<![CDATA[[SecurityRatty] tag: economist]]> http://securityratty.com/tag/economist Mon, 16 Jun 2008 20:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[RNC]]> http://securityratty.com/article/be0e55d9cb445eec42568a38816bb728 http://securityratty.com/article/be0e55d9cb445eec42568a38816bb728 Yup, we have the RNC here in MN. Downtown is locked down pretty tight, you would need the combined powers of Chuck Norris and Bruce Schneier to even get a cup of coffee down there. Here is the round up from The Economist's blog


You'll have to pardon me this morning if the round-up seems a bit off. I'm still a little stunned at the spectacle of an arena full of (seemingly sober and sane) adults chanting, "Drill, baby, drill".


So let's see, what's in the news? Well, last night Republicans trotted out a Massachusetts venture capitalist and governor, the former mayor of New York City, former executives of eBay and HP, and an Alaskan neophyte pol who as mayor of a small town delivered $4,000 in federal pork for every man, woman, and child, in railing against coastal elites and Washington politics, while supporting a candidate who's been in the Senate for 26 years.

]]> Thu, 04 Sep 2008 07:34:05 +0000 massachusetts venture capitalist alaskan neophyte pol washington politics bruce schneier rnc federal pork drill round-up pretty tight RNC <![CDATA[Real Artists Ship]]> http://securityratty.com/article/da6631c856e43a023c66515e59fbce16 http://securityratty.com/article/da6631c856e43a023c66515e59fbce16 For a number of reasons I follow emerging economies, the biggies being China and India. The BRIC countries (Brazil, Russia, India, and China) generally get lumped in together as the "next big thing", but they are at very, very different stages of development and more importantly are taking different paths. You can easily think of software security as an emerging discipline - despite a lot of talk and papers about Saltzer and Schroeder, we really don't have this stuff figured out. 


So China is following a well worn path similar to South Korea, Japan, and the early US. India is taking a totally different and unproven path towards growth. Tata Motors has been innovative in building the cheapest car - the Tata Nano which is a $2500 car, and engineering triumph, driven by a mantra that an engineer would stand behind "do we really need that?"

Now the progress to executing on this is held back by India's dysfunctional environment:

In a tale rich with incongruities, the Communist-run government of West Bengal State invited the Tata Group, a symbol of Indian capitalism, to set up its plant in an area called Singur. It acquired 1,000 acres from farmers on the company’s behalf.
As the project advanced, some farmers who had sold their land demanded it back. The main state-level opposition party, the Trinamool Congress, led protests demanding that the land be returned. Most people sympathetic to Tata accused the opposition of inducing the farmers to protest, while Tata’s critics said the farmers had legitimate grievances.


The issue simmered for months. But in recent days, protesters began surrounding the plant, blocking roads and preventing Tata workers from reaching the plant. “The existing environment of obstruction, intimidation and confrontation has begun to impact the ability of the company to convince several of its experienced managers to relocate and work in the plant,” Tata said in a statement on Tuesday.

The halt to the plant has caused many Indian business people to warn of a chilling effect on investment in the country. It is also unclear how Tata will be able to keep the Nano’s cost so low, since part of the affordable price reflects the company’s savings on the land in Singur.


Arvind Subramanian compares China and India's trajectories:

There is a fundamental asymmetry between state and markets. It is easier to create markets than it is to create state capacity or to prevent its deterioration. Creating markets is a lot about letting go, establishing a reasonable policy framework, and allowing the natural hustling instinct to take over. In other words, hustling is the natural state. Building state capacity, on the other hand, is quite different. It involves overcoming collective action problems, mediating conflict, creating accountability mechanisms where outputs are multiple and fuzzy and links between inputs and outputs murky, and contending with the deep imprints of history. In Weber’s memorable words, building public institutions is like the “slow boring of hard boards”.


In that light, China’s task of improving its private sector seems easier to accomplish than India’s task of arresting institutional decline. So, while China and India can probably both count on more years of high growth, the odds still favour China pulling off that feat than India. That, and not just the meagre medal tally, should be what India mulls over after the Beijing Olympics.


The Economist summarizes:

It's easier to liberalise a functional state than it is to functionalise a dysfunctional one, of any ideological stripe.


What does all this have to do with ostensibly the topic at hand - Information Security? Well Tata Motors had the innovation but they didn't have the deployment model, at least not yet. More to the point, a lot of software security gets driven by infosec groups but real change is only coming when its driven by the development group. Why? Development groups are functional, they ship code. A lot of the success in software security is predicated by who you choose to partner with, it is more effective and easier to add security into a functional development group that ships code.


]]> Wed, 03 Sep 2008 07:23:08 +0000 tata tata workers tata motors security india india mulls information security functional development software security Real Artists Ship <![CDATA[Information risk management, and lessons-learned in the financial industry]]> http://securityratty.com/article/b9c42d81e576cf16cdd8e7f1696edbc9 http://securityratty.com/article/b9c42d81e576cf16cdd8e7f1696edbc9 Economist had a good article entitled "Confessions of a Risk Manager", in which a risk manager from a global bank uses 20-20 hindsight to look at "what went wrong" in the lead-up to the credit crunch and the ensuing fallout. I won't pretend to understand all the ins and outs of financial derivatives, but there were some points raised that anyone in the IT security space can identify with...]]> Mon, 18 Aug 2008 20:00:00 +0000 information risk management financial industry risk manager financial derivatives credit crunch security space global bank pretend lead-up Information risk management, and lessons-learned in the financial industry <![CDATA[Economist.com - Confessions of a Risk Manager]]> http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c http://securityratty.com/article/536365450db644abfa519cdc03dc2c4c Economist this week and came across an excellent article titled "Confessions of a Risk Manager".

In the article a risk manager for a major financial institution talks about managing risks and how the risk department was viewed as an obstacle by the rest of the business. I'll just quote a section here so you can see that governance roles, especially those involving trade-offs of risk vs. return are difficult not just in security.
In their eyes, we were not earning money for the bank. Worse, we had the power to say no and therefore prevent business from being done. Traders saw us as obstructive and a hindrance to their ability to earn higher bonuses. They did not take kindly to this. Sometimes the relationship between the risk department and the business lines ended in arguments. . . .

Tactfully explaining why we said no was not our forte. Traders were often exasperated as much by how they were told as by what they were told.

At the root of it all, however, was—and still is—a deeply ingrained flaw in the decision-making process. In contrast to the law, where two sides make an equal-and-opposite argument that is fairly judged, in banks there is always a bias towards one side of the argument. The business line was more focused on getting a transaction approved than on identifying the risks in what it was proposing. The risk factors were a small part of the presentation and always “mitigated”. This made it hard to discourage transactions. If a risk manager said no, he was immediately on a collision course with the business line. The risk thinking therefore leaned towards giving the benefit of the doubt to the risk-takers.

Collective common sense suffered as a result. Often in meetings, our gut reactions as risk managers were negative. But it was difficult to come up with hard-and-fast arguments for why you should decline a transaction, especially when you were sitting opposite a team that had worked for weeks on a proposal, which you had received an hour before the meeting started. In the end, with pressure for earnings and a calm market environment, we reluctantly agreed to marginal transactions.


Every time I read about decision making like this I refer back to an some excellent presentations I've come across by Reidar Bratvold. He has done some excellent presentations on decision making in the face of risks/uncertainty.

]]> Mon, 11 Aug 2008 04:42:00 +0000 risk risk manager risk factors risk-takers business business line risk managers risk department business lines Economist.com - Confessions of a Risk Manager <![CDATA[On Measuring a Markets Maturity]]> http://securityratty.com/article/fab7f9ba9252b7312f5d80cd5260d882 http://securityratty.com/article/fab7f9ba9252b7312f5d80cd5260d882 Professor David Luckham posts a good question in Measuring a Market’s Maturity.  Here is a slightly revised reprint of our reply:

A few folks have tried to tie “maturity” to “if the code is robust” or “if the product has certain product features.” The way we have addressed this emerging controversy over at The CEP blog is to center the discussion around the Gartner Hype Cycle, which is a pretty good model for representing the maturity, adoption and business application of specific technologies.

On CEP Maturity and the Gartner Hype Cycle

Since many folks work very closely with Gartner, I expect they are keenly aware of Gartner’s view on technology adoption maturity models and their definitions. Just for our readers who might not be as familar, I quote Gartner’s definitions below to be complete from here:

A hype cycle is a graphic representation of the maturity, adoption and business application of specific technologies. The term was coined by Gartner[citation needed], an analyst/research house, based in the United States, that provides opinions, advice and data on the global information technology industry.

Since 1995, Gartner has used hype cycles to characterize the over-enthusiasm or “hype” and subsequent disappointment that typically happens with the introduction of new technologies. Hype cycles also show how and when technologies move beyond the hype, offer practical benefits and become widely accepted. According to Gartner, hype cycles aim to separate the hype from the reality, and enable CIOs and CEOs to decide whether or not a particular technology is ready for adoption. A longer-term historical perspective on such cycles can be found in the research of the economist Carlota Perez.

A hype cycle in Gartner’s interpretation comprises 5 steps:

“Technology Trigger” — The first phase of a hype cycle is the “technology trigger” or breakthrough, product launch or other event that generates significant press and interest.

“Peak of Inflated Expectations” — In the next phase, a frenzy of publicity typically generates over-enthusiasm and unrealistic expectations. There may be some successful applications of a technology, but there are typically more failures.

“Trough of Disillusionment” — Technologies enter the “trough of disillusionment” because they fail to meet expectations and quickly become unfashionable. Consequently, the press usually abandons the topic and the technology.

“Slope of Enlightenment” — Although the press may have stopped covering the technology, some businesses continue through the “slope of enlightenment” and experiment to understand the benefits and practical application of the technology.

“Plateau of Productivity” — A technology reaches the “plateau of productivity” as the benefits of it become widely demonstrated and accepted. The technology becomes increasingly stable and evolves in second and third generations. The final height of the plateau varies according to whether the technology is broadly applicable or benefits only a niche market.

The term is now used more broadly in the marketing of new technologies.

We used the Gartner Hype Cycle in Two-Thirds of Our Readers Say CEP is Still Immature as a basis for having interested readers vote, and in a unscientific straw poll, the readers indicated that, in their view, CEP is still immature.

At the CEP Blog we ground our discussions and terminology on maturity in Gartner’s models on maturity, and we ground our discussions on event processing in the art-and-science of a long standing domain in event processing - multisensor data fusion (MSDF).

]]> Sun, 20 Jul 2008 08:10:01 +0000 hype cycles aim hype cycles hype gartner hype cycle hype cycle maturity markets maturity cep blogwe ground cep On Measuring a Markets Maturity <![CDATA[Links for 2008-07-15 [del.icio.us]]]> http://securityratty.com/article/6d10d0e3306711df8bca069e3f891fa8 http://securityratty.com/article/6d10d0e3306711df8bca069e3f891fa8
  • SAP Library - Administration Manual - Logging
  • TaoSecurity: The Best Single Day Class Ever
    I had the great fortune to attend Edward Tufte's one day class Presenting Data and Information. I only knew Tufte from advertisements in the Economist. For example, the image at left was frequently used as an ad in the print magazine.
  • Dorian Software BLOG: Event Analyst ® 7 Can Slice and Dice Your Security Event Logs ... Any Way Your Auditors Want Them Served
  • The Future Of Application And Database Security: Part 1, Setting The Stage | securosis.com
    • ]]>     Tue, 15 Jul 2008 20:00:00 +0000 single day class day class attend edward tufte tufte dorian software blog security event logs administration manual database security sap library Links for 2008-07-15 [del.icio.us]     <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146 http://securityratty.com/article/90bb58ffbec02539c2d62e825dbe8146

    Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

    Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on April 17, 2008.

    You may also listen to this podcast right now:

    Show Content:

    Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]>     Tue, 15 Jul 2008 13:20:45 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...     <![CDATA[Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...]]> http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b http://securityratty.com/article/f67dc99a7a07715d84135662a2d7276b

    Synopsis:  Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...

    Welcome to Blue Box: The VoIP Security Podcast #80, a 44-minute podcast  from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.   

    Download the show here (MP3, 20MB) or subscribe to the RSS feed to download the show automatically. 

    NOTE: This show was originally recorded on April 17, 2008.

    You may also listen to this podcast right now:

    Show Content:

    Comments, suggestions and feedback are welcome either as replies to this post  or via e-mail to blueboxpodcast@gmail.com.  Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows.  You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there. 

    Thank you for listening and please do let us know what you think of the show.

    ]]>     Tue, 15 Jul 2008 12:22:35 +0000 voip voip security news voip news australia voip news voip security voip security podcast voipsa blog site voipsa voipshield vulnerabilities Blue Box #80: VoIPShield vulnerabilities, what is ethical disclosure?, SIP trunking, VoIP security news, new nomadism, and much more...     <![CDATA[How to Spot a Recession]]> http://securityratty.com/article/413416266b3ae9a8053b39e95cf3a464 http://securityratty.com/article/413416266b3ae9a8053b39e95cf3a464 Sat, 12 Jul 2008 04:24:03 +0000 air force attack indy mac bank economist george taylor predominantly nasty news smirk weds week afghanistan reference How to Spot a Recession <![CDATA[Unpredictable IT means unreliable business, survey says]]> http://securityratty.com/article/dd98d2c99c10da5fccc7f2ccc79c477e http://securityratty.com/article/dd98d2c99c10da5fccc7f2ccc79c477e Mon, 16 Jun 2008 20:00:00 +0000 business risk economist intelligence unit risk survey views professionals countries Unpredictable IT means unreliable business, survey says