<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: excel]]></title>
    <link>http://securityratty.com/tag/excel</link>
    <description></description>
    <pubDate>Tue, 20 May 2008 08:50:08 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[On Idiots and Logs]]></title>
      <link>http://securityratty.com/article/6490a97e465cf9d880fa1849d0525c8e</link>
      <guid>http://securityratty.com/article/6490a97e465cf9d880fa1849d0525c8e</guid>
      <description><![CDATA[How on Earth can someone even utter the phrases &quot; scalable log management &quot; and &quot; Microsoft Access for data storage &quot; in one sentence? OMG, OMG, OMG

MS Access, for God's sake! I wonder if they tried...]]></description>
      <content:encoded><![CDATA[How on Earth can someone even utter the phrases "<span style="font-weight: bold;">scalable log management</span>" and "<span style="font-weight: bold;">Microsoft <span style="font-style: italic;">Access </span>for data storage</span>" in one sentence? OMG, OMG, OMG...<br /><br />MS Access, for God's sake! I wonder if they tried storing logs in Excel spreadsheets?<br /><br />Yeeeeesh.<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=POYrOK"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=POYrOK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=6Uxd8K"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=6Uxd8K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=pM3f8K"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=pM3f8K" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/365910571" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 07:51:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft access">microsoft access</category>
      <category domain="http://securityratty.com/tag/omg">omg</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/scalable log management">scalable log management</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/data storage">data storage</category>
      <category domain="http://securityratty.com/tag/excel spreadsheets">excel spreadsheets</category>
      <category domain="http://securityratty.com/tag/yeeeeesh">yeeeeesh</category>
      <category domain="http://securityratty.com/tag/phrases">phrases</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/365910571/on-idiots-and-logs.html">On Idiots and Logs</source>
    </item>
    <item>
      <title><![CDATA[Microsofts Patch Fix Critical Vulnerabilities In IE And Office]]></title>
      <link>http://securityratty.com/article/83530b8c3cc5bababe63cdb90ab7881a</link>
      <guid>http://securityratty.com/article/83530b8c3cc5bababe63cdb90ab7881a</guid>
      <description><![CDATA[Microsoft has released six critical patches and five patches described as important, addressing a total of 26 vulnerabilities. All six critical updates address code injection risks involving Access,...]]></description>
      <content:encoded><![CDATA[Microsoft has released six critical patches and five patches described as important, addressing a total of 26 vulnerabilities. All six critical updates address code injection risks involving Access, Excel, Microsoft Office and Internet Explorer.
Full bulletin can be found here. Here’s the brief summary of critical flaws:
CVE-2008-2254, CVE-2008-2255, CVE-2008-2256, CVE-2008-2257, CVE-2008-2259 and CVE-2008-2258: These patches fix [...]]]></content:encoded>
      <pubDate>Wed, 13 Aug 2008 08:26:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/critical">critical</category>
      <category domain="http://securityratty.com/tag/critical patches">critical patches</category>
      <category domain="http://securityratty.com/tag/patches">patches</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/patches fix">patches fix</category>
      <category domain="http://securityratty.com/tag/critical flaws">critical flaws</category>
      <category domain="http://securityratty.com/tag/microsoft office">microsoft office</category>
      <category domain="http://securityratty.com/tag/internet explorer">internet explorer</category>
      <category domain="http://securityratty.com/tag/vulnerabilities">vulnerabilities</category>
      <source url="http://cyberinsecure.com/microsofts-patch-fix-critical-vulnerabilities-in-ie-and-office/">Microsofts Patch Fix Critical Vulnerabilities In IE And Office</source>
    </item>
    <item>
      <title><![CDATA[Patch Tuesday? Aw jeez!]]></title>
      <link>http://securityratty.com/article/df0606458c7029fd2520302ee43099b3</link>
      <guid>http://securityratty.com/article/df0606458c7029fd2520302ee43099b3</guid>
      <description><![CDATA[This is gonna be a biggie people. Good luck to us all


clipped from www.internetnews.com

Patch Tuesday Targets Mammoth Set of Flaws


The six critical security flaws relate to Remote Code Execution...]]></description>
      <content:encoded><![CDATA[<div > This is gonna be a biggie people.<br/>Good luck to us all. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/D5F7239D-A64F-4E48-8BB3-B173B743903A/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/ee23fe0f-71fa-4504-bb9c-6470bd02df89/D5F7239D-A64F-4E48-8BB3-B173B743903A/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.internetnews.com/security/article.php/3764856/Patch+Tuesday+Targets+Mammoth+Set+of+Flaws.htm" href="http://www.internetnews.com/security/article.php/3764856/Patch+Tuesday+Targets+Mammoth+Set+of+Flaws.htm" style="font-size: 11px;">www.internetnews.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.internetnews.com/security/article.php/3764856/Patch+Tuesday+Targets+Mammoth+Set+of+Flaws.htm --><DIV>Patch Tuesday Targets &#8216;Mammoth&#8217; Set of Flaws</DIV></td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.internetnews.com/security/article.php/3764856/Patch+Tuesday+Targets+Mammoth+Set+of+Flaws.htm --><P>The six critical security flaws relate to Remote Code Execution vulnerabilities in Microsoft Windows, Internet Explorer, Media Access Player, Access, Excel, PowerPoint and Microsoft Office. All versions of Windows, from Windows 2000 to Vista, and Windows Server 2003 and 2008, are impacted. Microsoft today also released an updated version of the Microsoft Windows Malicious Software Removal Tool.<br />
</P></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/D5F7239D-A64F-4E48-8BB3-B173B743903A/blog/" title="blog or email this clip"><img src="http://content7.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
]]></content:encoded>
      <pubDate>Tue, 12 Aug 2008 20:50:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/microsoft windows">microsoft windows</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/critical security flaws">critical security flaws</category>
      <category domain="http://securityratty.com/tag/windows server">windows server</category>
      <category domain="http://securityratty.com/tag/access">access</category>
      <category domain="http://securityratty.com/tag/flaws">flaws</category>
      <category domain="http://securityratty.com/tag/media access player">media access player</category>
      <category domain="http://securityratty.com/tag/microsoft office">microsoft office</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=553">Patch Tuesday? Aw jeez!</source>
    </item>
    <item>
      <title><![CDATA[Malware and Office Documents Joining Forces]]></title>
      <link>http://securityratty.com/article/dee3d028ca8134c75e2aec7f397d1493</link>
      <guid>http://securityratty.com/article/dee3d028ca8134c75e2aec7f397d1493</guid>
      <description><![CDATA[Common office files as documents, presentations, spreadsheets and PDF files, are the most widely abused ones in targeted attacks, which when backed up with enough personal information and take into...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<a href="http://bp1.blogger.com/_wICHhTiQmrA/SHtuv_mJSwI/AAAAAAAAB6M/X83g6Zkr9hg/s1600-h/screen1.jpg" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHtuv_mJSwI/AAAAAAAAB6M/b0YAu_NWEQk/s200-R/screen1.jpg" style="border: 0pt none ;" /></a>Common office files as documents, presentations, spreadsheets and PDF files, are the most widely abused ones in targeted attacks, which when backed up with enough personal information and take into consideration the time of their attack if the social engineering campaign is either going to be based on a current/upcoming event, or on an event anticipated due to information gathered through open source intelligence, often make it through common signature based scanning solutions.<br />
<br />
Despite the relatively easy to obtain, point'n'click <a href="http://www.f-secure.com/weblog/archives/00001450.html">DIY tools for backdooring common office files</a> are available for the script kiddies to take advantage of, some are <a href="http://ddanchev.blogspot.com/2007/10/dynamics-of-malware-industry.html">naturally remaining proprietary tools</a>, making them harder to analyze unless a copy is obtained. Like this one, generating "undetected" by signatures based scanning, office documents and spreadsheets that would drop the actual malware on the PC.<br />
<br />
Automatic translation of its description and core features :<br />
<br />
<i>"The program represents a generator OfficeJoiner macros in the language Visual Basic for Application (VBA), for introduction in the document Microsoft Office Word / Microsoft Office Excel executable file (win32 exe), followed by fully automatic recovery and launch, without any&nbsp; additional action by the user. The only requirement that formed in such a way xls / doc files is to support&nbsp; VBA macros on the computer end-user formed file and permission to launch macros.</i><br />
<br />
<i>The program uses NOT a vulnerability (exploit) or macro-virus tools for the introduction, extraction or running embedded files. This means that it has generated macros compatible with ALL versions of Microsoft Office products starting with Microsoft Office 97 package, with any established "patches" and the service pack. Macros generated by this program not detected antivirus, for the simple reason that they are not viruses or macro viruses. The program uses only "established" means products built into Microsoft Excel VBA language to achieve their goals.</i><br />
<br />
<i>- Fully automatic generation of macro for the introduction of documents word / excel any given exe-file with his persistence in the body and subsequent documents automatic recovery and launch, when opening a document word / excel.&nbsp;</i><br />
<br />
<i>- Generated macros are compatible with all versions of ms word / excel since version 97,&nbsp; employments and regardless of the presence / absence of any patches / servicepacs.&nbsp;</i><br />
<br />
<i>- Generated macros are not macro-viruses, exploits do not use and do not contain any malicious code, so do not be detected by any antivirus tools as viruses.&nbsp;</i><br />
<br />
<i>- Conversion body ex-file macro happening in such a way that while in doc / xls file it not detected any antivirus, and can be freely sent by mail safely passed all checks, even if in itself contains viral code defined antivirus. <br />
&nbsp;</i><br />
<i>- Sgenerirovanny and attached to the body of the document macro can be protected with a password or signed certificate, using funds established Microsoft Office, which does not affect him productivity or efficiency (macro, in any case remain fully workable).&nbsp;</i><br />
<br />
<i>- Box macro can be made both in the new document, and in any document containing data and-or other macros. Generated program code is fully compatible with any other embedded in the document macros or entering data, and will not interfere with their work, as well as maintain its efficiency.</i><br />
<br />
<div dir="ltr" id="result_box"><i>- Added auto-finding ways to extract exe-file; <br />
&nbsp;</i></div>
<div dir="ltr" id="result_box"><i>- Added possibility of a macro arbitrary text in the body of the instrument; <br />
&nbsp;</i></div>
<div dir="ltr" id="result_box"><i>- Optimized algorithm macro-generation code; <br />
</i></div>
<div dir="ltr" id="result_box"><i>&nbsp;</i> </div>
<div dir="ltr" id="result_box"></div>
<div style="text-align: left;"></div>
<div class="separator" style="text-align: center; clear: both;"></div>
<div dir="ltr" id="result_box"><a href="http://bp1.blogger.com/_wICHhTiQmrA/SHt7EgPiRwI/AAAAAAAAB6U/BtNJaK_13LM/s1600-h/officedocs_malware_sample.PNG" imageanchor="1" style="border: 0pt none ; background-color: transparent; clear: left; margin-bottom: 1em; float: left; margin-right: 1em;"><img src="http://bp1.blogger.com/_wICHhTiQmrA/SHt7EgPiRwI/AAAAAAAAB6U/xhaiKacT-eM/s200-R/officedocs_malware_sample.PNG" style="border: 0pt none ;" /></a><i>Enabling this option will lead to the creation macro code, who himself will find a way to unpack and run embedded exe-file. Auto-search finds the current user folder and produces there extraction and launch embedded file. The peculiarity of this method is that this method will work on the computers of users with a limited account, because in its user folder in any case has the right to record / performance. Using this option is justified to improve the "punching" macro on computers with limited account or unknown file structure (let Windows installed on the disk is different from C). <br />
<br />
You can specify a name for final file independently, or leave blank, then the name will be generated automatically.</i> </div>
<div dir="ltr" id="result_box"><i><br />
</i></div>
<div dir="ltr" id="result_box"><i>On this possibility has asked for a user program, its essence is that after running a macro, retrieval and downloading exe-file the document with the introduction of exe-file will be withdrawn posed text. Perhaps in this way can improve the application of social engineering, designed to force the user to allow support for macros. For example, in the text of the document indicate: <br />
<br />
"This document contains hidden text (password, a system of calculation formulas, interactive components, etc.), Which can be viewed only after the inclusion of support macros. Please enable support for macros and re-opening this document ". <br />
<br />
After resolving support macros, and the implementation of embedded exe-file, the document will be withdrawn given a string containing probable "password" or any other textual information.</i>  " </div>
<br />
Despite that the tool is proprietary, the underground economy's leaks are largely driven by bargain hunters who would exchange proprietary tool, whose often biased exclusiveness may increase the profit margins, for a service or a good that may be worthless for them in general, but impossible to obtain and take advantage of in the present. It will not just leak in one way or another, someone will inevitably backdoor the backdooring tool and trick the novice bargain hunters into running it, by having both their host infected and money taken.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2007/03/underground-economys-supply-of-goods.html">The Underground Economy's Supply of Goods and Services</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/yet-another-diy-proprietary-malware.html">Yet Another DIY Proprietary Malware Builder</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/small-pack-web-malware-exploitation-kit.html">The Small Pack Web Malware Exploitation Kit - Proprietary</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/diy-exploit-embedding-tool-proprietary.html">DIY Exploit Embedding Tool - A Proprietary Release</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/skype-spamming-tool-in-wild.html">Skype Spamming Tool in the Wild - Proprietary Release</a><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=mMDIJJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=mMDIJJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=vtGZUJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=vtGZUJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Voeqqj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Voeqqj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QZJLHj"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QZJLHj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=4VmcIJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=4VmcIJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=rqLHKJ"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=rqLHKJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LnaC8j"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LnaC8j" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/335226251" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 07:20:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/document">document</category>
      <category domain="http://securityratty.com/tag/document macros">document macros</category>
      <category domain="http://securityratty.com/tag/support">support</category>
      <category domain="http://securityratty.com/tag/enable support">enable support</category>
      <category domain="http://securityratty.com/tag/macro">macro</category>
      <category domain="http://securityratty.com/tag/macro viruses">macro viruses</category>
      <category domain="http://securityratty.com/tag/support vba macros">support vba macros</category>
      <category domain="http://securityratty.com/tag/exe-file">exe-file</category>
      <category domain="http://securityratty.com/tag/extract exe-file">extract exe-file</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/335226251/malware-and-office-documents-joining.html">Malware and Office Documents Joining Forces</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Sprint Treo 800w, New Wireless in Portland (Ore.), Hartford (Conn.) Fail]]></title>
      <link>http://securityratty.com/article/f1981ba4dac94faf8437d40c4aeb2ef4</link>
      <guid>http://securityratty.com/article/f1981ba4dac94faf8437d40c4aeb2ef4</guid>
      <description><![CDATA[Palm Treo 800w released: Sprint is offering the EVDO/Wi-Fi phone with Windows Mobile 6.1 and built-in GPS. The phone is $250 with a two-year contract. This is apparently the phone that Palm should...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://reviews.cnet.com/smartphones/palm-treo-800w-sprint/4505-6452_7-33142476.html"><strong>Palm Treo 800w released:</strong></a> Sprint is offering the EVDO/Wi-Fi phone with Windows Mobile 6.1 and built-in GPS. The phone is $250 with a two-year contract. This is apparently the phone that Palm should have released a couple of years ago; now, it's unfavorably compared to the iPhone except for keyboard entry and the ability to subscribe ($10/mo) for turn-by-turn live navigation. You'll note that applications are scarcely mentioned, which is one of the linchpins of the iPhone. This is a business phone with productivity tools--unlike the iPhone, you can use on-board apps to create and edit Word and Excel documents, not just view them. There's also no store mentioned for purchasing video and audio, or software for synchronizing them. The reviewer finds the video quality washed out as well, and the 320-by-320-pixel touchscreen is a bit small compared to other smartphones that focus on video.</p>

<p><a href="http://ir.proxim.com/releasedetail.cfm?ReleaseID=321784"><strong>Stephouse steps into Portland, Ore., void:</strong></a> Local firm <a href="http://www.stephouse.net/Enterprise"><strong>Stephouse</strong></a> has built out 5 sq mi of business-grade wireless availability in downtown Portland and 2 sq mi in an underserved part of north Portland using Proxim gear for both Wi-Fi and WiMax service. Wi-Fi use is $20 per month or 1 free hour per day up to 10 free hours per month. The offering seems to focus on the business side, though, in competition with services like Towerstream. Prices aren't listed on the company's site.</p>

<p><a href="http://www.hartfordbusiness.com/news6031.html"><strong>Hartford drops Wi-Fi effort:</strong></a> Connecticut's trouble capital city has given up on city-wide Wi-Fi. No surprise. No firms ready to build for free, no money, no tangible goals. My wife grew up in the suburb to the west--West Hartford, prosaically enough--and speculates that the lack of county-oriented government in Connecticut has doomed Hartford to be a civic wasteland. It's recovering a bit as housing affordability goes up, and there's more going on in the city than there used to be. But there won't be Wi-Fi. Incidentally, the <a href="http://www.marktwainhouse.org/"><strong>Mark Twain House & Museum in Hartford</strong></a>, home of one of the world's first bloggers, is near financial ruin. It's a great piece of American history; I'm hoping it's saved again--it's had many lives since Twain built it and went bankrupt.</p>]]></content:encoded>
      <pubDate>Mon, 14 Jul 2008 06:45:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/hartford">hartford</category>
      <category domain="http://securityratty.com/tag/portland">portland</category>
      <category domain="http://securityratty.com/tag/city-wide wi-fi">city-wide wi-fi</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/business phone">business phone</category>
      <category domain="http://securityratty.com/tag/phone">phone</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/business-grade wireless availability">business-grade wireless availability</category>
      <category domain="http://securityratty.com/tag/free hour">free hour</category>
      <source url="http://wifinetnews.com/archives/008394.html">Wee-Fi: Sprint Treo 800w, New Wireless in Portland (Ore.), Hartford (Conn.) Fail</source>
    </item>
    <item>
      <title><![CDATA[Fort Lewis soldiers exposed by laptop theft]]></title>
      <link>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</link>
      <guid>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08 (UPDATED 7/11/08 - Laptop with information about soldier found; Lacey teen arrested

Organization
United States Army
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usarmy.jpg" width="88" align="right" height="119"><font size="2"><b>Date Reported: </b><br>7/9/08 (UPDATED 7/11/08 - </font><a href="http://www.theolympian.com/377/story/504243.html">Laptop with information about soldier found; Lacey teen arrested</a>)<br><font size="2"><br><b>Organization: </b><br><a href="http://www.army.mil/">United States Army</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.lewis.army.mil/index.asp">Fort Lewis</a>*<br><font size="1"><br>*The principal Fort Lewis maneuver units are the 1st Brigade, 25th Infantry Division and the 3d Brigade, 2nd Infantry Division. It is also home to the 593d Corps Support Group, the 555th Engineer Group, the 1st MP Brigade (Provisional), the I Corps NCO Academy, Headquarters, Fourth ROTC Region, the 1st Personnel Support Group, 1st Special Forces Group (Airborne), 2d Battalion (Ranger), 75th Infantry, and Headquarters, 5th Army (West).&nbsp; Fort Lewis has more than 25,000 soldiers and civilian workers, source: <a href="http://www.lewis.army.mil/about-ft-lewis.asp">About Fort Lewis</a> </font><br><br><span style="font-weight: bold;">Victims:</span><br>Soldiers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~800 - 900<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.king5.com/localnews/stories/NW_070808WAB_soldiers_ID_theft_KC.3e0bcdc6.html">KING Channel 5 News</a> <br><a href="http://www.thenewstribune.com/news/local/story/409911.html">Tacoma News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Elisa Hahn, KING Channel 5 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials.<br><br>In this case, an Army employee told Lacey police he left the laptop and a 500-gigabyte removable hard drive on the seat of his Dodge truck, parked unlocked in front of his house overnight July 3<br><span style="font-style: italic;">[Evan] Storing personal information on removable devices such as laptops, external hard drives and flash drives without encryption, strike one.&nbsp; Moving the mobile device outside of a controlled area is strike two.&nbsp; Leaving the mobile device overnight in an unlocked vehicle in plain sight of passers-by is an emphatic strike three.</span><br><br>He reported them stolen about 10 a.m. on July 4.<br><span style="font-style: italic;">[Evan] A soldier's personal information stolen on the day our country celebrates our independence is insulting.</span><br><br>A post spokeswoman said officials were notifying the involved soldiers out of concern that the case might put them at risk for identity theft.<br><br>the Army began no later than Wednesday notifying the affected soldiers through e-mail and phone calls. They’ll get follow-up letters.<br><br>Officials said the employee, a civilian military personnel specialist, appears to have violated Army standards and policies for protecting personal information and government property.<br><br>Army laptops and removable storage devices containing personal information are generally restricted to on-post workplaces but can be signed out with a supervisor’s permission.<br><br>They’re also supposed to be password-protected and personal information is supposed to be encrypted<br><br>The Army is assisting Lacey police with the theft investigation and conducting its own review, said Catherine Caruso, a Fort Lewis spokeswoman.<br><br>"We’re not releasing anything more about what information was inappropriately compromised or about the soldiers whose information was involved," Caruso said.<br><br>"Clearly it was personal information regarding 800 to 900 soldiers from Fort Lewis. Beyond that, we’d rather not specify."<br><br>there was no classified, secret or top-secret information on the laptop and the hard drive.<br><br>Caruso said the employee was working on a project regarding a particular unit at a location other than his office.<br><br>She said "it would be inappropriate to speculate" about what potential disciplinary action the worker might face if he is found to have broken security rules.<br><span style="font-style: italic;">[Evan] It is probably inappropriate to speculate, but you know we will anyway.&nbsp; My guess is that there is another person looking for a job in the Olympia, Washington area.</span><br><br>Since the theft, post officials have set new training requirements for military personnel staff and prepared a memo for each employee to sign outlining the safeguarding and reporting requirements<br><br><span style="font-weight: bold;">Commentary:</span><br>When someone's poor judgment creates unnecessary risk to military personnel it carries a little more weight for me.&nbsp; These men and women give everything to protect us.&nbsp; Without them I wouldn't be able to write this, and without them you wouldn't be able to read it. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>United States Army:<br>June, 2008 - <a href="http://breachblog.com/2008/06/03/walterreed.aspx">Walter Reed Army Medical Center breach through P2P</a> <br>April, 2008 - <a href="http://breachblog.com/2008/04/13/usaasc.aspx%20">Excel Spreadsheet on the web exposes Army officers and civilians</a> <br><br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/11/usarmy.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 09:44:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fort lewis soldiers">fort lewis soldiers</category>
      <category domain="http://securityratty.com/tag/soldiers">soldiers</category>
      <category domain="http://securityratty.com/tag/fort lewis">fort lewis</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/lacey police officials">lacey police officials</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/army">army</category>
      <category domain="http://securityratty.com/tag/army standards">army standards</category>
      <source url="http://breachblog.com/2008/07/11/usarmy.aspx">Fort Lewis soldiers exposed by laptop theft</source>
    </item>
    <item>
      <title><![CDATA[Laptop stolen from the home of a BearingPoint employee]]></title>
      <link>http://securityratty.com/article/cdacc39a32caa98a264d6e52be4b661f</link>
      <guid>http://securityratty.com/article/cdacc39a32caa98a264d6e52be4b661f</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/5/08

Organization
BearingPoint, Inc

Contractor/Consultant/Branch
None

Victims
Independent BearingPoint contractors

Number Affected
Unknown

Types...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/bearingpoint.jpg" width="166" align="right" height="81"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/5/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.bearingpoint.com/portal/site/bearingpoint">BearingPoint, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Independent BearingPoint contractors<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"first and last name and Social Security Number"<br><br><span style="font-weight: bold;">Breach Description:</span><br>On May 14, 2008 a BearingPoint company-issued laptop was stolen from the residence of an employee.&nbsp; The laptop contained sensitive personal information belonging to a number of BearingPoint independent contractors.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-153117.pdf">The Maryland State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Maryland State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>BearingPoint recognizes the importance of safeguarding the personal information it handles in the course of conducting business.<br><span style="font-style: italic;">[Evan] As demonstrated on their web site.&nbsp; The number "8" followed by "The number of years in a row that identity theft has been the #1 internet crime"</span><br><br><img src="http://images.quickblogcast.com/95781-88451/8.jpg" width="576" border="0"><br><br><br><img src="http://images.quickblogcast.com/95781-88451/8y.jpg" width="576" border="0"><br><br>To that end, we have implemented safeguards for the information.<br><span style="font-style: italic;">[Evan] OK, I am following so far.</span><br><br>Even the most rigorous safeguards, however, can not guarantee protection against criminal conduct.<br><span style="font-style: italic;">[Evan] Well, I think "rigorous safeguards" needs to be quantified somewhat.&nbsp; What are "rigorous safeguards" and how do they apply to this breach?</span><br><br>The Company was recently victimized by such conduct and we are writing to inform you that this criminal conduct might have a direct impact on you.<br><span style="font-style: italic;">[Evan] Uh oh, here it comes.&nbsp; Not only was "The Company" recently victimized, but just as importantly, the owners of the personal information were victimized as well.</span><br><br>On May 14, 2008, the residence of one of our employees was burglarized and the company-issued laptop computer was taken amongst other personal property.<br><br>The employee promptly reported the theft to the Atlanta Police Department, which is investigating the break in.<br><br>The investigation into the burglary is on-going and BearingPoint is cooperating fully.<br><br>BearingPoint worked diligently to reconstruct the information stored on the stolen laptop.<br><br>BearingPoint has been able to determine that the computer contains the name and social security number of independent contractors.<br><span style="font-style: italic;">[Evan] Recognizing the importance of safeguarding personal information, is storing personal information on a laptop (presumably without encryption due to the fact that there is no mention of it) a prudent practice?</span><br><br>The stolen laptop did not contain credit or debit card numbers, or financial account numbers.<br><span style="font-style: italic;">[Evan] So a criminal would have to open his/her own accounts using the other information that WAS on the laptop.</span><br><br>We have no reason to believe that the information stored on the stolen laptop was the target of the burglary or that the information has been misused.<br><br>The personal information on the laptop can be accessed only with two passwords and two forms of authentication.<br><span style="font-style: italic;">[Evan] The "passwords" are the authentication.&nbsp; I am guessing that BearingPoint meant two forms of identification (probably usernames).&nbsp; Again, I am guessing that one of the username/passwords is for the operating system itself which takes less than 10 minutes to bypass in most instances and I am guessing that the other username/password combination is file access for which there are known workarounds in many common applications (Word, Excel, PowerPoint, etc.).&nbsp; Either way, I think that this excerpt is meant to minimize the situation with a strong bias towards saving face.</span><br><br>In addition, the personal information was not stored in a single file or spreadsheet but dispersed among numerous files.<br><span style="font-style: italic;">[Evan] Information security personnel know better than to argue the security through obscurity defense.</span><br><br>To date, we have received no report indicating that the information stored on the laptops has been accessed or misused.<br><span style="font-style: italic;">[Evan] I think "laptops" in the breach notification is a typo</span><br><br>BearingPoint recognizes this development, and any related inconvenience, might be upsetting.<br><br>We regret this incident has occurred and we apologize for any inconvenience it may cause you.<br><br>As a result of this incident, we have taken immediate steps to review our current policies and procedures to further enhance security for personal data we handle and to reduce the risk of recurrence.<br><span style="font-style: italic;">[Evan] Restrict ability to store confidential information on mobile devices?&nbsp; Encryption?&nbsp; Two-factor authentication?</span><br><br>To lessen the potential inconvenience to you and reduce the risk that you might be subjected to attempts to steal your identity, we have engaged ConsumerInfo.com Inc., and Experian company, to provide you with one year of credit monitoring, at no cost to you.<br><br>Please contact BPt-FMGOICPrivacy@bearingpoint.com should you have additional questions regarding the cirumstance of the incident.<br><br>BearingPoint currently anticipates notifying affected individuals on or before June 6, 2008, of this incident.<br><br><span style="font-weight: bold;">Commentary:</span><br>Marketing on the BearingPoint web site boasts "BearingPoint has demonstrated some of the biggest advancements in risk consulting services among the large number of providers in this market" - Forrester Wave: Risk Consulting Services, Q2, June 2007 Report.&nbsp; <br><br>It is disappointing to read about a well-respected company losing control of confidential information, but what makes this worse is the fact that it happened through the actions of a leading information security and risk consulting company.&nbsp; It is important to point out that one incident <span style="font-weight: bold;">DOES NOT</span> define a company. <br><br>No encryption or mention of it as a matter of policy, and the attempts to minimize the possible impact by mentioning ineffective controls (passwords and obscurity) is troubling. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/19/bearingpoint.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 19 Jun 2008 11:38:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/bearingpoint">bearingpoint</category>
      <category domain="http://securityratty.com/tag/store confidential information">store confidential information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/independent contractors">independent contractors</category>
      <source url="http://breachblog.com/2008/06/19/bearingpoint.aspx">Laptop stolen from the home of a BearingPoint employee</source>
    </item>
    <item>
      <title><![CDATA[Walter Reed Army Medical Center breach through P2P]]></title>
      <link>http://securityratty.com/article/9729c053ac7d1be346029b81accc1754</link>
      <guid>http://securityratty.com/article/9729c053ac7d1be346029b81accc1754</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/2/08

Organization
United States Army

Contractor/Consultant/Branch
Walter Reed Army Medical Center (&quot;WRAMC

Victims
Military Health System...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/walterreed.jpg" align="right" height="107" width="197"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/2/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.army.mil/">United States Army</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.wramc.amedd.army.mil/Pages/default.aspx">Walter Reed Army Medical Center ("WRAMC")</a> <br><br><span style="font-weight: bold;">Victims:</span><br>"Military Health System beneficiaries" or patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"Names, Social Security numbers, birth dates and other information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"WASHINGTON (AP) — Sensitive information on about 1,000 patients at Walter Reed Army Medical Center and other military hospitals was exposed in a security breach, sparking identity theft concerns and an investigation by the Army."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wramc.amedd.army.mil/Lists/WRNews/DispForm.aspx?Id=68&amp;">Walter Reed Army Medical Center News</a> <br><a href="http://ap.google.com/article/ALeqM5ggIYzqvXf4Qosf6ubPXxZRRAMPEAD9127N4O0">Associated Press</a> <br><a href="http://www.wishtv.com/Global/story.asp?S=8413762">WISH TV Channel 8 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Walter Reed Army Medical Center<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>WASHINGTON (AP) — Sensitive information on about 1,000 patients at Walter Reed Army Medical Center and other military hospitals was exposed in a security breach, sparking identity theft concerns and an investigation by the Army.<br><br>Names, Social Security numbers, birth dates and other information was released, hospital officials said Monday.<br><span style="font-style: italic;">[Evan] This information belongs mostly to military personnel that were patients of WRAMC.&nbsp; The victims are the people that defend this country.&nbsp;&nbsp; Grrr.</span><br><br>The computer file that was breached did not include information such as medical records, or the diagnosis or prognosis for patients, they said.<br><br>Walter Reed officials declined to explain exactly how the information was compromised, pending an ongoing investigation by the hospital and the Army.<br><span style="font-style: italic;">[Evan] There is more insight into the cause of the breach below.&nbsp; Keep reading.</span><br><br>Preliminary results of an on-going investigation have identified a computer from which the data was apparently compromised.<br><br>Data security personnel from Walter Reed and the Department of the Army continue to investigate the source and causes for the information compromise.<br><br>The medical center learned of the breach on May 21 from an outside data mining company, which officials did not identify.<br><br>the company was working for another client, found the file and contacted Walter Reed.<br><br>The hospital said it is working to notify all of the people named in the data file. Letters or e-mails were being sent out, beginning Monday.<br><br>The chairman of the House Armed Services Committee, Rep. Ike Skelton, D-Mo., said he wants to hear from the Army about its investigation.<br><br>"It's very troubling when private data is inappropriately released," Skelton said. "We must ensure that personal information is protected and prevent any future compromise of patient records."<br><span style="font-style: italic;">[Evan] Obviously easier said than done.</span><br><br>Walter Reed plans to offer free credit protective services to patients whose information was revealed.<br><br>The hospital also has set up a hot line for people to call to see if their information was disclosed (1-877-854-8542, ext. 9).<br><br>The Health Insurance Portability and Accountability Act of 1996 protects patients from unauthorized release of their health records. The Walter Reed Army Medical Center has a robust information assurance program that meets all program standards and requirements. The compromised data file did not include protected health information such as medical records, diagnosis or prognosis for patients.<br><br><span style="font-weight: bold;">Message to "Team WRAMC" from COL Patty Horoho:</span><br>I want to ensure that each of you have an understanding of what may be in the papers regarding possible disclosure of personal data. Walter Reed officials were notified of a possible disclosure of personally identifiable information through a Peer to Peer (P2P) network of approximately 1000 Military Health System beneficiaries. The information did NOT contain any protected health information such as medical records, diagnosis or prognosis for patients. The individuals impacted have been identified and we are taking a proactive approach to contact them to assist in providing fraud protection services. Below is the media release we sent out will provide more details. A 24/7 hotline has been established in the Combined Operations Center, 202-782-8333 or 877-854-8542 ext 9 and a info site on the web page is also being created. <br><br>I need everyone to ensure that they are not loading or down loading programs that are not authorized by the command as it increases our vulnerability and possibly can cause a breach in protected information being shared. <br><br><span style="font-weight: bold;">Commentary:</span><br>So the cause of this breach was an unauthorized installation and configuration of a Peer to Peer (P2P) program.&nbsp; My concerns about this revolve around the ability to install the application and the inability of WRAMC personnel to block and/or detect the network traffic.&nbsp; <br><br>The installation of computer programs on a computer usually require elevated privileges such as administrative access.&nbsp; Are users of WRAMC information resources also administrators of their systems?&nbsp; If so, this is generally not a good idea.<br><br>P2P programs such as BitTorrent, Morpheus, Lime Wire, etc. are dependent upon a network to work, thus the "Peer to Peer".&nbsp; Most, if not all P2P network traffic is easy to block and/or detect with any combination of filtering, network access control and intrusion detection or prevention.&nbsp; Are these technologies not in use at WRAMC?<br><br>Lastly, what is WRAMC policy with respect to acceptable use and network access?&nbsp; There is no mention in the news reports. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>April, 2008 - <a href="http://breachblog.com/2008/04/13/usaasc.aspx">Excel Spreadsheet on the web exposes Army officers and civilians</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/03/walterreed.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 03 Jun 2008 05:14:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/walter reed">walter reed</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/wramc personnel">wramc personnel</category>
      <category domain="http://securityratty.com/tag/wramc">wramc</category>
      <category domain="http://securityratty.com/tag/network access control">network access control</category>
      <category domain="http://securityratty.com/tag/network access">network access</category>
      <category domain="http://securityratty.com/tag/team wramc">team wramc</category>
      <source url="http://breachblog.com/2008/06/03/walterreed.aspx">Walter Reed Army Medical Center breach through P2P</source>
    </item>
    <item>
      <title><![CDATA[Govt Earns C On Computer Security Report Card]]></title>
      <link>http://securityratty.com/article/9c92ed5dd8b6c26956c8f319590f87f1</link>
      <guid>http://securityratty.com/article/9c92ed5dd8b6c26956c8f319590f87f1</guid>
      <description><![CDATA[There was always that one kid in class. You know, the one that didnt always get it. Or spent most of the day staring out the window. Daydreaming knuckle heads that were nowhere near inclined to excel....]]></description>
      <content:encoded><![CDATA[<p><center><img src="http://www.liquidmatrix.org/blog/wp-content/uploads/2008/05/elbarto.png" alt="Bart Simpson" title="elbarto" width="250" height="381" /></center></p>
<p>There was always that one kid in class. You know, the one that didn&#8217;t always get it. Or spent most of the day staring out the window. Daydreaming knuckle heads that were nowhere near inclined to excel. Well, it appears that they US gov&#8217;t is one of those kids. Well, on average anyway.</p>
<p>From the Washington Post:</p>
<blockquote><p>The federal government earned an overall grade of &#8220;C&#8221; for securing its computer systems and networks from cyber attack last year, a slight improvement from the &#8220;C-minus&#8221; mark the government was given in 2006.</p>
<p>The report cards were issued today by Rep. Tom Davis of Virginia, the ranking Republican on the House Committee on Oversight and Government Reform.</p>
<p>Nine agencies earned failing grades for 2007, including the departments of Agriculture, Commerce, Defense, Interior, Labor, Transportation, Treasury, Veterans Affairs, as well as the Nuclear Regulatory Commission. The grades are based on data submitted by the agencies and agency inspector generals to the White House for fiscal year 2007. </p></blockquote>
<p>There are a couple bright spots. The DOJ, SSA, EPA and the GSA were among eight agencies that managed to score an &#8220;A&#8221; on their report card. <i>They</i> get to go to McDonald&#8217;s.</p>
<p>But, the NRC gets no hot apple pie with their happy meal.</p>
<p><a href="http://blog.washingtonpost.com/securityfix/2008/05/govt_earns_grade_of_c_for_comp.html">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=X0hmdo"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=X0hmdo" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=l20mDH"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=l20mDH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=V3SZnh"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=V3SZnh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=I6zhZh"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=I6zhZh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=YpKv5h"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=YpKv5h" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=Ly34Uh"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=Ly34Uh" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/294605824" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 18:46:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/government reform">government reform</category>
      <category domain="http://securityratty.com/tag/report card">report card</category>
      <category domain="http://securityratty.com/tag/federal government">federal government</category>
      <category domain="http://securityratty.com/tag/hot apple pie">hot apple pie</category>
      <category domain="http://securityratty.com/tag/agency inspector generals">agency inspector generals</category>
      <category domain="http://securityratty.com/tag/agencies">agencies</category>
      <category domain="http://securityratty.com/tag/couple bright spots">couple bright spots</category>
      <category domain="http://securityratty.com/tag/nuclear regulatory commission">nuclear regulatory commission</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/294605824/">Govt Earns C On Computer Security Report Card</source>
    </item>
    <item>
      <title><![CDATA[Three Essays on Muni-Fi You Should Read]]></title>
      <link>http://securityratty.com/article/45037ba4b3a574e07b9a0a98bfb0b3cc</link>
      <guid>http://securityratty.com/article/45037ba4b3a574e07b9a0a98bfb0b3cc</guid>
      <description><![CDATA[In the aftermath of the last man standing, MetroFi, announcing its metro-scale Wi-Fi endgame, three useful essays have appeared: If you're trying to understand the past, present, and future of the...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" />In the aftermath of the last man standing, MetroFi, announcing its metro-scale Wi-Fi endgame, three useful essays have appeared: If you're trying to understand the past, present, and future of the space, I recommend you read these short opinion pieces.</p>

<p>First, Karl Edwards of Excelsio, a firm that consults on municipal broadband, <a href="http://www.muniwireless.com/2008/05/20/what-went-wrong-with-muni-wi-fi-what-cities-can-do-now/"><strong>lays out a pretty straight case</strong></a> as to why EarthLink, Kite, and MetroFi's networks, among other one-offs, were designed to fail. I've written about aspects of this over the last four years, but Edwards is succinct. In part, EarthLink offering to build Philadelphia's network at no cost to the city set the mold wrong for all networks to follow. We're resetting now, and Wi-Fi's moment may have passed. </p>

<p>Edwards offers as one the constraints set by cities, "Expectation that the network would cover 90-95% of the City with wireless coverage as opposed to just in the areas where there was a solid business case." This has been a problem I've had for a couple of years when it started to become clear that 90-plus percent coverage wasn't in the interest of the ISP--nor in the city's interest because these networks couldn't be completed.</p>

<p>Edwards also notes that when consulting for Grand Rapids, Mich., which chose Clearwire as its wireless partner, EarthLink told the city that they expected a conservative 22-percent uptake for their Wi-Fi service by end of the fourth year. Given that in mature markets, a high-single-digit uptake is considered very good, that's shows how the Excel spreadsheets were skewed. USI Wireless's estimates for break-even require less than 10 percent of the population in their covered areas to subscribe, and their numbers of subscribers to date are tracking that number closely.</p>

<p>He closes with a set of eight principles for wireless network builders to come to the table with and cities to adopt, all of which I agree with.</p>

<p>Next, <a href="http://www.muniwireless.com/2008/05/17/how-sf-and-other-cities-could-have-created-citywide-wi-fi-access-the-easy-way/"><strong>Esme Vos suggests a very modest proposal:</strong></a> San Francisco should have required all its cafes to offer free Wi-Fi, and then Fon or others could have aggregated and bundled access to these locations. There's a long set of comments accusing Esme of communism, socialism, utopianism, and other isms. The post and the comments make for lively reading.</p>

<p>Finally, Craig Plunkett, who operates hotspot networks around New York City and Long Island, chimes in with a summary of these opinions and the notion that <a href="http://www.cedx.com/2008/05/when-did-muniwi.html?cid=115472508#comment-115472508"><strong>muni-Fi jumped the shark</strong></a> when Ocean City, N.J., decided to put Wi-Fi in garbage cans. He points out that "an infill strategy" of providing service where needed and then extending from there is effective.</p>]]></content:encoded>
      <pubDate>Tue, 20 May 2008 08:50:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ocean city">ocean city</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi service">wi-fi service</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/york city">york city</category>
      <category domain="http://securityratty.com/tag/offer free wi-fi">offer free wi-fi</category>
      <category domain="http://securityratty.com/tag/percent">percent</category>
      <category domain="http://securityratty.com/tag/city set">city set</category>
      <category domain="http://securityratty.com/tag/90-plus percent coverage">90-plus percent coverage</category>
      <source url="http://wifinetnews.com/archives/008327.html">Three Essays on Muni-Fi You Should Read</source>
    </item>
  </channel>
</rss>
