<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: manual]]></title>
    <link>http://securityratty.com/tag/manual</link>
    <description></description>
    <pubDate>Sat, 07 Jun 2008 22:49:38 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[ScienceLogics 5-Year Anniversary]]></title>
      <link>http://securityratty.com/article/1287b8dac0ea60512bed5f303d15fe55</link>
      <guid>http://securityratty.com/article/1287b8dac0ea60512bed5f303d15fe55</guid>
      <description><![CDATA[August 2003. The largest blackout in U.S. history darkens the Northeast and Midwest, the Blaster worm has been unleashed and Madonna and Britney create a stir at the 2003 MTV Music Video Awards . In...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="164" alt="B-day Cake" src="http://blog.sciencelogic.com/wp-content/uploads/2008/08/b-day-cake1.jpg" width="244" align="left" border="0"> August 2003. The largest <a href="http://blogs.wsj.com/biztech/2008/08/13/celebrating-the-anniversary-of-the-big-blackout/?mod=djemTECH" target="_blank">blackout</a> in U.S. history darkens the Northeast and Midwest, the <a href="http://news.cnet.com/2010-1001-5117862.html" target="_blank">Blaster worm</a> has been unleashed and Madonna and Britney create a stir at the <a href="http://en.wikipedia.org/wiki/2003_MTV_Video_Music_Awards" target="_blank">2003 MTV Music Video Awards</a>. In the midst of this <a href="http://www.grid.unep.ch/product/publication/download/ew_heat_wave.en.pdf" target="_blank">hot summer</a> madness, ScienceLogic was founded.
<p>To kick off our celebration of our first five years, we asked <a href="http://www.sciencelogic.com/leadership.htm" target="_blank">ScienceLogic founders</a> Dave Link, Richard Chart and Chris Cordray for their thoughts and memories on events leading to today’s milestone. How and why did they set out on this venture? What happened along the way – expected and unexpected? Why were they successful in times when other new (and established) businesses have come and <a href="http://en.wikipedia.org/wiki/Category:2003_disestablishments" target="_blank">gone</a>?
<p><b>How did you three put together this team?</b>
<p>We all worked together at a large Managed Service Provider for a couple of years before leaving to start ScienceLogic, so we all knew each other and knew our collective strengths. More importantly, each of us had worked with network management tools on some level (sales and marketing, engineering and product development), and knew first-hand all of the customer pain points, from every perspective. So we left and began rapidly figuring out how to build a better network management solution based upon our real world operational experience..
<p><strong>Dave:</strong> One interesting aspect is that our areas of expertise don’t overlap, which has contributed to our success. Chris is excellent with developing the product front-end and interface, Richard handled the backend architecture and engineering and I focused on the technical business side of sales and marketing. Our roles have been to build a product that works well and that provides real value to operations teams that experience the same day to day frustrations that we felt.<b></b>
<p><b>Whose idea was it to start the company?</b>
<p><strong>Dave:</strong> It was really a collective effort. We were all passionate about “getting it right” and not just starting a company. We knew the industry need and between us, we had the knowledge and skill sets to address all of the right aspects of developing a product and a building a business around it.
<p><b>What process did you go through to get started?</b>
<p><strong>Richard:</strong> From the beginning we knew the type of solution the market needed and we knew that we wanted to build it as an appliance. From different vantage points, we had each experienced the effects of long, difficult and expensive installations that still exist with traditional network tools. Every install has unique variations: there are always different server types, varying hardware and software versions, different patches installed, and on and on. Every installation was time consuming and unpredictable. We knew that an appliance model would address all of these variables and save a lot of time on how quickly customers could achieve immediate value.
<p>The harder decisions were around actually starting the business, assessing the market and of course determining the product pricing.
<p><b>EM7 completely flips the traditional model of complex, lengthy and expensive deployments. How did you convince others that the EM7 Meta-Appliance product was valid?</b>
<p><strong>Dave:</strong> Yes, EM7 totally disrupts the traditional model for network management. While others take a narrow approach, we intentionally designed EM7 to focus on the broad problem – managing the data center. How do you cover a variety of technologies and make sure they work seamlessly together? The vision was to make it easier, not harder, for customers.
<p><strong>Chris:</strong> I have to give it to Dave – very early on, he realized the power of a demo. If Dave could get in front of someone, he’d make them a believer. He’d use the Peter Falk/Columbo technique of “let me show you one more thing.” It was very effective. It’s getting easier, but even today people sometimes have to see EM7 in action before they become believers.
<p><b>Can you describe the early days of running a new business?</b>
<p><strong>Dave:</strong> ScienceLogic is a classic case of entrepreneurship. For the first year we worked out of our basements. We kept the costs low in every conceivable way and spent the first year developing the product before we even made a sale.
<p><strong>Chris:</strong> We stayed at lots of odd places when we were on the road, took cheap flights with multiple layovers and purchased lots of our first test equipment on eBay. This was during the dot-com bust so there was lots of equipment for sale on eBay, really cheap!
<p><strong>Richard:</strong> The amount of equipment I had in my house was absolutely crazy. Back then, servers were huge – I had a Cisco 6509 Catalyst, a Compaq Proliant DL380, Brocade switch, IBM Netfinity 4500R, and tons of other machines.
<p><strong>Chris:</strong> I had to install a new circuit box at home because I was blowing breakers. I remember when that 6509 crashed, we revived it and it died again. The second death was final.
<p><b>So you started in your houses – what was your first office space?</b>
<p><strong>Dave:</strong> My friend, the CEO at Ernst &amp; Young Technology had a few extra cubes and a data center in their office that they graciously allowed us to use. Their help was an important step in helping us really formalize the business. We started doing well and adding people, but ironically, their company was downsizing. Before long, many of their original YET people were gone and the ScienceLogic team kept growing in to the open cubes.
<p>Our first leased space was converted warehouse space in Chantilly, VA that once housed an internet radio station. It was cool – it had a large salt water fish tank, a loft, a spiral staircase and a Star Trek door that retracted into the walls with the customary lights and “whooshing” sound.
<p>We outgrew the Chantilly space, leading to our current office in Reston, VA.
<p><b>Who was the first ScienceLogic customer?</b>
<p>Our first paying customer was <a href="http://martinspoint.com/" target="_blank">Martins Point Health Care</a>. We deployed there in July 2004 and are pleased to say they continue to be a ScienceLogic customer. Other early (and still) EM7 <a href="http://www.sciencelogic.com/customers.htm" target="_blank">customers</a> include Navy Knowledge Online and the Department of Transportation. Nearly all of our customers are still actively using EM7 and renewing their maintenance.
<p><b>Where do you see the company in the next 5, 10 or 15 years?</b>
<p>Well, our revenue has doubled year-over-year in each of the last three years, so of course we’d like to continue to grow like that or even faster. In five years we’ve gone from three founders to the point where Dave does not know everyone’s fondest childhood memory. We’ll continue to scale our growth to cover the demands of our growing customer base.
<p><b>Where do you see the industry going over the coming years?</b>
<p><strong>Chris:</strong> IT is always moving and gaining in complexity, so network management is also becoming more complicated. There’s increasing diversity, new standards, virtualization and cloud computing. All of these are today’s technologies. Customers have a mix of the old and the new, so EM7 has to accommodate and support both.
<p><strong>Richard:</strong> Each generation of products has a new set of ways to monitor, but the “old” doesn’t go away. Even when a new, hot technology comes along, the old technologies still need to be supported. We work to ensure EM7 keeps up with both.
<p><strong>Dave:</strong> After five years we’re just hitting our stride and we’re just now reaching the tipping point in awareness of ScienceLogic and EM7. We’re all still passionate about the product and as Chris and Rich said, there’s still a lot do. We’ll continue disrupting the market with EM7. Our vision hasn’t changed, and with the increasing levels of automation that customers demand, the market needs are greater than ever. Our future is as bright, or brighter, than ever and we’ll continue to be looking for smart ways to automate traditionally manual IT Operations processes.
<p><b>What’s your advice for someone interested in starting their own business?</b>
<p><strong>Chris:</strong> Be passionate. That’s what has gotten me through the tough times. I didn’t really appreciate this thought when I heard others say it before. But it’s very true.
<p><strong>Richard:</strong> I agree. We met and talked with lots of people who told us, “That’s been done before.” But we kept going because we truly believed in what we were doing and we knew that while our approach was different, that it would be successful.
<p><strong>Richard:</strong> Be fearless. You can’t be too nervous and you need to be able to expect and handle the stress because it will be there. You have to learn to accept the stressful times as a necessary part of the process of starting out on your own.
<p><strong>Dave:</strong> Know your niche from the beginning and give potential customers a compelling reason to trust you and really benefit from your solution. You have to know the problem, see the gap and have a clear and consistent vision of how to solve the problem. Then you have to execute. If you don’t build your team with “doers” you won’t make it.
<p><strong>Chris:</strong> It helps to have friends. ScienceLogic was built on friendships and relationships, starting with the three of us. If you look at our team, most of our hires are referrals – people who developed and maintained great connections with other great people throughout their careers. Maintain your connections and keep in touch with your network of friends.</p>
]]></content:encoded>
      <pubDate>Wed, 20 Aug 2008 18:39:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/em7 completely flips">em7 completely flips</category>
      <category domain="http://securityratty.com/tag/em7">em7</category>
      <category domain="http://securityratty.com/tag/network management">network management</category>
      <category domain="http://securityratty.com/tag/network management tools">network management tools</category>
      <category domain="http://securityratty.com/tag/em7 meta-appliance product">em7 meta-appliance product</category>
      <category domain="http://securityratty.com/tag/sciencelogic team">sciencelogic team</category>
      <category domain="http://securityratty.com/tag/team">team</category>
      <category domain="http://securityratty.com/tag/front">front</category>
      <category domain="http://securityratty.com/tag/product front-end">product front-end</category>
      <source url="http://blog.sciencelogic.com/sciencelogics-5-year-anniversary/08/2008">ScienceLogics 5-Year Anniversary</source>
    </item>
    <item>
      <title><![CDATA[Wired 802.1X and Windows XP SP3- Yes you can!]]></title>
      <link>http://securityratty.com/article/0178304882a872ac541258a4d798bda7</link>
      <guid>http://securityratty.com/article/0178304882a872ac541258a4d798bda7</guid>
      <description><![CDATA[Ive gotten a lot of questions recently about using 802.1X on the wired interface with Windows XP SP3. In the past few weeks Ive also stumbled across a lot of forum posts, blogs and articles stating...]]></description>
      <content:encoded><![CDATA[<P>I&#8217;ve gotten a lot of questions recently about using 802.1X on the wired interface with Windows XP SP3. In the past few weeks I&#8217;ve also stumbled across a lot of forum posts, blogs and articles stating you <em>&#8216;can&#8217;t do wired 802.1X with XP SP3</em>.&#8221;</P>
<P>Well, sure you can! There is a little trick now, though. </P>
<P><strong>As part of the move to the Microsoft NAP integration, they&#8217;ve broken out the wired and wireless supplicant management</strong> into two pieces. Until SP3, all 1X was handled in the Wireless Zero Configuration (WZCSVC)&nbsp;service. The wired 1X supplicant is handled now by a different service and must be <span style="TEXT-DECORATION: underline">manually started</span>. </P>
<P>
<blockquote>
<P>In Windows XP SP3, the supplicants are each handled separately by these services&#8230;<br>&nbsp;&nbsp;&nbsp; •&nbsp; Wireless 802.1X: WZCSVC service <br>&nbsp;&nbsp;&nbsp; •&nbsp; Wired 802.1X:&nbsp;Wired AutoConfig service (DOT3SVC)</P></blockquote><strong>How do you start the Wired AutoConfig service?</strong> Two ways, the end user (or admin) can do it manually on the endpoint, or you can push it out with group policies. <br>
<P>Instead of duplicating a lott&#8217;a text, you can find detailed instructions for manual and pushed wired 1X configurations on <A class=offsite-link-inline title="Microsoft KB Article" href="http://support.microsoft.com/kb/953650" target=_blank>Microsoft KB article 953650</A>. </P>
<P>You can also learn more about Microsoft NAP integration in the <A class=offsite-link-inline title="Microsoft NAP Q&amp;A" href="http://www.microsoft.com/technet/network/nap/napfaq.mspx" target=_blank>Network Access Protection Q&amp;A site</A>. </P>
<P># # #</P>
]]></content:encoded>
      <pubDate>Wed, 23 Jul 2008 09:59:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wired">wired</category>
      <category domain="http://securityratty.com/tag/wzcsvc service">wzcsvc service</category>
      <category domain="http://securityratty.com/tag/wzcsvc">wzcsvc</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/wired autoconfig service">wired autoconfig service</category>
      <category domain="http://securityratty.com/tag/wired interface">wired interface</category>
      <category domain="http://securityratty.com/tag/sp3">sp3</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/microsoft nap integration">microsoft nap integration</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/7/23/wired-8021x-and-windows-xp-sp3-yes-you-can.html">Wired 802.1X and Windows XP SP3- Yes you can!</source>
    </item>
    <item>
      <title><![CDATA[Growing Without Adding Overhead: Opus Interactive]]></title>
      <link>http://securityratty.com/article/b31466803f8417d2b35d5e511b6828a7</link>
      <guid>http://securityratty.com/article/b31466803f8417d2b35d5e511b6828a7</guid>
      <description><![CDATA[We had the pleasure of interviewing client Opus Interactives Director of DataCenter Operations at Interop Las Vegas this year , and thought this was a great time to highlight some of the other...]]></description>
      <content:encoded><![CDATA[<p>We had the pleasure of <a href="http://blog.sciencelogic.com/green-it-and-virtualization-management-one-service-providers-tale/05/2008" target="_blank">interviewing client Opus Interactive’s Director of DataCenter Operations at Interop Las Vegas this year</a>, and thought this was a great time to highlight some of the other successes that Opus has had in managing their growth and IT operations.
<p>Like most of the service providers we talk to, they look to virtualization to provide immediate benefits to the business – e.g, cost savings from server consolidation and support for Green IT through cutting power/cooling requirements. And one more dimension to virtualization – Opus launched a new service, vClustr, which is a virtual dedicated server that provides the benefits of a fully managed dedicated server at a fraction of the cost&#8230;managed by EM7, of course.
<p>We were happy to help Opus by working with them to implement our EM7 solution. Their growth plan was severely limited by inefficient processes and tools. As Opus grew rapidly in 2006, the tools they had in place were not easy to integrate as they were managed independently. There was a manual billing and ticketing infrastructure in place, and valuable engineer time was spent on maintaining what they had instead of enabling business growth. The company faced a choice, either grow by adding overhead and bodies or grow through automation.
<p>Opus chose automation. They needed an automated solution to cover their immediate needs, and also enable them to scale processes for emerging technologies and future service offerings. Throughout their growth, Opus wanted to maintain their “customer first” philosophy and expand <a href="http://green-pc.blogspot.com/2008/07/green-technology-high-on-it-agenda.html" target="_blank">their green efforts</a>.
<p>By choosing EM7, Opus was able to replace their multiple, disparate tools with a single, integrated management system for networks, servers, applications, service desk assets and virtualization infrastructure. EM7 provided automated billing, ticketing, alerts and escalation options as well as a branded customer portal for transparency and self-service ticketing.
<p>The results were tremendous. Opus Interactive recouped $130k per year of engineering resources. They automated critical operations to increase efficiency, enabled proactive monitoring and prepared for growth, while giving the business the processes and tools to grow the business without additional human capital resources.
<p>We’re glad that we could help such a great company achieve their goals of providing an <a href="http://serverspecs.blogs.techtarget.com/2008/07/03/flash-advancements-help-data-center-efficiency/" target="_blank">efficient</a> “best-in-class” solution that combined superior customer service with a <a href="http://www.greenm3.com/2008/07/a-look-inside-m.html" target="_blank">green philosophy</a>.
<p>Get the entire <a href="http://www.sciencelogic.com/pdf/Opus_Interactive_Case_Study.pdf" target="_blank">case study</a> here.</p>
<p><a href="http://sharethis.com/item?&wp=abc&amp;publisher=ea11358c-69de-4e80-9804-e964a8930b70&amp;title=Growing+Without+Adding+Overhead%3A+Opus+Interactive&amp;url=http%3A%2F%2Fblog.sciencelogic.com%2Fgrowing-without-adding-overhead-opus-interactive%2F07%2F2008">ShareThis</a></p>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 15:39:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/opus">opus</category>
      <category domain="http://securityratty.com/tag/opus interactive">opus interactive</category>
      <category domain="http://securityratty.com/tag/virtualization">virtualization</category>
      <category domain="http://securityratty.com/tag/virtualization opus">virtualization opus</category>
      <category domain="http://securityratty.com/tag/customer">customer</category>
      <category domain="http://securityratty.com/tag/customer portal">customer portal</category>
      <category domain="http://securityratty.com/tag/superior customer service">superior customer service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/growth plan">growth plan</category>
      <source url="http://blog.sciencelogic.com/growing-without-adding-overhead-opus-interactive/07/2008">Growing Without Adding Overhead: Opus Interactive</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-07-15 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/6d10d0e3306711df8bca069e3f891fa8</link>
      <guid>http://securityratty.com/article/6d10d0e3306711df8bca069e3f891fa8</guid>
      <description><![CDATA[SAP Library - Administration Manual - Logging
TaoSecurity: The Best Single Day Class Ever I had the great fortune to attend Edward Tufte's one day class Presenting Data and Information. I only knew...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/b7/54e63f48e58f15e10000000a155106/frameset.htm">SAP Library - Administration Manual - Logging</a></li>
<li><a href="http://taosecurity.blogspot.com/2008/06/best-single-day-class-ever.html">TaoSecurity: The Best Single Day Class Ever</a><br/>
I had the great fortune to attend Edward Tufte's one day class Presenting Data and Information. I only knew Tufte from advertisements in the Economist. For example, the image at left was frequently used as an ad in the print magazine.</li>
<li><a href="http://eventlogs.blogspot.com/2008/06/event-analyst-7-can-slice-and-dice-your.html">Dorian Software BLOG: Event Analyst &reg; 7 Can Slice and Dice Your Security Event Logs ... Any Way Your Auditors Want Them Served</a></li>
<li><a href="http://securosis.com/2008/06/25/the-future-of-application-and-database-security-part-1-setting-the-stage/">The Future Of Application And Database Security: Part 1, Setting The Stage | securosis.com</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/336759455" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/single day class">single day class</category>
      <category domain="http://securityratty.com/tag/day class">day class</category>
      <category domain="http://securityratty.com/tag/attend edward tufte">attend edward tufte</category>
      <category domain="http://securityratty.com/tag/tufte">tufte</category>
      <category domain="http://securityratty.com/tag/dorian software blog">dorian software blog</category>
      <category domain="http://securityratty.com/tag/security event logs">security event logs</category>
      <category domain="http://securityratty.com/tag/administration manual">administration manual</category>
      <category domain="http://securityratty.com/tag/database security">database security</category>
      <category domain="http://securityratty.com/tag/sap library">sap library</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/336759455/anton18">Links for 2008-07-15 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Effective Security with a Continuous Approach to ISO 27001 Compliance]]></title>
      <link>http://securityratty.com/article/742a0f6337db9ec4d8b2ea17dead37c7</link>
      <guid>http://securityratty.com/article/742a0f6337db9ec4d8b2ea17dead37c7</guid>
      <description><![CDATA[Source: Tripwire) The ISO 27001 standard is primarily referred to as the Information Security Management System (ISMS) certification standard. Organizations that seek to implement an ISMS are examined...]]></description>
      <content:encoded><![CDATA[<b>(Source: Tripwire)</b>  The ISO 27001 standard is primarily referred to as the Information Security Management System (ISMS) certification standard.  Organizations that seek to implement an ISMS are examined against ISO 27001. As with several global standards, the scope of this standard is far reaching, with several sets of control objectives and guidelines. Its fundamental purpose is to act as a compendium of techniques for securing IT environments and thus effectively managing business risk as well as demonstrating regulatory compliance.<p>ISO 27001 is recognized internationally as a structured methodology for information security. Companies that choose to adopt ISO 27001 demonstrate their commitment to high levels of information security, however it does not mandate specific procedures nor define the implementation techniques for gaining certification. Thus, companies being audited for ISO 27001 compliance deal with the same issues that plague companies facing regulatory audits: how to effectively achieve compliance and, following an audit, cost-effectively maintain it.<p>The Tripwire Enterprise solution provides organizations with powerful configuration control through its configuration assessment and change auditing capabilities. In this white paper, learn how with Tripwire Enterprise, organizations can quickly achieve IT configuration integrity by proactively assessing how their current configurations measure up to specifications as given in ISO 27001. This provides immediate visibility into the state of their systems, and through automating the process, saves time and effort over a manual efforts.
<p><a href="http://feeds.computerworld.com/~a/Computerworld/Security/News?a=k034He"><img src="http://feeds.computerworld.com/~a/Computerworld/Security/News?i=k034He" border="0"></img></a></p><img src="http://feeds.computerworld.com/~r/Computerworld/Security/News/~4/331677375" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 09:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iso">iso</category>
      <category domain="http://securityratty.com/tag/tripwire enterprise">tripwire enterprise</category>
      <category domain="http://securityratty.com/tag/tripwire enterprise solution">tripwire enterprise solution</category>
      <category domain="http://securityratty.com/tag/adopt iso">adopt iso</category>
      <category domain="http://securityratty.com/tag/tripwire">tripwire</category>
      <category domain="http://securityratty.com/tag/certification standard">certification standard</category>
      <category domain="http://securityratty.com/tag/certification">certification</category>
      <category domain="http://securityratty.com/tag/standard">standard</category>
      <category domain="http://securityratty.com/tag/plague companies">plague companies</category>
      <source url="http://feeds.computerworld.com/~r/Computerworld/Security/News/~3/331677375/whitepapers.do">Effective Security with a Continuous Approach to ISO 27001 Compliance</source>
    </item>
    <item>
      <title><![CDATA[SecurityRatty virtual discussion]]></title>
      <link>http://securityratty.com/article/322793ec7e4a53161a2ec99e8524f3dd</link>
      <guid>http://securityratty.com/article/322793ec7e4a53161a2ec99e8524f3dd</guid>
      <description><![CDATA[Is SecurityRatty RSS argegator? Yes, it is
Fully automatic without prepost moderation
No RSS Ads
Manual feed/post removal by request
Here some alternative opinions
blog.spywareguide.com
securosis.com...]]></description>
      <content:encoded><![CDATA[<p>Is SecurityRatty RSS argegator? Yes, it is.</p>
<p>- Fully automatic without prepost moderation<br />
- No RSS Ads<br />
- Manual feed/post removal by request</p>
<p>Here some alternative opinions:</p>
<ul>
<li style="text-align: left;"><a href="http://blog.spywareguide.com/2008/07/content-scrapers-and-security.html">blog.spywareguide.com</a></li>
<li><a href="http://securosis.com/2008/07/02/securityratty-is-slimey-content-stealing-thief/">securosis.com</a></li>
<li><a href="http://securosis.com/2008/07/02/i-win/">securosis.com</a></li>
<li><a href="http://securosis.com/2008/07/02/securityratty-is-slimey-content-stealing-thief/">securosis.com</a></li>
<li><a href="http://www.liquidmatrix.org/blog/2008/07/02/security-ratty-steals-content-one-time-too-many/">liquidmatrix.org</a></li>
<li><a href="http://anti-virus-rants.blogspot.com/2008/07/how-not-to-comment-spam.html">anti-virus-rants.blogspot.com</a></li>
</ul>
<p>What&#8217;s your?</p>
]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 15:26:49 +0000</pubDate>
      <category domain="http://securityratty.com/tag/manual feedpost removal">manual feedpost removal</category>
      <category domain="http://securityratty.com/tag/securityratty rss argegator">securityratty rss argegator</category>
      <category domain="http://securityratty.com/tag/securosis">securosis</category>
      <category domain="http://securityratty.com/tag/prepost moderation">prepost moderation</category>
      <category domain="http://securityratty.com/tag/alternative opinions">alternative opinions</category>
      <category domain="http://securityratty.com/tag/rss ads">rss ads</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/blogspot">blogspot</category>
      <category domain="http://securityratty.com/tag/blog">blog</category>
      <source url="http://securityratty.com/blog/?p=11">SecurityRatty virtual discussion</source>
    </item>
    <item>
      <title><![CDATA[Google Open Sources Web Assessment Tool]]></title>
      <link>http://securityratty.com/article/128129d00191a851fc7c17a3ec3f9529</link>
      <guid>http://securityratty.com/article/128129d00191a851fc7c17a3ec3f9529</guid>
      <description><![CDATA[The folks at Google have released their own proprietary web application assessment proxy. The tool is called ratproxy and was authored by Michal Zalewski
From Google Code
Ratproxy is a semi-automated,...]]></description>
      <content:encoded><![CDATA[<p>The folks at Google have released their own proprietary web application assessment proxy. The tool is called ratproxy and was authored by <a href="http://lcamtuf.coredump.cx/">Michal Zalewski</a>.</p>
<p>From Google Code:</p>
<blockquote><p>Ratproxy is a semi-automated, largely passive web application security audit tool. It is meant to complement active crawlers and manual proxies more commonly used for this task, and is optimized specifically for an accurate and sensitive detection, and automatic annotation, of potential problems and security-relevant design patterns based on the observation of existing, user-initiated traffic in complex web 2.0 environments.</p></blockquote>
<p>This tool falls into the same family as Burp and Paros, as examples. It will apparently run on Linux, FreeBSD, Mac OS X and Windows if you have Cygwin loaded. Check it out. </p>
<p><a href="http://code.google.com/p/ratproxy/">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=NkvSmj"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=NkvSmj" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=El0TEJ"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=El0TEJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=MdpCej"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=MdpCej" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=G6TZLj"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=G6TZLj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=ESE22j"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=ESE22j" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=ac9LIj"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=ac9LIj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/324867361" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 08:51:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/google">google</category>
      <category domain="http://securityratty.com/tag/tool">tool</category>
      <category domain="http://securityratty.com/tag/tool falls">tool falls</category>
      <category domain="http://securityratty.com/tag/complement active crawlers">complement active crawlers</category>
      <category domain="http://securityratty.com/tag/design patterns based">design patterns based</category>
      <category domain="http://securityratty.com/tag/google code">google code</category>
      <category domain="http://securityratty.com/tag/ratproxy">ratproxy</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/michal zalewski">michal zalewski</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/324867361/">Google Open Sources Web Assessment Tool</source>
    </item>
    <item>
      <title><![CDATA[Meet ratproxy, our passive web security assessment tool]]></title>
      <link>http://securityratty.com/article/bc78dd4116c64ea5b3a05fa82e188ff7</link>
      <guid>http://securityratty.com/article/bc78dd4116c64ea5b3a05fa82e188ff7</guid>
      <description><![CDATA[Posted by Michal Zalewski

We're happy to announce that we've just open-sourced ratproxy , a passive web application security assessment tool that we've been using internally at Google. This utility,...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Posted by Michal Zalewski</span><br /><br />We're happy to announce that we've just open-sourced <a href="http://code.google.com/p/ratproxy">ratproxy</a>, a passive web application security assessment tool that we've been using internally at Google. This utility, developed by our information security engineering team, is designed to transparently analyze legitimate, browser-driven interactions with a tested web property and automatically pinpoint, annotate, and prioritize potential flaws or areas of concern.  <br /><br />The proxy analyzes problems such as cross-site script inclusion threats, insufficient cross-site request forgery defenses, caching issues, cross-site scripting candidates, potentially unsafe cross-domain code inclusion schemes and information leakage scenarios, and much more. (A more-detailed discussion of these features and information on securing vulnerable applications is provided <a href="http://code.google.com/p/ratproxy/wiki/RatproxyDoc">here</a>.) Compared with more-traditional active crawlers, or with fully manual request inspection and modification frameworks, this approach offers several significant advantages in terms of minimized overhead; marginalized risk of site disruptions; high coverage of complex, client-driven application states in web 2.0 solutions; and insight into dynamic cross-domain trust models.<br /><br />We decided to make this tool freely available as open source because we feel it will be a valuable contribution to the information security community, helping advance the community's understanding of security challenges associated with contemporary web technologies. We believe that responsible security research brings a net overall benefit to the safety of the Web as a whole, and have released this tool explicitly to support that kind of research.<br /><br />To download the proxy, please visit this <a href="http://ratproxy.googlecode.com/files/ratproxy-1.50.tar.gz">page</a>. Also, please keep in mind that the proxy is designed solely to highlight interesting patterns in web applications, and a further analysis by a security professional is often required to interpret the results and their significance for the tested platform.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=cTCU6J"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=cTCU6J" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?a=K3C5fj"><img src="http://feeds.feedburner.com/~f/GoogleOnlineSecurityBlog?i=K3C5fj" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~4/324447250" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 01 Jul 2008 12:49:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/web">web</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information leakage scenarios">information leakage scenarios</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/contemporary web technologies">contemporary web technologies</category>
      <category domain="http://securityratty.com/tag/information security community">information security community</category>
      <category domain="http://securityratty.com/tag/web property">web property</category>
      <category domain="http://securityratty.com/tag/community">community</category>
      <category domain="http://securityratty.com/tag/web applications">web applications</category>
      <source url="http://feeds.feedburner.com/~r/GoogleOnlineSecurityBlog/~3/324447250/meet-ratproxy-our-passive-web-security.html">Meet ratproxy, our passive web security assessment tool</source>
    </item>
    <item>
      <title><![CDATA[Loving customers frustrate security firms too]]></title>
      <link>http://securityratty.com/article/90258e9f33623bc8f6064f70d8abd5d6</link>
      <guid>http://securityratty.com/article/90258e9f33623bc8f6064f70d8abd5d6</guid>
      <description><![CDATA[Roger Grimes has a good article up on his InfoWorld, Security Advisory blog entitled &quot; Security firms frustrate loving customers &quot;. Roger details some specific examples of how security vendors just...]]></description>
      <content:encoded><![CDATA[<p>Roger Grimes has a good article up on his InfoWorld, Security Advisory blog entitled "<a href="http://weblog.infoworld.com/securityadviser/archives/2008/06/security_firms.html">Security firms frustrate loving customers</a>". Roger details some specific examples of how security vendors just don't "show the love" to customers and prospective customers, with the result being lost business. Roger highlights three examples: <br><br><strong>1.</strong> <strong>Making renewals a manual process with those annoying phone trees</strong>. I agree, when I hear the press 1 for this and press 2 for this, my blood starts to boil. There is no reason that this just can't be built into the product to renew over the web. Security or no, any software vendor not doing it this is just plain crazy.<br><strong><br>2. Calling into a company with a sales inquiry and the sales guy never calls back</strong>. This one just kills me. When doing due diligence on potential acquisitions at a prior company I would call in or email with a sales inquiry and wait to see how long it would take for them to get back to me. It was a good indication of how well the sales organization and company functioned.<br><br><strong>3. Killing the deal with one sided, overly legal and burdensome terms</strong>. Another one that I battle all the time. The CFO has to be able to recognize revenue so needs specific T&amp;Cs. The lawyers want to protect the vendor against all eventualities and is doing his job. You want to make as few warranties and representations as possible to limit your liability. The result, the customer gets one sided, unfair document with fine print on maintenance pricing, renewals, SLAs, etc. Most customers don't even read the EULA. Take a lot at some of the ones with software you have bought. It may surprise you.<br><br>But in my best Fox News voice, lets be fair and balanced. So in that vein, let me give you 3 specific examples of how loving customers frustrate security firms:<br><br><strong>1. The guys who picked the product leave and the new guy comes in and doesn't have a clue.</strong> This happens all the time, especially in the government. One guy or team buys the product for a specific reason and has all of the expertise. The new folks come in and even if they know your product is there, they don't know why or how to use it. They may feel they inherited this product and have their own favorite product in this category. They can't wait to replace you and either don't use the product at all or blame the problems of the world on it.<br><br><strong>2. Buying the product and than "other priorities" delay implementation.</strong> A surefire recipe for shelfware. When I see this happening I tell our folks better to be a pain in the butt and force them to use the product they bought than to sit around watching the license expire on the shelf. The longer the product sits, the more it becomes a nice to have, rather than a must have, that drove the sale. Now sure, one can say that what does the vendor care, the customer paid. If he doesn't use it, less support costs. But you don't get renewals, you don't get upsells or referrals without customers using product.<br><strong><br>3. Using the product in unintended ways.</strong> Another favorite heartburn of mine. Customers figure just because the application runs Linux underneath, why can"t I run (You Name It). We recently had a customer that was chewing up support hours like the dial at a gas pump today. It turns out the problems we all due to the all of the other software that he had put on the box, not to mention editing .conf files, database tables, etc. It is hard enough supporting the software we developed. It is a whole another story supporting software that you have written.<br><br>So Roger, yes the customer is always right and security vendors have to get their act together if they want to survive, let alone compete in these tough economic times. But customers certainly don't make the job any easier with some of the shenanigans they pull.</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=zkXRhU"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=zkXRhU" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=Lqo4nI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=Lqo4nI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=SmwKYI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=SmwKYI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=nQ1xDI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=nQ1xDI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=23iD7I"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=23iD7I" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ewSG9i"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ewSG9i" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=axWNoi"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=axWNoi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/311509491" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 13 Jun 2008 15:45:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security firms">security firms</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/product">product</category>
      <category domain="http://securityratty.com/tag/product sits">product sits</category>
      <category domain="http://securityratty.com/tag/favorite product">favorite product</category>
      <category domain="http://securityratty.com/tag/prospective customers">prospective customers</category>
      <category domain="http://securityratty.com/tag/software vendor">software vendor</category>
      <category domain="http://securityratty.com/tag/vendor">vendor</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/311509491/loving-customer.html">Loving customers frustrate security firms too</source>
    </item>
    <item>
      <title><![CDATA[Your Router Crashing? Could Be XP SP3]]></title>
      <link>http://securityratty.com/article/4ee56a19c1eec6d2bf8762723c87a936</link>
      <guid>http://securityratty.com/article/4ee56a19c1eec6d2bf8762723c87a936</guid>
      <description><![CDATA[Heres an interesting article. Apparently people have been noticing that their broadband modems have been crashing. It turns out that the culprit could very well be Windows XP with SP3
From APCMAG...]]></description>
      <content:encoded><![CDATA[<p>Here&#8217;s an interesting article. Apparently people have been noticing that their broadband modems have been crashing. It turns out that the culprit could very well be Windows XP with SP3.</p>
<p>From APCMAG:</p>
<blockquote><p>Broadband modem/router maker Billion says XP SP3 has been causing its BiPAC 5200-series routers to go into a constant crash and reboot cycle.</p>
<p>The company has produced firmware upgrades that solve the problem.</p>
<p>Although Windows XP SP3 has been available for manual download from Microsoft since May 6, it has just hit Windows Update as an automatic upgrade, which will cause unexpected problems for owners of “unpatched” Billion BiPAC 5200 routers, and possibly other brands or models of router.</p>
<p>The affected BiPAC 5200 firmware versions are 2.9.8.x and 2.11.0.x~2.11.33.x.
</p></blockquote>
<p>Reminds me of the problem that Vista caused on wireless networks when it first came out.</p>
<p><a href="http://apcmag.com/router_crashes_blamed_on_windows_xp_sp3.htm">Article Link</a></p>

<p><a href="http://feeds.feedburner.com/~a/Liquidmatrix?a=ni5u3V"><img src="http://feeds.feedburner.com/~a/Liquidmatrix?i=ni5u3V" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=avCdRI"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=avCdRI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=pazGEi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=pazGEi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=1qy4si"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=1qy4si" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=THBMDi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=THBMDi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/Liquidmatrix?a=VGhQUi"><img src="http://feeds.feedburner.com/~f/Liquidmatrix?i=VGhQUi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/Liquidmatrix/~4/307115525" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 07 Jun 2008 22:49:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bipac 5200-series routers">bipac 5200-series routers</category>
      <category domain="http://securityratty.com/tag/bipac">bipac</category>
      <category domain="http://securityratty.com/tag/sp3">sp3</category>
      <category domain="http://securityratty.com/tag/windows">windows</category>
      <category domain="http://securityratty.com/tag/routers">routers</category>
      <category domain="http://securityratty.com/tag/hit windows">hit windows</category>
      <category domain="http://securityratty.com/tag/billion bipac">billion bipac</category>
      <category domain="http://securityratty.com/tag/article link">article link</category>
      <category domain="http://securityratty.com/tag/article">article</category>
      <source url="http://feeds.feedburner.com/~r/Liquidmatrix/~3/307115525/">Your Router Crashing? Could Be XP SP3</source>
    </item>
  </channel>
</rss>
