<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: franklin]]></title>
    <link>http://securityratty.com/tag/franklin</link>
    <description></description>
    <pubDate>Wed, 22 Aug 2007 09:20:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Post Your Questions for Philadelphia Wireless Panelists]]></title>
      <link>http://securityratty.com/article/4ffaea55de6513864702705b92a352d0</link>
      <guid>http://securityratty.com/article/4ffaea55de6513864702705b92a352d0</guid>
      <description><![CDATA[Organizers of day-long discussion about ubiquitous mobile broadband want to know what you want to ask: In Philadelphia on 22-Sept-2008, panelists from AT&amp;T, Comcast, Sprint XOHM, The Wharton School,...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://momo-ma.com/?p=28"><strong>Organizers of day-long discussion about ubiquitous mobile broadband want to know what you want to ask:</strong></a> In Philadelphia on 22-Sept-2008, panelists from AT&T, Comcast, Sprint XOHM, The Wharton School, and Network Acquisition Corporation (the folks who will be operating the former EarthLink network in Phila.) will be on one stage at 6 pm at The Franklin Institute's Planetarium (free, $5 contribution requested, advance registration recommended).</p>

<p>The panel will discuss fourth-generation (4G) networks, including both LTE and WiMax, and discuss what these networks might deliver, as well as how Wi-Fi networks fit into this future. </p>

<p>One of the organizers asked if I'd solicit questions--you can post them below--which they'll try to ask during the panel. The group would then write up responses which could posted in turn here.</p>

<p>The powerhouse that is <a href="http://werbach.com/about.html"><strong>Kevin Werbach</strong></a>, a professor at The Wharton School, is moderating the event. Werbach has been part of interesting thinking about spectrum for many years, a former editor of Release 1.0, and a former FCC staffer. He'll share the stage with a fairly high-powered crowd, including AT&T's enterprise architect for mobility, the president of NAC, and senior people from Comcast and Sprint Xohm.</p>

<p>The event is part of the Mid-Atlantic Chapter series called MobileMonday, an interesting business group that's trying to provoke discussion and development around mobile technology and access. This particular event is sponsored by local business development organization Select Greater Philadelphia.</p>]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 06:10:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi networks fit">wi-fi networks fit</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/sprint xohm">sprint xohm</category>
      <category domain="http://securityratty.com/tag/wharton school">wharton school</category>
      <category domain="http://securityratty.com/tag/philadelphia">philadelphia</category>
      <category domain="http://securityratty.com/tag/mid-atlantic chapter series">mid-atlantic chapter series</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/network acquisition corporation">network acquisition corporation</category>
      <category domain="http://securityratty.com/tag/kevin werbach">kevin werbach</category>
      <source url="http://wifinetnews.com/archives/008447.html">Post Your Questions for Philadelphia Wireless Panelists</source>
    </item>
    <item>
      <title><![CDATA[Williamson County Schools learns of breach reported nine months ago]]></title>
      <link>http://securityratty.com/article/ab879007319944481d6c7e5668489293</link>
      <guid>http://securityratty.com/article/ab879007319944481d6c7e5668489293</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/11/08

Organization
Williamson County Schools

Contractor/Consultant/Branch
None

Victims
Students

3,052 ACT students and 2,117 students who took the...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wcs.jpg" width="109" align="right" height="123"><font size="2"><b>Date Reported: </b><br>7/11/08<br><br><b>Organization: </b><br><a href="http://www.wcs.edu/">Williamson County Schools</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students*<br><br><font size="1">*"3,052 ACT students and 2,117 students who took the second grade test were affected", Source: <a href="http://www.wcs.edu/student_information_conf.htm%20">Student Information News Conference Text 7/11/08</a><br></font> <br><span style="font-weight: bold;">Number Affected:</span><br>5,169<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, testing scores, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online."<br><br>Reference URL:<br><a href="http://www.wcs.edu/student_information_conf.htm">Williamson County Student Information News Conference</a> <br><a href="http://www.newschannel5.com/Global/story.asp?S=8662746">News Channel 5</a> <br><a href="http://www.wreg.com/Global/story.asp?S=8657599">WREG Channel 3 News</a> <br><a href="http://www.wsmv.com/news/16843341/detail.html#-">WSMV Channel 4 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Liberty Coalition<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online.<br><br>Now the county could lose some federal funding because of the mistake.<br><span style="font-style: italic;">[Evan] Do you really think that this will happen?&nbsp; If we looked deeper into the way the public school systems handle confidential information, half of the school districts would lose funding.&nbsp; Williamson County is in good company across the country.</span><br style="font-style: italic;"><br>The school district had to notify the Department of Education because this was a federal violation.<br><br>Director of Schools, Rebecca Sharber is taking on the responsibility of fixing the problem.<br><br>"I'm the head of the school system. I'm accountable," said Sharber.<br><span style="font-style: italic;">[Evan] What a fantastic statement.&nbsp; Corporate CEOs, non-profit executive directors, etc. ARE ultimately responsible for the protection of information.&nbsp; Ms. Sharber just earned my respect.</span><br style="font-style: italic;"><br>"It certainly is distressing to me that information was ever out there," said Sharber.<br><br>According to school officials, former assessment specialist, Chris Nugent is responsible for the computer mix-up.<br><br>He resigned Friday.<br><br>"Mr. Nugent has resigned his position as Assessment Specialist, effective immediately."<br><br>It was August last year when Nugent mistakenly loaded the info on a personal web page, but he never alerted the district.<br><br>They only found out a couple of weeks ago.<br><br>"A principal who had been contacted by a parent brought this to our attention on June 26th."<br><br>"The information given to us indicated that our assessment specialist, Chris Nugent, was involved. This was the first we had heard of this situation."<br><br>"We began our investigation immediately asking Mr. Nugent to gather all data that could possibly be associated with this situation."<br><br>"We thought at that time he would be able to supply the names of students possibly involved in the most timely manner."<br><br>"When Mr. Nugent was unable to get that information for us, our attorney Jason Golden contacted the Liberty Coalition, the organization that had posted the Internet report presented to us by the principal."<br><span style="font-style: italic;">[Evan] The Liberty Coalition posted the information surrounding the breach in October, 2007, many months before the victims were ever made aware.</span><br style="font-style: italic;"><br>"Yesterday afternoon, the Liberty Coalition was able to provide the names of the students affected."<br><br>"Our investigation indicates that the student information was posted on a private website created by Mr. Nugent sometime during the month of August, 2007."<br><br>"On August 28, 2007, the Liberty Coalition notified Mr. Nugent that private student information was on his web site."<br><br>"On August 29, 2007, the web site was shut down."<br><br>"Mr. Nugent did not notify school authorities."<br><br>"Our investigation has established that Mr. Nugent had confidential student files on the same thumb-drive with his personal files."<br><br>"We believe that when Mr. Nugent uploaded his personal files to a web site he created, he inadvertently uploaded our student files."<br><br>Sharber said the first step will be to look at revising policies on student information.<br><br>They will also pay for fraud alerts for the students.<br><br>It could cost the district hundreds of thousands of dollars to pay for those fraud alerts.<br><br>"I would say to other school districts they need to really, really check their policies and procedures on how student data is being used," said Sharber.<br><span style="font-style: italic;">[Evan] Again, did I mention that I respect Ms. Sharber?&nbsp; This statement is very good advice.</span><br><br>More than 5,000 students had their security information posted.<br><br>Most of those are high school students who took the ACT in the 2006-2007 school year, and second graders who took the TCAP the same year.<br><br>"We have learned that most students who took the second grade TCAP achievement test and most students who took the ACT test during the 2006-07 school year had social security numbers on a private website during August of 2007."<br><span style="font-style: italic;">[Evan] Is there some kind of legal requirement that states that a Social Security number must be tied to test scores, or was this just poor judgment?&nbsp; Are/were Social Security numbers used as student IDs at the district?</span><br style="font-style: italic;"><br>"Our review of the records shows that 3,052 ACT students and 2,117 students who took the second grade test were affected."<br><br>The information was on the internet for about a month.<br><br>"I want to thank the parents of Williamson County Schools for their patience and understanding and the positive suggestions they have shared as we have conducted our investigation and gone public with this information.", said Sharber<br><span style="font-style: italic;">[Evan] The Liberty Coalition went public with </span><a style="font-style: italic;" href="https://www.ssnbreach.org/release.php?g=13">this breach</a><span style="font-style: italic;"> in October, 2007.&nbsp; I appreciate the motives of the Liberty Coalition, but I am not pleased with the way they report breaches.&nbsp; I'll elaborate below in the commentary section.</span><br style="font-style: italic;"><br>"I understand the anxiety that our parents are experiencing.", said Sharber<br><br>"On Monday, we will be calling all parents of students whose social security numbers were exposed to let them know their child was affected, and we will follow up that phone call with a letter."<br><br>"We are working to locate a security company, and at our expense, we will cover the cost of fraud protection for the students affected."<br><span style="font-style: italic;">[Evan] I hope that the school locates a good "security company".&nbsp; Of course </span><a style="font-style: italic;" href="http://www.frsecure.com">FRSecure</a><span style="font-style: italic;"> would be glad to help.&nbsp; I promise to keep the plugs to a minimum <img src="http://breachblog.com/emoticons/smile.png" border="0" />.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>OK.&nbsp; We all know that a breach affecting kids is especially bad.&nbsp; We all know that we are all human and all humans make mistakes.&nbsp; I presume that there are a number of risky information security behaviors at Williamson County Schools.&nbsp; This risky behavior just so happened to expose personal information online.&nbsp; What other risky behaviors will be addressed at the school district?<br><br>Now about the Liberty Coalition's role.&nbsp; I appreciate the motives of Aaron Titus and the Liberty Coalition.&nbsp; He maintains the SSNBreach.org web site where he publicizes information security breaches that his organization finds (or is informed about).&nbsp; My attention was first drawn to Aaron Titus in August 2007, when he reported the <a href="https://www.ssnbreach.org/release.php?g=1">Louisiana Board of Regents breach</a> affecting ~200,000 people.&nbsp; What drew my attention to his report was not the breach itself, but the way in which it he proceeded to report it.&nbsp; Lyger at Attrition.org covers it well <a href="http://attrition.org/security/rant/z/privacy.html">here</a>.<br><br>In this case, the Liberty Coalition publicly posted this breach in October, 2007 which is more than 9 months before the victims were ever made aware!&nbsp; According to the Liberty Coalition press release; "We updated this press release after becoming aware of Mr. Nugent's relationship with the school district. The Liberty Coalition also worked directly with district officials to help them notify the affected individuals."&nbsp; It would have been nice if the victims were notified prior to a public press release.&nbsp; I wonder why Mr. Nugent's relationship with the school district wasn't known earlier.&nbsp; I don't have the details that the Liberty Coalition does surrounding this breach, so I can only speculate.<br><br>The fact that some breaches are reported on SSNBreach.org prior to notification (in this case nine months), I chose to generally not report them here at The Breach Blog. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/12/wcs.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 12 Jul 2008 20:12:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/school students">school students</category>
      <category domain="http://securityratty.com/tag/schools">schools</category>
      <category domain="http://securityratty.com/tag/williamson county schools">williamson county schools</category>
      <category domain="http://securityratty.com/tag/williamson county">williamson county</category>
      <category domain="http://securityratty.com/tag/county">county</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/school authorities">school authorities</category>
      <category domain="http://securityratty.com/tag/school district">school district</category>
      <source url="http://breachblog.com/2008/07/12/wcs.aspx">Williamson County Schools learns of breach reported nine months ago</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-06-10 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/488ab6b9815db50fb25776ac0d7849fb</link>
      <guid>http://securityratty.com/article/488ab6b9815db50fb25776ac0d7849fb</guid>
      <description><![CDATA[ONJava.com -- Esper: Event Stream Processing and Correlation
Taking the complex out of complex event processing | Service-Oriented Architecture | ZDNet.com
CEP, Complex Event Processing | StreamBase...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://www.onjava.com/pub/a/onjava/2007/03/07/esper-event-stream-processing-and-correlation.html">ONJava.com -- Esper: Event Stream Processing and Correlation</a></li>
<li><a href="http://blogs.zdnet.com/service-oriented/?p=1047">Taking the &lsquo;complex&rsquo; out of complex event processing | Service-Oriented Architecture | ZDNet.com</a></li>
<li><a href="http://www.streambase.com/cep.htm">CEP, Complex Event Processing | StreamBase</a></li>
<li><a href="http://hansgilde.wordpress.com/2008/04/14/ep-is-real-time-data-mining/#comment-204">EP is real-time data mining? &laquo; Hans Gilde&rsquo;s weblog</a></li>
<li><a href="http://www.ultimatewindowssecurity.com/reviews/logrhythm4.html">Randy Franklin Smith's Ultimate Windows Security - LR4</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/309356849" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 10 Jun 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/complex">complex</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <category domain="http://securityratty.com/tag/randy franklin smith">randy franklin smith</category>
      <category domain="http://securityratty.com/tag/hans gildes weblog">hans gildes weblog</category>
      <category domain="http://securityratty.com/tag/real-time data">real-time data</category>
      <category domain="http://securityratty.com/tag/windows security">windows security</category>
      <category domain="http://securityratty.com/tag/event stream">event stream</category>
      <category domain="http://securityratty.com/tag/streambase">streambase</category>
      <category domain="http://securityratty.com/tag/architecture">architecture</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/309356849/anton18">Links for 2008-06-10 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[700,000 records on stolen CCB server]]></title>
      <link>http://securityratty.com/article/31a0c887e162bd0eecb24965eb90aaeb</link>
      <guid>http://securityratty.com/article/31a0c887e162bd0eecb24965eb90aaeb</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/18/08

Organization
Numerous

See Commentary section for list of businesses

Contractor/Consultant/Branch
Central Collection Bureau (&quot;CCB

Victims...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/cbb.jpg" align="right" height="150" width="150"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/18/08<br><br><span style="font-weight: bold;">Organization: </span><br>Numerous*<br><br><font size="1">*See Commentary section for list of businesses</font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.ccbinc.net/index.htm">Central Collection Bureau ("CCB")</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Individuals who were referred to CCB for debt collection purposes by Indiana businesses, on or before March 20, 2008 <br><br><span style="font-weight: bold;">Number Affected:</span><br>~700,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information, including names, contact information, Social Security numbers, dates of birth, dates of service, and medical procedure codes"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Indiana residents are hereby alerted to a security breach at Central Collection Bureau (CCB, located at 7510 South Madison Avenue, Indianapolis, Indiana.&nbsp; This breach potentially exposed the personal information, including names, contact information, Social Security numbers, dates of birth, dates of service, and medical procedure codes."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.ccbinc.net/press_release_04182008.htm">Central Collection Bureau</a> <br><a href="http://www.suntimes.com/news/nation/906211,identity042108.article">Chicago Sun-Times (Associated Press)</a> <br><a href="http://www.wthr.com/Global/story.asp?S=8195357&amp;nav=menu188_2">NBC Channel 13 Eyewitness News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Central Collection Bureau<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>SECURITY BREACH NOTIFICATION ALERT:<br>CENTRAL COLLECTION BUREAU<br>Dated April 18, 2008<br><br>Indiana residents are hereby alerted to a security breach at Central Collection Bureau (CCB, located at 7510 South Madison Avenue, Indianapolis, Indiana. <br><br>This breach potentially exposed the personal information, including names, contact information, Social Security numbers, dates of birth, dates of service, and medical procedure codes.<br><br>These individuals were referred to CCB for debt collection purposes by Indiana businesses, on or before March 20, 2008 <br><br>Approximately 700,000 files may have been breached.<br><br>The businesses that engaged CCB for debt collection during that period of time are listed below.<br><br>Please note that only a very small percentage of the individuals who were patients or customers of the businesses below—i.e., those who ultimately were referred for debt collection—would have their personal information included in the CCB database.<br><br>Some of the information might be outdated. St. Vincent Health System said it had not given any billing business to Central Collection in more than three years, so all of the missing billing information is several years old.<br><span style="font-style: italic;">[Evan] This was a question that my colleagues and I were debating about this breach.&nbsp; 700,000 records seems like an awful lot of "active" collection accounts.&nbsp; CCB would need quite a few collection agents to service this many accounts, if in fact they were all active.&nbsp; I think we can assume that only a fraction of the 700,000 records were actually "active" and CCB did not effectively destroy information that they no longer needed to keep.</span><br><br>Other patients and customers of those companies are not affected by this breach.<br><br>The theft occurred on Friday, March 21, 2008, at CCB's location in Indianapolis.<br><br>On that date,&nbsp; thieves broke into the company's offices and stole 8 computers, as well as one of its servers (databases).<br><br>The server was password protected and protected by three locked doors.&nbsp; The 8 computers did not contain personal information.<br><br>The information was protected by two passwords but was not encrypted, Klene said.<br><br>"Our server was password protected. We have obviously spoken to some IT people who feel that a good computer hacker could get through those passwords," he said.<br><span style="font-style: italic;">[Evan] It doesn't even take a "good computer hacker" to get through the passwords.</span><br><br>CCB promptly contacted the police and is working with the Indiana Attorney General's office. <br><br>The company also promptly installed additional locks, a security system, and a motion detection system to help minimize the risk of any further unauthorized access to its information.<br><span style="font-style: italic;">[Evan] These will help with physical security.&nbsp; Full-disk encryption and a effective data retention policy wouldn't hurt for logical security, eh?&nbsp; Us information security guys would refer to multiple defensive layers as "defense in depth".&nbsp; Brilliant!</span><br><br>CCB apologizes to its clients and all Indiana residents affected by this incident.<br><br>"We're obviously heartsick about this," said Chet Klene, Central Collection Bureau president. "We've been in business since 1972, and nothing like this has ever happened before."<br><span style="font-style: italic;">[Evan] I don't doubt that CCB is "heartsick" by this incident.&nbsp; I feel bad for them and the fact that they probably did not know any better.&nbsp; Maybe this is partly a failure on the part of the information security profession as a whole.</span><br><br>While the company has no information suggesting that the breach occurred for purposes of identity theft, it nevertheless has contacted the three national credit bureaus to place a fraud alert.<br><br>Please go to the CCB website at <a href="http://www.ccbinc.net,">www.ccbinc.net,</a> call CCB at 317-887-5165 or 1-800-878-5165 or email CCB at theft@ccbinc.net for more information<br><br><span style="font-weight: bold;">Commentary:</span><br>Clients of CCB with information on the stolen server include:&nbsp; <br><br>Academy Animal Hospital, Advanced Interventional Pain, Advanced Physical Therapy, Alternative Care Experience, Anderson General Surgery, Andrew Dick MD, Anesthesia, Aqua Systems, Associated Billing, "Barbara Sturm, MD", Brad Sammons DDS, Brien Grow DO, Buchanan Counseling Services, Campion Barrow &amp; Assoc., Cardiothoracis Surgeons, Cardiovascular Diagnostic Services, Carl Foster MD, Caryn Guba DDS, Center For Orthopaedic Surgery, Central Indiana Phys Medicine &amp; Rehab, Charles Howe Professional Medical Corp, Charles Kelley III DPM, Charles Kerkhove Jr DDS, Charles Tomich DDS, Chiropractic Thereputics, Citizens Gas &amp; Coke, City of Franklin Ambulance, Clarian Radiology, Clinical Laboratory Physicians, Comdent, Comprecare, Culligan Water Conditioning, Cummins Behavioral Health System, D.E. Kelley DDS, Daniel Feeny MD, David Pennington III MD, David Shaw MD, David Szentes MD, Denture By Design, Dermatopathology Lab, Diagnostic Medicine, Dunlap Urgent Care, Edward J Diekhoff MD, Emily Cline MD, Emergency Medical Group Physicians, Forest Creek Family Dental, Friendly Village of Indy, Gary Hunt DDS, Gary Taylor DDS, Generations In Dentistry, George Small Jr MD, Gial Anesthesiology Service, Grandmas House Child Care, Greg Hardin MD, Hamilton Anesthesia Group, Hearing Center, Henderson Drugs &amp; Home Health, House of Kids, Howard Alig MD, Howard Regional Health System, Indiana Radiology Partners, Indiana Spine Group, Indiana General Surgery, Indiana Medical Network, Indpls Neurosurgical Group, Internal Medicine Plus, JCB Anesthesia &amp; Pain Mgt, Jeffrey Stevens DPM, Jennifer Siegel DDS, JMH Health Affiliates, John Jackson DC, John Norris MD, Johnson Co Anesthesia, Johnson County REMC, Johnson Memorial Hospital, Joseph Meek DDS, Julie Chao MD, Kenny Stall MD, Kerry Mays MD, Kevin Macadaeg MD, Khalil Wakim MD, Kidd Pediatrics, Knowledge Learning Corp, Koehring &amp; Sons, Kokomo Sports Center, Larry Buckel MD, Laura Steiner MD, Laura Stitle MD, Laurette Robey MD, Laverne Tubergen MD, Lawrence Falender DDS, Library Park Immediate Care, Lora Overton DO, Madison Anesthesia Group, Madison Avenue Flower Shop, Mark Ellis DDS, Mark Kahn DDS, Mark Ogle MD, Mark Yamanaka MD, Martinsville Dental Center, Memory Maker Studios, Mere Image Sportswear, Meridian Veterinary Clinic, Methodist Arthritis Physicians, Methodist Medical Group, Michael Arnold DDS, Michael Cozzi MD, Michael Harper, Midamerica Surgery Center, Milto Cleaners, Mitchell Foster MD, Muncie Cataract &amp; Laser Center, Nancy Zinni MD, Northside Surgical Specialists, Northside Anesthesia Services, Northwest Medical Pain Control, Nufinity, Orthopaedic Supplies Inc., Panchapakesan Harlan MD, Paul Batties MD, Paul Johnson DDS, Paul Johnson DDS, Paul Strange MD, Philip Borders MD, Pioneer Anesthesia Consultanta, PT Buntin MD, R.D. McQuiston MD, Rebecca De La Rosa DDS, Richard Herd Jr DDS, Rick Stephens Builder, Riley Bennett &amp; Egloff LLP, Robert Smith MD, Robert's Salon &amp; Day Spa, Ronald Wines DDS, RW Armstrong, Sandhya Nanda MD, Sarah Akard DDS, Scot Hagadorn MD, South Emerson Anesthesia Assoc., South Emerson Pain Management, South Emerson Surgery Center, Southeast Family Physicians, Southside Animal Hospital, Southside Family Medical Group, Southside Pediatrics, St. Vincent Health and related entities, Stephen Stitle MD, Stephen Szynal DO, Stonehedge Apartments, Stop 11 Animal Hospital, Sun Medical, Surgical Associates of Madison Co, Susan Wagner DDS, Thomas Eads MD, Thomas Ferrara MD, Tim Schafer DDS, University Family Physicians, University Pediatric Associates, University Surgeons, USF Inc, Valle Vista Guidance Center, Valle Vista Hospital, Walker Family Dentistry, Wells &amp; Marvel PC <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/22/cbb.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 22 Apr 2008 10:57:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dds">dds</category>
      <category domain="http://securityratty.com/tag/gary taylor dds">gary taylor dds</category>
      <category domain="http://securityratty.com/tag/gary hunt dds">gary hunt dds</category>
      <category domain="http://securityratty.com/tag/lawrence falender dds">lawrence falender dds</category>
      <category domain="http://securityratty.com/tag/joseph meek dds">joseph meek dds</category>
      <category domain="http://securityratty.com/tag/caryn guba dds">caryn guba dds</category>
      <category domain="http://securityratty.com/tag/mark ellis dds">mark ellis dds</category>
      <category domain="http://securityratty.com/tag/sarah akard dds">sarah akard dds</category>
      <category domain="http://securityratty.com/tag/ccb">ccb</category>
      <source url="http://breachblog.com/2008/04/22/cbb.aspx">700,000 records on stolen CCB server</source>
    </item>
    <item>
      <title><![CDATA[The Continuing .Gov Blackat SEO Campaign]]></title>
      <link>http://securityratty.com/article/20bc317bf017dd20ebd3bb5ebec5b01a</link>
      <guid>http://securityratty.com/article/20bc317bf017dd20ebd3bb5ebec5b01a</guid>
      <description><![CDATA[Just like the situation in the previous case of injecting SEO content into .gov domains , once the pages are up and running, they get actively advertised across the Web, again automatically. While...]]></description>
      <content:encoded><![CDATA[<a href="http://bp1.blogger.com/_wICHhTiQmrA/R7nzm6d7lrI/AAAAAAAABYo/vBZdtq6xIAA/s1600-h/bridger_SEO_content.jpg"><img id="BLOGGER_PHOTO_ID_5168429897239729842" style="FLOAT: left; MARGIN: 0px 10px 10px 0px; CURSOR: hand" alt="" src="http://bp1.blogger.com/_wICHhTiQmrA/R7nzm6d7lrI/AAAAAAAABYo/vBZdtq6xIAA/s200/bridger_SEO_content.jpg" border="0" /></a>Just like the situation in <a href="http://ddanchev.blogspot.com/2007/10/compromised-sites-serving-malware-and.html">the previous case</a> of <a href="http://ddanchev.blogspot.com/2007/11/p0rngov-ongoing-blackhat-seo-operation.html">injecting SEO content into .gov domains</a>, once the pages are up and running, they get actively advertised across the Web, again automatically. While <strong>bridger-mt.gov</strong> responds to <strong>72.22.69.184</strong>, the subdomain <strong>freeporn.eee.bridger-mt.gov</strong> is pointing to another netblock, in this case <strong>66.49.238.80</strong>, exactly the same approach was used in a previous such assessment that was however serving malware to its visitors. Here are some of the very latest such examples listed by directory :<br /><br />- Cobb County Government - <strong>cobbcountyga.gov/css</strong> - over 2,240 pages<br />- Benton Franklin Health District  - <strong>bfhd.wa.gov/search/templates/dark/.thumbs</strong> - 1,200 pages<br />- Bridger, Montana - <strong>freeporn.eee.bridger-mt.gov</strong> - 778 pages<br />- Mid-Region Council of Governments - <strong>mrcog-nm.gov/includes/phpmailer/language</strong> - 336 pages<br />- Michigan Senate - <strong>senate.michigan.gov/FindYourSenator/top</strong> - 26 pages<br />- Nevada City, California - <strong>nevadacityca.gov/postcards</strong> - 13 pages<br />- Brookhaven National Laboratory - <strong>pvd.chm.bnl.gov/twiki/pub/Trash/OnlinePharmacy</strong> - 12 pages<br /><br />Who's behind all of these? Checking the outgoing links and verifying the forums the advertisements got posted at could prove informative, but for instance, <strong>topsfield-ma.gov/warrant</strong> where a single blackhat SEO page was located seems to <a href="http://ddanchev.blogspot.com/2007/11/overperforming-turkish-hacktivists.html">have been hacked</a> by a <a href="http://ddanchev.blogspot.com/2007/11/mass-defacement-by-turkish-hacktivists.html">turkish defacement group</a> who left the following - "<em>RapciSeLo WaS HeRe !!! OwNz You - For AvciHack.CoM with greets given to "J0k3R  inf3RNo  ByMs-Dos  FuriOuS  SSeS  UmuT  SerSeriiii  Ov3R  YstanBLue  DeHS@ CMD  3RR0R  SaNaLBeLa  Keyser-SoZe  GoLg3  J0k3ReM  JackalTR  Albay ParS  MicroP</em>"<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=taCAhJE"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=taCAhJE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=5UkcTdE"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=5UkcTdE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kuB8mre"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kuB8mre" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=pz8ncXe"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=pz8ncXe" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=paftldE"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=paftldE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QsquYyE"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QsquYyE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wNv87Pe"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wNv87Pe" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/237185889" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 18 Feb 2008 12:23:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/gov">gov</category>
      <category domain="http://securityratty.com/tag/pages">pages</category>
      <category domain="http://securityratty.com/tag/gov domains">gov domains</category>
      <category domain="http://securityratty.com/tag/bridger">bridger</category>
      <category domain="http://securityratty.com/tag/gov responds">gov responds</category>
      <category domain="http://securityratty.com/tag/bridger-mt">bridger-mt</category>
      <category domain="http://securityratty.com/tag/cobb county government">cobb county government</category>
      <category domain="http://securityratty.com/tag/freeporn">freeporn</category>
      <category domain="http://securityratty.com/tag/subdomain freeporn">subdomain freeporn</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/237185889/continuing-gov-blackat-seo-campaign.html">The Continuing .Gov Blackat SEO Campaign</source>
    </item>
    <item>
      <title><![CDATA[Franklin University student information posted on Web]]></title>
      <link>http://securityratty.com/article/1d6b8149cea21f183cb740805b691597</link>
      <guid>http://securityratty.com/article/1d6b8149cea21f183cb740805b691597</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
1/29/08

Organization
Franklin University

Contractor/Consultant/Branch
None

Victims
Students and/or alumni

Number Affected
Unknown

Types of Data...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/franklin.jpg" align="right" height="95" width="196"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>1/29/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.franklin.edu/" target="_blank"> Franklin University</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students and/or alumni<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>Name, Social Security number, trimester and course number, email address, and Franklin University ID number<br><br><span style="font-weight: bold;">Breach Description:</span><br>A file containing sensitive personal information belonging to Franklin University students and alumni was inadvertently posted to a public web server.&nbsp; The number of affected persons has not been publicly released.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/Franklin_U.pdf" target="_blank"> The New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>A file containing the names, Social Security numbers, term and class information, email addresses, and Franklin University identification numbers of students and/or alumni was inadvertently placed on our web server, which made it possible for the information to be viewed online.<br><br>Although we believe the exposure to be minimal, it is possible that your information may have been viewed by others.<br><span style="font-style: italic;">[Evan] The "others" in this case are unauthorized persons.</span><br><br>We have removed the file from the Web server so the file can no longer be viewed online and we are working with third party experts to minimize the risk of future incidents of this nature.<br><span style="font-style: italic;">[Evan] If this information was available on the internet, there is a good chance that the information is also available through search engine caches.&nbsp; There is no mention whether or not Franklin University contacted Google, Yahoo!, etc. to have any cached information removed promptly.&nbsp; Personally, I have not had the opportunity to look.</span><br><br>We deeply regret this unfortunate situation.<br><br>Because we value our students and alumni, we are offering you credit monitoring through Experian@ for 12 months, at no expense to you.<br><br>We sincerely apologize for any inconvenience that this may cause you. To view Frequently Asked Questions on our Web site, visit <a href="http://www.franklin.edu/go/securityupdate.">www.franklin.edu/go/securityupdate.</a> If you have additional questions, please call us on our dedicated toll-free line at 1-877-212-2211 Monday through Thursday 8 a.m.-8 p.m., Friday 8 a.m.-5 p.m., or Saturday 9 a.m.-1 p.m. EST.<br><br><span style="font-weight: bold;">Commentary:</span><br>Mistakes will happen, so you should count on them happening.&nbsp; Many mistakes can be averted through effective information security training and awareness, and many mistakes can be minimized through effective incident response procedures and testing. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/01/30/franklin.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 30 Jan 2008 15:33:19 +0000</pubDate>
      <category domain="http://securityratty.com/tag/franklin university">franklin university</category>
      <category domain="http://securityratty.com/tag/franklin">franklin</category>
      <category domain="http://securityratty.com/tag/students">students</category>
      <category domain="http://securityratty.com/tag/students andor alumni">students andor alumni</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/franklin university identification">franklin university identification</category>
      <category domain="http://securityratty.com/tag/franklin university students">franklin university students</category>
      <category domain="http://securityratty.com/tag/class information">class information</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <source url="http://breachblog.com/2008/01/30/franklin.aspx">Franklin University student information posted on Web</source>
    </item>
    <item>
      <title><![CDATA[Security vs. Privacy]]></title>
      <link>http://securityratty.com/article/6a395199ffb6ff7b9d11a927aa94f61e</link>
      <guid>http://securityratty.com/article/6a395199ffb6ff7b9d11a927aa94f61e</guid>
      <description><![CDATA[If there's a debate that sums up post-9/11 politics, it's security versus privacy. Which is more important? How much privacy are you willing to give up for security? Can we even afford privacy in this...]]></description>
      <content:encoded><![CDATA[<p>If there's a debate that sums up post-9/11 politics, it's security versus privacy. Which is more important? How much privacy are you willing to give up for security? Can we even afford privacy in this age of insecurity? Security versus privacy: It's the battle of the century, or at least its first decade.</p>

<p>In a Jan. 21 <cite>New Yorker</cite> article, Director of National Intelligence Michael McConnell discusses a proposed plan to monitor all -- that's right, <em>all</em> -- internet communications for security purposes, an idea so extreme that the word "<a href="http://www.schneier.com/essay-036.html">Orwellian</a>" feels too mild.</p>

<p>The article (now online <a href="http://cryptome.org/spymaster.htm">here</a>) <a href="http://arstechnica.com/news.ars/post/20080117-us-intel-chief-wants-carte-blanche-to-peep-all-net-traffic.html">contains</a> <a href="http://blog.wired.com/27bstroke6/2008/01/feds-must-exami.html">this passage</a>:</p>

<blockquote>In order for cyberspace to be policed, internet activity will have to be closely monitored. Ed Giorgio, who is working with McConnell on the plan, said that would mean giving the government the authority to examine the content of any e-mail, file transfer or Web search. "Google has records that could help in a cyber-investigation," he said. Giorgio warned me, "We have a saying in this business: 'Privacy and security are a zero-sum game.'"</blockquote>

<p>I'm sure they have that saying in their business. And it's precisely why, when people in their business are in charge of government, it becomes a police state. If privacy and security really were a zero-sum game, we would have seen mass immigration into the former East Germany and modern-day China. While it's true that police states like those have less street crime, no one argues that their citizens are fundamentally more secure.</p>

<p>We've been told we have to trade off security and privacy so often -- in debates on <a href="http://www.huffingtonpost.com/ka-taipale/privacy-vs-security-se_b_71785.html">security</a> versus <a href="http://www.huffingtonpost.com/marc-rotenberg/privacy-vs-security-pr_b_71806.html">privacy</a>, <a href="http://findarticles.com/p/articles/mi_m0GER/is_2002_Winter/ai_97116472/pg_1">writing contests</a>, <a href="http://www.rasmussenreports.com/public_content/politics/current_events/general_current_events/51_say_security_more_important_than_privacy">polls</a>, <a href="http://www.scu.edu/ethics/publications/briefings/privacy.html">reasoned</a> <a href="http://www.csmonitor.com/2002/1015/p11s02-coop.html">essays</a> and political rhetoric -- that most of us don't even question the fundamental dichotomy.</p>

<p>But it's a <a href="http://www.schneier.com/crypto-gram-0109a.html#8">false</a> <a href="http://www.wired.com/politics/law/commentary/circuitcourt/2006/05/70971">one</a>.</p>

<p>Security and privacy are not opposite ends of a seesaw; you don't have to accept less of one to get more of the other. Think of a door lock, a burglar alarm and a tall fence. Think of guns, anti-counterfeiting measures on currency and that dumb liquid ban at airports. Security affects privacy only when it's based on identity, and there are <a href="http://www.schneier.com/essay-008.html">limitations to that sort of approach</a>.</p>

<p>Since 9/11, approximately three things have potentially improved airline security: reinforcing the cockpit doors, passengers realizing they have to fight back and -- possibly -- sky marshals. Everything else -- all the security measures that affect privacy -- is just <a href="http://www.schneier.com/essay-096.html">security theater and a waste of effort</a>.</p>

<p>By the same token, many of the anti-privacy "security" measures we're seeing -- <a href="http://www.schneier.com/essay-160.html">national ID cards</a>, <a href="http://www.schneier.com/essay-100.html">warrantless eavesdropping</a>, <a href="http://www.schneier.com/essay-108.html">massive data</a> <a href="http://www.schneier.com/essay-163.html">mining</a> and so on -- do little to improve, <a href="http://arstechnica.com/news.ars/post/20080119-analysis-metcalfes-law-real-id-more-crime-less-safety.html">and in some cases harm</a>, security. And government claims of their success are either <a href="http://www.schneier.com/blog/archives/2007/09/more_on_the_ger_1.html">wrong</a>, or against <a href="http://www.schneier.com/blog/archives/2007/06/portrait_of_the_1.html">fake threats</a>.</p>

<p>The debate isn't security versus privacy. It's liberty versus control. </p>

<p>You can see it in <a href="http://www.schneier.com/blog/archives/2007/11/redefining_priv.html">comments by government officials</a>: "Privacy no longer can mean anonymity," says Donald Kerr, principal deputy director of national intelligence. "Instead, it should mean that government and businesses properly safeguard people's private communications and financial information." Did you catch that? You're expected to give up control of your privacy to others, who -- presumably -- get to decide how much of it you deserve. That's what loss of liberty looks like.</p>

<p>It should be no surprise that people choose security over privacy: <a href="http://www.rasmussenreports.com/public_content/politics/current_events/general_current_events/51_say_security_more_important_than_privacy">51  to 29 percent in a recent poll</a>. Even if you don't subscribe to <a href="http://en.wikipedia.org/wiki/Maslow's_hierarchy_of_needs">Maslow's hierarchy of needs</a>, it's obvious that security is more important. Security is vital to survival, not just of people but of every living thing. Privacy is unique to humans, but it's a social need. It's <a href="http://www.schneier.com/blog/archives/2006/05/the_value_of_pr.html">vital to personal dignity, to family life, to society</a> -- to what makes us uniquely human -- but not to survival.</p>

<p>If you set up the false dichotomy, of course people will choose security over privacy -- especially if you scare them first. But it's still a false dichotomy. There is no security without privacy. And liberty requires both security and privacy. The famous quote attributed to Benjamin Franklin reads: "Those who would give up essential liberty to purchase a little temporary safety, deserve neither liberty nor safety." It's also true that those who would give up privacy for security are likely to end up with neither. </p>

<p>This essay <a href="http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0124">originally appeared</a> on Wired.com.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=Jv1YlaD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=Jv1YlaD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=psUxJZD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=psUxJZD" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 29 Jan 2008 02:21:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/privacy">privacy</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security affects privacy">security affects privacy</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/people choose security">people choose security</category>
      <category domain="http://securityratty.com/tag/choose security">choose security</category>
      <category domain="http://securityratty.com/tag/anti-privacy">anti-privacy</category>
      <category domain="http://securityratty.com/tag/afford privacy">afford privacy</category>
      <category domain="http://securityratty.com/tag/security theater">security theater</category>
      <source url="http://www.schneier.com/blog/archives/2008/01/security_vs_pri.html">Security vs. Privacy</source>
    </item>
    <item>
      <title><![CDATA[Presenting at the Connecticut Developers Group August 28th]]></title>
      <link>http://securityratty.com/article/bc8ec74f20252dfa7f5cd3e71b6c0c82</link>
      <guid>http://securityratty.com/article/bc8ec74f20252dfa7f5cd3e71b6c0c82</guid>
      <description><![CDATA[If anyone in the Connecticut is interested, I will be doing a presentation entitled Applied Cryptography on August 28 th . Its similar to the presentation I used to do ( Block Ciphers and...]]></description>
      <content:encoded><![CDATA[<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>If anyone in the </FONT><A href="http://www.ctdotnet.com/"><FONT face=Calibri>Connecticut is interested, I will be doing a presentation entitled Applied Cryptography on August 28<SUP>th</SUP></FONT></A><FONT face=Calibri>.<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>It&#8217;s similar to the presentation I used to do (</FONT><A href="http://marvets.com/blog/archive/2005/06/10/193.aspx"><FONT face=Calibri>Block Ciphers and Initialization Vectors</FONT></A><FONT face=Calibri>) only I&#8217;ve expanded its scope a little.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>I changed the presentation slightly and am trying to turn it into a </FONT><A href="http://www.dnrtv.com/"><FONT face=Calibri>dnrTV</FONT></A><FONT face=Calibri> episode with </FONT><A href="http://www.franklins.net/"><FONT face=Calibri>Cark Franklin</FONT></A><FONT face=Calibri> (who will also be in attendance).<SPAN style="mso-spacerun: yes">&nbsp; </SPAN>Hope to see you there.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 10pt"><FONT face=Calibri>-Eric Marvets</FONT></P><img src ="http://marvets.com/blog/aggbug/4207.aspx" width = "1" height = "1" />]]></content:encoded>
      <pubDate>Wed, 22 Aug 2007 09:20:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/presentation slightly">presentation slightly</category>
      <category domain="http://securityratty.com/tag/initialization vectors">initialization vectors</category>
      <category domain="http://securityratty.com/tag/block ciphers">block ciphers</category>
      <category domain="http://securityratty.com/tag/connecticut">connecticut</category>
      <category domain="http://securityratty.com/tag/cark franklin">cark franklin</category>
      <category domain="http://securityratty.com/tag/august">august</category>
      <category domain="http://securityratty.com/tag/dnrtv episode">dnrtv episode</category>
      <category domain="http://securityratty.com/tag/eric marvets">eric marvets</category>
      <source url="http://marvets.com/blog/archive/2007/08/22/4207.aspx">Presenting at the Connecticut Developers Group August 28th</source>
    </item>
  </channel>
</rss>
