</li><li>To implement measures that prevents future incidents. <br></li></ol><font size="2">The Company said, "We would like to thank our customers for their patience, loyalty and support, as well as for their understanding that we are doing everything we can to correct this situation. The staff and management of UltimateBet are fully committed to providing a safe and secure environment for our players, and we want to assure customers of our unwavering resolve to monitor site security with every resource at our disposal." <br><br><span style="font-weight: bold;">Investigation Timeline </span><br>These are the key events in the course of the incident. <br></font><ul><li><font size="2">January 2008: UltimateBet is alerted to suspicions of unfair play on the part of the account "NioNio". Within 24 hours, UltimateBet contacts the KGC to provide formal notice that UltimateBet has initiated an investigation of the incident. UltimateBet subsequently forwarded a copy of all related data to the KGC.</font></li><li>January 2008: The "NioNio" account and related accounts are suspended pending further investigation.</li><li>February 2008: Preliminary findings indicate abnormally high winning statistics for the suspect accounts. After discussions with the KGC, UltimateBet engages third-party gaming experts to assist with the analysis.</li><li>February 2008: Investigators confirm that the suspect accounts are associated with individuals who had worked for UltimateBet under the previous ownership.</li><li>February 2008: UltimateBet discovers the unauthorized code that allowed the perpetrators to obtain hole card information during live play. The code was part of a legacy auditing system that was manipulated by the perpetrators of the fraud.</li><li>February 2008: UltimateBet immediately removes the unauthorized code and works with the KGC and with third-party auditors to verify that the security hole has been eliminated.</li><li>March 2008: Six player accounts are confirmed to have participated in this scheme. No accounts were deleted at any point, although some account names were changed multiple times. The following account names are known to have been used in the fraudulent activity: NioNio, Sleepless, NoPaddles, nvtease, flatbroke33, ilike2win, UtakeIt2, FlipFlop2, erick456, WhackMe44, RockStarLA, stoned2nite, monizzle, FireNTexas, HeadKase01, LetsPatttty, NYMobser, and WhoWhereWhen.</li><li>May 2008: The investigation confirms that the fraudulent activity took place from March 7, 2006 to December 3, 2007.</li><li>May 2008: Gaming Associates certifies that the software code that enabled unfair play was removed from UltimateBet servers in February of 2008.</li><li>May 2008: Customers affected by this incident are identified, and plans for corrective action are reviewed with the KGC. <br></li></ul><font size="2"><span style="font-weight: bold;">Corrective Actions Taken </span><br>The following actions have been taken or are currently underway as a direct result of this investigation. <br></font><ul><li><font size="2">The security hole identified in UltimateBet's investigation has been permanently eliminated.</font></li><li>UltimateBet is establishing a state-of-the-art software Security Center that consolidates and greatly enhances existing security capabilities. The first release of the new Security Center focuses solely on the immediate detection of abnormal winnings. Gaming mathematicians, poker professionals, and security software developers have all contributed to the specifications for the new Security Center.</li><li>UltimateBet customers are no longer permitted to change account names unless they have suffered abuse in chat rooms. Requests for changes must be supported by proof of abuse and must be approved by the Chief Compliance Officer.</li><li>In addition to its existing security department, UltimateBet has established a new specialized Poker Security team of professionals dedicated to fraud prevention.</li><li>The refund process will begin immediately. The accounts associated with fraudulent activity did not use an unfair advantage in all play sessions. Regardless, UltimateBet is refunding all losses to these accounts.</li><li>Accounts related to the fraudulent activity have been disabled, and the individuals associated with those accounts permanently banned from the site.</li><li>UltimateBet has worked closely and transparently with its governing body, the KGC and its designated expert auditors, to determine exactly what happened, how it happened, and who was involved, and has taken action to prevent any possibility of this situation recurring.</li><li>Tokwiro is pursuing its legal options in regard to this incident. <br></li></ul><font size="2">For further inquiries please contract press@ultimatebet.com <br><br><span style="font-weight: bold;">Commentary:</span><br>This is potentially a multi-million dollar loss for Tokwiro Enterprises ENRG and its very troubling that this breach went undetected for so long. The software used by the site is proprietary and should really be subject to a significant amount of information security scrutiny.<br><br>If I were a player, I think I would be beyond angry.&nbsp; Not just angry about the loss of money, but angry about the loss of confidence and being cheated in general.&nbsp; I personally know people that refuse to play online poker because of the risk posed by poorly secured sites.<br><br>Information security of online gaming sites must be a #1 priority for the companies that run them.&nbsp; Seems obvious, but many statements in the information security business seem obvious.&nbsp; Personally, I like the response from Tokwiro.&nbsp; If they follow through (which I assume they would), Tokwiro's actions should go a long ways towards reducing risk and restoring customer confidence.<br><br>Check out the comments at <a href="http://www.cardplayer.com/poker-news/article/4279/owner-of-ultimatebet-confirms-security-breach">Card Player</a> to get some insight into what some players are thinking. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Tokwiro Enterprises ENRG/Absolute Poker:<br>October, 2007 - <a href="http://www.msnbc.msn.com/id/21381022/">Online poker cheating blamed on employee</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/04/ultimatebet.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 04 Jun 2008 06:55:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ultimatebet">ultimatebet</category>
      <category domain="http://securityratty.com/tag/tokwiro enterprises enrg">tokwiro enterprises enrg</category>
      <category domain="http://securityratty.com/tag/tokwiro enterprises">tokwiro enterprises</category>
      <category domain="http://securityratty.com/tag/ultimatebet issues statement">ultimatebet issues statement</category>
      <category domain="http://securityratty.com/tag/ultimatebet prior">ultimatebet prior</category>
      <category domain="http://securityratty.com/tag/ultimatebet subsequently">ultimatebet subsequently</category>
      <category domain="http://securityratty.com/tag/ultimatebet immediately removes">ultimatebet immediately removes</category>
      <category domain="http://securityratty.com/tag/ultimatebet servers">ultimatebet servers</category>
      <category domain="http://securityratty.com/tag/ultimatebet statement">ultimatebet statement</category>
      <source url="http://breachblog.com/2008/06/04/ultimatebet.aspx">UltimateBet cheating goes undetected for almost 21 months</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Your Brain on Wi-Fi; Zipit Offers Free SMS; Wi-Fi Alliance Model Trade Group]]></title>
      <link>http://securityratty.com/article/4f3c220d069c94efc3814a8be19cf516</link>
      <guid>http://securityratty.com/article/4f3c220d069c94efc3814a8be19cf516</guid>
      <description><![CDATA[Cell phones interfere with brain waves? I often write about studies that show no connection between electromagnetic radiation and health, so it's only fair I highlight credible ones that suggest a...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.sciam.com/article.cfm?id=mind-control-by-cell"><strong>Cell phones interfere with brain waves?</strong></a> I often write about studies that show no connection between electromagnetic radiation and health, so it's only fair I highlight credible ones that suggest a connection. In what appears to be two well-conducted and well-controlled studies, cell phones appeared to <a href="http://www.ncbi.nlm.nih.gov/pubmed/17786925?ordinalpos=1&itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_RVDocSum"><strong>affect alpha waves</strong></a> (related to one's focus on external v. internal stimulus and sleep), and <a href="http://www.ncbi.nlm.nih.gov/pubmed/17548154?ordinalpos=1&itool=EntrezSystem2.PEntrez.Pubmed.Pubmed_ResultsPanel.Pubmed_RVDocSum"><strong>delta waves</strong></a> (related to deep sleep). While no particular health result was measured, both studies, Scientific American explains, demonstrate a connection between EMF and mental behavior.</p>

<p><a href="http://www.businesswire.com/portal/site/home/news/sections/?ndmViewId=news_view&newsLang=en&newsId=20080512005854"><strong>Zipit gives away text messaging for a year, changes prices, options:</strong></a> The Zipit Wireless Messenger 2 (Z2) was <a href="http://wifinetnews.com/archives/008091.html"><strong>introduced in Dec. 2007</strong></a> with a number of interesting features for a messaging appliance targeted at teens--and their fretting parents. With no Web portal, the $150 device included unlimited Wi-Fi on Wayport's McDonald's network (now nearly 10,000 locations), and support for popular IM clients. It also included SMS with major cell carries, charging $5 per month for 1,500 incoming and 1,500 outgoing messages. Uptake must have been poor, as the manufacturer announced today that purchases until 31-July-2008 would include a year of free text messages. The company also modified its plan without noting that fact, increasing messages to a "reasonable personal usage" of 5,000 incoming and 5,000 outgoing messages per month. There are no overage charges. The service will now cost $30 per year instead of $5 per month for new purchasers starting 1-August-2008. That's a 50-percent price reduction (over $5 times 12), but it's often much cheaper to bill annually in advance. </p>

<p><a href="http://online.wsj.com/article/SB121018817892074495.html?mod=googlenews_wsj"><strong>Wi-Fi Alliance cited in WSJ as model for multipartner alliance:</strong></a> An interesting analysis in the Wall Street Journal's Business Insight section points to the Wi-Fi Alliance standards based, no-company-on-top approach as one that led it to win out through both technology and organization over other standards that might have taken precedence. I've been stunned over the years how a group that has a board comprised of the most powerful and competitive interests in this market segment, and which has hundreds of much smaller members, has managed to keep alive the notion of interoperability for the greater good of the industry and customers. 802.11n's long delay certainly threatened harmony--especially with some ugly proprietary slap-ons to 802.11g--but the alliance continues to keep the technology in equilibrium, while still allowing individual companies to differentiate their products with little difficulty.</p>]]></content:encoded>
      <pubDate>Mon, 12 May 2008 09:26:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/zipit">zipit</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/text">text</category>
      <category domain="http://securityratty.com/tag/free text messages">free text messages</category>
      <category domain="http://securityratty.com/tag/messages">messages</category>
      <category domain="http://securityratty.com/tag/cell phones">cell phones</category>
      <category domain="http://securityratty.com/tag/cell phones interfere">cell phones interfere</category>
      <category domain="http://securityratty.com/tag/wi-fi alliance cited">wi-fi alliance cited</category>
      <category domain="http://securityratty.com/tag/zipit wireless messenger">zipit wireless messenger</category>
      <source url="http://wifinetnews.com/archives/008315.html">Wee-Fi: Your Brain on Wi-Fi; Zipit Offers Free SMS; Wi-Fi Alliance Model Trade Group</source>
    </item>
    <item>
      <title><![CDATA[Peter Gabriel Web Server Stolen]]></title>
      <link>http://securityratty.com/article/8d983272d1a993a28204fdb3bb483a93</link>
      <guid>http://securityratty.com/article/8d983272d1a993a28204fdb3bb483a93</guid>
      <description><![CDATA[Reported on Slashdot today is the news that Peter Gabriel's web server has been solen from the data center where it was being hosted. I have my own thoughts on a possible motive; mostly related to...]]></description>
      <content:encoded><![CDATA[
      Reported on <a href="http://hardware.slashdot.org/article.pl?sid=08/05/06/1639257&from=rss">Slashdot today</a> is the news that Peter Gabriel's web server has been solen from the data center where it was being hosted. I have my own thoughts on a possible motive; mostly related to some of the dreadful noise he's produced over the past 30 years.

Physical security has been a previous topic of this blog (see entry from <a href="http://www.computerweekly.com/blogs/stuart_king/2007/12/dont-forget-physical-security.html">10 Dec 2007</a>). 

1. Don't make assumptions about third party security controls. Check them for yourself. 

2. Make sure your incident response plans include actions to take in the event of critical equipment being stolen.

Some good guidance on physical security for small businesses here on <a href="http://www.getsafeonline.org/nqcontent.cfm?a_id=1098">GetSafeOnline</a>. 

Some further related information <a href="http://www.informationweek.com/blog/main/archives/2008/04/physical_securi.html">here</a>.









      
   ]]></content:encoded>
      <pubDate>Wed, 07 May 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/physical security">physical security</category>
      <category domain="http://securityratty.com/tag/web server">web server</category>
      <category domain="http://securityratty.com/tag/peter gabriel">peter gabriel</category>
      <category domain="http://securityratty.com/tag/party security controls">party security controls</category>
      <category domain="http://securityratty.com/tag/previous topic">previous topic</category>
      <category domain="http://securityratty.com/tag/data center">data center</category>
      <category domain="http://securityratty.com/tag/critical equipment">critical equipment</category>
      <category domain="http://securityratty.com/tag/dreadful noise">dreadful noise</category>
      <category domain="http://securityratty.com/tag/guidance">guidance</category>
      <source url="http://www.computerweekly.com/blogs/stuart_king/2008/05/peter-gabriel-web-server-stole.html">Peter Gabriel Web Server Stolen</source>
    </item>
    <item>
      <title><![CDATA[Happy Birthday Spam! Wish you many unhappy returns!]]></title>
      <link>http://securityratty.com/article/c3810931d5de1770341b1fc34bf7664f</link>
      <guid>http://securityratty.com/article/c3810931d5de1770341b1fc34bf7664f</guid>
      <description><![CDATA[Yup, many unhappy returns


clipped from news.yahoo.com





For 30 years now, youve been getting spam



WASHINGTON (AFP
This week, the world will mark an anniversary that has changed the face and...]]></description>
      <content:encoded><![CDATA[<div > Yup, many unhappy returns. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/86B7644A-C114-4FA3-83EA-98AD74702A49/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/11c65157-f774-432a-a2f9-e81bf543f518/86B7644A-C114-4FA3-83EA-98AD74702A49/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years" href="http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years" style="font-size: 11px;">news.yahoo.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">
					<DIV class="source"><br />
                                                						<A href="http://us.rd.yahoo.com/dailynews/afp/brand/SIG=ofqlv2;_ylt=AqE9kROEtnalBegiR8_lWj.OOrgF/*http://www.afp.com"><IMG width="51" height="27" border="0" alt="AFP" src="http://l.yimg.com/us.yimg.com/i/us/nws/p/afp_logo_51.png" /></A><br />
                                                					</DIV><br />
                                        For 30 years now, you&#8217;ve been getting spam                </div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years --><P><br />
                        WASHINGTON (AFP) -<br />
This week, the world will mark an anniversary that has changed the face &#8212; and other anatomical regions &#8212; of email inboxes everywhere: the first known spam email was sent 30 years ago on Saturday.<br />
                        </P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years --><P><br />
But the message sent on May 3, 1978 by a marketer for the now defunct DEC computer company to around 400 people on the west coast of the United States wasn&#8217;t called spam, and the sender dispatched it without ill intent.</P></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://news.yahoo.com/s/afp/20080502/tc_afp/technologyinternetspamhistory30years --><P><br />
How things have changed.</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/86B7644A-C114-4FA3-83EA-98AD74702A49/blog/" title="blog or email this clip"><img src="http://content7.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Sat, 03 May 2008 11:41:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/unhappy returns">unhappy returns</category>
      <category domain="http://securityratty.com/tag/spam email">spam email</category>
      <category domain="http://securityratty.com/tag/west coast">west coast</category>
      <category domain="http://securityratty.com/tag/email inboxes">email inboxes</category>
      <category domain="http://securityratty.com/tag/anatomical regions">anatomical regions</category>
      <category domain="http://securityratty.com/tag/intent">intent</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/marketer">marketer</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=441">Happy Birthday Spam! Wish you many unhappy returns!</source>
    </item>
  </channel>
</rss>
