<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: floor]]></title>
    <link>http://securityratty.com/tag/floor</link>
    <description></description>
    <pubDate>Tue, 07 Oct 2008 04:32:33 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Mayhem in Mumbai]]></title>
      <link>http://securityratty.com/article/b7902ee86f589ca527ebb734d591a745</link>
      <guid>http://securityratty.com/article/b7902ee86f589ca527ebb734d591a745</guid>
      <description><![CDATA[The total number of casualties rise in the financial capital of India after terrorists attack multiple locations

The latest figures suggest that at least 100 people have been killed and as many as...]]></description>
      <content:encoded><![CDATA[The total number of casualties rise in the financial capital of India after terrorists attack multiple locations.<br /><span id="fullpost"><br />The latest figures suggest that at least 100 people have been killed and as many as 900 injured.  Radio and television reporters are saying that it has all the hallmarks of an Al-Qaeda attack.  Locations included a railway station, a cinema, the Taj Hotel, and another very popular restaurant. <br /></span><br />It appears as if the terrorists singled out Westerners as they are reported to have taken British and American tourists hostages and brought them up to the 18th floor of the hotel.  This evening the hotel is on fire and the fate of the hostages is still unknown.<br /><br />The good news for some, is that they were able to escape form the hotel in the confusion.  It appears that the terrorists could have numbered dozens of heavily armed men.  This is definitely not a random attack but a well planned and executed operation aimed at causing mass casualties amnd hitting India's financial markets in much the same way as Wall Street was attacked on 9/11.<br /><br />We do not hear that much about India's terrorist problems in the West but I was made aware of it when I was invited to India to speak on Security matters this time last year.  I have since that time made clients and potenital clients aware of the  security situation.  <br /><br />There has been much outsourcing to India and many U.S. businesses are sending personnel over there as a result.  Those who can afford to have their own professional security protectors should consider that option very carefully.  It could very well turn out being more of a necessity than a luxury in these dangerous times.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Thu, 27 Nov 2008 02:48:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/india">india</category>
      <category domain="http://securityratty.com/tag/potenital clients aware">potenital clients aware</category>
      <category domain="http://securityratty.com/tag/taj hotel">taj hotel</category>
      <category domain="http://securityratty.com/tag/hotel">hotel</category>
      <category domain="http://securityratty.com/tag/clients">clients</category>
      <category domain="http://securityratty.com/tag/hostages">hostages</category>
      <category domain="http://securityratty.com/tag/mass casualties amnd">mass casualties amnd</category>
      <category domain="http://securityratty.com/tag/american tourists hostages">american tourists hostages</category>
      <category domain="http://securityratty.com/tag/aware">aware</category>
      <source url="http://www.thebulletproofblog.com/2008/11/mayhem-in-mumbai.html">Mayhem in Mumbai</source>
    </item>
    <item>
      <title><![CDATA[Is That a Coffee Table or a Munition?]]></title>
      <link>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</link>
      <guid>http://securityratty.com/article/bcc3ebc100f5b51c419148587e587e92</guid>
      <description><![CDATA[One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard....]]></description>
      <content:encoded><![CDATA[<p>One of the standard software security prescriptions for the SDLC is to data classification and enforce least privilege. From a security perspective this sounds fantastic, especially on a whiteboard. When the rubber meets the real world road, things often turn out slightly different.&#0160;</p><br /><div>It turns out that it is hard to conduct business with excessive granularity.</div><div><a href="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-pi" style="display: inline;"><a href="http://www.economist.com/displaystory.cfm?story_id=11965352"><img alt="D3408BB1" class="at-xid-6a00d83451c75869e201053619a7a7970b " src="http://1raindrop.typepad.com/.a/6a00d83451c75869e201053619a7a7970b-320wi" /></a></a><span style="font-family: &#39;Trebuchet MS&#39;; ">
</span> <br /></div><br /><div>Here is an <a href="http://www.economist.com/displaystory.cfm?story_id=11965352">article</a> from The Economist on the challenges of space technology, commercialization and information sharing. This is widely applicable to corporate information security policies:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-weight: bold; line-height: normal; ">Gravity is not the main obstacle for America’s space business. Government is</span></p><p><span style="font-family: Verdana; line-height: normal; ">IN THE spring of 2006 Robert Bigelow needed to take a stand on a trip to Russia to keep a satellite off the floor. The stand was made of aluminium. It had a circular base and legs. It was, says the entrepreneur and head of Bigelow Aerospace in Nevada, “indistinguishable from a common coffee table”. Nonetheless, the American authorities told Mr Bigelow that this coffee table was part of a satellite assembly and so counted as a munition. During the trip it would have to be guarded by two security officers at all times.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal;"><br /></span><span style="font-family: Verdana; line-height: normal; ">Exporting technology has always presented a dilemma for America. The country leads the world in most technologies and some of these give it a military advantage. If export rules are too lax, foreign powers will be able to put American technology in their systems, or copy it. But if the rules are too tight, then it will stifle the industries that depend upon sales to create the next generation of technology.</span><br /><span style="font-family: Verdana; line-height: normal; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; line-height: normal; ">It is a difficult balance to strike and critics charge that America has erred on the side of stifling. They claim that overly strict export controls have so damaged the space industry that America’s national security is now threatened by its dwindling leadership in space technology. The system, they complain, fails to distinguish between militarily sensitive hardware that should be controlled and widely available commercial technologies, such as lithium-ion batteries and solar cells. The zealous application of the export rules is the American space industry’s biggest handicap.</span></p></blockquote><div><span style="font-family: Verdana; font-weight: bold; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal; ">Read the whole thing its fascinating. So what started off as well intentioned asset protection eventually compromised the most important asset of all - strategic advantage.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">So what&#39;s a better model? I am partial to think about these sorts of problems as free trade agreements. Each integration point should have a set of policies, and enforcement mechanisms that also include compensating transactions.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; line-height: normal;">For example, did you know that in the US you can buy companies that trade on other exchanges through ADRs? You buy the ADR of say a French Telco which trades on a European exchange only you buy the ADR on the NYSE or Nasdaq. Then the French Telco issues you a dividend because you are a shareholder, but the French government withholds the dividend for foreign owners. Yet because there is a free trade agreement between the two countries, the US lets you write off the unreceived portion of the dividend on your taxes. (this may or may not be the case in US-France just an example). Anyway, its not a silver bullet but its an interesting strategy.</span></div><div><span style="font-family: Verdana; line-height: normal;"><br /></span></div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 09:40:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/coffee table">coffee table</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/american technology">american technology</category>
      <category domain="http://securityratty.com/tag/free trade agreement">free trade agreement</category>
      <category domain="http://securityratty.com/tag/trade">trade</category>
      <category domain="http://securityratty.com/tag/space technology">space technology</category>
      <category domain="http://securityratty.com/tag/french telco issues">french telco issues</category>
      <category domain="http://securityratty.com/tag/common coffee table">common coffee table</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/is-that-a-coffee-table-or-a-munition.html">Is That a Coffee Table or a Munition?</source>
    </item>
    <item>
      <title><![CDATA[ Here Comes Everybody Review]]></title>
      <link>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</link>
      <guid>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</guid>
      <description><![CDATA[In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market...]]></description>
      <content:encoded><![CDATA[<p>In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market's transaction costs: buyers and sellers need to find one another, then reach agreement, and so on. The Coase theorem implies that if these transaction costs are low enough, direct markets of individuals make a whole lot of sense. But if they are too high, it makes more sense to get the job done by an organization that hires people. </p>

<p>Economists have long understood the corollary concept of Coase's ceiling, a point above which organizations collapse under their own weight -- where hiring someone, however competent, means more work for everyone else than the new hire contributes. Software projects often bump their heads against Coase's ceiling: recall Frederick P. Brooks Jr.'s seminal study, <cite>The Mythical Man-Month</cite> (Addison-Wesley, 1975), which showed how adding another person onto a project can slow progress and increase errors. </p>

<p>What's new is something consultant and social technologist Clay Shirky calls &quot;Coase's Floor,&quot; below which we find projects and activities that aren't worth their organizational costs -- things so esoteric, so frivolous, so nonsensical, or just so thoroughly unimportant that no organization, large or small, would ever bother with them. Things that you shake your head at when you see them and think, &quot;That's ridiculous.&quot;</p>

<p>Sounds a lot like the Internet, doesn't it? And that's precisely Shirky's point. His new book, <a href="http://www.amazon.com/exec/obidos/ASIN/1594201536/counterpane/"><cite>Here Comes Everybody: The Power of Organizing Without Organizations</cite></a>, explores a world where organizational costs are close to zero and where ad hoc, loosely connected groups of unpaid amateurs can create an encyclopedia larger than the Britannica and a computer operating system to challenge Microsoft's. </p>

<p>Shirky teaches at New York University's Interactive Telecommunications Program, but this is no academic book. Sacrificing rigor for readability, <cite>Here Comes Everybody</cite> is an entertaining as well as informative romp through some of the Internet's signal moments -- the Howard Dean phenomenon, Belarusian protests organized on LiveJournal, the lost cellphone of a woman named Ivanna, Meetup.com, flash mobs, Twitter, and more -- which Shirky uses to illustrate his points. </p>

<p>The book is filled with bits of insight and common sense, explaining why young people take better advantage of social tools, how the Internet affects social change, and how most Internet discourse falls somewhere between dinnertime conversation and publishing. </p>

<p>Shirky notes that &quot;most user-generated content isn't 'content' at all, in the sense of being created for general consumption, any more than a phone call between you and a sibling is 'family-generated content.' Most of what gets created on any given day is just the ordinary stuff of life -- gossip, little updates, thinking out loud -- but now it's done in the same medium as professionally produced material. Unlike professionally produced material, however, Internet content can be organized after the fact.&quot; </p>

<p>No one coordinates Flickr's 6 million to 8 million users. Yet Flickr had the first photos from the 2005 London Transport bombings, beating the traditional news media. Why? People with cellphone cameras uploaded their photos to Flickr. They coordinated themselves using tools that Flickr provides. This is the sort of impromptu organization the Internet is ideally suited for. Shirky explains how these moments are harbingers of a future that can self-organize without formal hierarchies. </p>

<p>These nonorganizations allow for contributions from a wider group of people. A newspaper has to pay someone to take photos; it can't be bothered to hire someone to stand around London underground stations waiting for a major event. Similarly, Microsoft has to pay a programmer full time, and <cite>Encyclopedia Britannica</cite> has to pay someone to write articles. But Flickr can make use of a person with just one photo to contribute, Linux can harness the work of a programmer with little time, and Wikipedia benefits if someone corrects just a single typo. These aggregations of millions of actions that were previously below the Coasean floor have enormous potential. </p>

<p>But a flash mob is still a mob. In a world where the Coasean floor is at ground level, all sorts of organizations appear, including ones you might not like: violent political organizations, hate groups, Holocaust deniers, and so on. (Shirky's discussion of teen anorexia support groups makes for very disturbing reading.) This has considerable implications for security, both online and off. </p>

<p>We never realized how much our security could be attributed to distance and inconvenience -- how difficult it is to recruit, organize, coordinate, and communicate without formal organizations. That inadvertent measure of security is now gone. Bad guys, from hacker groups to terrorist groups, will use the same ad hoc organizational technologies that the rest of us do. And while there has been some success in closing down individual Web pages, discussion groups, and blogs, these are just stopgap measures. </p>

<p>In the end, a virtual community is still a community, and it needs to be treated as such. And just as the best way to keep a neighborhood safe is for a policeman to walk around it, the best way to keep a virtual community safe is to have a virtual police presence. </p>

<p>Crime isn't the only danger; there is also isolation. If people can segregate themselves in ever-increasingly specialized groups, then they're less likely to be exposed to alternative ideas. We see a mild form of this in the current political trend of rival political parties having their own news sources, their own narratives, and their own facts. Increased radicalization is another danger lurking below the Coasean floor. </p>

<p>There's no going back, though. We've all figured out that the Internet makes freedom of speech a much harder right to take away. As Shirky demonstrates, Web 2.0 is having the same effect on freedom of assembly. The consequences of this won't be fully seen for years. </p>

<p><cite>Here Comes Everybody</cite> covers some of the same ground as Yochai Benkler's <cite>Wealth of Networks</cite>. But when I had to explain to one of my corporate attorneys how the Internet has changed the nature of public discourse, Shirky's book is the one I recommended.</p>

<p>This essay <a href="http://www.spectrum.ieee.org/sep08/6631">previously appeared</a> in <i>IEEE Spectrum</i>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=wZmPN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=wZmPN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xDcAN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xDcAN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 04:39:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/shirky">shirky</category>
      <category domain="http://securityratty.com/tag/shirky notes">shirky notes</category>
      <category domain="http://securityratty.com/tag/organizations">organizations</category>
      <category domain="http://securityratty.com/tag/community">community</category>
      <category domain="http://securityratty.com/tag/virtual community safe">virtual community safe</category>
      <category domain="http://securityratty.com/tag/organizations collapse">organizations collapse</category>
      <category domain="http://securityratty.com/tag/internet content">internet content</category>
      <category domain="http://securityratty.com/tag/internet discourse falls">internet discourse falls</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/here_comes_ever.html"> Here Comes Everybody Review</source>
    </item>
    <item>
      <title><![CDATA[Celebrity's Bodyguard Caught on Camera]]></title>
      <link>http://securityratty.com/article/81cffb6766a5b98cf121e07a6e081430</link>
      <guid>http://securityratty.com/article/81cffb6766a5b98cf121e07a6e081430</guid>
      <description><![CDATA[Paparazzi seem to draw bodyguards to their cameras like moths to a light bulb

This recent grapple caught on video was aired on the Fox News show in the &quot; Kelly's Court &quot; segment. Megyn Kelly acted as...]]></description>
      <content:encoded><![CDATA[Paparazzi seem to draw bodyguards to their cameras like moths to a light bulb. <br /><span id="fullpost"><br />This recent grapple caught on video was aired on the Fox News show in the "<a href="http://www.comcast.net/data/fan/html/popup.html?v=934615342">Kelly's Court</a>" segment.  Megyn Kelly acted as the judge while two other lawyers debated whether the photographer had a chance of winning a civil suit   <br /></span><br />The celebrity, John Meyer, appeared to be exiting a restaurant with a friend when a photographer tried to take a picture.  Although the clip was relatively short, it appeared as if Mr. Meyer's E.P. agent went over the top in trying to block the photogapher from taking the picture.<br /><br />From a professional E.P. point of view, the matter could have been handled with much decorum and expertise.  Mr. Meyer should have been closely escorted to his vehicle and placed inside out of harm's way.  Since there only appeared to be one E.P. agent (who also doubled up as driver), when he went charging at the photographer, he left his Principal unprotected.<br /><br />For some reason, many of the people employed to protect celebrities seem more preoccupied with making sure that pictures are not taken rather than ensuring the safety of their Principal.  What makes it all the more ironic, is the fact that these celebrities are usually out in the public eye and therefore can not realistically expect total privacy.<br /><br />If you are a Personal Protection Specialist and you find yourself in this position, remember two things.  Firstly, always remember your duty to protect your Principal.  If you are doing it alone, who will be looking after them when you are rolling around the floor with a photographer?<br /><br />Secondly, remember that you can be sued civilly - and do not take that literally, there is nothing civil about it.  You may or may not be prosecuted criminally, but if you lose a civil suit, it could mean that you'll be spending the rest of your working life paying that photographer who is claiming neck injuires and all kinds of trauma.<br /><br />A picture may be worth a thousand words, but it is hardly worth ruining your career and life.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sun, 23 Nov 2008 18:14:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/civil">civil</category>
      <category domain="http://securityratty.com/tag/photographer">photographer</category>
      <category domain="http://securityratty.com/tag/civil suit">civil suit</category>
      <category domain="http://securityratty.com/tag/kelly">kelly</category>
      <category domain="http://securityratty.com/tag/megyn kelly acted">megyn kelly acted</category>
      <category domain="http://securityratty.com/tag/celebrities">celebrities</category>
      <category domain="http://securityratty.com/tag/protect celebrities">protect celebrities</category>
      <category domain="http://securityratty.com/tag/meyer">meyer</category>
      <category domain="http://securityratty.com/tag/john meyer">john meyer</category>
      <source url="http://www.thebulletproofblog.com/2008/11/celebritys-bodyguard-caught-on-camera.html">Celebrity's Bodyguard Caught on Camera</source>
    </item>
    <item>
      <title><![CDATA[Come Meet at CSI in DC]]></title>
      <link>http://securityratty.com/article/e6562d9c485cc52151697f063ce893ca</link>
      <guid>http://securityratty.com/article/e6562d9c485cc52151697f063ce893ca</guid>
      <description><![CDATA[If you are in DC, come meet me during/after SIEM Summit or catch me at the show floor (ask at Qualys booth
About me:...]]></description>
      <content:encoded><![CDATA[If you are in DC, come meet me during/after <a href="http://www.csiannual.com/conference/summit.php">SIEM Summit</a> or catch me at the show floor (ask at <a href="http://www.qualys.com/">Qualys </a>booth)<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=Pe95N"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=Pe95N" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=aboGN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=aboGN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=2WaeN"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=2WaeN" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/456058114" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 17 Nov 2008 03:44:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/duringafter siem summit">duringafter siem summit</category>
      <category domain="http://securityratty.com/tag/qualys booth">qualys booth</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/floor">floor</category>
      <category domain="http://securityratty.com/tag/chuvakin">chuvakin</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/456058114/come-meet-at-csi-in-dc.html">Come Meet at CSI in DC</source>
    </item>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74</link>
      <guid>http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>
<p><a href="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/a"><img src="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/H4w0W-ygK2s" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/H4w0W-ygK2s/i.php">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2</link>
      <guid>http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[Phreaknic 12 (2008) Hacker Con]]></title>
      <link>http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79</link>
      <guid>http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79</guid>
      <description><![CDATA[New Video: Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at...]]></description>
      <content:encoded><![CDATA[New Video: <a href="http://www.irongeek.com/i.php?page=videos/phreaknic-12-hacker-con">Phreaknic 12 (2008) Hacker Con</FONT></B></a>
<p></p>
<p>This is a quick and dirty video documentary of the things that when on around the talks and event at <a href="http://www.phreaknic.info">Phreaknic 12 </a>(2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows: </p>
<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Intro and leaving Louisville with Brian. Morgellon talks about hacking the <a href="http://dailyduino.com/">Arduino</a> micro controller platform.&nbsp;Sorteal talks about the LiVes Open Source video editor. AT&amp;T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon&nbsp; gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask <a href="http://dualcoremusic.com/nerdcore/">Int80 about using his nerdcore</a> music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with <a href="http://leebaird.com/Me/Hacking.html">Lee Baird</a> and John Skinner. I do a little <a href="http://www.irongeek.com/i.php?page=security/bluecasing1">Bluecaseing/Warnibbling </a>with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the <a href="http://dailyduino.com/">Arduinos</a> Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with <a href="http://www.rmccurdy.com/">operat0r</a>. USB door key fun with the <a href="http://dailyduino.com/">Arduino</a>. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. <a href="http://dualcoremusic.com/nerdcore/">Int80</a> gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. <a href="http://www.winnschwartau.com/">Winn Schwartau</a> joins in on the keylogger fun. <a href="http://www.packetsniffers.org/">DOSman and Zack</a> use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. <a href="http://www.hak5.org/">Daren and Shannon from Hak5</a> blind me this time. :) Then they do a quick interview. I interview <a href="http://www.digome.com/">TRiP</a> about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. <a href="http://www.offensive-security.com/">Ziplock</a> had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the <a href="http://www.shmoo.com/~gdead/Site/Home.html">Potters</a> won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.</p>
<p><a href="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/a"><img src="http://feedads.googleadservices.com/~a/fu-jGbBXkZllK6znlRDBB8Bbjxo/i" border="0" ismap="true"></img></a></p><img src="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~4/f9ViIhlukDU" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 02:59:17 +0000</pubDate>
      <category domain="http://securityratty.com/tag/con">con</category>
      <category domain="http://securityratty.com/tag/phreaknic">phreaknic</category>
      <category domain="http://securityratty.com/tag/video">video</category>
      <category domain="http://securityratty.com/tag/con swag overview">con swag overview</category>
      <category domain="http://securityratty.com/tag/source video editor">source video editor</category>
      <category domain="http://securityratty.com/tag/talks">talks</category>
      <category domain="http://securityratty.com/tag/sorteal talks">sorteal talks</category>
      <category domain="http://securityratty.com/tag/hacker con">hacker con</category>
      <category domain="http://securityratty.com/tag/lee eat jerky">lee eat jerky</category>
      <source url="http://feedproxy.google.com/~r/IrongeeksSecuritySite/~3/f9ViIhlukDU/i.php">Phreaknic 12 (2008) Hacker Con</source>
    </item>
    <item>
      <title><![CDATA[The McAfee Secure Standard: Sort Of]]></title>
      <link>http://securityratty.com/article/93a923291bb66872facd096a29cc894d</link>
      <guid>http://securityratty.com/article/93a923291bb66872facd096a29cc894d</guid>
      <description><![CDATA[I need your help
I am in receipt of the McAfee Secure Standard, drafted to transparently describe the McAfee Secure service, as promised during my meeting with Joe Pierini and Kirk Lawrence of McAfee...]]></description>
      <content:encoded><![CDATA[I need your help.<br />I am in receipt of the McAfee Secure Standard, drafted to transparently describe the McAfee Secure service, as promised during my <a href="http://holisticinfosec.blogspot.com/2008/08/mcirony-unexpected-response-from-mcafee.html" target="_blank">meeting</a> with Joe Pierini and Kirk Lawrence of McAfee some weeks ago. I admit my attitude has soured since last I discussed it here, as the Standard is not yet ready for public release (I last said 2-3 weeks and that was five weeks ago), but bear with me. I can't publish exact quotes from the Standard, as I've promised not to, but let me give you insight on the upside, then the downside.<br /><br />The upside includes all the transparency we'd hoped for. You'll read the McAfee Secure Standard and know exactly where they stand with regard as to what can be expected of the McAfee Secure Service. My discussions with Joe Pierini have been productive and respectful, he means well, and I believe he will try to drive the greater McAfee leadership to officially incorporate suggestions made in this blog. <br />I have even had the pleasure of reading a Researcher/Finder Policy that very succinctly describes what researchers can expect when they submit vulnerabilities found in McAfee Secure sites. That's all good stuff and to be applauded.<br /><br />Now for the downside.<br /><br />The McAfee Secure Standard will draw a clear distinction between "enterprise" customers and all the Ma & Pa websites who have so loved McAfee Secure / ScanAlert Hacker Safe for conversions.<br />The most glaring and painful distinction for me is this. While enterprise customers will have a clearly defined time line in which to remediate script injection vulnerabilities like XSS and open redirects, before losing their McAfee Secure badge, <span style="font-weight:bold;">the Ma & Pa sites will have absolutely no requirement to fix their XSS issues</span>. XSS vulnerabilities and the McAfee Secure badge will remain consistent on all those sites that care more about "convincing" their customers that they're secure with a McAfee Secure badge; a badge that, by its own pending standard, will contradict what we know to be truly secure.<br /><br />My views are clear. I have made every effort to convince McAfee that this stance is counter intuitive to good web application security standards. I believe that, in their own way, they are listening. So here's your chance.<br />1) Is transparency enough?<br />2) Is holding only enterprise customers accountable acceptable?<br />3) Should ALL McAfee Secure customers be expected to fix their vulnerabilities, even if on different timelines?<br />4) What else do you want McAfee to hear, in the form of constructive feedback only?<br />I will publish all well written, thoughtful comments here. Let's keep it positive and see if we can help convince McAfee that script injection vulnerabilities and McAfee Secure can't exist in the same physical space. Like matter and anti-matter. ;-)<br />The floor is yours...<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html&title=The%20McAfee%20Secure%20Standard:%20Sort%20Of " title="The McAfee Secure Standard: Sort Of ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html" title="The McAfee Secure Standard: Sort Of ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 19:47:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mcafee">mcafee</category>
      <category domain="http://securityratty.com/tag/mcafee secure customers">mcafee secure customers</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/mcafee secure sites">mcafee secure sites</category>
      <category domain="http://securityratty.com/tag/mcafee secure standard">mcafee secure standard</category>
      <category domain="http://securityratty.com/tag/mcafee secure service">mcafee secure service</category>
      <category domain="http://securityratty.com/tag/mcafee secure">mcafee secure</category>
      <category domain="http://securityratty.com/tag/loved mcafee secure">loved mcafee secure</category>
      <category domain="http://securityratty.com/tag/convince mcafee">convince mcafee</category>
      <source url="http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html">The McAfee Secure Standard: Sort Of</source>
    </item>
    <item>
      <title><![CDATA[Innovators, Imitators and Idiots]]></title>
      <link>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</link>
      <guid>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</guid>
      <description><![CDATA[Charlie Rose interviews Warren Buffett


Charlie Rose
And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage. We just lost sight...]]></description>
      <content:encoded><![CDATA[<p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;">Charlie Rose <a href="http://www.cnbc.com/id/26982338/page/2/">interviews</a> Warren Buffett:</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage.&#0160; We just lost sight of risk and leverage of what was appropriate?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.&#0160; Again, because it pays off for a while.&#0160; You know, you can lose leverage, and it&#39;s the only way a smart guy can go broke.&#0160; If you owe money, you can&#39;t pay them out.&#0160; You just pay for everything, you do smart things, you eventually get very rich.&#0160; If you do smart things and use leverage and do one wrong thing along the way, it could wipe you out, because anything times zero is zero.&#0160; But it&#39;s reinforcing when the people around you are doing it successfully, you&#39;re doing it successfully, and it&#39;s a lot like Cinderella at the ball.&#0160; I mean you know at midnight everything is going to turn to pumpkins and mice; right?&#0160; But if the evening goes along, I mean, you know, the guys look better all the time, the music sounds better, it&#39;s more and more fun, you think why the hell should I leave at quarter of 12.&#0160; I&#39;ll leave at two minutes to 12.&#0160; But the trouble is, there are no clocks on the wall.&#0160; And everybody thinks they&#39;re going to leave at two minutes to 12.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Its effectively the job of leadership to know when to take the punch bowl away and to have the credibility to do this. This is also the risk-reward balance that infosec must try to strike, part of the answer is differentiating <a href="http://1raindrop.typepad.com/1_raindrop/2007/11/dhandho-infosec.html">risk and uncertainty</a>. As our current financial situation shows, its a hard thing to pull off</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And should wise people have known better?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">People should always know better.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">I mean people -- people don&#39;t get -- they don&#39;t get smarter about things that get as basic as greed and you can&#39;t stand to see your neighbor getting rich.&#0160; You know you&#39;re smarter than he is, and he&#39;s doing these things, you know, and he&#39;s getting rich, and your spouse is getting unhappy with you because you aren&#39;t doing -- pretty soon you start doing it.&#0160; And so you get what I call the natural progression, the three Is.&#0160; The innovators, the imitators, and the idiots.&#0160; And that&#39;s what happens.&#0160; Everybody just kind of goes along.&#0160; And you look kind of silly if you disagree.&#0160; I mean, you know, you could have these crazy Internet valuations in the late 1990s, but they prove themselves out in the market.&#0160; The next day they were selling for more than they were the day before, and people said, you know, you&#39;re crazy if you don&#39;t get in on this.&#0160; So it&#39;s very human.&#0160; Now, with housing it&#39;s something even more dramatic than that, because most people aspire to own their own home.&#0160; And if you really think that houses prices are going to go up next year and the year after, you feel if I don&#39;t buy it this year, I&#39;m going to have to buy it next year.&#0160; That&#39;s not true of an Internet stock.&#0160; But it&#39;s true of a home.&#0160; And when somebody makes it very easy for you to do it by saying you don&#39;t really have to put up my money, you can lie about your income a little, or we&#39;ll give you 100 percent mortgage, you&#39;re going to do it, because everybody that&#39;s done it has been proven right.&#0160; You have what they call social tools, and, you know, you&#39;re going to feel like an idiot if you didn&#39;t do it, because the house cost more.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">And this is why its hard to pull off. There is a lot of human emotion and envy (*). I think the point Buffett raises about innovators, imitators and idiots is a useful one for infosec. We see all kinds of new projects and technologies that have risks and rewards associated with them, its helpful to categorize these under innovation (high risk but possible game changer), imitators (so called best practices), and idiots (sheep mode - blind risk acceptance). We can get some traction here to use these concepts to understand what to do when assessing say the architectural and oeprational risk of a system.</span></div><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Finally, we should always spend some time to consider infosec decisions in a broader long term economic context and this is also true of our current financial crisis</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Oh, I think confidence will come back.&#0160; I will tell you this.&#0160; This country is going -- be living better ten years from now than it is now.&#0160; It will be living better in 20 years from now than ten years from now.&#0160; The ingredients that made this country, you know, the miracle of the world -- I mean we had a seven for one improvement in the average American standard of living in the 20th century.&#0160; Now, we had the great depression, we had two world wars, we had the flu epidemic.&#0160; You know, we had oil shock.&#0160; You know, we had all these terrible things happen.&#0160; But something about the American system unleashed more and of a potential to human beings over that hundred years so that we had a seven for one improvement in -- there&#39;s never been any -- I mean, you have centuries where if you&#39;ve got a 1 percent improvement, then it&#39;s something.&#0160; So we&#39;ve got a great system.&#0160; And we&#39;ve got more productive capacity now than we ever have.&#0160; The American worker is more productive than he&#39;s ever been.&#0160; We&#39;ve got more people to do it.&#0160; We&#39;ve got all the ingredients for a sensational future.&#0160; It&#39;s just that right now the athlete&#39;s on the floor.&#0160; But we -- this is a super athlete.</span></p></blockquote><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">Again, we want to look at risk events in a broader, long term context. In Buffett&#39;s words its - &quot;be fearful when others are greedy and greedy when others are fearful.&quot; As the world panics and Jim Cramer is melting down on TV, Buffett is quietly writing checks with both hands, buying $3B of GE, $5B of Goldman, $6.5 of Wrigley/Mars and so on. Uncertainty is one thing, it could be 6 months it could be 5 years until this thing turns around, but risk is another - you hedge your risk with price and long term advantages, i.e. moats. People will still eat candy in a bad economy.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">* Buffett&#39;s partner Charlie Munger calls envy the stupidest of the seven deadly sins, because only you feel bad, there is an upside to all the others. He said you can pay someone on Wall St $2 million a year and they will be perfectly happy until they find out someone across the hall is making $2.1 million and then they will be miserable. Which is an insane way tolive.</span></div>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 04:32:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/oeprational risk">oeprational risk</category>
      <category domain="http://securityratty.com/tag/risk events">risk events</category>
      <category domain="http://securityratty.com/tag/risk-reward balance">risk-reward balance</category>
      <category domain="http://securityratty.com/tag/wise people">wise people</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/buffett raises">buffett raises</category>
      <category domain="http://securityratty.com/tag/buffett">buffett</category>
      <category domain="http://securityratty.com/tag/blind risk acceptance">blind risk acceptance</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/10/innovators-imitators-and-idiots.html">Innovators, Imitators and Idiots</source>
    </item>
  </channel>
</rss>
