<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: expensive]]></title>
    <link>http://securityratty.com/tag/expensive</link>
    <description></description>
    <pubDate>Sun, 07 Sep 2008 03:30:15 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Of Planes and Ships]]></title>
      <link>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</link>
      <guid>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</guid>
      <description><![CDATA[Tom Barnett is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.thomaspmbarnett.com/weblog/2008/09/column_121.html">Tom Barnett</a> is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the &quot;nail it to the wall&quot; quote at the end):</p><p><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">One of the main problems in counterterrorism today is that there are so many people and vehicles, and so much data and material, moving through globalization&#39;s myriad networks that it seems virtually impossible to track it all effectively. Nowhere has this problem been more acute than on the high seas.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">In 2006, Adm. Harry Ulrich, then U.S. commander of NATO Naval Forces Europe, decided to do something about it. Despite having virtually no resources, his dream was to transpose the global air-traffic control system onto sea traffic.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Worldwide, aircraft are transparent, because they&#39;re all required to carry an identification beacon that allows them to be tracked leaving and entering airports, and monitored between airports, by a global network of sensors. Act suspiciously and somebody&#39;s fighter aircraft will soon be on your tail.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">No such pervasive system currently exists globally for maritime traffic. While bigger ships carry an ID beacon similar to aircraft, without a shared monitoring network, that&#39;s like tracking only selected commercial jets and giving everyone else a pass.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">So Ulrich, upon taking command, asked a simple question: &quot;If we can do that in the air, why can&#39;t we do it on the sea?&quot; He made a point of pioneering his sea-traffic-control effort first inside the Mediterranean, where NATO&#39;s southern naval forces have historically been concentrated, but his real target was waters off Africa -- the most ungoverned maritime space in the world.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich knew the U. S. Navy couldn&#39;t do it alone, much less bring Africa&#39;s meager coast-guard-like navies up to snuff so they could do it on their own. So he quickly created a network of assets -- both public and private -- to manage that space, modeling his monitoring system on international air-traffic control.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich began stitching together a network of shore-based sensors ringing the Mediterranean. His naval command then began initial monitoring by tapping into the International Maritime Organization&#39;s existing Automated Identification System, transforming NATO&#39;s ability to track ship traffic in the Med.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Almost overnight, NATO went from tracking dozens of ships on the Mediterranean to thousands, and instead of getting the data sometimes up to 72 hours late, now the contacts were being tracked in one to five minutes -- to an accuracy within 50 feet on the earth&#39;s surface.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When the classic big-firm systems integrators told Ulrich it would be too costly to pull it off, the admiral turned to the Volpe Center in Cambridge, Massachusetts, a U.S. Department of Transportation research center. Instead of hundreds of millions of dollars, Ulrich&#39;s initial network cost $900,000. The shore-based receivers are small, roughly the size of a radar dish you might find on a pleasure craft.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The strength of the system is a function of its reach: the more countries join, the larger the shared operational picture. By the time Ulrich retired at the end of 2007, he had enlisted 32 countries throughout the Mediterranean, the North Atlantic, along the west coast of Africa, around the Black Sea, and in the Pacific. Today, the network continues to spread around the planet.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; font-size: 14px; line-height: 20px; "><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">With Ulrich&#39;s system in place, local police, coast guards, and border patrols catch most bad guys, obviating American military responses. As Harry told me for an article I wrote about his work in a fall 2007 issue of Esquire, </span><span style="font-weight: bold; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">&quot;I don&#39;t do defense; I do security. When you talk defense, you talk containment and mutually assured destruction. When you talk security, you talk collaboration and networking. This is the future.&quot;</span></span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The admiral&#39;s legacy program, the Maritime Safety and Security Information System, earned the Volpe Center a prestigious &quot;Innovations in American Government&quot; award this month from Harvard University&#39;s Ash Institute for Democratic Governance and Innovation.</span></p></blockquote><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Security Collaboration + Networking &#160;= Federation. This is indeed the future - SAML came along just at the nick of time.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When you assume that to do access control you must have &quot;Complete Mediation&quot; in Saltzer and Schroeder&#39;s terms of the subject (users), the objects (data), the session, and the roles, then you are going to have an interesting life trying to deliver anything. And if you do it will mucho expensive.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">if you take the federated autonomous nodes approach, agree upon an attribute schema plus a protection model for same, and basic protocol, you are then free to move about the country. Security doesn&#39;t have to equal centralization or high cost. Get the attributes from point a to point b securely.</span></div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 19:04:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security architect">security architect</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/identification system">identification system</category>
      <category domain="http://securityratty.com/tag/initial network cost">initial network cost</category>
      <category domain="http://securityratty.com/tag/initial">initial</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/ulrich">ulrich</category>
      <category domain="http://securityratty.com/tag/time ulrich">time ulrich</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/of-planes-and-ships.html">Of Planes and Ships</source>
    </item>
    <item>
      <title><![CDATA[Network World Coverage of ScienceLogic at Interop]]></title>
      <link>http://securityratty.com/article/27b0a46be99117829b3a5801b8947a5d</link>
      <guid>http://securityratty.com/article/27b0a46be99117829b3a5801b8947a5d</guid>
      <description><![CDATA[We were all really excited to have the opportunity to illuminate Sevick and Wetzel about ScienceLogics value proposition at Interop
Yesterday, they posted a terrific blog post about what they saw at...]]></description>
      <content:encoded><![CDATA[<p>We were all really excited to have the opportunity to illuminate Sevick and Wetzel about ScienceLogic’s value proposition at Interop.
<p>Yesterday, they <a href="http://www.networkworld.com/community/node/33059" target="_blank">posted a terrific blog post</a> about what they saw at Interop. Fortunately, ScienceLogic was one of the technologies that they highlighted from the show. I have written earlier posts about <a href="http://blog.sciencelogic.com/whats-up-with-the-washington-posts-biz-section-coverage-of-local-business/05/2008" target="_blank">how difficult it has been</a> to gain smart, insightful coverage for our solutions with technology media.
<p>I have to say that they really got it! And it feels so good. We know that we have a bit of a hidden gem of a product here at ScienceLogic and will be working overtime in the coming months to take our business and products to a “Blue Ocean” environment that will shock and surprise many others in the media. However Sevick and Wetzel will be amongst the first to get a close-up on why and how we will deliver a new paradigm to this marketplace in 2009!
<p>A few excerpts from their post:<br />
<blockquote>
<p>“We noticed yet more specialty network management vendors, leading us to wonder how the market can support such a plethora of them, and we felt empathy for IT teams that have to master yet more interfaces.”
<p>“Application performance management and application acceleration vendors were well represented. Such products play well in today’s climate because they allow enterprises to get the most out of existing IT investments instead of buying more “stuff”. One particularly interesting vendor we talked to was <a href="http://www.sciencelogic.com/">ScienceLogic</a>. They are integrating IT infrastructure and application monitoring into a single, not-very-expensive platform that will serve mainstream business well. This is smart, and we predict they will give the CA’s, BMC’s, HP’s and IBM’s of the world a run for their money.”</p>
</blockquote>
<p>&nbsp;
<p>Check out the <a href="http://www.networkworld.com/community/node/33059" target="_blank">blog post here</a> and keep <a href="http://www.networkworld.com/community/appview" target="_blank">App Performance View</a> on your radar..<a href="http://www.networkworld.com/community/node/33059"></a></p>
]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 11:36:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/terrific blog post">terrific blog post</category>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/application acceleration vendors">application acceleration vendors</category>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/blog post">blog post</category>
      <category domain="http://securityratty.com/tag/sciencelogic">sciencelogic</category>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/application performance management">application performance management</category>
      <source url="http://blog.sciencelogic.com/network-world-coverage-of-sciencelogic-at-interop/09/2008">Network World Coverage of ScienceLogic at Interop</source>
    </item>
    <item>
      <title><![CDATA[Two Copycat Web Malware Exploitation Kits in the Wild]]></title>
      <link>http://securityratty.com/article/59660edd6ee56561c03dbddbfcbaac92</link>
      <guid>http://securityratty.com/article/59660edd6ee56561c03dbddbfcbaac92</guid>
      <description><![CDATA[We're slowly entering into &quot;can you find the ten similarities&quot; stage in respect to web malware exploitation kits, and their coders continuous supply of copycat malware kits under different names,...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SNqBEcPBZZI/AAAAAAAACLA/AJVrNj6P8JE/s1600-h/zopa01.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SNqBEcPBZZI/AAAAAAAACLA/of0mCvvFn4o/s200-R/zopa01.JPG" /></a>We're slowly entering into "can you find the ten similarities" stage in respect to web malware exploitation kits, and their coders continuous supply of copycat malware kits under different names, taking advantage of different exploits combination. <a href="http://ddanchev.blogspot.com/2008/09/copycat-web-malware-exploitation-kits.html">Copycat web malware exploitation kits are faddish</a>, however, from a strategic perspective, releasing exploits kits like this one <a href="http://www.trustedsource.org/blog/153/Rise-Of-The-PDF-Exploits">covered by Trustedsource</a>, consisting entirely of PDF exploits, can greatly increase the exploitability level of Adobe vulnerabilities in general.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SNqC_oeGqgI/AAAAAAAACLI/tCvdE7XRFt4/s1600-h/zopa02.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SNqC_oeGqgI/AAAAAAAACLI/iSGUOgS9ZUg/s200-R/zopa02.JPG" /></a>A similar web malware exploitation kit, once again using only Adobe related exploits is Zopa. Have you seen this layout before? That's the very same layout <a href="http://ddanchev.blogspot.com/2007/10/mpack-and-icepack-localized-to-chinese.html">MPack</a> and <a href="http://ddanchev.blogspot.com/2007/07/icepack-malware-kit-in-action.html">IcePack</a> were using, were in the sense of cybercriminals preferring to use much mode modular alternatives these days. Ironically, Zopa is more expensive than MPack and IcePack, with the coder trying to cash-in on its biased exclusiveness and introduction stage buzz generated around it.<br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://1.bp.blogspot.com/_wICHhTiQmrA/SNqFtIcwL7I/AAAAAAAACLQ/ZTdoCdSNYbA/s1600-h/stats_copycat_kit.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="http://1.bp.blogspot.com/_wICHhTiQmrA/SNqFtIcwL7I/AAAAAAAACLQ/aGd-dPNq3TY/s200-R/stats_copycat_kit.jpg" width="151" /></a>The second web malware exploitation kit is relying on a mix of exploits targeting patched vulnerabilities affecting IE, Firefox and Opera, with its authors asking for $50 for monthly updates, updates of what yet remains unknown. Both of these kits once again demonstrate the current&nbsp; mentality of the kit's coders having to do with -- thankfully -- zero innovation, fast cash and no long-term value.<br />
<br />
However, modularity, convergence with traffic management kits, vertical integration with cybercrime services and bullet proof hosting providers, advanced metrics, <a href="http://securitylabs.websense.com/content/Blogs/3183.aspx">evasive practices</a>, improved OPSEC (operational security), and dedicated cybercrime campaign optimizing staff, are all in the works.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/08/web-based-botnet-command-and-control.html">Web  Based Botnet Command and Control Kit 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/diy-botnet-kit-promising-eternal.html">DIY  Botnet Kit Promising Eternal Updates</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/pinch-vulnerable-to-remotely.html">Pinch  Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/06/zeus-crimeware-kit-vulnerable-to.html">The  Zeus Crimeware Kit Vulnerable to Remotely Exploitable Flaw</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/small-pack-web-malware-exploitation-kit.html">The  Small Pack Web Malware Exploitation Kit</a><br />
<a href="http://ddanchev.blogspot.com/2008/04/crimeware-in-middle-zeus.html">Crimeware  in the Middle - Zeus</a><br />
<a href="http://ddanchev.blogspot.com/2006/11/nuclear-grabber-toolkit.html">The  Nuclear Grabber Kit</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">The  Apophis Kit</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/firepack-exploitation-kit-localized-to.html">The  FirePack Exploitation Kit Localized to Chinese</a><span style="font-weight: bold;"><br />
</span><a href="http://ddanchev.blogspot.com/2007/10/mpack-and-icepack-localized-to-chinese.html">MPack  and IcePack Localized to Chinese</a><br />
<span style="font-weight: bold;"><span style="font-weight: bold;"></span></span><a href="http://ddanchev.blogspot.com/2008/05/icepack-exploitation-kit-localized-to.html">The  Icepack Exploitation Kit Localized to French</a> <br />
<a href="http://ddanchev.blogspot.com/2008/04/firepack-exploitation-kit-part-two.html">The  FirePack Exploitation Kit - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/firepack-web-malware-exploitation-kit.html">The  FirePack Web Malware Exploitation Kit</a><br />
<a href="http://ddanchev.blogspot.com/2007/05/webattacker-in-action.html">The  WebAttacker in Action</a><br />
<a href="http://ddanchev.blogspot.com/2007/08/nuclear-malware-kit.html">Nuclear  Malware Kit</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/random-js-malware-exploitation-kit.html">The  Random JS Malware Exploitation Kit</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/metaphisher-malware-kit-spotted-in-wild.html">Metaphisher  Malware Kit Spotted in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2007/04/shots-from-malicious-wild-west-sample_7672.html">The  Black Sun Bot</a><br />
<a href="http://ddanchev.blogspot.com/2007/04/shots-from-malicious-wild-west-sample_20.html">The  Cyber Bot</a><br />
<a href="http://ddanchev.blogspot.com/2007/09/google-hacking-for-mpacks-zunkers-and.html">Google  Hacking for MPacks, Zunkers and WebAttackers</a><br />
<a href="http://ddanchev.blogspot.com/2007/07/icepack-malware-kit-in-action.html">The  IcePack Malware Kit in Action</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=H3UxL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=H3UxL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=p3TZL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=p3TZL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=h2h0l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=h2h0l" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=LBCnl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=LBCnl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ntatL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ntatL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=AnrYL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=AnrYL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=0AlHl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=0AlHl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/402081047" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 10:28:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/diy botnet kit">diy botnet kit</category>
      <category domain="http://securityratty.com/tag/kit">kit</category>
      <category domain="http://securityratty.com/tag/nuclear malware kit">nuclear malware kit</category>
      <category domain="http://securityratty.com/tag/icepack exploitation kit">icepack exploitation kit</category>
      <category domain="http://securityratty.com/tag/nuclear grabber kit">nuclear grabber kit</category>
      <category domain="http://securityratty.com/tag/apophis kit">apophis kit</category>
      <category domain="http://securityratty.com/tag/malware exploitation kit">malware exploitation kit</category>
      <category domain="http://securityratty.com/tag/kits">kits</category>
      <category domain="http://securityratty.com/tag/control kit">control kit</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/402081047/two-copycat-web-malware-exploitation.html">Two Copycat Web Malware Exploitation Kits in the Wild</source>
    </item>
    <item>
      <title><![CDATA[Eye-Fi Adds Upgrade Track at Yearly Fee]]></title>
      <link>http://securityratty.com/article/3e1647519eaf22ed342316fc64fccf49</link>
      <guid>http://securityratty.com/article/3e1647519eaf22ed342316fc64fccf49</guid>
      <description><![CDATA[The Wi-Fi sharing digital memory card Eye-Fi adds another option for its product line: If you've purchased or plan to purchase an Eye-Fi, starting 5-Oct-2008, you can upgrade the model of card you...]]></description>
      <content:encoded><![CDATA[<p><strong><a href="http://www.eye.fi/news/press-releases/">The Wi-Fi sharing digital memory card Eye-Fi adds another option for its product line:</a></strong> If you've purchased or plan to purchase an Eye-Fi, starting 5-Oct-2008, you can upgrade the model of card you purchased by paying a yearly subscription fee. This provides more of a try-and-see mode for Eye-Fi's slightly more expensive offerings.</p>

<p>Eye-Fi divided its Wi-Fi SD card line-up into three parts earlier in the year: Home, which transfers to a computer ($80); Share, which uploads to a computer and to Eye-Fi's servers, which relay them to gallery, print, and social services ($100); and Explore, which ties in Wi-Fi positioning and one year of a Wayport hotspot subscription for uploads ($130). I wrote <strong><a href="http://wifinetnews.com/archives/008418.html">a long review of the Eye-Fi Explore</a></strong> on 12-Aug-2008.</p>

<p><img src="http://wifinetnews.com//images/2008/eye-fi_cards_sharer_sm.jpg" align="right"/>If you bought a Home, you can upgrade to the Share service for $10 per year, and if you bought either a Home or Share, you can add geotagging for $15 per year and hotspot access for $15 per year. It's a smart move, since original Eye-Fi card buyers already had a firmware upgrade that converted their card into a Share model; they'll now be able upgrade to the full featureset. This is something I thought the company was offering at launch months ago, and I speculated it would be easy to add.</p>

<p>Eye-Fi also added two new photo sharing services: Apple's MobileMe and AdoramaPix. I cannot think of any other firm that Apple has partnered with to allow direct MobileMe uploads, although this may be technically less a big deal than it sounds. But I believe it's unique--only the iPhone and iPhoto software can transfers images into MobileMe's galleries; I'll need to investigate further. It's a good feather in Eye-Fi's cap.</p>

<p>Finally, Eye-Fi says they'll release tweaked firmware on 5-Oct as well that will double the speed of photo transfers from their cards to a computer on the local network.</p>]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 18:07:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/eye-fi">eye-fi</category>
      <category domain="http://securityratty.com/tag/upgrade">upgrade</category>
      <category domain="http://securityratty.com/tag/eye-fi explore">eye-fi explore</category>
      <category domain="http://securityratty.com/tag/explore">explore</category>
      <category domain="http://securityratty.com/tag/direct mobileme uploads">direct mobileme uploads</category>
      <category domain="http://securityratty.com/tag/share service">share service</category>
      <category domain="http://securityratty.com/tag/mobileme">mobileme</category>
      <category domain="http://securityratty.com/tag/share">share</category>
      <category domain="http://securityratty.com/tag/transfers">transfers</category>
      <source url="http://wifinetnews.com/archives/008453.html">Eye-Fi Adds Upgrade Track at Yearly Fee</source>
    </item>
    <item>
      <title><![CDATA[When to shred: Purging data saves money, cuts legal risk]]></title>
      <link>http://securityratty.com/article/9e7ec6f8eac986e48f11cf91994a2341</link>
      <guid>http://securityratty.com/article/9e7ec6f8eac986e48f11cf91994a2341</guid>
      <description><![CDATA[Many organizations hang on to more data than they need, for much longer than they should. They pay millions of dollars for e-discovery, litigation that didn't have to happen or just plain expensive...]]></description>
      <content:encoded><![CDATA[Many organizations hang on to more data than they need, for much longer than they should. They pay millions of dollars for e-discovery, litigation that didn't have to happen or just plain expensive storage costs.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:961c0c899caaed942216f6c3f93d84b0:4uF%2FNhG7EmGu1TMgdYPOENR3sqw%2BIEqymIoWYtCMmJ5F5Mx3NvDns66YGGL3jVl9xUOlC%2FEXDpt%2BqL4EyPnuZHzFmj8rViFKjfHJdCgRalA%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:bd238b99de8aadf7de9138bb2c012061:rSt57f8wxaOWN%2BjYCYmXPmFOh2%2BgzeQIHnHZdqx%2FxleA%2BQajU17n3LnT0jbHB6nZ%2BanvFqBZktoytQWibseNwr01KZ7lTpgcODIwBtV7FeM%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:cce3186aed653352d648a48a86f43a64:JRGjGKzK5I5jv%2BKeds4UMCeJOHkmRo%2Ferggcg5LUFw1%2BivQbL1PKM5l4mL5CPOPY1lIZK35kPwcAUWWmr5vc3gb7Mz2Sbr485cRr9eft%2FVI%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:7ad3a3e4f473f098b89ed81714e2f03f:EuJ6MiZRriwYiiaMQhI4Dmo2D4VVcmc7mPolD1TWVCjEDfqPbBqGSQFQAxeGieJ9cyuVBqlXW9z3Az8PTQkh7s36NJSUzUIq9SkWIk8%2FQHA%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>      <a href="http://www.pheedo.com/click.phdo?s=db9637313069acd35a7ee84f8bb5d1fa"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=db9637313069acd35a7ee84f8bb5d1fa"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=db9637313069acd35a7ee84f8bb5d1fa" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 03:45:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/organizations hang">organizations hang</category>
      <category domain="http://securityratty.com/tag/e-discovery">e-discovery</category>
      <category domain="http://securityratty.com/tag/dollars">dollars</category>
      <category domain="http://securityratty.com/tag/millions">millions</category>
      <category domain="http://securityratty.com/tag/litigation">litigation</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=db9637313069acd35a7ee84f8bb5d1fa">When to shred: Purging data saves money, cuts legal risk</source>
    </item>
    <item>
      <title><![CDATA[Live Blogging from GOVCERT.NL 2008 - David Rice Speaking]]></title>
      <link>http://securityratty.com/article/b812655ba5e022590908c261f54a40e8</link>
      <guid>http://securityratty.com/article/b812655ba5e022590908c261f54a40e8</guid>
      <description><![CDATA[So, David Rice of &quot;Geekonomics&quot; fame is speaking; the content is pretty much the same as the book, but he sure can speak! :-) [see my review of the book here

The message is the same: cybercrime is...]]></description>
      <content:encoded><![CDATA[So, <a href="http://www.geekonomicsbook.com/">David Rice of "Geekonomics" fame</a> is speaking; the content is pretty much the same as the book, but he sure can speak! :-)  [see my review of the book <a href="http://chuvakin.blogspot.com/2008/06/it-changed-my-life-my-review-of.html">here</a>]<br /><br />The message is the same: cybercrime is due to bad software; market motivates people to create bad software ("don't worry - be crappy" idea); market will fail to create secure software, etc.<br /><br />Result? The <span style="font-style: italic;">0wned world.<br /><br /></span>So, how to you make insecure software MORE expensive to create than secure software? Laws? Insurance? What else will help? Only time will tell...<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=MhPzL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=MhPzL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=7FZvL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=7FZvL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=UXbvL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=UXbvL" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/394005708" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 20:40:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/david rice">david rice</category>
      <category domain="http://securityratty.com/tag/secure software">secure software</category>
      <category domain="http://securityratty.com/tag/bad software">bad software</category>
      <category domain="http://securityratty.com/tag/market">market</category>
      <category domain="http://securityratty.com/tag/insecure software">insecure software</category>
      <category domain="http://securityratty.com/tag/0wned world">0wned world</category>
      <category domain="http://securityratty.com/tag/book">book</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/review">review</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/394005708/live-blogging-from-govcertnl-2008-david.html">Live Blogging from GOVCERT.NL 2008 - David Rice Speaking</source>
    </item>
    <item>
      <title><![CDATA[Enough with all the passwords!]]></title>
      <link>http://securityratty.com/article/6349d38f11816f8e34daaa2d373f8621</link>
      <guid>http://securityratty.com/article/6349d38f11816f8e34daaa2d373f8621</guid>
      <description><![CDATA[Source: Novell) Typical companies have 70 or more applications requiring a password or similar credentials to get to them. Misplaced or forgotten passwords result in expensive, frequent calls to the...]]></description>
      <content:encoded><![CDATA[<b>(Source: Novell)</b> Typical companies have 70 or more applications requiring a password or similar credentials to get to them. Misplaced or forgotten passwords result in expensive, frequent calls to the help desk. Now there are single sign-on solutions to this costly dilemma and they could be the end to this down-side of application creep.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:dbd7f601c383df565f82c449845cd6f2:vIzNXqUQrbkV0UZsB2qohuIMIZm98NRfIoVT2%2BG24o5b7mCEHyJosYPDqnLSGyPV9iD4W4RsuXdVDHveOoCkYLM%2FLw3un2zOfTTd5BudDIM%3D'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:6317f18fb9bc9af514a9da7248ae4fdd:F0yBVrNU%2BrZSBLsiytS0QwtEBEsGKiMjGKdpSVKGP5E%2Fbhz4H1HEiw5IiaOcDyk31bSBp47clAnFLnQf2pjQ6Y%2Fz7%2FuBzB9aJIxEapbo4ss%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:53d7b8bae04da0e0b4920e9a14da3621:DRl1PQnp%2BU1m0Y0H%2BXUk9Zv9jC3%2FnF%2Fe7EsOD%2FJJSvkMQTBWU8vihm3fvz75WzvRaQsZprWA3l7KyllsLd%2F6sliQKKWHbImYUf9cRnFwhVc%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v2:85282acbdc474bd27699943830a79f6a:2v0rpL1lFy4GwfS7sZjnEXpY%2BodDqHGg%2BkZS9KyzKP34i7DXt3Pud4X3P%2Bi3Pc47b832ywHhmGiM9InFvBSAI%2BPYMNWukQY7TcfyGEvIeO0%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=a9455ee0a448c6dd770b96f91056a6e6" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=a9455ee0a448c6dd770b96f91056a6e6" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/single sign-on solutions">single sign-on solutions</category>
      <category domain="http://securityratty.com/tag/passwords result">passwords result</category>
      <category domain="http://securityratty.com/tag/application creep">application creep</category>
      <category domain="http://securityratty.com/tag/frequent calls">frequent calls</category>
      <category domain="http://securityratty.com/tag/similar credentials">similar credentials</category>
      <category domain="http://securityratty.com/tag/costly dilemma">costly dilemma</category>
      <category domain="http://securityratty.com/tag/typical companies">typical companies</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/down-side">down-side</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=a9455ee0a448c6dd770b96f91056a6e6">Enough with all the passwords!</source>
    </item>
    <item>
      <title><![CDATA[Darpa Wants Clean, Cheap Jet Fuel... From Coal]]></title>
      <link>http://securityratty.com/article/b349ecf7473a4b4e0a09d6c0bb305eee</link>
      <guid>http://securityratty.com/article/b349ecf7473a4b4e0a09d6c0bb305eee</guid>
      <description><![CDATA[The Air Force is flying everything from supersonic fighter jets to hulking cargo planes on a synthetic fuel blend, derived largely from coal. The problem is, that stuff is worse for the environment as...]]></description>
      <content:encoded><![CDATA[The Air Force is flying everything from supersonic fighter jets to hulking cargo planes on a synthetic fuel blend, derived largely from coal. The problem is, that stuff is worse for the environment as the old-school fuel. And it's expensive Enter Darpa,which is kick-staring a new, $4.5 million research effort to figure out how to turn coal into liquid fuel cheaply.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=55002d77dd89f06d2c06ba987adcbf1b" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=55002d77dd89f06d2c06ba987adcbf1b" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=nAvTL"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=nAvTL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=N2Tvl"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=N2Tvl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=4tKZl"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=4tKZl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=3wUKL"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=3wUKL" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=nI81L"><img src="http://feeds.wired.com/~f/wired/politics/security?i=nI81L" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=7IlBl"><img src="http://feeds.wired.com/~f/wired/politics/security?i=7IlBl" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=MZ8zl"><img src="http://feeds.wired.com/~f/wired/politics/security?i=MZ8zl" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=KHbnL"><img src="http://feeds.wired.com/~f/wired/politics/security?i=KHbnL" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/390712399" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/390712401" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 12 Sep 2008 08:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coal">coal</category>
      <category domain="http://securityratty.com/tag/million research effort">million research effort</category>
      <category domain="http://securityratty.com/tag/synthetic fuel blend">synthetic fuel blend</category>
      <category domain="http://securityratty.com/tag/supersonic fighter jets">supersonic fighter jets</category>
      <category domain="http://securityratty.com/tag/liquid fuel cheaply">liquid fuel cheaply</category>
      <category domain="http://securityratty.com/tag/expensive enter darpa">expensive enter darpa</category>
      <category domain="http://securityratty.com/tag/air force">air force</category>
      <category domain="http://securityratty.com/tag/cargo planes">cargo planes</category>
      <category domain="http://securityratty.com/tag/old-school fuel">old-school fuel</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/390712401/darpas-coal-to.html">Darpa Wants Clean, Cheap Jet Fuel... From Coal</source>
    </item>
    <item>
      <title><![CDATA[The Real Migration Problem]]></title>
      <link>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</link>
      <guid>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</guid>
      <description><![CDATA[Preview of Tom Friedman's thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added

FP: And what about drilling? Republican presidential candidate Sen. John McCain, his running...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.foreignpolicy.com/story/cms.php?story_id=4463">Preview</a> of Tom Friedman&#39;s thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added):</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><span class="fp_red" style="color: #8c182d; font-weight: bold; "><strong>FP:&#160;</strong></span>And what about drilling? Republican presidential candidate Sen. John McCain, his running mate Gov. Sarah Palin, and President George W. Bush are implying that lifting environmental restrictions on drilling is the way to promote energy independence.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><strong>TF:&#160;</strong>Well, I think it’s patent nonsense. No one believes that somehow offshore, there’s enough oil in any near term and even the long term to provide us oil independence. It’s the wrong approach because in a world that’s hot, flat, and crowded, fossil fuels—and particularly crude oil—are going to be expensive and exhausting. Therefore the focus should be on the next great global industry: clean energy technology. <span style="font-weight: bold;">When I hear McCain pounding the table for “drill, drill, drill,” it reminds me of someone pounding the table for IBM Selectric typewriters on the eve of the IT revolution.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; ">I’m not against offshore drilling, by the way, because I believe the technology and the safety has improved far beyond where it was back in the 70s, 80s, and 90s, even. What I’m against is making it the centerpiece of our energy policy. If all McCain said was, “Let’s drill, but let’s also throw everything into innovating the next generation of clean-energy technologies,” I’d say, “You’ve got it exactly right, pal.”</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></p><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Its funny because as someone who has done a half dozen legacy migration projects (with mental and emotional scars to prove it), I was thinking the same thing. The entrenched mindset. &quot;If we just dig our trench deeper (in this case literally) then we will be ok.&quot;...at least until the person in question retires...</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">One of the legacy migration project I worked on, I was the third consultant that tried to get this company off of mainframe and onto distributed systems (which are no panacea but this company really did need to make the move). The core developers of the mainframe were actively hostile to change, as opposed to simply passive aggressive, which we expect. For example, if you asked about how a piece of functionality worked, say a report writer, the developer would not answer, stand up, walk out of the room, come back with a 800 page &quot;data model&quot;, slam it on the table and walk out of the room. Good times.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">A chief objection beyond fear of the unknown was the perceived lack of elegance in the distributed systems as opposed to the control from say JCL. Anyway, what progress I made was due to analogizing that we were leaving Greece which has a rich culture, history, philosophy and moving to Rome which maybe was not as elegant as Greece but still people like circuses, roads and acqueducts. So when, several times a day, a perceived go/ no go issue arose, I would gently remind &#160;the developers that &quot;we are now in Rome and things work differently here.&quot;</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Intransigently digging the trench deeper is not the way, instead we need to better understanding the energy &#160;problem in a larger context, and finding deployable technologies to help address it. If you think drill, drill, drill is the answer, then I think the answer for you is the same as someone who knows COBOL and flat refuses to learn modern languages even when that is required - a nice retirement house on a golf course somewhere.</span></div>]]></content:encoded>
      <pubDate>Tue, 09 Sep 2008 05:38:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/clean-energy technologies">clean-energy technologies</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/drill">drill</category>
      <category domain="http://securityratty.com/tag/energy policy">energy policy</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/promote energy independence">promote energy independence</category>
      <category domain="http://securityratty.com/tag/trench deeper">trench deeper</category>
      <category domain="http://securityratty.com/tag/mccain">mccain</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/the-real-migration-problem.html">The Real Migration Problem</source>
    </item>
    <item>
      <title><![CDATA[Modelling Shoplifting]]></title>
      <link>http://securityratty.com/article/3943f3c70f24e801812a87cf0b0b61f8</link>
      <guid>http://securityratty.com/article/3943f3c70f24e801812a87cf0b0b61f8</guid>
      <description><![CDATA[The other day I was thinking that I should write about specific situation models and by coincident Marc Adler pens CEP and Shoplifting . In Marcs post, Marc begins to model shoplifting as if...]]></description>
      <content:encoded><![CDATA[<p>The other day I was thinking that I should write about specific situation models and by coincident Marc Adler pens <a href="http://magmasystems.blogspot.com/2008/09/cep-and-shoplifting.html" target="_blank">CEP and Shoplifting</a>.  In Marc&#8217;s post, Marc begins to model shoplifting as if shoplifting is &#8220;market data,&#8221; with Level 1 to Level 4 shoplifting &#8220;quotes&#8221; - the natural approach for a brilliant guy from Citi.   In reality, this model does not work very well, and I&#8217;ll touch on a few reasons why today.</p>
<p>Marc&#8217;s initial shoplifting model in his post is based on John <span id="SPELLING_ERROR_3" class="blsp-spelling-error">Colapinto&#8217;s concepts of matching a pattern of customer movements in the store with their estimated patterns of shoplifting behavioral patterns.    Marc&#8217;s asks how Coral8 might address this.   We are not ready to seek a vendor solution.  We do not yet have a workable detection model.</span></p>
<p><span class="blsp-spelling-error">As indicated above, I don&#8217;t think the example situation cited by John and Marc is a viable model for automated processing.    Tracking the behavior of customer&#8217;s movements, by machine, would require some very sophisticated image processing technology that would be too expensive compared to any possible loss at most retails stores.    This type of behavioral pattern recognition. in retail stores, is performed by people (security personnel), not machines, observing people.  </span></p>
<p><span class="blsp-spelling-error">To develop a machine pattern recognition application to detect retail shoplifting we need to build detection models that are economically feasible.  If we are going to use a model of shoplifting pattern recognition versus anomaly detection, we need to define the objects we must track.   </span></p>
<p><span class="blsp-spelling-error">In the most simple model, we have merchandise-objects.   Stores normally (physically) track merchandise-objects only at the exit/entry points of the store using some electromagnetic proximity detection technology.   In this model, the detection configuration is a combination of simple alerting with humans watching the store (&#8221;minding the store&#8221;).    This is not complex event processing.</span></p>
<p><span class="blsp-spelling-error">However, if we added another object to our model, the customer-object, then we start to get more &#8220;complex,&#8221; but we have not defined &#8220;complexity&#8221; yet because we have not defined the object properties, the possible states of the objects, and the relationships between the objects that are the basis for estimated situations.</span></p>
<p><span class="blsp-spelling-error">Hence, model building is constrained by available resources, simple economics and risk (cost-benefit).  If we are detecting shoplifting in Walmart the cost-benefit model for implementing an automated shoplifting detection system would be different than at a top diamond store on 5th Avenue in NYC.   Protecting loss at a weapons-grade uranium respository follows a different model than protecting loss at a handicraft shop, naturally.</span></p>
<p><span class="blsp-spelling-error">Like Marc, I find models to automatically detect shoplifting interesting, so permit me to close with a general discussion of shoplifting in the context of our <a href="http://www.thecepblog.com/what-is-complex-event-processing/" target="_blank">CEP/EP reference model</a>.</span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">One approach would be do determine what objects will be represented in our model.   For example, if we are going to track merchandise, we need to model the &#8221;merchandise-object&#8221;.  If we are going to track people, we need to define the properties of this &#8220;person object.&#8221;  If we are going to represent the store layout, we need to define all these objects (store-object, table-object, shelf-object, entry-object and so forth).  The model can get &#8220;complex&#8221; quite quickly.  </span></span></p>
<blockquote><p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Editorial Note:  <em>An object-oriented approach greatly assists complex model building because we can benefit from OO properties such as encapsulation and polymorphism.  For example, we can define a basic &#8220;person object class&#8221; and then create superclasses of this object for &#8220;customer-object&#8221;, &#8220;manager-object&#8221;, &#8220;or criminal-object.&#8221;</em></span></span></p></blockquote>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Generally speaking, each object we define will require a state-model, for example, in Marc&#8217;s example of a customer moving around the store, we would need to model the possible states (customer at the entrance, at table 1, at table 2, at shelf 1, in the bathroom, at the cashier, etc.)  Indeed Marc, this is complex event processing if we have modelled multiple objects and defined object-object relationships that indicate situations of interest.   For example, customer-object at table2 where merchandise-object has the property of  &#8221;very expensive, high risk&#8221; and then customer-object changes state to &#8220;in bathroom&#8221;.  Of course, we need more key indicators, but you get the idea.</span></span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">Right now, I am typing from the <a href="http://www.taste4heaven.com">Taste from Heaven Vegetarian Restaurant</a> in Chiang Mai and my battery is running low.  The owner of this excellent restaurant also runs the <a href="http://www.elephantnaturefoundation.org/" target="_blank">Elephant Nature Park</a>, a non-profit organization advocating and acting on behalf of the rights of the mighty elephants in Thailand.  Would be great if we could also automatically detect the situation of &#8220;elephant abuse&#8221; by poachers and other crimes against nature.   Time to get back to my delicious mushroom salad, Northeastern Thai style.</span></span></p>
<p><span class="blsp-spelling-error"><span class="blsp-spelling-error">As always, thanks for reading, time for me to get back to eating!</span></span></p>
<p> </p>
]]></content:encoded>
      <pubDate>Sun, 07 Sep 2008 03:30:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/store">store</category>
      <category domain="http://securityratty.com/tag/store-object">store-object</category>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/model canget complex">model canget complex</category>
      <category domain="http://securityratty.com/tag/model">model</category>
      <category domain="http://securityratty.com/tag/simple">simple</category>
      <category domain="http://securityratty.com/tag/simple economics">simple economics</category>
      <category domain="http://securityratty.com/tag/simple model">simple model</category>
      <category domain="http://securityratty.com/tag/object">object</category>
      <source url="http://www.thecepblog.com/2008/09/07/modelling-shoplifting/">Modelling Shoplifting</source>
    </item>
  </channel>
</rss>
