<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: ibm]]></title>
    <link>http://securityratty.com/tag/ibm</link>
    <description></description>
    <pubDate>Thu, 28 Aug 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[IBM vets ID management, access control technologies on own systems]]></title>
      <link>http://securityratty.com/article/217e8d13f9228c6d834280430e360f8c</link>
      <guid>http://securityratty.com/article/217e8d13f9228c6d834280430e360f8c</guid>
      <description><![CDATA[Rather than selling only stand-alone security tools, IBM is working to embed antivirus, firewall and other security features into all of its software products, software chief Steve Mills...]]></description>
      <content:encoded><![CDATA[Rather than selling only stand-alone security tools, IBM is working to embed antivirus, firewall and other security features into all of its software products, software chief Steve Mills says.]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stand-alone security tools">stand-alone security tools</category>
      <category domain="http://securityratty.com/tag/security features">security features</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/software products">software products</category>
      <category domain="http://securityratty.com/tag/embed antivirus">embed antivirus</category>
      <category domain="http://securityratty.com/tag/firewall">firewall</category>
      <source url="http://www.networkworld.com/news/2008/100208-ibm.html?fsrc=rss-security">IBM vets ID management, access control technologies on own systems</source>
    </item>
    <item>
      <title><![CDATA[IBM software bundle targets retail theft, data breaches]]></title>
      <link>http://securityratty.com/article/cb4662b93f7c290a9d035a6a5cae17ea</link>
      <guid>http://securityratty.com/article/cb4662b93f7c290a9d035a6a5cae17ea</guid>
      <description><![CDATA[IBM is targeting retail security with a package of software and services designed to prevent physical loss of merchandise, protect against electronic threats and comply with credit card industry...]]></description>
      <content:encoded><![CDATA[IBM is targeting retail security with a package of software and services designed to prevent physical loss of merchandise, protect against electronic threats and comply with credit card industry regulations.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=70698?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=70698?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Tue, 30 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/prevent physical loss">prevent physical loss</category>
      <category domain="http://securityratty.com/tag/electronic threats">electronic threats</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/retail security">retail security</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/protect">protect</category>
      <category domain="http://securityratty.com/tag/comply">comply</category>
      <category domain="http://securityratty.com/tag/package">package</category>
      <source url="http://www.networkworld.com/news/2008/100108-ibm-retail-theft.html?fsrc=rss-security">IBM software bundle targets retail theft, data breaches</source>
    </item>
    <item>
      <title><![CDATA[IBM offers glimpse at future virtualization security products ]]></title>
      <link>http://securityratty.com/article/92ec20e2a7fe6cf604f74fc96a77fdbd</link>
      <guid>http://securityratty.com/article/92ec20e2a7fe6cf604f74fc96a77fdbd</guid>
      <description><![CDATA[IBM offered a glimpse at its next-generation Proventia security product line-up with offerings for an IPS &quot;virtual appliance,&quot; a network security controller, plus the next edition of SiteProtector 7.0...]]></description>
      <content:encoded><![CDATA[IBM offered a glimpse at its next-generation Proventia security product line-up with offerings for an IPS "virtual appliance," a network security controller, plus the next edition of SiteProtector 7.0 and a tool for measuring corporate security posture.]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network security controller">network security controller</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/virtual appliance">virtual appliance</category>
      <category domain="http://securityratty.com/tag/glimpse">glimpse</category>
      <category domain="http://securityratty.com/tag/security posture">security posture</category>
      <category domain="http://securityratty.com/tag/siteprotector">siteprotector</category>
      <category domain="http://securityratty.com/tag/ips">ips</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <category domain="http://securityratty.com/tag/edition">edition</category>
      <source url="http://www.networkworld.com/news/2008/092608-ibm-virtualization-security.html?fsrc=rss-security">IBM offers glimpse at future virtualization security products </source>
    </item>
    <item>
      <title><![CDATA[IBM's AppScan now quashes bugs during development]]></title>
      <link>http://securityratty.com/article/488f0772eaa24f9f2f96fc1b80acbda2</link>
      <guid>http://securityratty.com/article/488f0772eaa24f9f2f96fc1b80acbda2</guid>
      <description><![CDATA[IBM on Monday introduced new source-code-scanning software designed to spot security bugs as programs are being...]]></description>
      <content:encoded><![CDATA[IBM on Monday introduced new source-code-scanning software designed to spot security bugs as programs are being written.]]></content:encoded>
      <pubDate>Sun, 21 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spot security bugs">spot security bugs</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/programs">programs</category>
      <category domain="http://securityratty.com/tag/monday">monday</category>
      <source url="http://www.networkworld.com/news/2008/092208-ibms-appscan-now-quashes-bugs.html?fsrc=rss-security">IBM's AppScan now quashes bugs during development</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: The ROI of Social Networking]]></title>
      <link>http://securityratty.com/article/8c52c835add6dca7c33f67c83e868434</link>
      <guid>http://securityratty.com/article/8c52c835add6dca7c33f67c83e868434</guid>
      <description><![CDATA[How do you derive business value from social networks
Moderator: Nick Hoover, Senior Editor, InformationWeek
Speaker - Anne Berkowitch, Co-Founder &amp; CEO, SelectMinds
Speaker - J.B. Holston, CEO and...]]></description>
      <content:encoded><![CDATA[<p>How do you derive business <a href="http://www.interop.com/newyork/conference/enterprise-20.php" target="_blank">value from social networks</a>?</p>
<ul>
<li>Moderator: Nick Hoover, Senior Editor, InformationWeek</li>
<li>Speaker - Anne Berkowitch, Co-Founder &amp; CEO, SelectMinds</li>
<li>Speaker - J.B. Holston, CEO and President, NewsGator</li>
<li>Speaker - Umberto Milletti, CEO, InsideView</li>
</ul>
<p>Businesses can take advantage of social networks by finding innovative ways to reach out to people. Looking at who you know and how you know them can benefit you. Knowing a personal connection to someone that you are trying to contact (for sales) is helpful. The blurring between home, personal, and business life is making this information more available and better able to leverage. People are able to capture more valuable long term information from social networks.</p>
<p>A lot of social network applications can be taken from the talent management space. Deploying alumni networks as a talent source is also a great asset. Alumni represent a well-known and relevant population. This provides a great economic benefit from a social network.</p>
<p>If you are running a sales organization and looking at building a pipeline of leads, consider how these leads are relevant. The ability to get more leads is apparent in finding the right person, right connection, and right contact. Underlying everything are productivity and efficiency. How much time are sales reps spending researching and pursuing each opportunity? With information on social networks, the time can be greatly decreased. Knowledge sharing is something that can be actively measured.</p>
<p>The ROI varies with the business issue that&#8217;s trying to be addressed by a particular network. Recruiting for example has a very concrete, measurable ROI. Knowledge share gets a little more tricky. How do you measure how much is shared and the impact on business systems? Businesses need to determine what specific goal they are trying to address.</p>
<p>CFOs want to see ROI, not intuitive information. If you can demonstrate engagement and participation in these networks and knowledge sharing tools, more and more executives are getting comfortable seeing how it&#8217;s used at a qualitative and process level. It&#8217;s a very case by case basis.</p>
<p>One major crisis that we see in our customers is the competition between sales and marketing. Each wants to do their own thing, they go together like oil and water. However, the push of the economy is now forcing them work together. This is a great opportunity for IT to step in and help them collaborate and be more productive.</p>
<p>Other resistance from companies are how to manage what they are trying to accomplish while still giving employees free reign of sites like Facebook. What are the incentives for using these technologies? How does it fit into your company culture and productivity scale? You must bring meaning to the structure of engaging in social networks.</p>
<p>Social networks like LinkedIn and Facebook would not exist if people did not contribute information to them. However, if people don&#8217;t know that it is there, it does not exist. People need to see the value and get drawn in to engage. There are two ways that companies get into social networks. Tie it into the business process. The general idea of social networks are intuitive and easy to understand, which make it an easier case to present to chief executives. Make it clear - how do you go about it and what&#8217;s the value?</p>
<p>Social networks are intrinsically about extending the network, the more contacts you have, the more to choose from when researching a specific contact. It also has to be integrated into your dataworkflow. Companies are going to build a variety of networks inside and outside the enterprise. The big companies (SAP, IBM) are all rushing to offer collaborative and social network functionality. However, this is not entirely useful unless it&#8217;s integrated into the entire infrastructure.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 17:54:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/alumni networks">alumni networks</category>
      <category domain="http://securityratty.com/tag/social network applications">social network applications</category>
      <category domain="http://securityratty.com/tag/networks">networks</category>
      <category domain="http://securityratty.com/tag/social network">social network</category>
      <category domain="http://securityratty.com/tag/networks inside">networks inside</category>
      <category domain="http://securityratty.com/tag/social networks">social networks</category>
      <category domain="http://securityratty.com/tag/social network functionality">social network functionality</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/roi">roi</category>
      <source url="http://blog.sciencelogic.com/interop-ny-the-roi-of-social-networking/09/2008">Interop NY: The ROI of Social Networking</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: IBM]]></title>
      <link>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</link>
      <guid>http://securityratty.com/article/44ba0e9ad08b54462e9c92a6c54837a5</guid>
      <description><![CDATA[Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage
IBMs presentation was...]]></description>
      <content:encoded><![CDATA[<p>Day one of Interop NY began with an introduction from Interop Manager Lenny Heymann, then Bob Picciano, General manager Lotus software and WebSpehere Portal IBM took the stage.</p>
<p>IBM&#8217;s presentation was cleverly titled <strong>2mor0@Wrk</strong> - Tomororow work and Web 2.0.</p>
<p><strong>Overview</strong></p>
<p>Web 2.0 is delivering a whole different paradigm of communication. The slide is Lotus Symphony - NOT PPT. Over 2 million downloads.</p>
<p>There is an information overload that impacts individual productivity in the workplace. It has a profound effect on organizational productivity. A more complex organization entity provides more pressure and more inefficiencies in workplace. Up to 70% of time can be used looking for the WRONG information.</p>
<p>Collaboration mitigates information overload. It allows you to identify experts and opinions.</p>
<p>The collaboration agenda. Enterprises are at the onset of exploring these features. Web 2.0 is giving us the capacity to do more. Collaboration optimizes business outcomes - global, secure and dynamic.The most progressive companies are looking at UNIFIED COMMUNICATIONS. Making sure that directories and profiles are fully mobile.</p>
<p>Collaboration should be a contextual part of the workflow, going directly into applications.</p>
<p>IBM&#8217;s collaboration strategy is to deliver these services through online or offline services.</p>
<p><strong>Demonstration</strong></p>
<p>Executive IT architect Ron Sebastian provided a demonstration of IBM&#8217;s collaboration strategy. IBM&#8217;s Web 2.0 solutions span delivery platforms:</p>
<ul>
<li>Platform - web as&nbsp; platform</li>
<li>Application - development</li>
<li>People - social computing</li>
</ul>
<p><a href="http://www-01.ibm.com/software/lotus/products/connections/" target="_blank">Lotus Connections</a> - a family of social computing software that provides profile lookup and community capabilities. Think of Facebook, Yahoo Groups, and delicious combined in one portal.</p>
<p>Ron demonstrated these social services embedded into a healthcare provider application. Semantic tagging is available, contact information and commenting. Not only are we providing service to customers, you can integrate sync capability to directly call the person you want.</p>
<p>The biggest aspect of Lotus Connection? It&#8217;s all integrated.</p>
<p>A new service - <a href="https://www.bluehouse.lotus.com/" target="_blank">Project Bluehouse</a>. This is a SaaS delivery of these collaborated capabilities. The store and share can manage and share documents within and outside the company. Access control is no longer an issue.</p>
<p>Collaborative Web 2.0 services available as standalone products that also work in a mobile environment.</p>
<p><strong>Case Study: Natural Disaster Management Mashup</strong></p>
<p>Boeing came up with twenty different scenarios that they could handle through their systems. The problem was the one they didn&#8217;t count on. One example was Katrina - how to deliver supplies to the area: what airports were open? Where could they land? The problem was they could not find one list of public, private and military airports, nor what was open. The mashup took different feeds to allow the deacon maker to make a more rapid and intelligent decision based on information on where they could fly in the appropriate supplies. From open information sites like <a href="http://www.airnav.com/" target="_blank">AirNav.com</a> and personal contacts, users were able to mashup the information to make better decisions.</p>
<p><strong>Conclusion</strong></p>
<p><a href="http://www.eweek.com/c/a/Messaging-and-Collaboration/IBM-to-Unveil-Social-Software-Center-at-Interop/" target="_blank">IBM announced the IBM Center for Social Software</a>, proving their commitment to connect, collaborate, and innovate. Users and academics can work together to how these innovations can be applied to businesses and provide value to the market.</p>
<p>There has been <a href="http://teblog.typepad.com/david_tebbutt/2008/04/ibms-bluehouse.html" target="_blank">some question</a> of whether or not IBM can pull this off and move into the collaborative Web 2.0 market. Despite <a href="http://www.theappgap.com/ibm-bluehouse-organizes-online-meetings-and-the-before-and-after.html" target="_blank">some criticism</a>, it looks like IBM has really taken a step forward in advancing their products and services to meet market needs.</p>
<p>People drive better business outcomes. Connecting, collaboration, and innovation is key. Having the right tools and information to do that eases pressure that many organizations feel and brings Web 2.0 technologies to the heart of businesses.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 09:39:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/information sites">information sites</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/collaboration">collaboration</category>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/social">social</category>
      <category domain="http://securityratty.com/tag/ibms collaboration strategy">ibms collaboration strategy</category>
      <category domain="http://securityratty.com/tag/social services">social services</category>
      <category domain="http://securityratty.com/tag/collaborative web">collaborative web</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-ibm/09/2008">Interop NY Keynotes: IBM</source>
    </item>
    <item>
      <title><![CDATA[The Real Migration Problem]]></title>
      <link>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</link>
      <guid>http://securityratty.com/article/066428c6b802b3676a2c3982d275cbbd</guid>
      <description><![CDATA[Preview of Tom Friedman's thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added

FP: And what about drilling? Republican presidential candidate Sen. John McCain, his running...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.foreignpolicy.com/story/cms.php?story_id=4463">Preview</a> of Tom Friedman&#39;s thinking for his new book - Hot, Flat and Crowded. Killer quote (emphasis added):</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><span class="fp_red" style="color: #8c182d; font-weight: bold; "><strong>FP:&#160;</strong></span>And what about drilling? Republican presidential candidate Sen. John McCain, his running mate Gov. Sarah Palin, and President George W. Bush are implying that lifting environmental restrictions on drilling is the way to promote energy independence.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; "><strong>TF:&#160;</strong>Well, I think it’s patent nonsense. No one believes that somehow offshore, there’s enough oil in any near term and even the long term to provide us oil independence. It’s the wrong approach because in a world that’s hot, flat, and crowded, fossil fuels—and particularly crude oil—are going to be expensive and exhausting. Therefore the focus should be on the next great global industry: clean energy technology. <span style="font-weight: bold;">When I hear McCain pounding the table for “drill, drill, drill,” it reminds me of someone pounding the table for IBM Selectric typewriters on the eve of the IT revolution.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span><span style="font-family: Verdana; font-size: 12px; line-height: 16px; ">I’m not against offshore drilling, by the way, because I believe the technology and the safety has improved far beyond where it was back in the 70s, 80s, and 90s, even. What I’m against is making it the centerpiece of our energy policy. If all McCain said was, “Let’s drill, but let’s also throw everything into innovating the next generation of clean-energy technologies,” I’d say, “You’ve got it exactly right, pal.”</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></p><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Its funny because as someone who has done a half dozen legacy migration projects (with mental and emotional scars to prove it), I was thinking the same thing. The entrenched mindset. &quot;If we just dig our trench deeper (in this case literally) then we will be ok.&quot;...at least until the person in question retires...</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">One of the legacy migration project I worked on, I was the third consultant that tried to get this company off of mainframe and onto distributed systems (which are no panacea but this company really did need to make the move). The core developers of the mainframe were actively hostile to change, as opposed to simply passive aggressive, which we expect. For example, if you asked about how a piece of functionality worked, say a report writer, the developer would not answer, stand up, walk out of the room, come back with a 800 page &quot;data model&quot;, slam it on the table and walk out of the room. Good times.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">A chief objection beyond fear of the unknown was the perceived lack of elegance in the distributed systems as opposed to the control from say JCL. Anyway, what progress I made was due to analogizing that we were leaving Greece which has a rich culture, history, philosophy and moving to Rome which maybe was not as elegant as Greece but still people like circuses, roads and acqueducts. So when, several times a day, a perceived go/ no go issue arose, I would gently remind &#160;the developers that &quot;we are now in Rome and things work differently here.&quot;</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: 16px;">Intransigently digging the trench deeper is not the way, instead we need to better understanding the energy &#160;problem in a larger context, and finding deployable technologies to help address it. If you think drill, drill, drill is the answer, then I think the answer for you is the same as someone who knows COBOL and flat refuses to learn modern languages even when that is required - a nice retirement house on a golf course somewhere.</span></div>]]></content:encoded>
      <pubDate>Tue, 09 Sep 2008 05:38:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/clean-energy technologies">clean-energy technologies</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/drill">drill</category>
      <category domain="http://securityratty.com/tag/energy policy">energy policy</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/promote energy independence">promote energy independence</category>
      <category domain="http://securityratty.com/tag/trench deeper">trench deeper</category>
      <category domain="http://securityratty.com/tag/mccain">mccain</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/the-real-migration-problem.html">The Real Migration Problem</source>
    </item>
    <item>
      <title><![CDATA[If a tree falls in someone else's silo...]]></title>
      <link>http://securityratty.com/article/16a8e8bbe75a3994d655d2737adf90ce</link>
      <guid>http://securityratty.com/article/16a8e8bbe75a3994d655d2737adf90ce</guid>
      <description><![CDATA[Must read post by Iang

In the case of phishing, it is relatively clear. The developers believe the PKI book. The PKI people believe in the efficacy of digital signatures to prove stuff. The...]]></description>
      <content:encoded><![CDATA[<p>&#160;Must read <a href="https://financialcryptography.com/mt/archives/001093.html">post</a> by Iang:</p><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">In the case of phishing, it is relatively clear. The developers believe the PKI book. The PKI people believe in the efficacy of digital signatures to prove stuff. The cryptographers believe in the perfection of mathematics, and the security world believes in the completeness of their own learning. They are all wrong, but only at the large level of generalisations, not at the detailed level of particular claims. Any one of the claims,&#160;<em>in isolation</em>&#160;can be shown to be true. But, generalising these brittle claims to be solid building blocks is a completely different question. Few of the claims are strong enough to partake in a general model without severe support; the general model of secure browsing is the best evidence of how it is secure in name only.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px;"><br /></span><span style="color: #666666; font-family: georgia; line-height: 19px; ">How then is it built? By accident or by design, a series of claims meet together in a holy ring of righteous architecture. Each of the proponents claim loudly that their part is strong, but the ring has no strength. Eventually, one of the claims in the links is broken. For phishing, the browsers never did have the potential to show authenticity; not only did they not have the security strength to do it (c.f., Skype v.&#160;<a href="http://en.wikipedia.org/wiki/Cross-site_request_forgery" style="color: #003366; font-weight: normal; text-decoration: underline; ">CSRF</a>), they didn&#39;t even do it in practice (recall the lost padlock?), and their recent efforts to show authenticity (c.f. colour debate) reveal how far they are from understanding even the goal, let alone the implementation. Once that link was broken, and money was made, all the others revealed their weaknesses, as crooks systematically worked to breach the lot.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">If we look at the wider financial collapse, now underscored by the nationalisation of the worlds biggest financiers of mortgages ($ 5.3 trillion.... or is it $ 5.4 ?), we see the same pattern. The bankers believed in their product. The originators believed in their origination, the securitizers believed in their free market and accurate price, and the holders believed in the assets. The CDO, the subprime, the other 100 special names, each was a contract. Each was clear in and of itself. But, when placed end-to-end, in a line, with a bunch of other agreements, the claims that were good in isolation were not strong enough to participate in the super-claim made of the overall edifice.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; ">The financial system was built like a bridge; each piece rested on the previous one. And then, the clever architects bent the bridge around ... and around again, until the first piece met the last. The elegant keystone of finance was to finally lift up the first one to rest on the last.</span><br /><span style="color: #666666; font-family: georgia; line-height: 19px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #666666; font-family: georgia; line-height: 19px; ">Thus, the banks themselves invested their capital in their own product.</span></p></blockquote><p><span style="color: #666666; font-family: georgia; line-height: 19px;"><br /></span></p><div><span style="color: #666666; font-family: georgia; line-height: 19px;"><span style="color: #000000; font-family: &#39;Trebuchet MS&#39;; line-height: 15px; ">Maybe computer security failures won&#39;t ever result in $6 trillion worth of failures, but every day we bet more and more of our economy on networked computer systems. And those architectures are built on the precise mindsets that Iang portrays.</span><br /></span></div><br /><div>Banks are apt to comply with their auditor&#39;s request to run scans their resources, but what they do not do is build systems with architectural integrity. Why do you log in with a username and password? Why are the <a href="http://1raindrop.typepad.com/1_raindrop/2008/09/your-companies-biggest-security-hole---what-is-the-bgp-style-vuln-lurking-in-software-security.html">messaging systems not locked down</a>? Where are the strong identity tokens and claims? Do banks know that they are <a href="http://1raindrop.typepad.com/1_raindrop/2008/08/mainframe-mindset.html">not on a mainframe any more</a>?&#160;</div><br /><div>Sadly, they don&#39;t - they build a web silo and then they hook it up the legacy silo and put a wide open messaging system in between. There is no end to end security design, just silos. The banks build distributed systems, they operate distributed systems, but they don&#39;t design distributed systems.</div><br /><div>It is too bad, its never been a core competency of banks to design systems, but it never mattered before because IBM just drew up the plan and the banks followed it. Now everyone has their own plan, but the security architecture reflects an auditor&#39;s checklist and manager&#39;s <a href="http://1raindrop.typepad.com/1_raindrop/2008/08/golf-driven-security.html">golf games</a> not risk management decisions or security architecture.</div><br /><div>If a tree falls in someone else&#39;s silo, your system doesn&#39;t hear until their silo knocks yours over...</div>]]></content:encoded>
      <pubDate>Mon, 08 Sep 2008 08:29:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/silo">silo</category>
      <category domain="http://securityratty.com/tag/design">design</category>
      <category domain="http://securityratty.com/tag/design systems">design systems</category>
      <category domain="http://securityratty.com/tag/systems">systems</category>
      <category domain="http://securityratty.com/tag/brittle claims">brittle claims</category>
      <category domain="http://securityratty.com/tag/claims">claims</category>
      <category domain="http://securityratty.com/tag/computer systems">computer systems</category>
      <category domain="http://securityratty.com/tag/legacy silo">legacy silo</category>
      <category domain="http://securityratty.com/tag/banks">banks</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/if-a-tree-falls-in-someone-elses-silo.html">If a tree falls in someone else's silo...</source>
    </item>
    <item>
      <title><![CDATA[Proctor & Gamble outsources security to IBM, but keeping security staff]]></title>
      <link>http://securityratty.com/article/f2a4be8bdad687786f5209a45d451692</link>
      <guid>http://securityratty.com/article/f2a4be8bdad687786f5209a45d451692</guid>
      <description><![CDATA[Proctor &amp; Gamble has selected IBM ISS to provide managed security services worldwide under a 5-year contract in which IBM ISS will manage internal- and perimeter-based security and host...]]></description>
      <content:encoded><![CDATA[Proctor & Gamble has selected IBM ISS to provide managed security services worldwide under a 5-year contract in which IBM ISS will manage internal- and perimeter-based security and host defenses.
]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security services worldwide">security services worldwide</category>
      <category domain="http://securityratty.com/tag/ibm iss">ibm iss</category>
      <category domain="http://securityratty.com/tag/gamble">gamble</category>
      <category domain="http://securityratty.com/tag/proctor">proctor</category>
      <category domain="http://securityratty.com/tag/host defenses">host defenses</category>
      <category domain="http://securityratty.com/tag/manage internal-">manage internal-</category>
      <category domain="http://securityratty.com/tag/5-year contract">5-year contract</category>
      <category domain="http://securityratty.com/tag/provide">provide</category>
      <source url="http://www.networkworld.com/news/2008/082908-proctor.html?fsrc=rss-security">Proctor &amp; Gamble outsources security to IBM, but keeping security staff</source>
    </item>
    <item>
      <title><![CDATA[Procter & Gamble outsources security to IBM, but keeping security staff]]></title>
      <link>http://securityratty.com/article/7450d57c504f01a577a770aa96ee37be</link>
      <guid>http://securityratty.com/article/7450d57c504f01a577a770aa96ee37be</guid>
      <description><![CDATA[Procter &amp; Gamble has selected IBM ISS to provide managed security services worldwide under a 5-year contract in which IBM ISS will manage internal- and perimeter-based security and host...]]></description>
      <content:encoded><![CDATA[Procter & Gamble has selected IBM ISS to provide managed security services worldwide under a 5-year contract in which IBM ISS will manage internal- and perimeter-based security and host defenses.
<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=92489?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=92489?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Thu, 28 Aug 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security services worldwide">security services worldwide</category>
      <category domain="http://securityratty.com/tag/ibm iss">ibm iss</category>
      <category domain="http://securityratty.com/tag/gamble">gamble</category>
      <category domain="http://securityratty.com/tag/procter">procter</category>
      <category domain="http://securityratty.com/tag/manage internal-">manage internal-</category>
      <category domain="http://securityratty.com/tag/host defenses">host defenses</category>
      <category domain="http://securityratty.com/tag/5-year contract">5-year contract</category>
      <category domain="http://securityratty.com/tag/provide">provide</category>
      <source url="http://www.networkworld.com/news/2008/082908-procter.html?fsrc=rss-security">Procter &amp; Gamble outsources security to IBM, but keeping security staff</source>
    </item>
  </channel>
</rss>
