<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: partner]]></title>
    <link>http://securityratty.com/tag/partner</link>
    <description></description>
    <pubDate>Thu, 18 Sep 2008 11:00:18 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Innovators, Imitators and Idiots]]></title>
      <link>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</link>
      <guid>http://securityratty.com/article/9f0fb5a40e7304e54d82bd150f69993b</guid>
      <description><![CDATA[Charlie Rose interviews Warren Buffett


Charlie Rose
And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage. We just lost sight...]]></description>
      <content:encoded><![CDATA[<p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;">Charlie Rose <a href="http://www.cnbc.com/id/26982338/page/2/">interviews</a> Warren Buffett:</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And so when you look at where we are going, there seems to be two issues that are apparent to me at least, risk and leverage.&#0160; We just lost sight of risk and leverage of what was appropriate?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.&#0160; Again, because it pays off for a while.&#0160; You know, you can lose leverage, and it&#39;s the only way a smart guy can go broke.&#0160; If you owe money, you can&#39;t pay them out.&#0160; You just pay for everything, you do smart things, you eventually get very rich.&#0160; If you do smart things and use leverage and do one wrong thing along the way, it could wipe you out, because anything times zero is zero.&#0160; But it&#39;s reinforcing when the people around you are doing it successfully, you&#39;re doing it successfully, and it&#39;s a lot like Cinderella at the ball.&#0160; I mean you know at midnight everything is going to turn to pumpkins and mice; right?&#0160; But if the evening goes along, I mean, you know, the guys look better all the time, the music sounds better, it&#39;s more and more fun, you think why the hell should I leave at quarter of 12.&#0160; I&#39;ll leave at two minutes to 12.&#0160; But the trouble is, there are no clocks on the wall.&#0160; And everybody thinks they&#39;re going to leave at two minutes to 12.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Its effectively the job of leadership to know when to take the punch bowl away and to have the credibility to do this. This is also the risk-reward balance that infosec must try to strike, part of the answer is differentiating <a href="http://1raindrop.typepad.com/1_raindrop/2007/11/dhandho-infosec.html">risk and uncertainty</a>. As our current financial situation shows, its a hard thing to pull off</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">And should wise people have known better?</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">People should always know better.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Charlie Rose:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Yeah.</span></p><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">I mean people -- people don&#39;t get -- they don&#39;t get smarter about things that get as basic as greed and you can&#39;t stand to see your neighbor getting rich.&#0160; You know you&#39;re smarter than he is, and he&#39;s doing these things, you know, and he&#39;s getting rich, and your spouse is getting unhappy with you because you aren&#39;t doing -- pretty soon you start doing it.&#0160; And so you get what I call the natural progression, the three Is.&#0160; The innovators, the imitators, and the idiots.&#0160; And that&#39;s what happens.&#0160; Everybody just kind of goes along.&#0160; And you look kind of silly if you disagree.&#0160; I mean, you know, you could have these crazy Internet valuations in the late 1990s, but they prove themselves out in the market.&#0160; The next day they were selling for more than they were the day before, and people said, you know, you&#39;re crazy if you don&#39;t get in on this.&#0160; So it&#39;s very human.&#0160; Now, with housing it&#39;s something even more dramatic than that, because most people aspire to own their own home.&#0160; And if you really think that houses prices are going to go up next year and the year after, you feel if I don&#39;t buy it this year, I&#39;m going to have to buy it next year.&#0160; That&#39;s not true of an Internet stock.&#0160; But it&#39;s true of a home.&#0160; And when somebody makes it very easy for you to do it by saying you don&#39;t really have to put up my money, you can lie about your income a little, or we&#39;ll give you 100 percent mortgage, you&#39;re going to do it, because everybody that&#39;s done it has been proven right.&#0160; You have what they call social tools, and, you know, you&#39;re going to feel like an idiot if you didn&#39;t do it, because the house cost more.</span></p></blockquote><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">And this is why its hard to pull off. There is a lot of human emotion and envy (*). I think the point Buffett raises about innovators, imitators and idiots is a useful one for infosec. We see all kinds of new projects and technologies that have risks and rewards associated with them, its helpful to categorize these under innovation (high risk but possible game changer), imitators (so called best practices), and idiots (sheep mode - blind risk acceptance). We can get some traction here to use these concepts to understand what to do when assessing say the architectural and oeprational risk of a system.</span></div><div><span style="font-weight: normal;"><br /></span></div><div><span style="font-weight: normal;">Finally, we should always spend some time to consider infosec decisions in a broader long term economic context and this is also true of our current financial crisis</span></div><div><span style="font-weight: normal;"><br /></span></div></strong></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="font-family: Verdana; font-size: 12px; line-height: normal; "><strong>Warren Buffett:</strong>&#0160;&#0160;</span><br /><span style="font-family: Verdana; font-size: 12px; line-height: normal; ">Oh, I think confidence will come back.&#0160; I will tell you this.&#0160; This country is going -- be living better ten years from now than it is now.&#0160; It will be living better in 20 years from now than ten years from now.&#0160; The ingredients that made this country, you know, the miracle of the world -- I mean we had a seven for one improvement in the average American standard of living in the 20th century.&#0160; Now, we had the great depression, we had two world wars, we had the flu epidemic.&#0160; You know, we had oil shock.&#0160; You know, we had all these terrible things happen.&#0160; But something about the American system unleashed more and of a potential to human beings over that hundred years so that we had a seven for one improvement in -- there&#39;s never been any -- I mean, you have centuries where if you&#39;ve got a 1 percent improvement, then it&#39;s something.&#0160; So we&#39;ve got a great system.&#0160; And we&#39;ve got more productive capacity now than we ever have.&#0160; The American worker is more productive than he&#39;s ever been.&#0160; We&#39;ve got more people to do it.&#0160; We&#39;ve got all the ingredients for a sensational future.&#0160; It&#39;s just that right now the athlete&#39;s on the floor.&#0160; But we -- this is a super athlete.</span></p></blockquote><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">Again, we want to look at risk events in a broader, long term context. In Buffett&#39;s words its - &quot;be fearful when others are greedy and greedy when others are fearful.&quot; As the world panics and Jim Cramer is melting down on TV, Buffett is quietly writing checks with both hands, buying $3B of GE, $5B of Goldman, $6.5 of Wrigley/Mars and so on. Uncertainty is one thing, it could be 6 months it could be 5 years until this thing turns around, but risk is another - you hedge your risk with price and long term advantages, i.e. moats. People will still eat candy in a bad economy.</span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;"><br /></span></div><div><span style="font-family: Verdana; font-size: 12px; line-height: normal;">* Buffett&#39;s partner Charlie Munger calls envy the stupidest of the seven deadly sins, because only you feel bad, there is an upside to all the others. He said you can pay someone on Wall St $2 million a year and they will be perfectly happy until they find out someone across the hall is making $2.1 million and then they will be miserable. Which is an insane way tolive.</span></div>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 04:32:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/oeprational risk">oeprational risk</category>
      <category domain="http://securityratty.com/tag/risk events">risk events</category>
      <category domain="http://securityratty.com/tag/risk-reward balance">risk-reward balance</category>
      <category domain="http://securityratty.com/tag/wise people">wise people</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/buffett raises">buffett raises</category>
      <category domain="http://securityratty.com/tag/buffett">buffett</category>
      <category domain="http://securityratty.com/tag/blind risk acceptance">blind risk acceptance</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/10/innovators-imitators-and-idiots.html">Innovators, Imitators and Idiots</source>
    </item>
    <item>
      <title><![CDATA[Skype security flub leads to discovery of Chinese monitoring]]></title>
      <link>http://securityratty.com/article/45c85bac2a4d86fa20904e4f706539a8</link>
      <guid>http://securityratty.com/article/45c85bac2a4d86fa20904e4f706539a8</guid>
      <description><![CDATA[Researchers have found evidence that Skype and Chinese partner TOM Online are monitoring text communications online for &quot;sensitive&quot; topics, and storing extensive logs on publicly-accessible servers....]]></description>
      <content:encoded><![CDATA[Researchers have found evidence that Skype and Chinese partner TOM Online are monitoring text communications online for "sensitive" topics, and storing extensive logs on publicly-accessible servers. Not only is this a major security risk, it also raises questions as to what level Skype is complying with the requests of the Chinese government.]]></content:encoded>
      <pubDate>Thu, 02 Oct 2008 22:00:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/skype">skype</category>
      <category domain="http://securityratty.com/tag/major security risk">major security risk</category>
      <category domain="http://securityratty.com/tag/level skype">level skype</category>
      <category domain="http://securityratty.com/tag/text communications online">text communications online</category>
      <category domain="http://securityratty.com/tag/extensive logs">extensive logs</category>
      <category domain="http://securityratty.com/tag/chinese government">chinese government</category>
      <category domain="http://securityratty.com/tag/raises questions">raises questions</category>
      <category domain="http://securityratty.com/tag/requests">requests</category>
      <category domain="http://securityratty.com/tag/researchers">researchers</category>
      <source url="http://digg.com/security/Skype_security_flub_leads_to_discovery_of_Chinese_monitoring">Skype security flub leads to discovery of Chinese monitoring</source>
    </item>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[John Zanni Delivers Keynote at the Tier1 Hosting Transformation Summit]]></title>
      <link>http://securityratty.com/article/e6b5db3dba618f48e7fa728ff2173006</link>
      <guid>http://securityratty.com/article/e6b5db3dba618f48e7fa728ff2173006</guid>
      <description><![CDATA[As General Manager of Worldwide Hosting, John Zanni is a key guy for every Managed Service Provider delivering Microsoft based solutions. At this years Hosting Transformation Summit , John gave a...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 0px 10px 10px 0px; border-left: 0px; border-bottom: 0px" height="244" alt="spla_image" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/spla-image.png" width="244" align="left" border="0"> As General Manager of Worldwide Hosting, <a href="http://www.microsoft.com/presspass/features/2008/jul08/07-29qazanni.mspx" target="_blank">John Zanni is a key guy for every Managed Service Provider</a> delivering Microsoft based solutions. At this year&#8217;s <a href="http://www.hostingtransformation.com/na/2008/" target="_blank">Hosting Transformation Summit</a>, John <a href="http://www.hostingtransformation.com/na/2008/agenda.php" target="_blank">gave a keynote</a> titled: &#8220;Leadership Perspective: Cloud Computing – is Virtualization Enough?&#8221;</p>
<p>John talked <a href="http://blogs.zdnet.com/BTL/?p=10007" target="_blank">about Microsoft’s mission</a>, his perspectives on key industry trends and market opportunity; he touched on <a href="http://www.betanews.com/article/Will_Microsofts_virtualization_spur_a_lot_more_cloud_computing/1221867502" target="_blank">Cloud Computing and Virtualization</a> and took some Q&amp;A from the audience of <a href="http://technet.microsoft.com/en-us/serviceproviders/default.aspx" target="_blank">Managed Service Provider</a> executives.</p>
<p>One of his first proclamations - Microsoft has really embraced the heterogeneous environment. Really? How in the world is Microsoft going to help convince IT line managers, or mid level managers to believe this statement? I think they have a long way to go to achieve this vision with any credibility in the marketplace.&nbsp; I do know that they are making small strides.</p>
<p>Microsoft has been widely credited with some very good blogs that are self critical and introspective. They have also been quite active in the standards boards within <a href="http://www.dmtf.org/home" target="_blank">DMTF</a> and many others such as <a href="http://www.openwsman.org/" target="_blank">Open WSMAN</a> and CIMON (<a href="http://www.openpegasus.org/" target="_blank">Open Pegasus</a>). Microsoft in February published 30,000 pages detailed technical specifications – protocol documentation for Exchange, since that time they have published another 15,000 pages. They have had over 224,000 downloads since February 21, 2008. Thus they are trying to be more open by making some of these <a href="http://www.microsoft.com/about/legal/intellectualproperty/protocols/default.mspx" target="_blank">secret sauce protocol resources</a> <a href="http://msdn.microsoft.com/openprotocols" target="_blank">directly available on the web</a>.</p>
<p>So for now, I will take a very cautious wait and see approach to this proclamation. Time will tell.</p>
<p><strong>Trends</strong></p>
<ul>
<li>Rapid growth continues
<li>Hosting Competition has a new face
<ul>
<li>Platform gorillas (amazooglesoft)
<li>Ad supported Web 2.0 hosters (Google, Facebook,) </li>
</ul>
<li>Utility Cloud Computing models are expanding to non-traditional hosting companies
<ul>
<li>Wells Fargo vSafe - hard to believe that a big bank would start to offer a SaaS offering
<li>New tools and markets digital ribbon, CohesiveIT </li>
</ul>
</li>
</ul>
<p><a href="http://mshostingsummit08.spaces.live.com/blog/cns!4308FE7290C0AF4!245.entry" target="_blank">IDC Data shows that growth of SaaS ISV’s is the biggest layer of growth</a>. The fastest growing services are complex, custom applications. IDC says this area will be bigger than the hosting area in the next 5 years. John said that <a href="http://blogs.msdn.com/ukisv/archive/2008/09/22/the-route-to-saas-and-beyond-final-seminar-places-remain-2nd-oct-08.aspx" target="_blank">Microsoft is spending a lot of time, money and energy on this right now</a>.</p>
<p>John said:</p>
<blockquote><p>“when Microsoft thinks about the building blocks that make-up the cloud, <a href="http://www.microsoft.com/virtualization/" target="_blank">virtualization is a core piece</a> of the puzzle. However you also need also identity services, Operating system with standard set of libraries to tap into… or remote storage that application developers will tap into.. Developers will consume these set of services, but you will also need a set of tools to manage your physical, virtual and geographically distributed datacenter infrastructure.” (that is where ScienceLogic comes in!!)</p>
</blockquote>
<p>He went on to say,</p>
<blockquote><p>“In some ways, virtualization enables decentralization – allows you to move from data centers, enables fast scaling out, business to move from on premise to the cloud and off again…. Automation is very important – this will help you scale your business – this is core to your future success.”</p>
</blockquote>
<p>He talked about a new breed of knowledge worker: He called them Digital Natives (compared to grey haired guys like me who are left out of this category).</p>
<p>Definition of a Digital natives? A young adult who has grown up with cellphone, web based applications, Facebook account, as their primary mode of communications.</p>
<p>John commented that we are 5 years into a 10 year journey. Only 12% of all servers in the world are virtualized today… in the next 4 years it will double to 25%. This is <a href="http://www.interopnews.com/news/vmware-ceo-maritz-addresses-virtualization-the-cloud-and-cha.html" target="_blank">the time to think through</a> how this business will affect you.</p>
<blockquote><p>‘Virtualization without good management is more dangerous than not using virtualization in the first place.” Thomas Bittman, Analyst Gartner</p>
</blockquote>
<p>Patching and provisioning nightmare – no scalable administration – sprawl chaos.</p>
<p>John posed a question to the audience: How do you partner to provide the ISV support in application development with specific market needs… partner by keeping the <a href="http://tarrysingh.blogspot.com/2008/09/microsofts-coo-on-cloud-computing.html" target="_blank">hosting to SaaS solution</a> providers up and running and provide the quality of service that their customers expect…. Complimentary services of storage and backup is a big win with a huge market-upside over the next 5 years..</p>
<p>John said that <a href="http://blogs.msdn.com/mhpta/archive/2008/04/10/microsoft-hosting-summit-2008.aspx" target="_blank">Microsoft continues</a> to make&nbsp; <a href="http://www.virtualization.info/2008/07/microsoft-bets-on-hosting-providers-to.html" target="_blank">huge investments with Managed Service Providers</a>.</p>
<ul>
<li>Investing in the <a href="http://www.microsoft.com/hosting/" target="_blank">windows hosting platform</a>
<li>Hyper V and SQL2008 GoLive program - getting beta code out to service provides to find as many bugs as early as possible.
<li><a href="http://blogs.msdn.com/stevecla01/archive/2008/09/22/explaining-software-plus-services.aspx" target="_blank">Software + Services (S+S)</a> incubation center program
<li>Partnering for <a href="http://tarrysingh.blogspot.com/2008/09/microsofts-coo-on-cloud-computing.html" target="_blank">cloud platform market offers</a>
<li>Cloud platform guidance and best practices </li>
</ul>
<p>During the Q&amp;A, David Burns from Cincinnati Bell asked the very best question… “when are you going to make it easier for the Service Provider market to <a href="http://www.virtualization.info/2008/09/microsoft-to-allow-3rd-parties-to.html" target="_blank">deal with the Microsoft Service Provider Licensing Agreement (SPLA)</a> quarterly statistics pull and change the SPLA pricing to be more efficient and creative for the new Virtualization and Cloud offerings you have talked about?&#8221;</p>
<p>John’s response: “We hear your frustrations loud and clear and are working on some new ideas for the future version of SPLA.” My interpretation – &#8220;Dear Service Providers don’t expect anything new or easier to deal with in the next 6 months!&#8221;</p>
<p>His closing remarks: &#8220;Cloud is evolving = very early stages, lots of hype, but think of how this evolution will effect your business and how you can plug into it.”</p>
]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 12:00:27 +0000</pubDate>
      <category domain="http://securityratty.com/tag/service provider market">service provider market</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service providers">service providers</category>
      <category domain="http://securityratty.com/tag/service provider">service provider</category>
      <category domain="http://securityratty.com/tag/service provider executives">service provider executives</category>
      <category domain="http://securityratty.com/tag/john">john</category>
      <category domain="http://securityratty.com/tag/john zanni">john zanni</category>
      <category domain="http://securityratty.com/tag/microsoft">microsoft</category>
      <category domain="http://securityratty.com/tag/microsoft based solutions">microsoft based solutions</category>
      <source url="http://blog.sciencelogic.com/john-zanni-delivers-keynote-at-the-tier1-hosting-transformation-summit/09/2008">John Zanni Delivers Keynote at the Tier1 Hosting Transformation Summit</source>
    </item>
    <item>
      <title><![CDATA[250k of Harvested Hotmail Emails Go For?]]></title>
      <link>http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6</link>
      <guid>http://securityratty.com/article/efaf965e7dacf43f06479ec7778d04e6</guid>
      <description><![CDATA[50 in this particular case, however, keeping in mind that the email harvester is anything but ethical, this very same database will be sold and re-sold more times than the original buyer would like to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SNuLDFWiz9I/AAAAAAAACLo/fQ_TqPImTk0/s1600-h/harvested_hotmail_sale.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="113" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SNuLDFWiz9I/AAAAAAAACLo/YJqc75ZUQgE/s200-R/harvested_hotmail_sale.png" width="200" /></a>$50 in this particular case, however, keeping in mind that the email harvester is anything but ethical, this very same database will be sold and re-sold more times than the original buyer would like to know about. Moreover, what someone is offering for sale, may in fact be already available as a value-added addition to a managed spamming service.<br />
<br />
With metrics and quality assurance applied in a growing number of spam and phishing campaigns, filling in the niche of email harvesting by distinguishing between different types of obfuscated emails by releasing an easily embeddable module, was an anticipated move. What's to come? <a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Spam and malware campaigns across social networks</a> "as usual" will propagate faster thanks to the ongoing harvesting of usernames within social networks, that would later on get imported in Web 2.0 "marketing" tools targeting the high-trafficked sites and automatically spamming them.<br />
<br />
From a spammer's perspective, geolocating these 250k emails could increase their selling prices since the buyers would be able to launch localized attacks with messages in the native languages of the receipts. Is the demand for quality email databases fueling the developments of this market segment, or are the spammers self-serving themselves and cashing-in by reselling what they've already abused a log time ago? That seems to be the case, since there's no way a buyer could verify the freshness of the harvested emails database and whether or not it has already been abused. <br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SNvGk2eGKcI/AAAAAAAACL4/yhy61idSl6I/s1600-h/segmented_harvested_emails.JPG" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SNvGk2eGKcI/AAAAAAAACL4/xFYzYTCaDes/s200-R/segmented_harvested_emails.JPG" width="152" /></a>For the time being, we've got several developed and many other developing market segments within spamming and phishing as different markets with different players. On one hand are the legitimately looking spamming providers offering "direct marketing services" working with lone spammers who find a reliable business partner in the face of the spamming vendor whose customers drive both side's business models. On the other hand, you've got the <a href="http://blogs.zdnet.com/security/?p=1835">spammers excelling in outsourcing the automatic account registration process</a>, coming up with ways to build a spamming infrastructure -- already available as a module to integrate in <a href="http://blogs.zdnet.com/security/?p=1899">managed spamming services</a> -- using legitimate services as a provider of the infrastructure.<br />
<br />
Despite that the arms race seems to be going on at several different fronts, spammers VS the industry and spammers VS spammers fighting for market share, the entire underground ecosystem is clearly allocating a lot of resources for research and development in order to ensure that they are always a step ahead of the industry.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/05/harvesting-youtube-usernames-for.html">Harvesting  Youtube Usernames for Spamming</a><b>&nbsp;</b><br />
<a href="http://ddanchev.blogspot.com/2007/10/thousands-of-im-screen-names-in-wild.html">Thousands  of IM Screen Names in the Wild</a><br />
<a href="http://ddanchev.blogspot.com/2008/08/automatic-email-harvesting-20.html">Automatic  Email Harvesting 2.0</a><br />
<a href="http://ddanchev.blogspot.com/2008/07/dissecting-managed-spamming-service.html">Dissecting a Managed Spamming Service</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/managed-spamming-appliances-future-of.html">Managed Spamming Appliances - the Future of Spam</a><br />
<a href="http://ddanchev.blogspot.com/2007/01/inside-email-harvesters-configuration.html">Inside an Email Harvester's Configuration File</a><br />
<a href="http://ddanchev.blogspot.com/2008/05/segmenting-and-localizing-spam.html">Segmenting and Localizing Spam Campaigns</a><br />
<a href="http://ddanchev.blogspot.com/2007/04/shots-from-malicious-wild-west-sample.html">Shots from the Malicious Wild West - Sample Four</a><br />
<b> </b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=De2zL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=De2zL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CYcFL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CYcFL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=OQPDl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=OQPDl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=Lhexl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=Lhexl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sZRFL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sZRFL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=ifNGL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=ifNGL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=BYibl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=BYibl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/402968423" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 25 Sep 2008 08:13:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/emails">emails</category>
      <category domain="http://securityratty.com/tag/email">email</category>
      <category domain="http://securityratty.com/tag/email harvester">email harvester</category>
      <category domain="http://securityratty.com/tag/spam campaigns">spam campaigns</category>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/lone spammers">lone spammers</category>
      <category domain="http://securityratty.com/tag/spammers">spammers</category>
      <category domain="http://securityratty.com/tag/250k emails">250k emails</category>
      <category domain="http://securityratty.com/tag/automatic email">automatic email</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/402968423/250k-of-harvested-hotmail-emails-go-for.html">250k of Harvested Hotmail Emails Go For?</source>
    </item>
    <item>
      <title><![CDATA[Clarity on Qantas' Plans: OnAir and Aeromobile]]></title>
      <link>http://securityratty.com/article/d054a83a986c1d357ea394b9721e5121</link>
      <guid>http://securityratty.com/article/d054a83a986c1d357ea394b9721e5121</guid>
      <description><![CDATA[Trade mag Flightglobal gets the full story on Qantas' in-flight calling, texting, and Internet plans: A few days ago, it seemed to come out that Qantas had dropped Aeromobile (its test partner last...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://www.flightglobal.com/articles/2008/09/24/316457/qantas-reveals-connectivity-plans-for-a380s-a330s-and.html"><strong>Trade mag Flightglobal gets the full story on Qantas' in-flight calling, texting, and Internet plans:</strong></a> A few days ago, it seemed to come out that Qantas had dropped Aeromobile (its test partner last year) for OnAir, and was moving to Internet service on A380s instead of in-flight cell calling and texting. Flightglobal clears the air, and reveals that Qantas will offer all of the above. (I wrote about this in "<a href="http://wifinetnews.com/archives/008448.html"><strong>Sorry, Qantas, No Unfettered Broadband</strong></a>.")</p>

<p>OnAir was chosen for A380 service, with the initial rollout--especially for international flights--using the 64 Kbps Inmarsat satellite offering, which is too paltry for anything but limited text communication. When the recently launched Pacific satellite is active--which may take up to a year--OnAir and Qantas can upgrade to the luxurious nearly 500 Kbps per channel service. </p>

<p>The head of OnAir is pushing some mighty serious horsehockey, however, when he says as quoted by Flightglobal that he "is confident that once the full service is up and running, passengers will be able to access the Internet 'in exactly the same way as they can on the ground.'" That may be the case in terms of access, but not in terms of cost. The cost will be enormously high unless OnAir has a magic deal with Inmarsat that's previously undisclosed. I suspect a per MB charge will be in effect that will discourage much use. Calls and texting could be carried over the same system, of course.</p>

<p>Qantas plans to continue to work with Aeromobile for domestic service, with calls and texting available, on their Boeing 767-300s and Airbus A330-200s, Flightglobal reports. Aeromobile has plans to launch a full Internet service later this year using cached and live content. [link via <a href="http://www.setteb.it/"><strong>Fabio Zambelli</strong></a>]</p>]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 12:01:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/plans">plans</category>
      <category domain="http://securityratty.com/tag/qantas">qantas</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/channel service">channel service</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/qantas plans">qantas plans</category>
      <category domain="http://securityratty.com/tag/onair">onair</category>
      <category domain="http://securityratty.com/tag/flightglobal">flightglobal</category>
      <category domain="http://securityratty.com/tag/trade mag flightglobal">trade mag flightglobal</category>
      <source url="http://wifinetnews.com/archives/008458.html">Clarity on Qantas' Plans: OnAir and Aeromobile</source>
    </item>
    <item>
      <title><![CDATA[XSF & XSS: Double your pleasure, double your fun]]></title>
      <link>http://securityratty.com/article/1fae85d8335f0c9fbe56b8858c8692c2</link>
      <guid>http://securityratty.com/article/1fae85d8335f0c9fbe56b8858c8692c2</guid>
      <description><![CDATA[If you've read this blog, or those of my peers, you're likely quite familiar with cross-site scripting, and the problems associated with open redirect vulnerabilities. A vulnerability you may be less...]]></description>
      <content:encoded><![CDATA[If you've read this blog, or those of my peers, you're likely quite familiar with cross-site scripting, and the problems associated with open redirect vulnerabilities. A vulnerability you may be less familiar with is <a href="http://www.xssed.com/news/26/Cross-site_framed/" target="_blank">cross-site framing</a>, which largely couples the best of both above-mentioned vulnerabilities. <br />What then, if there's a cross-site framing vulnerability coupled with cross-site scripting in the content offered by the frame? All sorts of problems come to mind: phishing, malware, credential theft; all arguably twice removed from the attacker's source, tucked away in the context of two victim sites.<br />First, I'll discuss the original XSS issue that led to this finding.<br />Recently, I was investigating a flawed parameter in <a href="http://www.openhire.com/" target="_blank">Openhire</a>, a career posting vendor used by major companies like <a href="http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?company_id=15635&version=1" target="_blank">Crate&Barrel</a>, Eileen Fisher, Enterprise, Benjamin Moore, Scottrade, and Getty Images.<br />Most of these sites simply link to the Openhire offering that hosts job postings on their behalf which, in turn, has been crafted to look like the referring site.<br />As an example, here's Scottrade's employment page hosted by Openhire.<br /><br /><span style="font-style:italic;"><a href="http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?version=1&company_id=15624" target="_blank">http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?version=1&company_id=15624</a></span><br /><br />Standard stuff, looks nicely like the Scottrade site, so everything's cool, right?<br />Wrong? What if someone hosting a service on your behalf suffers a security gap?<br /><span style="font-weight:bold;">You're only as strong as your weakest link!</span><br />Here's the posting for an Application Security Engineer (funny, eh?) at Scottrade as hosted on their behalf by Openhire:<br /><br /><span style="font-style:italic;"><a href="http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=dspjob&id=23&jobid=130527&company_id=15624&version=1&source=ONLINE&JobOwner=976367&level=levelid3&levelid3=18247&parent=St.%20Louis%20Corporate%20Headquarters%3B%3B%3BInformation%20Technology%3B%3B%3BSecurity&startflag=3&CFID=66851845&CFTOKEN=29a95-d12594d4-47d9-49e8-9067-1091bdf68e80" target="_blank">http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=dspjob&id=23&jobid=130527&company_id=15624&version=1&source=ONLINE&JobOwner=976367&level=levelid3&levelid3=18247&parent=St.%20Louis%20Corporate%20Headquarters%3B%3B%3BInformation%20Technology%3B%3B%3BSecurity&startflag=3&CFID=66851845&CFTOKEN=29a95-d12594d4-47d9-49e8-9067-1091bdf68e80</a></span><br /><br />Now here the same job posting spewing massive cookie data:<br /><br /><span style="font-style:italic;"><a href="http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=dspjob&id=23&jobid=130527&company_id=15624&version=1&source=ONLINE&JobOwner=%22%3E%3CSCRIPT%3Ealert(document.cookie)%3C/SCRIPT%3E&level=levelid3&levelid3=18247&parent=St.%20Louis%20Corporate%20Headquarters;;;Information%20Technology;;;Security&startflag=3" target="_blank">http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=dspjob&id=23&jobid=130527&company_id=15624&version=1&source=ONLINE&JobOwner=%22%3E%3CSCRIPT%3Ealert(document.cookie)%3C/SCRIPT%3E&level=levelid3&levelid3=18247&parent=St.%20Louis%20Corporate%20Headquarters;;;Information%20Technology;;;Security&startflag=3</a></span><br /><br />Screen shot offered below, as the code above will likely be repaired very soon by Openhire. I notified them this past Thursday.<br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/SNcebDIT4JI/AAAAAAAAADA/2umzh0wbmmw/s1600-h/Scottrade_Openhire.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/SNcebDIT4JI/AAAAAAAAADA/2umzh0wbmmw/s320/Scottrade_Openhire.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5248697340769067154" /></a><br /><br />It's bad enough when there's an application security hole in code someone else is hosting on your behalf, but what if your method of displaying said code is also at risk? Enter the Getty Images Jobs page.<br /><br /><span style="font-style:italic;"><a href="http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html?http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=careeropps&startflag=0&company_id=15531&version=2&CFID=12265212&CFTOKEN=60213778" target="_blank">http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html?http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=careeropps&startflag=0&company_id=15531&version=2&CFID=12265212&CFTOKEN=60213778</a></span><br /><br />Watch what happens when you pull the Openhire code. Can you say self-replicating frame loop from hell (in Firefox)? Trust me your browser will crash if you leave this running too long. This will likely be fixed soon, so if the URL doesn't work, the screen shot exemplifies the issue.<br /><br /><a href="http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html" target="_blank">http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html</a><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://4.bp.blogspot.com/_kVOWaY1TAF0/SNcqO933d4I/AAAAAAAAADY/SSzLv3ZpiN0/s1600-h/GettyonGetty.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://4.bp.blogspot.com/_kVOWaY1TAF0/SNcqO933d4I/AAAAAAAAADY/SSzLv3ZpiN0/s320/GettyonGetty.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5248710327339022210" /></a><br /><br />What if, instead of Openhire's Getty Images page, or nothing at all (which obviously creates its own issue), we drop in an arbitrary URL?<br />Yep, you guessed it.<br /><span style="font-style:italic;"><br />http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html?http://www.xssed.com/news/26/Cross-site_framed/</span><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_kVOWaY1TAF0/SNcmqF3wQyI/AAAAAAAAADI/EhR6rYOmwlI/s1600-h/Getty_XSF.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://2.bp.blogspot.com/_kVOWaY1TAF0/SNcmqF3wQyI/AAAAAAAAADI/EhR6rYOmwlI/s320/Getty_XSF.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5248706395295990562" /></a><br /><br />Now, bringing it all home for double the pleasure, double the fun, what if we coupled the original Openhire cross-site scripting vuln with Getty Images cross-site frame vuln?<br /><br />It hurts twice as much, in my book.<br /><br /><span style="font-style:italic;">http://www.gettyimagesjobs.com/gettyImagesJobsDisplay.html?http://hostedjobs.openhire.com/epostings/jobs/submit.cfm?fuseaction=dspjob&id=23&jobid=130527&company_id=15624&version=1&source=ONLINE&JobOwner=%22%3E%3CSCRIPT%3Ealert(document.cookie)%3C/SCRIPT%3E&level=levelid3&levelid3=18247&parent=St.%20Louis%20Corporate%20Headquarters;;;Information%20Technology;;;Security&startflag=3</span><br /><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/SNco1c6ensI/AAAAAAAAADQ/QaKByEFozTU/s1600-h/Getty%2BScottrade.png" target="_blank"><img style="cursor:pointer; cursor:hand;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/SNco1c6ensI/AAAAAAAAADQ/QaKByEFozTU/s320/Getty%2BScottrade.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5248708789483249346" /></a><br /><br />The lessons learned:<br />1) Ensure your partners are writing secure code on you behalf.<br />2) Ensure that the code you utilize to incorporate said partner's code is also well written. ;-)<br /><br />Double the headache, double the dumb.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/09/xsf-xss-double-your-pleasure-double.html&title=XSF%20&%20XSS:%20Double%20your%20pleasure,%20double%20your%20fun " title="XSF & XSS: Double your pleasure, double your fun ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/09/xsf-xss-double-your-pleasure-double.html" title="XSF & XSS: Double your pleasure, double your fun ">digg</a>]]></content:encoded>
      <pubDate>Sun, 21 Sep 2008 17:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/openhire code">openhire code</category>
      <category domain="http://securityratty.com/tag/openhire">openhire</category>
      <category domain="http://securityratty.com/tag/original openhire cross-site">original openhire cross-site</category>
      <category domain="http://securityratty.com/tag/scottrade site">scottrade site</category>
      <category domain="http://securityratty.com/tag/scottrade">scottrade</category>
      <category domain="http://securityratty.com/tag/cross-site">cross-site</category>
      <category domain="http://securityratty.com/tag/site">site</category>
      <category domain="http://securityratty.com/tag/secure code">secure code</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <source url="http://holisticinfosec.blogspot.com/2008/09/xsf-xss-double-your-pleasure-double.html">XSF &amp; XSS: Double your pleasure, double your fun</source>
    </item>
    <item>
      <title><![CDATA[About the SDL Pro Network]]></title>
      <link>http://securityratty.com/article/dc28bc3dae82ee1f5322434291949577</link>
      <guid>http://securityratty.com/article/dc28bc3dae82ee1f5322434291949577</guid>
      <description><![CDATA[Hello all, Dave here
I expect that a number of you have seen the announcement and various press articles or Steve Lipner's Tuesday post about our launch of the SDL Threat Modeling Tool 3.0, the SDL...]]></description>
      <content:encoded><![CDATA[Hello all, Dave here... 
<P>I expect that a number of you have seen the <A href="http://www.microsoft.com/presspass/features/2008/sep08/09-16lipnersdl.mspx" mce_href="http://www.microsoft.com/presspass/features/2008/sep08/09-16lipnersdl.mspx">announcement</A> and various press articles or <A href="http://blogs.msdn.com/sdl/archive/2008/09/16/sdl-press-tour-announcements.aspx" mce_href="http://blogs.msdn.com/sdl/archive/2008/09/16/sdl-press-tour-announcements.aspx">Steve Lipner's Tuesday post</A> about our launch of the SDL Threat Modeling Tool 3.0, the SDL Optimization Model and the <A href="http://download.microsoft.com/download/0/E/9/0E9AC448-30B2-4451-9E23-46244AFABB7F/Microsoft%20SDL%20Pro%20Network%20_Fact%20Sheet.pdf" mce_href="http://download.microsoft.com/download/0/E/9/0E9AC448-30B2-4451-9E23-46244AFABB7F/Microsoft%20SDL%20Pro%20Network%20_Fact%20Sheet.pdf">SDL Pro Network</A>.&nbsp; Since I was intimately involved with the creation of the SDL Pro Network, I thought I'd write a few words about our objectives and chat a bit about the thinking behind our partner choices for the pilot phase.</P>
<P>So, what are we hoping to gain by creating a network of security consulting and training experts to work with customers who want to implement the SDL?&nbsp; Generally speaking, this question has a two-part answer:&nbsp; First, Microsoft is, and always will be a partner-driven company - we rely on the skills and capabilities of our partners to provide specialized services and broad geographic coverage for Microsoft products and services.&nbsp; Second, even though there are talented folks in the <A href="http://www.microsoft.com/services/microsoftservices/default.mspx" mce_href="http://www.microsoft.com/services/microsoftservices/default.mspx">Microsoft Services</A> organization, it's clear that we will need help from our partners to scale to meet the demand.&nbsp; I can't tell you how many times the folks on the SDL team have been approached by people - after an executive briefing, or a session at TechEd - asking for guidance in implementing SDL in their own organizations.&nbsp; When we look at the demand and pair it with the geographic diversity of our customer base, it's clear that a partner approach is the right answer.</P>
<P>Now a few words about the partners who will be participating in the pilot phase...</P>
<P>After the decision was made to work with partners on SDL delivery, we had two primary criteria that we had to address; partner quality, and manageability of the SDL Pro Network pilot. We have all seen instances where individuals or consulting organizations have represented themselves to the IT community as having security expertise when in reality the "experts for hire" were simply reading a page or two ahead of the customer in whatever security tome was "in vogue" at the time.&nbsp; </P>
<P>Based on those observations, it was clear that partner "quality" was a critical criterion. &nbsp;Fortunately for us, we didn't have to look far to satisfy our quality bar - many of the companies in the SDL Pro Network pilot have direct experience with executing portions of the SDL on <I>our</I> products, or have delivered services to Microsoft in a security context. Design reviews, code reviews, penetration testing, training&nbsp;and other tasks critical to SDL implementation were (and are) common fare for these folks.</P>
<P>Despite the customer demand for SDL that I alluded to above, starting with a small pilot was the right thing to do; a small group of trusted consultancies supports our imperative for quality and it allows us to pragmatically grow the SDL Pro Network as the market matures. &nbsp;As we continue to evolve and innovate with the SDL, we'll have a strong core of partners to help drive the software security message. </P>
<P>Will we grow the SDL Pro Network?&nbsp; The qualified answer is: "When the market demands it..." - there are a number of talented potential partners who meet the quality bar - and clearly, the need for security in software development will grow to demand additional talented specialists. However, it's our plan to begin with a small set of partners of known expertise, and then respond to growing demand as it materializes.</P>
<P>So there you have it - the nuanced beginning and bright future of the SDL Pro Network...&nbsp; I invite your comments, and encourage you to check in at the <A href="http://www.microsoft.com/sdl" mce_href="http://www.microsoft.com/sdl">SDL Portal</A> as we continue to build out the program</P><img src="http://blogs.msdn.com/aggbug.aspx?PostID=8958114" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 23:12:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/sdl">sdl</category>
      <category domain="http://securityratty.com/tag/sdl pro network">sdl pro network</category>
      <category domain="http://securityratty.com/tag/sdl implementation">sdl implementation</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/sdl delivery">sdl delivery</category>
      <category domain="http://securityratty.com/tag/sdl optimization model">sdl optimization model</category>
      <category domain="http://securityratty.com/tag/quality">quality</category>
      <category domain="http://securityratty.com/tag/partner quality">partner quality</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://blogs.msdn.com/sdl/archive/2008/09/18/about-the-sdl-pro-network.aspx">About the SDL Pro Network</source>
    </item>
    <item>
      <title><![CDATA[From the Executive Women's Forum on Information Security]]></title>
      <link>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</link>
      <guid>http://securityratty.com/article/f2976566aba2a7d7042931766a835f14</guid>
      <description><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management &amp; Privacy is &quot;risk convergence is inevitable.&quot; The risks associated with information security, privacy, physical...]]></description>
      <content:encoded><![CDATA[The theme of the 2008 Executive Women's Forum on Information Security, Risk Management & Privacy is "risk convergence is inevitable." The risks associated with information security, privacy, physical security and so forth are converging such that an integrated management approach is required from within the firm. <br />
<br />
Interestingly enough, business continuity management was not a key risk area mentioned by all panelists of the session titled "Convergence: The Good, The Bad & The Ugly." There were two pieces of strategic program management advice from the panelists. The first point is that you have to partner with all of your lines of business and corporate support areas. Since risk is related to the delivery of the business, no one department can address all of the issues. And, you might find that there are good practices already in place within your firm, so that you are not reinventing the wheel - leverage the good stuff throughout the firm. The second point is to focus on the budget issue - how many risk-related activities are already in place in your organization that could be combined, and possibly duplicated, so that more work gets done with less money spent? Pooling of already limited budgets can go a long way toward developing a program that is more mature, delivers more benefit to the organization and eliminates a lot of duplicative work. <br />
<br />
But all of this convergence comes at a price - mainly in fear, uncertainty and doubt of the workforce. Some feel that they will lose authority (especially in siloed risk approaches); others might lose their jobs as a result of the convergence. This human aspect was mentioned as the key challenge of an integrated approach. Therefore, communicating not only up within the firm but down to the workforce is critical to achieving a well-run and integrated program. <br />
<br />
And finally, for those areas that just don't want to "play the game," use your internal audit department as the "stick" that can get them to act. When I was an IT risk manager, I always said that I was management's best friend - let me tell you the gaps in your risk program rather than having them come from the audit department, which then become part of the records of the firm.]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 15:29:34 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk approaches">risk approaches</category>
      <category domain="http://securityratty.com/tag/risk program">risk program</category>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/management">management</category>
      <category domain="http://securityratty.com/tag/management approach">management approach</category>
      <category domain="http://securityratty.com/tag/key risk">key risk</category>
      <category domain="http://securityratty.com/tag/audit department">audit department</category>
      <category domain="http://securityratty.com/tag/internal audit department">internal audit department</category>
      <source url="http://blog.gartner.com/blog/security.php?x=0&amp;itemid=3879">From the Executive Women's Forum on Information Security</source>
    </item>
    <item>
      <title><![CDATA[Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!]]></title>
      <link>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</link>
      <guid>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</guid>
      <description><![CDATA[I am participating in the 4th annual Hosting Transformation Summit in sunny Las Vegas today and have just listened to some heartwarming news from Dan Golding the head of Tier1 Research . Dan kicked...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/datacenter-ani-optimized.gif" border="0" alt="Datacenter_ani_optimized" width="242" height="249" align="left" /> I am participating in the <a href="http://www.hostingtransformation.com/na/2008/" target="_blank">4th annual Hosting Transformation Summit</a> in sunny Las Vegas today and have just listened to some heartwarming news from <a href="http://www.hostingtransformation.com/na/2008/panelists.php" target="_blank">Dan Golding</a> the head of <a href="http://www.t1r.com/" target="_blank">Tier1 Research</a>. Dan kicked off the morning with his Keynote “Managed Hosting and Colocation in 2009 and beyond.” As you may know, ScienceLogic has maintained a large group of customers in the Managed Service Provider industry so we love to keep our ears to the pavement regarding industry trends. (<em><a href="http://www2.sea.siemens.com/NR/rdonlyres/4866BFD6-9181-41BD-90EA-D8380255E826/0/Datacenter_ani_optimized.gif" target="_blank">image from: Siemens</a>)</em></p>
<p>Dan described the Managed Hosting and colocation sector as “on fire” The sector is humming – incredible growth, outstanding execution, blowing away expectations. I must say, looking back 5 years ago after the tech bubble collapse, I can’t believe how strong the <a href="http://blog.wired.com/business/2008/09/why-the-tech-in.html" target="_blank">sector bounced back</a> from those very difficult times.</p>
<p>His presentation was focused on a future, and a longer view for the industry. The HTS conference is packed this year with the largest attendance of Datacenter owners, Managed hosting and colocation companies ever to attend this conference.</p>
<ul>
<li>Demand steady or increasing in all markets, driven largely by capex constraints and greater awareness and choices.</li>
<li>Supply is growing more slowly in the past 18 months as the credit crunch has hurt the ability of providers to expand ( it is very hard to get mortgages, loans only on new datacenter projects). Expansion build-out of existing shells is occurring, but very little on spec.</li>
<li>Demand Growth of 15% in 2008. (Steady and increasing in the out years) However after supply growth peaked at 7.5% in 2007 supply growth now has slowed to 5%</li>
<li>Dan believes that supply growth will pick back up again in 2011</li>
</ul>
<p>Conclusions – supply is tight, demand is high and growing…this very good news for the industry.</p>
<ul>
<li>Some other trends:
<ul>
<li>The <a href="http://royal.pingdom.com/?p=327" target="_blank">green initiatives</a> are more than just a <a href="http://www.greenm3.com/2008/09/cisco-and-ibm-s.html" target="_blank">trend as datacenter owners</a> who don’t figure out how to <a href="http://www.greenm3.com/2008/08/modeling-for-gr.html" target="_blank">maximize power efficiency</a> will be painted as villains.</li>
<li><a href="http://www.webpronews.com/topnews/2008/09/02/us-getting-dominated-in-internet-traffic" target="_blank">Internet traffic</a> and services consumption are linked as Internet traffic growth has been doubling every year (2005-2007)</li>
<li>Prediction: 2011 -2012 - <a href="http://mashable.com/2008/08/31/is-the-us-becoming-a-part-of-the-internet-backwater/" target="_blank">internet traffic</a> will get an exaflood – it is coming with a new breed of applications (set to boxes HD Video, games, etc.) that will drive new traffic patterns. <a href="http://www.nytimes.com/2008/08/30/business/30pipes.html?_r=1&amp;ref=technology&amp;oref=slogin" target="_blank">Growth driven by consumer broadband</a> + applications (HD video) applications, which in turn will drive demand for Managed Hosting / Colocation Services…</li>
</ul>
</li>
</ul>
<p>Managed Hosting Services Highlights</p>
<ul>
<li>Incredibly fast growth 30%+</li>
<li>$10 Billion worldwide revenue by end of 2008</li>
<li>We’ll keep growth pace until at least 2011</li>
<li>Good news, Dan believes that fears about slowdown in growth are wildly overblown.</li>
</ul>
<p>Why is managed hosting growing so fast?</p>
<ul>
<li>Demographic shifts – new breed of IT employees that <a href="http://www.crcexchange.com/outsource-your-it" target="_blank">embrace outsourcing</a></li>
<li>Growth in internet applications <a href="http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html?source=rss&amp;url=http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html" target="_blank">(SaaS)</a> The acceptance and growth of browser based applications has been enormous!</li>
<li>Ambiguity between web hosting and managed hosting has turned positive</li>
</ul>
<p>Dan’s Key success factors <a href="http://blog.adspotlive.com/managed-hosting-and-related-things-to-be-considered/" target="_blank">managed hosting and services</a></p>
<ul>
<li>High margin services – and not too many – it is so tempting in our day to day business when a customer comes along and wants to come and give us money for a unique on-off service… at this point the answer has to be no – or do it through a partner.</li>
<li>High level of support delivery is critical – don’t cut pay in support people or outsource support to save a nickel… what you are selling is support. Keep doing this well or you will head into a bad place… just as examples in retail like Home Depot and others who have struggled with customer service challenges – the whole business starts to slide into the toilet… High levels of support delivers a strong word of mouth buying cycle</li>
</ul>
<p>Final thoughts, the industry is healthy and will continue to thrive. Customers are looking for the one stop shop, one company that is a trusted advisor to the customer. As customers place more eggs in the Managed Service bucket, the industry will need to tighten-up those SLA’s. Today some parts of the industry have been getting away with loose SLA’s… as customers get more sophisticated and have more on the line, they will become more demanding and require robust multi-component SLAs and back-it –up.</p>
]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 11:00:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/demand steady">demand steady</category>
      <category domain="http://securityratty.com/tag/demand">demand</category>
      <category domain="http://securityratty.com/tag/incredibly fast growth">incredibly fast growth</category>
      <category domain="http://securityratty.com/tag/growth">growth</category>
      <category domain="http://securityratty.com/tag/drive demand">drive demand</category>
      <category domain="http://securityratty.com/tag/drive">drive</category>
      <category domain="http://securityratty.com/tag/internet traffic growth">internet traffic growth</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <source url="http://blog.sciencelogic.com/can-you-believe-it-with-the-financial-markets-in-turmoil-the-hosting-industry-continues-to-thrive/09/2008">Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!</source>
    </item>
  </channel>
</rss>
