<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: picture]]></title>
    <link>http://securityratty.com/tag/picture</link>
    <description></description>
    <pubDate>Mon, 15 Sep 2008 05:41:43 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[The Commercialization of Anti Debugging Tactics in Malware]]></title>
      <link>http://securityratty.com/article/91955d7bc08228b99c0f5fa478c039b5</link>
      <guid>http://securityratty.com/article/91955d7bc08228b99c0f5fa478c039b5</guid>
      <description><![CDATA[Commoditization or commercialization, Themida or Code Virtualizer, individually crypting or outsourcing to an experienced malware crypting service offering discounts on a volume basis next to...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://2.bp.blogspot.com/_wICHhTiQmrA/SN0BFks8GsI/AAAAAAAACMQ/J_vLiffz110/s1600-h/figure_multiple.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="128" src="http://2.bp.blogspot.com/_wICHhTiQmrA/SN0BFks8GsI/AAAAAAAACMQ/bz624nz5JbE/s200-R/figure_multiple.jpg" width="200" /></a><a href="http://ddanchev.blogspot.com/2008/09/commoditization-of-anti-debugging.html">Commoditization</a> or commercialization, Themida or Code Virtualizer, individually crypting or outsourcing to an experienced malware crypting service offering discounts on a volume basis next to detection rates of the crypted binary offered by a trusted online scanner that is NOT distributing the samples to the vendors? These are just some of the questions malware authors often ask themselves, while others distribute pirated copies of Code Virtualizer urging everyone to start taking advantage of commercial anti-reverse engineering tools to make their malware harder to analyze. Once again, just like we've seen before, a legitimate commercial application can come handy in the hands of the wrong people :<br />
<br />
"<i>Code Virtualizer will convert your original code (Intel x86 instructions) into Virtual Opcodes that will only be understood by an internal Virtual Machine. Those Virtual Opcodes and the Virtual Machine itself are unique for every protected application, avoiding a general attack over Code Virtualizer. Code Virtualizer can protect your sensitive code areas in any x32 and x64 native PE files (like executable files/EXEs, system services, DLLs , OCXs , ActiveX controls, screen savers and device drivers).</i><br />
<br />
<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SN0CPwG9MzI/AAAAAAAACMY/lB8WtKqycj4/s1600-h/cvprotopt.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="149" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SN0CPwG9MzI/AAAAAAAACMY/kgSYpWIHW2E/s200-R/cvprotopt.png" width="200" /></a><i>Code Virtualizer can generate multiple types of virtual machines with a different instruction set for each one. This means that a specific block of Intel x86 instructions can be converted into different instruction set for each machine, preventing an attacker from recognizing any generated virtual opcode after the transformation from x86 instructions. The following picture represents how a block of Intel x86 instructions is converted into different kinds of virtual opcodes, which could be emulated by different virtual machines.</i><br />
<br />
<i>When an attacker tries to decompile a block of code that was protected by Code Virtualizer, he will not find the original x86 instructions. Instead, he will find a completely new instruction set which is not recognized by him or any other special decompiler. This will force the attacker to go through the extremely hard work of identifying how each opcode is executed and how the specific virtual machine works for each protected application. Code Virtualizer totally obfuscates the execution of the virtual opcodes and the study of each unique virtual machine in order to prevent someone from studying how the virtual opcodes are executed.</i>"<br />
<br />
With Cyber-as-a-Service business model becoming increasingly common, the entire <a href="http://ddanchev.blogspot.com/2007/10/multiple-firewalls-bypassing.html">quality assurance model in respect to malware</a> is slowly maturing from individual malware crypting propositions, where the seller of the service is basically taking advantage of a diverse set of public/private tools, into DIY web services offering crypting discounts on a volume basis, and perhaps most importantly - improving the customer's experience by letting him take advantage of the inventory of crypting tools and bypassing verification services. Within the tool's inventory are naturally lots of (pirated) commercial anti-reverse engineering tools.<br />
<br />
As we've seen before, whenever someone starts commercializing what used to be a self-selving process, others will either follow, or disintermediate their services by persistently releasing crypting tools for free in the wild. At the end of the day, it's all a matter of how serious they're about commercializing this market segment, and taking into consideration that a spamming vendor is offering malware crypting services "in between" the rest of the services in their portfolio, this underground cash cow is yet to prove itself in the long term.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wJDSL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wJDSL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=QoCNL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=QoCNL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=e4uxl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=e4uxl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=sXqbl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=sXqbl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=khiOL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=khiOL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=2cQ2L"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=2cQ2L" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=HiSTl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=HiSTl" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/406651187" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 12:55:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/machine">machine</category>
      <category domain="http://securityratty.com/tag/specific virtual machine">specific virtual machine</category>
      <category domain="http://securityratty.com/tag/internal virtual machine">internal virtual machine</category>
      <category domain="http://securityratty.com/tag/code">code</category>
      <category domain="http://securityratty.com/tag/sensitive code">sensitive code</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/unique virtual machine">unique virtual machine</category>
      <category domain="http://securityratty.com/tag/original code">original code</category>
      <category domain="http://securityratty.com/tag/code virtualizer">code virtualizer</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/406651187/commercialization-of-anti-debugging.html">The Commercialization of Anti Debugging Tactics in Malware</source>
    </item>
    <item>
      <title><![CDATA[Of Planes and Ships]]></title>
      <link>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</link>
      <guid>http://securityratty.com/article/47dfbf92b3eaba317f07cfa2064d0a9b</guid>
      <description><![CDATA[Tom Barnett is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.thomaspmbarnett.com/weblog/2008/09/column_121.html">Tom Barnett</a> is consistently the most interesting writer on globalization and econo-security seam. This weeks piece confronts a problem every security architect can relate to (emphasis added on the &quot;nail it to the wall&quot; quote at the end):</p><p><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">One of the main problems in counterterrorism today is that there are so many people and vehicles, and so much data and material, moving through globalization&#39;s myriad networks that it seems virtually impossible to track it all effectively. Nowhere has this problem been more acute than on the high seas.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">In 2006, Adm. Harry Ulrich, then U.S. commander of NATO Naval Forces Europe, decided to do something about it. Despite having virtually no resources, his dream was to transpose the global air-traffic control system onto sea traffic.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Worldwide, aircraft are transparent, because they&#39;re all required to carry an identification beacon that allows them to be tracked leaving and entering airports, and monitored between airports, by a global network of sensors. Act suspiciously and somebody&#39;s fighter aircraft will soon be on your tail.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">No such pervasive system currently exists globally for maritime traffic. While bigger ships carry an ID beacon similar to aircraft, without a shared monitoring network, that&#39;s like tracking only selected commercial jets and giving everyone else a pass.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">So Ulrich, upon taking command, asked a simple question: &quot;If we can do that in the air, why can&#39;t we do it on the sea?&quot; He made a point of pioneering his sea-traffic-control effort first inside the Mediterranean, where NATO&#39;s southern naval forces have historically been concentrated, but his real target was waters off Africa -- the most ungoverned maritime space in the world.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich knew the U. S. Navy couldn&#39;t do it alone, much less bring Africa&#39;s meager coast-guard-like navies up to snuff so they could do it on their own. So he quickly created a network of assets -- both public and private -- to manage that space, modeling his monitoring system on international air-traffic control.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Ulrich began stitching together a network of shore-based sensors ringing the Mediterranean. His naval command then began initial monitoring by tapping into the International Maritime Organization&#39;s existing Automated Identification System, transforming NATO&#39;s ability to track ship traffic in the Med.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Almost overnight, NATO went from tracking dozens of ships on the Mediterranean to thousands, and instead of getting the data sometimes up to 72 hours late, now the contacts were being tracked in one to five minutes -- to an accuracy within 50 feet on the earth&#39;s surface.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When the classic big-firm systems integrators told Ulrich it would be too costly to pull it off, the admiral turned to the Volpe Center in Cambridge, Massachusetts, a U.S. Department of Transportation research center. Instead of hundreds of millions of dollars, Ulrich&#39;s initial network cost $900,000. The shore-based receivers are small, roughly the size of a radar dish you might find on a pleasure craft.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The strength of the system is a function of its reach: the more countries join, the larger the shared operational picture. By the time Ulrich retired at the end of 2007, he had enlisted 32 countries throughout the Mediterranean, the North Atlantic, along the west coast of Africa, around the Black Sea, and in the Pacific. Today, the network continues to spread around the planet.</span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; font-size: 14px; line-height: 20px; "><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">With Ulrich&#39;s system in place, local police, coast guards, and border patrols catch most bad guys, obviating American military responses. As Harry told me for an article I wrote about his work in a fall 2007 issue of Esquire, </span><span style="font-weight: bold; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">&quot;I don&#39;t do defense; I do security. When you talk defense, you talk containment and mutually assured destruction. When you talk security, you talk collaboration and networking. This is the future.&quot;</span></span><span style="font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">The admiral&#39;s legacy program, the Maritime Safety and Security Information System, earned the Volpe Center a prestigious &quot;Innovations in American Government&quot; award this month from Harvard University&#39;s Ash Institute for Democratic Governance and Innovation.</span></p></blockquote><p><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></p><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">Security Collaboration + Networking &#160;= Federation. This is indeed the future - SAML came along just at the nick of time.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">When you assume that to do access control you must have &quot;Complete Mediation&quot; in Saltzer and Schroeder&#39;s terms of the subject (users), the objects (data), the session, and the roles, then you are going to have an interesting life trying to deliver anything. And if you do it will mucho expensive.</span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; "><br /></span></div><div><span style="border-collapse: collapse; line-height: 20px; font-size: 13px; font-family: &#39;Trebuchet MS&#39;; ">if you take the federated autonomous nodes approach, agree upon an attribute schema plus a protection model for same, and basic protocol, you are then free to move about the country. Security doesn&#39;t have to equal centralization or high cost. Get the attributes from point a to point b securely.</span></div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 19:04:11 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security architect">security architect</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/identification system">identification system</category>
      <category domain="http://securityratty.com/tag/initial network cost">initial network cost</category>
      <category domain="http://securityratty.com/tag/initial">initial</category>
      <category domain="http://securityratty.com/tag/cost">cost</category>
      <category domain="http://securityratty.com/tag/ulrich">ulrich</category>
      <category domain="http://securityratty.com/tag/time ulrich">time ulrich</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/of-planes-and-ships.html">Of Planes and Ships</source>
    </item>
    <item>
      <title><![CDATA["Would you feel safe with this man looking after you?]]></title>
      <link>http://securityratty.com/article/8449600c6be4b5f5790eebbbff0d12d3</link>
      <guid>http://securityratty.com/article/8449600c6be4b5f5790eebbbff0d12d3</guid>
      <description><![CDATA[That was the caption under the picture of Rocker,Ted Nugent, in last Tuesday's Guardian . Nugent had volunteered to be Sir Paul McCartney's &quot;Bodyguard&quot; when he played a concert in Israel
...]]></description>
      <content:encoded><![CDATA[<a href="http://1.bp.blogspot.com/_1UFxC-OgSnA/SN_3k0Kss4I/AAAAAAAAAGc/0WSQmbx1zdU/s1600-h/Mugshot__TED-NUGENT.jpg"><img style="float:left; margin:0 10px 10px 0;cursor:pointer; cursor:hand;" src="http://1.bp.blogspot.com/_1UFxC-OgSnA/SN_3k0Kss4I/AAAAAAAAAGc/0WSQmbx1zdU/s320/Mugshot__TED-NUGENT.jpg" border="0" alt=""id="BLOGGER_PHOTO_ID_5251187902388155266" /></a><br />That was the caption under the picture of Rocker,Ted Nugent, in last Tuesday's <a href="http://www.guardian.co.uk/music/2008/sep/23/paul.mccartney.popandrock">Guardian</a>.  Nugent had volunteered to be Sir Paul McCartney's "Bodyguard" when he played a concert in Israel. <br /><span id="fullpost"><br />Unfortunately,this is what our industry has to tolerate.  Many people, from broken down celebrity deer hunters to jail guards think that if you know how to shoot a rifle or open a gate for inmates to go to the yard, it automatically follows that you know everything about protecting the life of a executive.       <br /></span><br />So, Ted Nugent knows how to play guitar and shoot deer.  Just what part of that background would equip him to keep the former Beetle safe in the Middle East?  It is certainly not like Mr. Nugent is trying to pull the wool over our eyes when it comes to any specialized training he may have received.  "I'm Dirty Harry with a ponytail", claims the singer.<br /><br />First of all Mr. Nugent, "Dirty Harry" was a film produced by Hollywood to entertain people, not a "training aid".  Secondly, even if we were to stretch our imaginations and consider Harry Callaghan's actions, we would recall that the character was a Police Detective and as such, would have undergone rigourous training at a professional Police Academy.<br /><br />Refering to reported Islamic Extremist Death Threats made against McCartney if he insisted on playing the concert, Nugent informed us that he "will not bend or waiver to Voodoo Religions or Whackjobs".  <br /><br />It is unknown whether or not Mr. Nugent thinks that Islamic Extremists come from Haiti, but if he is serious about a future career in Executive Protection, we would advise him to attend our <a href="http://www.sextonsecurity.com/training.html">upcoming course in Dubai </a>next month where he will not only learn first hand the Art of Personal Protection, but he will also learn about Middle Eastern Cultures, Tradition and Religion.<br /><br />Unfortunately, there's no way of predicting how much culture we may be able to pass on to Mr. Nugent, as the course is only a little over a week long.  We will also be teaching etiquette and which knife and fork to use when attending a formal event with your Principal.  That's right Ted, you don't get to tear the meat from the bone with your hands.  <br /><br />Someone call the U.A.E. and let the Hilton know that we may have to stay longer than planned.<div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Sun, 28 Sep 2008 16:44:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ted nugent">ted nugent</category>
      <category domain="http://securityratty.com/tag/nugent">nugent</category>
      <category domain="http://securityratty.com/tag/ted">ted</category>
      <category domain="http://securityratty.com/tag/dirty harry">dirty harry</category>
      <category domain="http://securityratty.com/tag/deer">deer</category>
      <category domain="http://securityratty.com/tag/sir paul mccartney">sir paul mccartney</category>
      <category domain="http://securityratty.com/tag/mccartney">mccartney</category>
      <category domain="http://securityratty.com/tag/celebrity deer hunters">celebrity deer hunters</category>
      <category domain="http://securityratty.com/tag/professional police academy">professional police academy</category>
      <source url="http://www.thebulletproofblog.com/2008/09/would-you-feel-safe-with-this-man.html">"Would you feel safe with this man looking after you?</source>
    </item>
    <item>
      <title><![CDATA[Pieces of the WLAN mgmt. puzzle that cant be solved by WLAN gear vendors ]]></title>
      <link>http://securityratty.com/article/70de91a40d8a68aec42aa3567c72c758</link>
      <guid>http://securityratty.com/article/70de91a40d8a68aec42aa3567c72c758</guid>
      <description><![CDATA[As robust as they are, the management systems shipping with todays WLAN gear are only part of the whole enterprise WLAN management picture. There are several classes of ad-hoc tools that address a...]]></description>
      <content:encoded><![CDATA[As robust as they are, the management systems shipping with today’s WLAN gear are only part of the whole enterprise WLAN management picture. There are several classes of ad-hoc tools that address a number of broad management areas that may not be included in any given management system from a WLAN gear vendor.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/wirelessmobile;sz=468x60;ord=88602?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/wirelessmobile;sz=468x60;ord=88602?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 21 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wlan gear vendor">wlan gear vendor</category>
      <category domain="http://securityratty.com/tag/todays wlan gear">todays wlan gear</category>
      <category domain="http://securityratty.com/tag/broad management">broad management</category>
      <category domain="http://securityratty.com/tag/ad-hoc tools">ad-hoc tools</category>
      <category domain="http://securityratty.com/tag/management system">management system</category>
      <category domain="http://securityratty.com/tag/management systems">management systems</category>
      <category domain="http://securityratty.com/tag/classes">classes</category>
      <category domain="http://securityratty.com/tag/robust">robust</category>
      <category domain="http://securityratty.com/tag/address">address</category>
      <source url="http://www.networkworld.com/reviews/2008/092208-wlan-management-side.html?fsrc=rss-security">Pieces of the WLAN mgmt. puzzle that cant be solved by WLAN gear vendors </source>
    </item>
    <item>
      <title><![CDATA[VMworld 2008 Keynote with Paul Maritz]]></title>
      <link>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</link>
      <guid>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</guid>
      <description><![CDATA[Traveling towards VMworld 2008
I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy...]]></description>
      <content:encoded><![CDATA[<p><em><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; margin: 5px; border-right-width: 0px" height="160" alt="paulmaritzvmware" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/paulmaritzvmware.jpg" width="240" align="left" border="0" /> Traveling towards VMworld 2008</em></p>
<p>I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy red flags to guide us not to the empty seats in front of us, but to the ones 50 yards on. (Ah Vegas, my feet hurt already.) Perhaps the point was to live in the moment, soak in the pre-rock concert atmosphere complete with a hip and cool soundtrack ripped off from Apple commercials. (Do they all use the same ad firm?) A better way to build the anticipation for, yes, the kickoff keynote session at <a href="http://www.vmworld.com/conferences/2008/" target="_blank">VMworld 2008</a>. (<em><a href="http://www.flickr.com/photos/jumpingshark/2862470725/" target="_blank">photo credit: lodev</a>)</em></p>
<p>To the sounds of <a href="http://www.youtube.com/watch?v=PEinqCHPY08" target="_blank">Hey Ya</a> (Shake it like a Polaroid picture), we shifted forward in our uncomfortable temporary seating placed, as at all tech conferences, too close for all but the skinny girls. The moment was here &#8211; one of those videos started playing on the dozen or so huge monitors floating above the convention crowd. You know this video; you&#8217;ve probably seen it before from HP or someone like that. One of those videos with instrumental Coldplay music in the background with time <a href="http://www.hp.com/hpinfo/newsroom/hpads/" target="_blank">lapse/speeded-up video</a> of people in motion and floating captions dropping into the images that leave you with a slight smile on your face as you &#8220;get&#8221; the relationship between image and text. (Do they all use the same ad firm?)</p>
<p>And here he is, announced like a Vegas headliner, <a href="http://vmblog.com/archive/2008/07/23/forbes-interviews-vmware-ceo-paul-maritz-after-financial-analyst-call.aspx" target="_blank">Paul Maritz, the new CEO of VMware</a>. Hmm. After all that hype, I rather expected someone in a black turtleneck and jeans to come out. Instead here&#8217;s this guy with pleat-front pants and an admittedly cool accent (New Zealand?) who looks a little like Al from Home Improvement. Not that there&#8217;s anything wrong with that &#8211; everyone likes Al.</p>
<p><em>And then the real fun begins.</em></p>
<ul>
<li>30 years ago, Paul Maritz started off his business career as a developer </li>
<li>10 years ago, VMware was founded by <a href="http://blog.sciencelogic.com/diane-greene-ousted-from-vmware/07/2008" target="_blank">Diane</a> <a href="http://virtualization.com/news/2008/07/08/diane-greene-vmware-paul-maritz/" target="_blank">Greene</a> and <a href="http://www.cio-weblog.com/50226711/found_rosenblum_leaves_vmware.php" target="_blank">Mendel</a> <a href="http://blog.sciencelogic.com/another-vmware-founder-leaves/09/2008" target="_blank">Rosenblum</a> (BTW, 10 seconds spent showing a slide with cartoon-ized images of the founders, &#8220;thanks for what you did for the company for the past 10 years&#8221;. 10 seconds after 10 years&#8230;but maybe more would have been hypocritical&#8230;) </li>
<li>a retrospective of centralized vs. decentralized computing initiatives from the 1960&#8217;s to today </li>
<li>of course VMware milestones from 1998 to today </li>
<li>and then an analyst-ready diagram showing the product roadmap (to be delivered in 2009) with, you guessed it, finally a connection between <a href="http://advice.cio.com/laurianne_mclaughlin/vmworld_ceo_maritz_outlines_broad_plans_for_cloud_and_client" target="_blank">VMware and cloud computing</a> (remember Maritz&#8217;s cloud-computing company was bought by EMC just a couple of years ago and that&#8217;s the section he headed up at EMC before being brought into VMware). </li>
</ul>
<p><em>Forward Looking</em></p>
<p>2008 (and probably much of 2009) will be a very busy year for VMware. If you believe the roadmap, <a href="http://www.uberpulse.com/us/2008/09/vmwares_ambitious_expansion_plan.php" target="_blank">VMware seems to be taking on the management of everything</a> &#8211; from chargeback and capacity planning to virtual storage and virtual networking (more to come on just what the planned vStorage and vNetwork will deliver) &#8211; but all of it VMware-centric. As <a href="http://blog.sciencelogic.com/vmware-is-better-than-microsoft/09/2008" target="_blank">we said in an earlier post,</a> they&#8217;ve moved away from &#8220;defending&#8221; the hypervisor business proposition to focusing on management services on top of their own hypervisor platform. Revenue pressures must be excruciating &#8211; who wants to be a public company these days?</p>
<p>The best part of that new &#8220;Virtual Data Center Operating System&#8221; <a href="http://www.vmware.com/technology/virtual-datacenter-os/" target="_blank">diagram/roadmap</a> was the addition (and I mean addition) of something called <a href="http://vmetc.com/2008/09/16/vmwares-vcloud-iniatives-the-vision-for-the-next-10-years/" target="_blank">Cloud vServices</a>. (Did anyone else find it odd that <a href="http://virtualization.com/news/2008/09/15/vcloud-vmware-to-be-cloud-computing-provider-too-but-inside-your-private-dc-and-not-tomorrow/" target="_blank">Cloud vServices</a> is kind of on its own in the Infrastructure vServices area? AND, I&#8217;ll have to get the other version of the diagram/roadmap I actually saw at the show because that one shows an inexplicable 4<sup>th</sup> box in the Application vServices area titled &#8220;&#8230;&#8221;. Really. Maybe to balance out the addition of <a href="http://www.itpro.co.uk/606237/vmwares-paul-maritz-goes-on-offence" target="_blank">Cloud vServices?</a>)</p>
<p>What was clear is that the move from VirtualCenter to vCenter &#8211;and the new vServices for rolled-up management of <a href="http://www.virtualization.info/2008/09/live-from-vmworld-2008-day-2-vmware.html" target="_blank">virtualization components</a>/capability to span multiple <a href="http://blogs.zdnet.com/virtualization/?p=542" target="_blank">VirtualCenters</a> (or future vCenters) for reporting, monitoring and management at scale &#8211; has been in the works for a bit (but in tech time, that could mean 6 months), but the cloud stuff&#8230;not so much.</p>
<p>Beyond the very high-level speak appropriate to a keynote (100+ service provider partners for off-premise cloud&#8230;suspended VM&#8217;s that you don&#8217;t have to pay for until you need it), the details are uber-fuzzy. There was a session that Dave went to which was supposed to shed more light, but when questions were asked about how it really works, the answers seemed to be TBD. Does anyone know more? If VMware really has figured out practical cloud computing for enterprises, kudos to them. But I fear they&#8217;re <a href="http://news.cnet.com/8301-13505_3-10042463-16.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20" target="_blank">like everyone else</a> (except maybe AT&amp;T) and are still working out the details.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 15:00:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vservices">vservices</category>
      <category domain="http://securityratty.com/tag/infrastructure vservices">infrastructure vservices</category>
      <category domain="http://securityratty.com/tag/cloud vservices">cloud vservices</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware milestones">vmware milestones</category>
      <category domain="http://securityratty.com/tag/keynote">keynote</category>
      <category domain="http://securityratty.com/tag/vmware-centric">vmware-centric</category>
      <category domain="http://securityratty.com/tag/paul maritz">paul maritz</category>
      <source url="http://blog.sciencelogic.com/vmworld-2008-keynote-with-paul-maritz/09/2008">VMworld 2008 Keynote with Paul Maritz</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: Cisco]]></title>
      <link>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</link>
      <guid>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</guid>
      <description><![CDATA[After some rousing introduction music, Marie Hatter , Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization
Introduction...]]></description>
      <content:encoded><![CDATA[<p>After some rousing introduction music, <a href="http://blogs.cisco.com/authors/bio/83" target="_blank">Marie Hatter</a>, Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization.</p>
<p><strong>Introduction</strong></p>
<p>Virtualization is a word used by consumers and also by IT. But, do we all mean the same thing?</p>
<p>A very cool video from Cisco provided answers to &#8220;what is virtualization&#8221; from an  engineering perspective, data center perspective, IT perspective and the user perspective (virtual world).</p>
<p>Virtualization is about breaking the bonds between applications and server hardware, nodes and networks, applications and operating systems.</p>
<p>Why is this interesting? Virtualization holds the promise to transform the way we work, live, learn and play.</p>
<p><strong>Why virtualize?</strong></p>
<p>The real estate boom over the last 30 years has driven people to the suburbs. People didn&#8217;t mind commuting for an hour with lower gas prices. Today, we have a weak economy and gas prices are high. Something has to change.</p>
<p>Many are opting to stay at home. Businesses are trying out telecommuting, some (like Cisco) are even offering telepresence. This helps by reducing carbon footprint. Corporations are breaking free from physical requirements. The global workforce is also having an impact on the network. These changes are having a huge impact on the network.</p>
<p>We are on the cusp of transitioning from virtualization to VIRTUALIZATION.</p>
<p><strong>&#8220;One to many&#8230;.many to one.&#8221;</strong></p>
<p>This is Cisco&#8217;s idea of virtualization.</p>
<p>Consider the different roles we play in life - one to many. Spouse, executive, friend, parent, gym rat. This would be &#8220;one to many&#8221;. This is exactly what virtualization does. It allows you to partition resources off that you can use on the fly.</p>
<p><strong>Where do I start?</strong></p>
<p>Virtualization starts with server and storage. But, it&#8217;s the network that touches everything - it spans the physical, the virtual, and the cloud. This provides the connectivity to all these resources. The network brings transparency to the picture. It allows you to better monitor performance and better implement security - great benefits!</p>
<p><strong>Why do I need this?</strong></p>
<p>At Cisco, we saw that we were only using 20% of our storage utilization. We wanted to virtualize our datacenters. When we did that, we were able to get 68% storage utilization. For each year that we were able to defer buildup, we saved $40 million.</p>
<p>From a business standpoint, virtualization helps you differentiate and work faster. Provisioning in minutes, improved productivity and competitive differentiation, using less power (environmental impact), and up the ante of business continuity. If VMWare fails? It&#8217;s OK. You can reprovision it on the fly.</p>
<p><strong>Is it for everyone?</strong></p>
<p>IT organizations tend to be siloed. You have the IT side and the Operations side. Each has responsibility. For virtualization to work, these walls have to come down. The concept of virtualization depends on shared resources.</p>
<p><strong><a href="http://en.wikipedia.org/wiki/Metcalfe%27s_law" target="_blank">Metcalfe&#8217;s Law of the Network</a> Effect</strong></p>
<p>Everytime you add a node to the network, you increase the value. This is what happens with virtualization. Every device you virtualize increases the power of each device. More control of environment and more efficiency.</p>
<p>This leads to&#8230;</p>
<p><strong>Cloud computing.</strong></p>
<p>Wow, show of hands from the audience when Marie asked &#8220;how many are using cloud computing?&#8221; and &#8220;how many are using your own clouds?&#8221; - not a lot of hands were raised. Interesting considering the coverage cloud computing has and the focus of it.</p>
<p>Cloud computing has three possibilities at Cisco:</p>
<ul>
<li>Flexible infrastructure (hosting)</li>
<li>Abstract services (APIs)</li>
<li>Application services (SaaS)</li>
</ul>
<p>Automation is going to be key, and will need to integrate virtualization-aware elements.</p>
<p>Can you imagine if you wanted interoperability in the cloud? People haven&#8217;t even begun thinking about it.</p>
<p><strong>Conclusion</strong></p>
<p>As you virtualize, your role will change. You will think more about strategy. But keep in mind these &#8220;minefields&#8221; of virtualization:</p>
<ul>
<li>Insufficient planning</li>
<li>Lack of standards</li>
<li>Weak security</li>
</ul>
<p>Security cannot be an afterthought. It has to be planned. We&#8217;ve seen new forms of malware, hypervisor attacks, and root kit infections.</p>
<p>As higher expectations from end users evolve, we&#8217;re becoming not server oriented, but SERVICE oriented.</p>
<p><strong>Tips:</strong></p>
<ul>
<li>Think holistically</li>
<li>Consider IT culture - equipment and people</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 10:11:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/virtualization">virtualization</category>
      <category domain="http://securityratty.com/tag/virtualization starts">virtualization starts</category>
      <category domain="http://securityratty.com/tag/virtualization helps">virtualization helps</category>
      <category domain="http://securityratty.com/tag/helps">helps</category>
      <category domain="http://securityratty.com/tag/virtualization depends">virtualization depends</category>
      <category domain="http://securityratty.com/tag/virtualization holds">virtualization holds</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network brings transparency">network brings transparency</category>
      <category domain="http://securityratty.com/tag/cisco">cisco</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-cisco/09/2008">Interop NY Keynotes: Cisco</source>
    </item>
    <item>
      <title><![CDATA[EstDomains and Intercage VS Cybercrime]]></title>
      <link>http://securityratty.com/article/54303a8239cd0becf5843fb3552a50a8</link>
      <guid>http://securityratty.com/article/54303a8239cd0becf5843fb3552a50a8</guid>
      <description><![CDATA[Surreal, especially when you get to read that EstDomains has &quot; ruthlessly suspended over five thousand domains only for last week &quot;, and also, that it &quot; has a reliable ally in its battle against...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div style="text-align: left;"></div><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://3.bp.blogspot.com/_wICHhTiQmrA/SM7tc-r3kHI/AAAAAAAACKc/aUL1ohUu-Zc/s1600-h/estdomain_alert.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://3.bp.blogspot.com/_wICHhTiQmrA/SM7tc-r3kHI/AAAAAAAACKc/yiFaA33Sfdw/s200-R/estdomain_alert.png" /></a>Surreal, especially when you get to read that EstDomains has "<i>ruthlessly suspended over five thousand domains only for last week</i>", and also, that it "<i>has a reliable ally in its battle against malware in a face of Intercage, Inc</i>".<br />
<br />
Here's <a href="http://www.domainnews.com/en/general/estdomains-denies-links-to-malware-distribution.html">the press release</a> :<br />
<br />
"<i>The EstDomains, Inc management does not deny the fact that no one is secured from having a customer who uses provided services for delinquent purposes. But it must be noted that the carefully planned infrastructure of EstDomains, Inc makes the special provision for the cases of malware distribution that may originate from the domain name registered under the company's name. Such domain names are suspended immediately along with domain holder's account if there is an evidence of malware presence on the web site. <b>According to the most recent statistics over five thousand domain names were detected and ruthlessly suspended by EstDomains, Inc specialists only last week.</b><br />
<br />
<b>The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality.</b> But the outstanding performance of hosting services is not the sole reason why EstDomains, Inc appreciates this partnership so greatly. Intercage, Inc generously provides EstDomains, Inc specialists with reports regarding discovered malware vehicles. As the main database for additional domain name management services is located in Intercage Data Center, EstDomains, Inc has the perfect opportunity to get notifications of the slightest mark of malware presence in the shortest time and take measures in advance.</i> "<br />
<br />
The press release reminds me of <a href="http://ddanchev.blogspot.com/2008/04/hacked-by-rbn.html">RBN's defacement of my blog</a> posted on the 1st of April, and despite that <a href="http://www.malwarebytes.org/forums/index.php?showtopic=6159">EstDomains started "performing for the community"</a> as of recently, thanks to the collective intelligence and persistence of everyone turning their research into actionable intelligence against them, this performance aiming to minimize the effect of the negative PR is more or less futile considering <a href="http://www.spyware-techie.com/malicious-website-list/">all the cybercrime activities that they've been tolerating or ignoring</a> for the past couple of years. For future generations to see, <a href="http://www.malwarebytes.org/forums/index.php?showtopic=6159">this is how EstDomains "performs for the community"</a> :<br />
<br />
"<i>We've suspended all the domains listed in this topic. But please don't make posting these domains on this forum a habit. We have a 24/7 online tech support which can be contacted at <a href="https://support.estdomains.com/" target="_blank">https://support.estdomains.com</a><br />
<br />
Best regards,<br />
EstDomains Team&nbsp;</i><br />
<br />
<i>EstMate says : Ihatemondayand.com and antispycheck.com - both suspended. If any of the suspended websites are still active to you it maybe be because of your computer's or ISP's DNS-cache, others won't be able to access these websites</i><br />
<br />
<i>googlescanners-360.com isn't registered with us. As for other domains, the ones, which were registered through us, have been suspended. Regarding our preventive measures, the fact that you don't see them doesn't mean there isn't any. Yes, we don't write about them but in most cases we suspend whole accounts with problematic domains and look for connections to other accounts etc. During the last week we've suspended over 15000 different domains.</i>"<br />
<br />
What's more disturbing regarding this particular domain registrar is that it's a U.S based operation, namely, using the lack of international cybercrime cooperation as an excuse for not taking actions earlier doesn't fit into the picture. Moreover, this is just the tip of the iceberg, and taking into consideration a personal mentality that the cybercriminals you know are better than the cybercriminals you don't know, the RBN or any of its "leftovers" aren't fully taking advantage of the tactics they could be using in order to make it harder to shut them down, but how come? Simply, they don't have to put extra efforts and would once again remain online for years to come, which is perhaps more disturbing at the first place.<br />
<br />
What in the world is the Russian Business Network, is it still alive and kicking, are the same people that used to maintain my favorite netblock ever, still the ones running it, and what tactics are they taking advantage of in order to make it harder for the community to establish direct links with a particular netblock and the RBN itself?<br />
<br />
With RBN's "leftovers" -- <b>InterCage, Inc., Softlayer Technologies, Layered Technologies, Inc., Ukrtelegroup Ltd, Turkey Abdallah Internet Hizmetleri, and Hostfresh --</b> making headlines just like the way it should be, what I've been researching for the past couple of months is how they've migrated from the centralized hosting provider to what appears to be a fully operational franchise. The business model is very simple, the RBN through its extensive underground networking skills supplies to customers to franchisers operating small anti-abuse netblocks across the globe, where they offer dedicated hosting and share revenue with the RBN. Anyone trusted enough and capable of supplying such netblocks starts running the RBN anti-abuse franchise. It's also worth pointing out that these franchises are in fact starting to cut the middle man, and disintermediate the RBN by actively advertising their services in order for them to create a self-sustainable business model without having to rely on the RBN connecting them with customers.<br />
<br />
What used to be a centralized cybercrime powerhouse operating several highly visible anti-abuse netblocks, is today's decentralized infrastructure, with the profit margins for the anti-abuse services that it's logically capable to break-even and earn profits even with a few high profile dedicated hosting customers. Anyone can be the Russian Business Network, gain experience into the market segment, then disintermediate them by starting to advertise their own services. From a powerhouse to a franchise model, what the RBN had to offer can be easily duplicated by a countless number of local RBN's, and this is only starting to take place.<br />
<br />
<b>Related posts:</b><br />
<a href="http://ddanchev.blogspot.com/2008/07/lazy-summer-days-at-ukrtelegroup-ltds.html">Lazy Summer Days at UkrTeleGroup Ltd. </a><br />
<a href="http://ddanchev.blogspot.com/2008/06/malicious-isps-you-rarely-see-in-any.html">The Malicious ISPs you Rarely See in Any Report</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/geolocating-malicious-isps.html">Geolocationg Malicious ISPs</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/new-media-malware-gang-part-four.html">The New Media Malware Gang - Part Four</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/new-media-malware-gang-part-three.html">The New Media Malware Gang - Part Three</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/new-media-malware-gang-part-two.html">The New Media Malware Gang - Part Two</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/new-media-malware-gang.html">The New Media Malware Gang</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices </a><br />
<a href="http://ddanchev.blogspot.com/2008/04/hacked-by-rbn.html">HACKED BY THE RBN!</a><br />
<a href="http://ddanchev.blogspot.com/2008/03/rogue-rbn-software-pushed-through.html">Rogue RBN Software Pushed Through Blackhat SEO</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-phishing-activities.html">RBN's Phishing Activities</a><br />
<a href="http://ddanchev.blogspot.com/2008/02/rbns-malware-puppets-need-their-master.html">RBN's Puppets Need Their Master</a><br />
<a href="http://ddanchev.blogspot.com/2008/01/rbns-fake-account-suspended-notices.html">RBN's Fake Account Suspended Notices</a><br />
<a href="http://ddanchev.blogspot.com/2007/12/diverse-portfolio-of-fake-security.html">A Diverse Portfolio of Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/go-to-sleep-go-to-sleep-my-little-rbn.html">Go to Sleep, Go to Sleep my Little RBN</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/exposing-russian-business-network.html">Exposing the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/11/detecting-and-blocking-russian-business.html">Detecting the Blocking the Russian Business Network</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/over-100-malwares-hosted-on-single-rbn.html">Over 100 Malwares Hosted on a Single RBN IP</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/rbns-fake-security-software.html">RBN's Fake Security Software</a><br />
<a href="http://ddanchev.blogspot.com/2007/10/russian-business-network.html">The Russian Business Network</a><b> <br />
</b><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=CWZlL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=CWZlL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=wdsJL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=wdsJL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=6wf1l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=6wf1l" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JLXVl"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JLXVl" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=fkyiL"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=fkyiL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=l6gML"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=l6gML" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=kPS6l"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=kPS6l" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/394232850" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 05:09:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/single rbn">single rbn</category>
      <category domain="http://securityratty.com/tag/rbn">rbn</category>
      <category domain="http://securityratty.com/tag/rbn anti-abuse franchise">rbn anti-abuse franchise</category>
      <category domain="http://securityratty.com/tag/estdomains">estdomains</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/malware distribution">malware distribution</category>
      <category domain="http://securityratty.com/tag/thousand domain names">thousand domain names</category>
      <category domain="http://securityratty.com/tag/domain names">domain names</category>
      <category domain="http://securityratty.com/tag/rogue rbn software">rogue rbn software</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/394232850/estdomains-and-intercage-vs-cybercrime.html">EstDomains and Intercage VS Cybercrime</source>
    </item>
    <item>
      <title><![CDATA[Live Blogging from GOVCERT.NL 2008 - Marchus Sachs Speaking]]></title>
      <link>http://securityratty.com/article/ab3d53e1d3da8c395355b11889a9e050</link>
      <guid>http://securityratty.com/article/ab3d53e1d3da8c395355b11889a9e050</guid>
      <description><![CDATA[The next presentation at GOVCERT.NL 2008 is Marchus Sachs's &quot;Security in Supply Chain&quot;; very interesting as well

If the world weren't already 0wned due to bad software (see my account of the previous...]]></description>
      <content:encoded><![CDATA[The <a href="http://www.govcert.nl/symposium/programme.html">next presentation</a> at GOVCERT.NL 2008  is Marchus Sachs's "Security in Supply Chain"; very interesting as well.<br /><br />If the world weren't already 0wned due to bad software (see my account of <a href="http://chuvakin.blogspot.com/2008/09/live-blogging-from-govcertnl-2008-david.html">the previous presentation</a>), Marchus talks about how "0wning your supplier to 0wn you" will become more popular. Infected disk drives, picture frames, GPS units (!), laptops, USB keys, MP3 players, etc are a sign of it; the public one, that is.  Real "pre-0wned" stuff is the stuff you never see ALL THE WHILE it gets incorporated into our critical systems (like the fake Cisco routers - this one somehow sounds very ominous to me...)<br /><br />BTW, the one I have  not heard is one about Apple iPods being shipped infected with <span style="font-style: italic;">Windows</span>-based malware :-) WTH?<br /><br />I also love his example of a chewing gum AND a USB stick lying on the floor.<br />Will you pick a stick of gum and stick it in your mouth? Ewwwgh...<br />How about a USB stick? Hmm...<br /><br />So, will RBN (or its tomorrow's equivalent)  go into a business of partnering with a fake MP3 player manufacturer AND produce players  "pre-0wned" with custom malware? Just an idea ...  "RBN-branded MP3 player" to make money two ways.<br /><br />How do you solve this? More lawsuits?<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=f0TDL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=f0TDL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=zEwgL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=zEwgL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=34iFL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=34iFL" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/394020215" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 21:18:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/stick">stick</category>
      <category domain="http://securityratty.com/tag/usb stick">usb stick</category>
      <category domain="http://securityratty.com/tag/marchus sachs">marchus sachs</category>
      <category domain="http://securityratty.com/tag/custom malware">custom malware</category>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/malware">malware</category>
      <category domain="http://securityratty.com/tag/fake cisco routers">fake cisco routers</category>
      <category domain="http://securityratty.com/tag/previous presentation">previous presentation</category>
      <category domain="http://securityratty.com/tag/produce players">produce players</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/394020215/live-blogging-from-govcertnl-2008.html">Live Blogging from GOVCERT.NL 2008 - Marchus Sachs Speaking</source>
    </item>
    <item>
      <title><![CDATA[Assets Good Until Reached For]]></title>
      <link>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</link>
      <guid>http://securityratty.com/article/b4259e9d1ccfa754480b062e7acb4e32</guid>
      <description><![CDATA[A few months back Minyanville wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised? Some smart...]]></description>
      <content:encoded><![CDATA[<p><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">A few months back </span></span><a href="http://www.minyanville.com/articles/football-bears-bulls-Credit-equities-fannie/index/a/18769"><span style="font-size: 12px; "><span style="font-family: Arial;">Minyanville</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> wondered whether this subprime mess would end up as a cancer or a car crash. Guess we know the answer now. The question is - should we be at all surprised?

Some smart folks have been warning for a long time. Warren Buffett famously called derivatives financial weapons of mass destruction.</span></span></p><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Charlie Munger, as he is wont to do, went a bit further (from 2004):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #222222; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">I think a good litmus test of the mental and moral quality at any large institution [with significant derivatives exposure] would be to ask them, &quot;Do you really understand your derivatives book?&quot; Anyone who says yes is either crazy or lying.</span></span></p></blockquote><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have many other statements in the same direction, based on their own experience from buying companies that used deriviatives where they were unable to to unwind the books and figure out who owed who. At the last Berkshire Hathaway annual meeting someone asked Charlie Munger what we could learn from past blow ups about the present crisis</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It was a particularly foolish mess. We talked about an idiot in the credit delivery grocery business, Webvan. Internet based delivery service for groceries -- that was smarter than what happened in mortgage business. I wish we had those Webvan people back.</span></span></p></blockquote><div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
What can we learn from all this?
<br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Well Dan Geer launched a revolution with his </span></span><a href="http://catless.ncl.ac.uk/risks/20.06.html"><span style="font-size: 12px; "><span style="font-family: Arial;">famous speech</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> about risk management. He got the big picture part right on the security industry evolving into more risk management practices, however the examples we assumed that were right at the time, the financial industry are proving wrong. For one thing you can&#39;t manage a risk if you don&#39;t know the assets (back to Charlie Munger, emphasis added):</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 20px; "><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">It is crazy to allow things to get too big to fail, run with knavery. As an industry, there is a crazy culture of greed and overreaching and overconfidence trading algorithms. It is demented to allow derivative trading such that clearance risks are embedded in system. Assets are all “good until reached for” on balance sheets. We had $400m of that at general re, </span></span><span style="font-weight: bold; font-size: 12px; "><span style="font-family: Arial;">“good until reached for”</span></span><span style="color: #333333; line-height: 20px; font-size: 12px; "><span style="font-family: Arial;">. In drug business you must prove it is good. It is a crazy culture, and to some extent an evil culture. Accounting people really failed us. Accounting standards ought to be dealt with like engineering standards.</span></span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So, yes it is about risk management, but if you build too many abstractions on top of your assets through derivative accounting and such you may find you don&#39;t have any assets when you need them. Don&#39;t fall in love with your abstractions, </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/04/security-rules.html"><span style="font-size: 12px; "><span style="font-family: Arial;">manage your assets</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">There are some clear lessons for us in Information Security, err I mean Information Risk Management.</span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Margin of safety</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
Its our job to manage risk, but this doesn&#39;t mean that we have to build layers and layer of abstraction on top of it. It also means that we help to design, build, deploy, and operate systems with margins of safety. Understanding the failure modes and accounting for this in design. Developers (because they are supposed to) and architects (because they haven&#39;t been properly trained) focus on functional requirements, building features, but on security not so much. There are many ways to improve security in a system and they are all inadequate by themselves, but we can help find </span></span></span><a href="http://1raindrop.typepad.com/1_raindrop/2007/06/cost_effective_.html"><span style="font-size: 12px; "><span style="font-family: Arial;">cost effective improvements</span></span></a><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. </span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Don&#39;t fall in love with abstractions</span></span><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">
</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">If you have a 100,000 dekstops or 100,000 servers it hard to manage. You will need to automate and to do that you need to abstract, but you should also realize that its a drawing on a whiteboard not reality. You need </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2005/12/the_road_to_ass.html"><span style="font-size: 12px; "><span style="font-family: Arial;">abstraction assurance</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">.&#160;</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><a href="https://financialcryptography.com/"><span style="font-size: 12px; "><span style="font-family: Arial;">Ian Grigg</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2008/09/if-a-tree-falls-in-someone-elses-silo.html#comments"><span style="font-size: 12px; "><span style="font-family: Arial;">commented</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"> on an earlier post</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">There are distinct parallels between phishing / retail payments, and the bigger investment mess. In both cases, banks would argue these are core business. In both cases, they have applied risk-based security models, and accepted some loss. In both cases, they have the ability to apply substantial experience to the monitoring, allocating and absorbing risks and losses.</span></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span><span style="color: #333333; line-height: 19px; font-size: 12px; "><span style="font-family: Arial;">In both cases, they watched and did nothing as the risks started from low, and migrated upwards. Are we at the point where regulation has killed the ability of banks to apply their (arguable) one core skill, to whit, risk-based analysis? Are banks that far out of banking that they no longer have it?</span></span></p></blockquote><div><div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So you have to remember that top down and bottom up need to be combined.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; line-height: 14px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Design for failure</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Dan Geer has also told the story that he sat in a large bank&#39;s risk management training, and the trainer said &quot;you may wonder why this works so well. it works because there is zero ambiguity over who owns what risk.&quot; Dan&#39;s thought was - &quot;in my field we have nothing but ambiguity.&quot; Turns out the second part was right, we have nothing but ambiguity over who owns what risk; unfortunately the financial people have much more ambiguity than they thought! So we do have a lesson here after all, and it this - when the thing you thought was true isn&#39;t, the failure mode is very ugly. </span></span><a href="http://1raindrop.typepad.com/1_raindrop/2006/01/design_for_fail.html"><span style="font-size: 12px; "><span style="font-family: Arial;">Design for failure - a</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">dd layers of protection. </span></span><span style="font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="font-size: 12px; white-space: pre-wrap; "><span style="font-style: italic; font-size: 12px; "><span style="font-family: Arial;">Keep it simple.</span></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">They have some smart engineers at Google to be sure, but even they had </span></span><a href="http://www.identityblog.com/?p=1011"><span style="font-size: 12px; "><span style="font-family: Arial;">incredibly basic errors in their SSO</span></span></a><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">. I have seen other obvious fails like people signing WS-Security messages, and the recipient checks for a signature but not if they trust the signer! There are so many ways to shoot yourself in the foot in a loosely coupled systems, and we have so many abstractions layered on top of each other, part of the mantra of protecting assets has to be keeping it simple.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">So that is my list, to do all these things it requires that Infosec get in the game, understand the use cases, understand the business value (it should be abundantly clear that you can&#39;t simply rely on &quot;business people&quot; to be &quot;business experts&quot;), and that you not lose sight of the asset amidst all the abstraction. Finally, the systems we build security on are very primitive, a firewall and SSL are fine, a seatbelt was fine in 1935 and its still fine today, but there are lots of other safety controls in cars. ABS, airbags, traction control, they all protect the assets far better than in 1935, that&#39;s what we need to build.</span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;"><br /></span></span></div><div><span style="line-height: 14px; white-space: pre-wrap; font-size: 12px; "><span style="font-family: Arial;">Anyone can make bad assumptions (assume you know who owns what risk) and its easy to make bad abstractions (the firewall protects the information system), but when you combine bad assumptions with bad abstractions you&#39;ll get assets that are good until reached for sooner or later</span></span></div></div></div>]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 05:41:43 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/information risk management">information risk management</category>
      <category domain="http://securityratty.com/tag/risk management practices">risk management practices</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/assets">assets</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/business people">business people</category>
      <category domain="http://securityratty.com/tag/security industry">security industry</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/09/assets-good-until-reached-for.html">Assets Good Until Reached For</source>
    </item>
  </channel>
</rss>
