<![CDATA[[SecurityRatty] tag: director]]> http://securityratty.com/tag/director Wed, 15 Oct 2008 03:07:28 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[National Security Perspectives A Post-Election Insider View]]> http://securityratty.com/article/caa8257ee971993e58e1b834379f8c71 http://securityratty.com/article/caa8257ee971993e58e1b834379f8c71 Recently I participated in an event entitled National Security Perspectives held at the famous Congressional Country Club in Maryland. The featured panelists had impressive credentials from the NSA, DHS and the CIA. The topics of discussion ranged from Current Geopolitical Threats and Evolving Technology Demands to predictions about the New Administrations Intelligence, Defense and Homeland Security focus.

The panelists were:
William P. Crowell – former Deputy Director of the National Security Agency
Michael P. Jackson – Deputy Secretary, Department of Homeland Security
Jose A. Rodriguez, Jr. – former Director CIA, National Clandestine Service & CIA, DCI Counterterrorist Center

Overall, it was a very nicely arranged event on a brisk fall evening with about 100 CXO attendees; mostly large but some small government contractors and a few product companies like ScienceLogic that conduct business with military, intelligence and the public sector.

No surprise, given the financial crisis the economy is suffering from that the panelists said we also have a crisis coming on the Federal budget front. This will put enormous pressure on the way Administration thinks, and how and where to spend the $$.

Obama’s tone regarding the issues he will be confronting in the world during the election was encouraging. Make the world more non-partisan and take on the threats that we have in front of us head-on!

The panel was very upfront about current threats. William Crowell said,

“It is highly imprudent to believe that there will not be another 9-11. We have to fund and support the work to stop other attacks. We can only mitigate risk but we can’t eliminate risk. We have to try to absorb the sense of urgency and wake up every day looking at the intelligence screens as if 9-11 happened within the last couple of months.”

He added,

“They (the intelligence community) need the innovation, sense of commitment and urgency that comes from the private sector – a sense of mutual commitment to that mission.”

Predicted Priorities for investment for DHS:

  1. Cyber attack as the top issue
  2. Nuclear threats including dirty bomb
  3. Chemical and biological attacks
  4. Explosive attacks against critical infrastructure with maximum # of lives and or financial disruption / loss.
  5. Large scale natural disasters – hurricane + earthquakes
  6. Border penetration - identity management and border management issues

An Obama administration will spend dollars around these threat vectors. They will want to spend $$ to help state and local governments. Grants to state and local governments should significantly increase with the Obama administration, so think about how you will increase your focus on the state and local government spending initiatives.

Secure border investments – the panelists believe that the new administration will feel compelled to invest here. Michael P. Jackson bluntly said, “You have to make investments in border tools to get meaningful immigration reform.”

Panelists agreed that the 1st year will be an intense period of scrutiny about fundamental directions. We can’t afford it all at DHS; it is dramatically under budgeted. At TSA/DOT and then at DHS, we spent about $4 Billion on technology investments since 9-11; those investments are now reaching the end of the original service life.

One gripe from the panel that I found humorous: “We don’t have a group of people who think like entrepreneurs.” It is insane how long things last when you buy things in the government. As an example, we are still replacing vacuum tubes in some of the very old FAA gear… this is well beyond what any reasonable person would think these initial investments should/would last.

Final Thoughts:
I actually think that the Obama Administration will be quite favorable to COTS software products, SaaS offerings, and creative financing initiatives from the private sector. The government just won’t have the capital budget to do everything it wants to accomplish. I would say if you look at how intelligently and aggressively Obama used technology to assist his campaign, the odds are good that this new breed of IT talent (which is already really comfortable with SaaS products, blogs, wiki’s, hosted/outsourced Cloud solutions… this team really understands the latest technology trends) will quickly work to bring these new IT paradigms to the Federal marketplace. Clearly the private sector can help the Government achieve more with lower capital budgets – beginning to provide services rather than transaction-based selling. Another clear idea is to think about leasing as a better way to work with the government which going forward will have increased budgets restrictions.

They will likely be in confrontation with members of Congress that won’t change fast enough, however the future of our nation’s ability to fight terror lies in becoming more efficient and effective. It requires the government be flexible enough to figure out what jobs and IT functions to outsource in a nimble and smart way. My prediction: this is great news for Service Providers. Overall the next 4 years should be great for our business as well as the Managed Service Provider/SaaS industry!

]]> Tue, 18 Nov 2008 11:13:25 +0000 secure border investments investments government contractors government threats government achieve initial investments shouldwould obama administration current threats National Security Perspectives A Post-Election Insider View <![CDATA[Rational Risk Management, Angry Italians, and Irrational Security Analysts]]> http://securityratty.com/article/616867e9cd4e8203d8c23c0bef989749 http://securityratty.com/article/616867e9cd4e8203d8c23c0bef989749 Hope you all had a great weekend.  I had meant to point you earlier to a FAIR analysis that Chris Hayes did over at his Blog.  But I’ve been a little busy, and before I could mention it, Stuart King put up a kind of angry response on his ComputerWorld blog.  Snark aside, there are a couple of other really troubling aspects of Stuart’s reaction to Chris’ analysis that I thought we could talk about this morning.

The problem is that (Chris’ analysis is) completely impractical. I’ll take a recent, and fairly typical situation as an example. I was taking issue with the manner in which remote access was being provisioned for a third party vendor to connect to a system hosted by one of our European business units. To cut a long story short, it was not only a breach of policy but highly insecure. I wanted the access to be disconnected, the business unit director wanted my risk assessment. And he didn’t want to wait for it.

To quote Chris Hayes, spending time on working out the expected effectiveness of controls, over a given timeframe, as measured against a baseline level of force was not going to pacify an angry Italian fearful that my decision was going to cost him money. He wanted my explanation of the risk and more importantly, what I was going to offer as a solution to keep his business functioning

As Chris is someone who actually does this for a living in a large company, and this is typical of his actual day job, I really find Stuart’s “impractical” comment to be, um, misinformed.

Also, I think Stuart mistakes the purpose of a risk analysis.  The purpose of the risk analysis is not to force someone to be “secure”, but to provide knowledge for decision making.  Using it as a “hammer” to knock in the nail of your personal risk tolerance impairs efficiency and in the long run retards “security” as it creates political resentment.  Seriously, who cares if something might violate policy or not in a pre-implementation discussion?  Policies are not stone tablets handed down from on high, they are state-in-time codification of the data owners risk tolerance.  This risk tolerance changes sometimes, and that’s OK.

To that extent, I appreciate (and I’m sure Chris does, as well) that risk analysis does not create rationality in the data owner.  Someone who sees you as a speedbump on the route to progress they may not be ready to appreciate your point of view even if it is stated in the most rational manner possible.   But it’s worth noting (and Stuart’s example is indicative of this point) that risk analysis does not create rationality in the analyst, either.  If one is being so “security minded” as to ignore the risk tolerance of the business owner - we’re bound to get a reaction similar to that Stuart encountered.  In fact, a practical risk analysis like Chris performed on his blog, done in 30 minutes, should identify the critical point of disagreement between Stuart and the data owner (again, Stuart doesn’t own the data, the agitated Italian does).

But let’s stay rational and open to alternatives to what Chris offers.  Stuart states his approach to risk analysis as:

When I need to document a risk assessment I use a very simple form: list the threats, state the level of vulnerability, list the associated operational costs and potential revenue hits. High, medium, or low risk? Describe the controls and options. Write up who needs to do what, and how much of their time it’s going to take. Job done.

At first glance, I don’t think what Chris has done is any less efficient, and it provides greater insight (using Frequency and Capability instead of just ‘listing the threats’).  But what is key here is that Chris’ approach is consistent and defensible.  Less generous risk geeks and CSO’s I know would have no little difficulty with Stuart’s approach.  But to particularly answer Stuart’s main objection (impracticality) I would offer that with practice, Chris’ work is probably quicker and easier than Stuart’s described process as it eliminates much of the ambiguity an immature risk analysis creates - reducing the need for further discussion and arguments with data owners (regardless of disposition or nationality).

Finally the irony of Stuart’s post is that the reason he had this confrontation may in fact be because he was incapable of bringing a salient model for risk to the table, one that identified the factors that create risk and developed a defensible belief statement concerning risk.   We’ll never know if one would have helped him in this isolated instance, but I can tell you that in organizations like Chris’, good risk models and strong risk anlayses create operational efficiencies, reduce costs, and streamlines intra-departmental communications.

]]> Mon, 17 Nov 2008 13:43:15 +0000 risk risk tolerance risk models practical risk analysis strong risk anlayses generous risk geeks immature risk analysis quote chris hayes chris hayes Rational Risk Management, Angry Italians, and Irrational Security Analysts <![CDATA[Speaking of Security Podcast #127]]> http://securityratty.com/article/d60e884160f385e41db54c74a6f13c81 http://securityratty.com/article/d60e884160f385e41db54c74a6f13c81 Click to Download/Listen (07:52)

It's election day in the US, and today's Speaking of Security Podcast focuses on the notorious breach of Sarah Palin's email account on Yahoo. Satchit Dokras, a Director in RSA's EMC Product Security Office, talks about Palin's exposed email and how all of us can better protect our online accounts.
]]> Mon, 03 Nov 2008 21:00:00 +0000 sarah palin email palin security podcast focuses email account notorious breach satchit dokras election day online accounts Speaking of Security Podcast #127 <![CDATA[Security at the Point of Sale]]> http://securityratty.com/article/a9296c05396f4536fb1f3474ddb874e2 http://securityratty.com/article/a9296c05396f4536fb1f3474ddb874e2

]]> Sun, 02 Nov 2008 21:00:00 +0000 marcotte daniel marcotte data security montreal retailer pin pads holiday season cash register thefts director Security at the Point of Sale <![CDATA[You may not even know it, but a Bodyguard may be protecting your colleague as you work.]]> http://securityratty.com/article/b854f696580e858bbb700b07fed3a181 http://securityratty.com/article/b854f696580e858bbb700b07fed3a181 Seattlepi.com reporter, Andrea James.

The article raises many points that I am sure many of us have or would overlook if it was not brought to our attention. The director of New Beginnings, a Seattle based non-profit that provides advocacy and shelter for victims made the point that while going home after a hard day's work is something that many employees look forward to, for victims of domestic abuse, work is the only place that provides them safety and a sanctuary from a tortured home life.


Our company is frequently requested by employers to provide covert bodyguards for employees with domestic problems at home. The reason for this is due to the fact that physical violence at home, quite often spills into the workplace by the abuser and when that happens, the liklihood of the domestic partner and other co-workers getting hurt or even killed is very real.

Employers know that they have a responsibility to keep the workplace safe so they hire companies like ours to have trained personal protection specialists blend in at the place of empoyment and watch out for the identified threat. Just about 100% of the time the victim of the abuse is a female employee but this article and the comments that follow show that males also suffer from domestic violence.

It is the opinion of our company that we will see even more workplace violence, domestic and otherwise, as companies continue to practice cost cutting tactics like downsizing and layoffs due to the worsening economy. Other related predictions would be thefts from the workplace, increase in fraud and embezzlement, an increase in Resume/CV fabrications as more and more people compete for fewer jobs.

This all goes to show that employers have to be more astute and procative in making sound hiring decisions, being alert for internal theft and abuse and being proactive when it comes to workplace violence.
Visit Sexton Executive Security at www.sextonsecurity.com
]]> Sun, 26 Oct 2008 09:33:00 +0000 workplace safe workplace domestic domestic violence workplace violence domestic partner home life home provide covert bodyguards You may not even know it, but a Bodyguard may be protecting your colleague as you work. <![CDATA[5534 Stolen Ebay Logins And Passwords Accidentally Found Online By Security Firm]]> http://securityratty.com/article/f3ef175a0425d67f9206e710ccab1c5c http://securityratty.com/article/f3ef175a0425d67f9206e710ccab1c5c Thu, 23 Oct 2008 22:06:55 +0000 ebay logins facetime security labs list includes malware research firm list christopher boyd october haul director 5534 Stolen Ebay Logins And Passwords Accidentally Found Online By Security Firm <![CDATA[Integrated Security]]> http://securityratty.com/article/f019b5d7dfb1fe329de2cdcc311d5ad1 http://securityratty.com/article/f019b5d7dfb1fe329de2cdcc311d5ad1 Tom Barnett on what the big consulting companies are doing:

Now we're into a world where asking companies to pay you millions for a massive PPT slide deck that says, "This is your company now and this is what your company should look like tomorrow," is simply a non-starter. So while the tech-heavy firms like Accenture and Cap Gemini do well at the bottom and the high-end starts like the Monitor Group do well at the top of the pyramid, a lot of mid-range, standard cookie-cutter management consulting firms are seeing their market decline. Everyone wants the super-integrated solution now that combines compliance, security, systems-integration, performance metrics—and they want it delivered in a service-oriented architecture that frees companies up to evolve in ways commensurate with globalization's many demands and opportunities.

I see efforts in all the compliance, security, systems-integration, performance metrics, and SOA rabbit holes. I don't see very much unification. In my swamp - SOA security. I do see a lot of starter efforts where companies build out services, but forget the security -  and then either an auditor comes asks "so how are you doing authN and authZ for your web services" or a security event happens, or a diligent director comes along and asks variant of the auditor question. Then some things start to happen, usually a purchase of a XML gateway, but Data Power, Vordel and Cisco can't help you if its just shelfware.

Integration is inherently difficult and messy. Information security groups need to get good at engaging with development and architecture in a proactive way to deiver these security services to the system. I call it "playing offense", infosec spends most of its time defending against bad guys, and that is ok, it is a huge part of infosec's job, but sometimes you need to go on offense and raise the bar. Make the bad guys' job harder, build security in.

]]> Wed, 22 Oct 2008 13:05:50 +0000 security soa security information security web services services security event security services companies frees companies Integrated Security <![CDATA[Qualys]]> http://securityratty.com/article/f7b6ca08909715bc9218aafde12f49c4 http://securityratty.com/article/f7b6ca08909715bc9218aafde12f49c4 As I am sitting here in my new office getting set up, it is time for me to share the full news with the world.

So, starting today I am a Director of PCI Compliance Solutions at Qualys.

There you have it :-)

More on this later; I am way too busy now.
About me: http://www.chuvakin.org
]]> Mon, 20 Oct 2008 03:44:00 +0000 pci compliance solutions qualys org time world director office share news Qualys <![CDATA[OWASP European Summit - Portugal]]> http://securityratty.com/article/ea11601c79d7b13866fce47288b63fbd http://securityratty.com/article/ea11601c79d7b13866fce47288b63fbd Portugal/Algarve - 4th - 7th November 2008

Setting the Web Application Security Agenda for 2009: OWASP Invites You to Join Our Summit in Portugal

http://www.owasp.org/index.php/OWASP_EU_Summit_2008

With the theme ‘Setting the AppSec agenda for 2009′, the OWASP Summit will be a worldwide gathering of OWASP leaders and key industry players to present and discuss the latest OWASP tools, documentation projects, and web application security trends. Join us in Portugal in just a few short weeks! This venue hosts a diverse selection of training courses along with technical and business tracks, making it THE place to learn about web application security and the resources OWASP has available for use today.

OWASP is a not-for-profit organization with the purpose of supporting the Web Application Security community around the world, and has granted $250,000 USD for web application security research. In addition to over 40 presentations from the OWASP Leaders and grant recipients, the OWASP Summit will host multiple Working Sessions designed to improve collaboration, achieve specific objectives and identify roadmaps for OWASP projects, chapters, and the OWASP community itself.

To facilitate this event, OWASP is investing $150,000 USD which will be used to cover air travel and accommodation expenses for OWASP leaders, active contributors, and select key industry leaders. With their confirmed presence, the OWASP Summit will provide a relaxed but professional environment to meet, discuss, influence and contribute to OWASP projects.

There are still funds available! If you are interested in attending and you meet the profile of the current OWASP supported attendees (see list here: http://spreadsheets.google.com/pub?key=pAX6n7m2zaTVLrPtR07riBA) contact Paulo Coimbra (paulo.coimbra@owasp.org). Please note that you should do so only if you meet the paid attendance criteria (see herehttps://www.owasp.org/index.php/OWASP_EU_Summit_2008_paid_participation_rules) and are unable to get corporate support to attend this event (for other corporate sponsorship opportunities see http://www.owasp.org/index.php/OWASP_EU_Summit_2008_Sponsors).

The OWASP Summit will also host a large and diverse selection of training courses, covering multiple OWASP specific and Web Application Security Topics.

The remarkable impact of OWASP is made possible only by the collaboration of many dedicated people and organizations worldwide. In that spirit of cooperation, OWASP invites all its members (who have 20% discount + 1 VIP Ticket) and interested individuals and companies to attend this thrilling event. Please join us and help to set the Web Application Security Agenda for 2009!

Please see below for additional details about the OWASP Summit or visit the OWASP Summit website: http://www.owasp.org/index.php/OWASP_EU_Summit_2008.

Projects

OWASP projects selected for Summit presentation include new documentation and innovative tools to help developers, architects, and security specialists ensure that applications are secure:

  • Application Security Verification Standard,
  • Code review guide, V1.1,
  • Ruby on Rails Security Guide v2,
  • Securing WebGoat using ModSecurity,
  • Testing Guide v3,
  • GTK+ GUI for w3af project,
  • Access Control Rules Tester,
  • AntiSamy .NET,
  • Live CD & DVD Project,
  • OpenPGP Extensions for HTTP,
  • Orizon Project,
  • Python Static Analysis,
  • WebScarab-NG,
  • And many, many others.

Working Sessions

Expecting the presence of the application security industry key players, the Working Sessions will cover a wide range of issues such as:

  • OWASP Top 10 2009,
  • Browser Security,
  • Web Application Framework Security,
  • Enterprise Security API Project,
  • Best Practices for OWASP Chapter Leaders,
  • OWASP Documentation Projects,
  • OWASP Tools Projects,
  • OWASP Education Project,
  • OWASP Strategic Planning for 2009,
  • OWASP Certification,
  • OWASP Winter of Code 2009
  • Two-way Internationalization of OWASP Content
  • And many more.

Training

These 2-day, 1-day or 1/2-day training courses cover a wide range of OWASP specific and Web Application Security Topics:

  • OWASP Top 10 - What Developers Should Know on Web Application Security
  • Uncovering WebScarab’s Secret Treasures
  • Securing WebGoat with ModSecurity
  • Secure Programming with Java
  • Advanced Web Application Security Testing
  • Building Secure Web 2.0 Applications
  • Building Secure Web Services
  • Building Secure Web Applications with OWASP’s Enterprise Security API (ESAPI)
  • Classic ASP Security using OWASP tools
  • Web Application Assessments
  • Hacking Owasp Orizon Project v1.0
  • Ajax Security
  • Practical Penetration Testing: Think Like an Attacker to Stop Attacks
  • Linux Software Exploitation
  • Web server/services hardening using SELinux

Main Contact:

Kate Hartmann
OWASP Operations Director
9175 Guilford Road, Suite 300
Columbia, MD 21046, USA
Phone: +1-301-575-0189
Facsimile: +1-301-604-8033
Email: kate.hartmann@owasp.org

]]> Wed, 15 Oct 2008 14:27:22 +0000 summit documentation owasp documentation projects projects owasp owasp tools projects owasp tools owasp summit website owasp projects OWASP European Summit - Portugal <![CDATA[Terrorist Fear Mongering Seems to be Working Less Well]]> http://securityratty.com/article/09f36b7171d3f9e45ccf11b061db25e3 http://securityratty.com/article/09f36b7171d3f9e45ccf11b061db25e3 BART, the San Francisco subway authority, has been debating allowing passengers to bring drinks on trains. There are all sorts of good reasons why or why not -- convenience, problems with spills, and so on -- but one reason that makes no sense is that terrorists may bring flammable liquids on board. Yet that is exactly what BART managers said.

No big news -- we've seen stupid things like this regularly since 9/11 -- but this time people responded:

Added Director Tom Radulovich, "If somebody wants to break the law and bring flammable liquids on, they can. It's not like al Qaeda is waiting in their caves for us to have a sippy-cup rule."

Directing his comments to BART administrators, he said, "You know, it's just fearmongering and you should be ashamed."

]]> Wed, 15 Oct 2008 03:07:28 +0000 bart bart managers flammable liquids director tom radulovich bart administrators sippy-cup rule time people passengers law Terrorist Fear Mongering Seems to be Working Less Well