<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: safe]]></title>
    <link>http://securityratty.com/tag/safe</link>
    <description></description>
    <pubDate>Fri, 21 Nov 2008 10:07:38 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Safe Keeping: Article on TrueCrypt in Information Security]]></title>
      <link>http://securityratty.com/article/ab5084b0110ed541d33ab8bacd7c8718</link>
      <guid>http://securityratty.com/article/ab5084b0110ed541d33ab8bacd7c8718</guid>
      <description><![CDATA[My article, Safe Keeping , regarding TrueCrypt , is now available in Information Security magazine
TrueCrypt is an open source laptop encryption alternative for your organization
This article also...]]></description>
      <content:encoded><![CDATA[<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://1.bp.blogspot.com/_kVOWaY1TAF0/STSHkaz9dCI/AAAAAAAAAFE/La2FsbHQbRU/s1600-h/TrueCrypt.png" target="_blank"><img style="float:none; margin:0 10px 10px 0;cursor:pointer; cursor:hand;width: 149px; height: 200px;" src="http://1.bp.blogspot.com/_kVOWaY1TAF0/STSHkaz9dCI/AAAAAAAAAFE/La2FsbHQbRU/s200/TrueCrypt.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5274990123299992610" /></a><br />My article, <a href="http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1340488,00.html" target="_blank">Safe Keeping</a>, regarding <a href="http://www.truecrypt.org/" target="_blank">TrueCrypt</a>, is now available in <a href="http://searchsecurity.techtarget.com/magazineCurrent/0,296884,sid14,00.html" target="_blank">Information Security</a> magazine. <br /><span style="font-style:italic;">TrueCrypt is an open source laptop encryption alternative for your organization.</span><br />This article also includes a sidebar on <a href="http://adeona.cs.washington.edu/index.html" target="_blank">Adeona</a>, <span style="font-style:italic;">an open source system for tracking the location of your lost or stolen laptop that does not rely on a proprietary, central service.</span><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://2.bp.blogspot.com/_kVOWaY1TAF0/STSHsKTTuvI/AAAAAAAAAFM/U-PSN3rXU1c/s1600-h/adeona.png" target="_blank"><img style="float:none; margin:0 10px 10px 0;cursor:pointer; cursor:hand;width: 200px; height: 60px;" src="http://2.bp.blogspot.com/_kVOWaY1TAF0/STSHsKTTuvI/AAAAAAAAAFM/U-PSN3rXU1c/s200/adeona.png" border="0" alt=""id="BLOGGER_PHOTO_ID_5274990256307026674" /></a><br />I humbly suggest that you consider using both should you lack commercial solutions. <br />Cheers.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/12/safe-keeping-article-on-truecrypt-in.html&title=Safe Keeping:%20Article%20on%20TrueCrypt%20in%20Information%20Security " title="Safe Keeping: Article on TrueCrypt in Information Security ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/12/safe-keeping-article-on-truecrypt-in.html" title="Safe Keeping: Article on TrueCrypt in Information Security ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/12/safe-keeping-article-on-truecrypt-in.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 11:59:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/article">article</category>
      <category domain="http://securityratty.com/tag/truecrypt">truecrypt</category>
      <category domain="http://securityratty.com/tag/lack commercial solutions">lack commercial solutions</category>
      <category domain="http://securityratty.com/tag/information security magazine">information security magazine</category>
      <category domain="http://securityratty.com/tag/central service">central service</category>
      <category domain="http://securityratty.com/tag/safe">safe</category>
      <category domain="http://securityratty.com/tag/source system">source system</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/adeona">adeona</category>
      <source url="http://holisticinfosec.blogspot.com/2008/12/safe-keeping-article-on-truecrypt-in.html">Safe Keeping: Article on TrueCrypt in Information Security</source>
    </item>
    <item>
      <title><![CDATA[The "A"]]></title>
      <link>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</link>
      <guid>http://securityratty.com/article/1b9ddda67145b0350bba4d9bf6a096a3</guid>
      <description><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here

Generally, most people in Information...]]></description>
      <content:encoded><![CDATA[Information Security sits in a strange area somewhere between Business and IT in a little space that really hasn't been properly defined. It is exciting here.<br /><br />Generally, most people in Information Security today did not start out as pure Information Security people, they evolved. And where they evolved from gives one a clue as to their mindset and how they see themselves.<br /><br />Some come from an Audit background and you'll recognise these guys from their love of lists and frameworks - they dream of Cobit controls and little boxes that are waiting for ticks. Somehow they have tons of documentation and they know it all and can find it all. They generally drive Volvo's and like order.<br /><br />But most InfoSec guys come from an IT background and it shows. I guess that, having said that, most hackers come from an IT background too. And it shows.<br /><br />Now, lets consider the C-I-A triangle thingum. Quick lesson for those who don't know it - there are three aspects of information that Information Security wishes to preserve - the <span style="font-weight: bold;">C</span>onfidentiality, the <span style="font-weight: bold;">I</span>ntegrity and the <span style="font-weight: bold;">A</span>vailability. From my experience, most IT people are governed by Availability - the "A". In fact, when an IT contract is drawn up - there is no SLI or SLC but there will always be an SLA. With very specific terms, measurements and penalties.<br /><br />If the Firewall crashes and has to be rebuilt. What will the IT manager be most interested in? The A - how fast can you get the traffic moving again?<br /><br />So we have tools to measure uptime in 99.999999999999999s and such and anything that can cause network downtime (or if the network is up and the services such as mail are down - same difference) is taken care of. Spam, worms, viruses etc.<br /><br />I guess that hackers (those that define what we do) are also IT background people. They seem to be more concerned with big-bang, widely deployed DoS attacks and stealing IT resources. At least, they used to be, until they discovered that they could make money from stealing information. Actually, I may be naive but I don't believe that the hackers we have today are the same as those we had in the past... I believe that we have a new generation of hackers - criminals who merely use the Internet to steal money because that it where the money is easiest to steal.<br /><br />The problem is that we were lucky in a way that our old tools worked against the threats that we had - firewalls, antiviruses, etc etc. They don't work against people breaking into our networks and stealing information. For that we need a new generation of Information Security people (or the old generation to update their game)...<br /><br />Here is a quick poll to see which generation you are in:<br /><br />1. What is the one piece of information on your network that your competitors would love to see?<br />2. What is the percentage of mails coming into your network that are spam?<br />3. What mail is going to competitors?<br />4. What is the process for someone to order a pencil?<br />5. What is a blog?<br />6. Who in your organisation uses facebook for business?<br />7. How many of your PCs have up-to-date antivirus?<br />8. What is the worst virus out at the moment?<br />9. Do you believe that your Firewall is configured correctly?<br /><br />The answers are as follows:<br />1. This is ESSENTIAL to know if you want to be in the next generation. And you can't guess this. You may think that it is something financial but most financial information can be guessed by your competitors anyhow. You may think it is a recipe or special way of doing something but any established company has had their recipe ripped off anyhow and can beat any new competitor by competitive pricing. It may be new product information. It may be staff information. It may be the CEO's contact list. Don't guess - find out.<br /><br />2. Who cares? Certainly not the CEO. Maybe the CIO. "We are saving you x amount of bandwidth and your users x amount of time" is nice but won't save the business from closing down due to data loss. Operationalise this and get on with your job.<br /><br />3. Good to know. I'm sure that if you told your CEO/CIO "Last week we detected 5 large emails going to our competitors from inside our R&amp;D department" you'd have his full attention.<br /><br />4. Good to know. Who does the ordering? Who does the okaying? Who does the paying? If you know all of this then you know how business works. And when things go wrong - you'll be able to help.<br /><br />5. And do you want your staff to use them? And if they do, what can they put on them? What are they puting on them?<br /><br />6. This is an interesting question because Facebook is usually an issue of "The A" (productivity). But it can be an issue of C and I.<br /><br />7. Who cares? Again, this is an operational issue. Viruses that jump onto your radar are usually ones that attack "the A" but its the ones that are pushing information out of your organisation that are sneaky enough not to have sgnatures and not to be discovered. You will have PCs without up-to-date antivirus and you will have viruses. The trick is not to let your information be stolen by viruses. Also, keep backups so if a PC does get wiped out - you can get the information back again (but this is an operational issue again).<br /><br />8. Trick question - the answer is - the one you don't know about. Old generation InfoSec guys can rattle off names of viruses that are all in the top 10 at the moment.. New generation viruses are targetted and usually do their worst before a pattern is out.<br /><br />9. Old generation answer - yes. New generation answer - who cares? Information flows all over including in and out of the Firewall. Firewalls also usually rely on port security but most everything runs on port 80 anyhow so the Firewall should be configured but it doesn't kep us safe - more work needs to be done for that.<br /><br />I find that it is not very easy to move from old generation to new generation InfoSec. The main difference is that old generation was very technical and appealed to the technical nature of computer geeks. The new generation is business oriented and requires more interaction with people, more meetings, more time with people. Ouch.<br /><br />There will always be a place for technical people in Information Security but as the tools mature and "just work" there is less demand. And a background in technology is very useful when the technical guys try to "BS" you.<br /><br />And "the A" is very important too. Protecting your network from being brought down. Protecting information from disappearing. Stopping viruses. Etc. But the new generation will need to consider "the I" and "the C" as well because the attacks against these and the importance of protecting information against disclosure or manipulation will increase.<br /><br />This post was done to add my voice to what Rich says so quickly and concisely in the <a href="http://securosis.com/2008/11/10/the-two-kinds-of-security-threats-and-how-they-affect-your-life/">securosis blog</a>.<img src="http://feeds.feedburner.com/~r/SecurityThoughts/~4/471338550" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 01 Dec 2008 10:57:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/financial information">financial information</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/generation infosec guys">generation infosec guys</category>
      <category domain="http://securityratty.com/tag/infosec guys">infosec guys</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/guys">guys</category>
      <category domain="http://securityratty.com/tag/staff information">staff information</category>
      <category domain="http://securityratty.com/tag/technical guys">technical guys</category>
      <source url="http://feeds.feedburner.com/~r/SecurityThoughts/~3/471338550/a.html">The "A"</source>
    </item>
    <item>
      <title><![CDATA[Tips for staying safe online this Holiday season]]></title>
      <link>http://securityratty.com/article/4601cb0e0df5f980983616dff3fecc59</link>
      <guid>http://securityratty.com/article/4601cb0e0df5f980983616dff3fecc59</guid>
      <description><![CDATA[Great article by Mr Walling. Take the time read the tips and maybe you wont become a statistic this season


clipped from www.marketwatch.com

Walling Datas Top Ten Safety Tips for Online Shopping


...]]></description>
      <content:encoded><![CDATA[<div > Great article by Mr Walling.<br/>Take the time read the tips and maybe you wont become a statistic this season </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/a9a2ac45-d36e-42ed-8102-6fd92fd5847c/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D" href="http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D" style="font-size: 11px;">www.marketwatch.com</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Walling Data&#8217;s Top Ten Safety Tips for Online Shopping</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.marketwatch.com/news/story/Walling-Datas-Top-Ten-Safety/story.aspx?guid=%7B877022E1-B408-495D-A4F6-C49F6002D0AE%7D --><DIV class="p"><br />
            &#8220;The Internet is safe if you follow basic, fundamental rules of<br />
      using a computer safely,&#8221; says Luke Walling, Founder and President of Walling<br />
      Data, one of the largest distributors of online security products in<br />
      the country. &#8220;Many people think of their computer much like<br />
      they would an appliance, such as a microwave or stereo that behaves in a<br />
      predictable pre-programmed way. But, in reality computers<br />
      are dynamic devices that evolve dramatically with the installation of<br />
      each new program. It&#8217;s important to remember that viruses<br />
      and spyware are programs as well.&#8221;<br />
</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/5CC9381E-01B3-4581-A29F-B6C7D9C85A8E/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_281108043701"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=281108043701&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_281108043701" /></a></P>]]></content:encoded>
      <pubDate>Fri, 28 Nov 2008 13:37:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/tips">tips</category>
      <category domain="http://securityratty.com/tag/online security products">online security products</category>
      <category domain="http://securityratty.com/tag/computer safely">computer safely</category>
      <category domain="http://securityratty.com/tag/safety tips">safety tips</category>
      <category domain="http://securityratty.com/tag/computer">computer</category>
      <category domain="http://securityratty.com/tag/dynamic devices">dynamic devices</category>
      <category domain="http://securityratty.com/tag/datas top">datas top</category>
      <category domain="http://securityratty.com/tag/safe">safe</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=665">Tips for staying safe online this Holiday season</source>
    </item>
    <item>
      <title><![CDATA[Stolen Credit Cards account for 59% of online criminal activity]]></title>
      <link>http://securityratty.com/article/cffc479a20281b84d90e501e93ee3e5d</link>
      <guid>http://securityratty.com/article/cffc479a20281b84d90e501e93ee3e5d</guid>
      <description><![CDATA[Please dont become a statistic in this area. Be careful online, make sure the site is safe and make sure your computer security products are up to date and functioning properly


clipped from...]]></description>
      <content:encoded><![CDATA[<div > Please dont become a statistic in this area.<br/>Be careful online, make sure the site is safe and make sure your computer security products are up to date and functioning properly. </div>
<table cellpadding="0" cellspacing="0" width="100%" style="margin: 12px 0px; font-family: arial; color: #333333; background: #ffffff; border: solid 4px #e5e5e5; width: 100%; clear: left;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" class="CM_CTB_Content_Wrap" style="margin: 0px; padding: 0px;background-color: #ffffff;">
<tr>
<td valign="top">
<table cellpadding="0" cellspacing="0" width="100%" style="border-bottom: solid 1px #dcdcdc; white-space: nowrap; margin-bottom: 8px; background-color: #eeeeee ;background-image: url(http://clipmarks.com/images/source-bg.gif); background-repeat: repeat-x; height: 24px; line-height: 24px; vertical-align: middle; padding-bottom: 4px; color: #666666; font-size: 10px;">
<tr>
<td valign="top"><a href="http://clipmarks.com/clipmark/99552E1B-B318-4802-8F6C-B1B550619662/" title="go to this clipmark"><img src="http://content.clipmarks.com/blog_icon/42ad7146-dd54-4e9b-a0e8-3ef6189e7b41/99552E1B-B318-4802-8F6C-B1B550619662/" alt="" width="19" height="19" border="0" style="vertical-align: middle; margin: 0px 4px; display: inline; border: none; float:none;" /></a>clipped from <a title="http://www.crime-research.org/news/24.11.2008/3666/" href="http://www.crime-research.org/news/24.11.2008/3666/" style="font-size: 11px;">www.crime-research.org</a></td>
</tr>
</table>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.crime-research.org/news/24.11.2008/3666/ -->
<div style="margin: 4px 0px; color: #000000; font-size: 20px;">Symantec takes cybercrime snapshot with &#8216;Underground Economy&#8217; report
</div>
</td>
</tr>
</table>
<div style="height: 2px; font-size: 2px; background: #dcdcdc; border-bottom: solid 1px #f5f5f5; margin: 2px 4px;"></div>
<table cellpadding="0" cellspacing="0" width="100%" style="text-align: left; padding: 0px 8px; margin: 4px 0px 8px 0px; background: transparent; border: none;">
<tr>
<td valign="top"><!-- CLIPPED FROM: http://www.crime-research.org/news/24.11.2008/3666/ --><DIV><br />
The “Underground Economy” report contains a snapshot of online criminal activity observed from July 2007 to June 2008 by a Symantec team monitoring activities in Internet Relay Chat (IRC) and Web-based forums where stolen goods are advertised. Symantec estimates the total value of the goods advertised on what it calls &#8220;underground servers&#8221; was about $276 million, with credit-card information accounting for 59% of the total.</DIV></td>
</tr>
</table>
</td>
</tr>
</table>
<div style="margin: 0px 6px 6px 4px;">
<table style="font-size: 11px;border-spacing: 0px;padding: 0px;" cellpadding="0" cellspacing="0" width="100%">
<tr>
<td style="background:transparent;border-width:0px;padding:0px;">&nbsp;</td>
<td align="right" style="background:transparent;border-width:0px;padding:0px;width:107px" width="107"><a href="http://clipmarks.com/share/99552E1B-B318-4802-8F6C-B1B550619662/blog/" title="blog or email this clip"><img src="http://content6.clipmarks.com/images/c2b-foot.png" border="0" alt="blog it" width="107" height="17" style="border-width:0px;padding:0px;margin:0px;" /></a></td>
</tr>
</table>
</div>
</td>
</tr>
</table>
<BR/><MAP name="bdv_RSS_Ad_281108040924"><AREA alt="Feed Ads By BidVertiser.com" shape="poly" coords="0,0,467,0,467,45,315,45,315,59,0,59" href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108040924&amp;click=1" target="_blank" /><AREA alt="Feed Ads By BidVertiser.com" shape="rect" coords="315,45,467,59" href="http://www.bidvertiser.com/bdv/bidvertiser/bdv_ref.dbm?Ref_PID=165886&amp;Ref_Option=main&amp;source=90614506" target="_blank" /></MAP><P><a href="http://secure.bidvertiser.com/performance/bdv_rss_rd.dbm?pid=165886&amp;bid=400950&amp;PHS=281108040924&amp;click=1" target="_blank"><IMG src="http://bdv.bidvertiser.com/BidVertiser.dbm?pid=165886&amp;bid=400950&amp;PHS=281108040924&amp;rssimage=1&amp;rSRC=2" border="0" usemap="#bdv_RSS_Ad_281108040924" /></a></P>]]></content:encoded>
      <pubDate>Fri, 28 Nov 2008 13:09:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/online criminal activity">online criminal activity</category>
      <category domain="http://securityratty.com/tag/underground economy report">underground economy report</category>
      <category domain="http://securityratty.com/tag/symantec">symantec</category>
      <category domain="http://securityratty.com/tag/symantec team">symantec team</category>
      <category domain="http://securityratty.com/tag/computer security products">computer security products</category>
      <category domain="http://securityratty.com/tag/calls underground servers">calls underground servers</category>
      <category domain="http://securityratty.com/tag/internet relay chat">internet relay chat</category>
      <category domain="http://securityratty.com/tag/credit-card information">credit-card information</category>
      <category domain="http://securityratty.com/tag/total">total</category>
      <source url="http://spywarebiz.com/spywarebizblog/?p=663">Stolen Credit Cards account for 59% of online criminal activity</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-11-25 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/5f45c605eed2ff767afb830215eb7e3a</link>
      <guid>http://securityratty.com/article/5f45c605eed2ff767afb830215eb7e3a</guid>
      <description><![CDATA[The Myth of Software Support Chris Swans Weblog
More On Why I Think Free Microsoft AV Will Be Good For Consumers | securosis.com My belief is that we essentially have both conditions today (low...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://thestateofme.wordpress.com/2008/11/20/the-myth-of-software-support/">The Myth of Software Support &laquo; Chris Swan&rsquo;s Weblog</a></li>
<li><a href="http://securosis.com/2008/11/25/more-on-why-i-think-free-microsoft-av-will-be-good-for-consumers/">More On Why I Think Free Microsoft AV Will Be Good For Consumers | securosis.com</a><br/>
My belief is that we essentially have both conditions today (low innovation, easy evasion), and the nature of attacks will continue to change rapidly enough to exceed the current capabilities of AV.</li>
<li><a href="http://securosis.com/2008/11/21/idiocy/">Idiocy | securosis.com</a></li>
<li><a href="http://securosis.com/2008/11/19/the-impact-of-free-antivirus-from-microsoft/">The Impact Of Free Antivirus From Microsoft | securosis.com</a><br/>
This gives them enough time to avoid suddenly losing 40% (don’t quote me on that, I’m on an airplane and just guessing) of profits over 12 months. The real losers will be the consumer-only AV companies without diversified portfolios or a larger enterprise base.</li>
<li><a href="http://www.csoonline.com/article/463067/Rich_Mogull_Infosec_Trends_for_">Rich Mogull: 7 Infosec Trends for 2009 - CSO Online - Security and Risk</a></li>
<li><a href="http://news.cnet.com/8301-1001_3-10096254-92.html">Safe bets for IT spending in '09 | Business Tech - CNET News</a><br/>
Second, security management will merge with log management. That works for ArcSight, RSA, LogLogic, and LogRhythm.</li>
<li><a href="http://darkmatterlabs.blogspot.com/2008/11/land-of-confusion.html">Dark Matters: Land of Confusion</a></li>
<li><a href="http://www.internetnews.com/software/article.php/3786036/Enterprise+SaaS+Buyers+Want+More+Than+Uptime.htm">InternetNews Realtime IT News - Enterprise SaaS Buyers Want More Than Uptime</a></li>
<li><a href="http://www.socaltech.com/high_tower_software_shuts_down/s-0018681.html">High Tower Software Shuts Down | socalTECH.com</a><br/>
Aliso Viejo-based High Tower Software, a venture-backed developer of security, compliance, and log management software, has shut down.</li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/465834955" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tower software shuts">tower software shuts</category>
      <category domain="http://securityratty.com/tag/log management software">log management software</category>
      <category domain="http://securityratty.com/tag/log management">log management</category>
      <category domain="http://securityratty.com/tag/tower software">tower software</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security management">security management</category>
      <category domain="http://securityratty.com/tag/larger enterprise base">larger enterprise base</category>
      <category domain="http://securityratty.com/tag/enterprise saas buyers">enterprise saas buyers</category>
      <category domain="http://securityratty.com/tag/cnet news">cnet news</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/465834955/anton18">Links for 2008-11-25 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Safe Computing During The Holiday Season]]></title>
      <link>http://securityratty.com/article/832646954f5f9c892ef83ef66398bd73</link>
      <guid>http://securityratty.com/article/832646954f5f9c892ef83ef66398bd73</guid>
      <description><![CDATA[The holiday season is a time of increased online activity. During the hustle and bustle that surrounds this time of year, whats more convenient than saving a little time (and money) by shopping and...]]></description>
      <content:encoded><![CDATA[The holiday season is a time of increased online activity. During the hustle and bustle that surrounds this time of year, whats more convenient than saving a little time (and money) by shopping and b...]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 11:32:07 +0000</pubDate>
      <category domain="http://securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/online activity">online activity</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/convenient">convenient</category>
      <category domain="http://securityratty.com/tag/surrounds">surrounds</category>
      <category domain="http://securityratty.com/tag/bustle">bustle</category>
      <category domain="http://securityratty.com/tag/hustle">hustle</category>
      <source url="http://www.net-security.org/article.php?id=1190">Safe Computing During The Holiday Season</source>
    </item>
    <item>
      <title><![CDATA[Gmail security and recent phishing activity]]></title>
      <link>http://securityratty.com/article/9a45bb9bbae6a2b37196f35b1390b206</link>
      <guid>http://securityratty.com/article/9a45bb9bbae6a2b37196f35b1390b206</guid>
      <description><![CDATA[Posted by Chris Evans

We've seen some speculation recently about a purported security vulnerability in Gmail and the theft of several website owners' domains by unauthorized third parties. At Google...]]></description>
      <content:encoded><![CDATA[<span class="byline-author">Posted by Chris Evans</span><br /><br />We've seen some speculation recently about a purported security vulnerability in Gmail and the theft of several website owners' domains by unauthorized third parties. At Google we're committed to providing secure products, and we mounted an immediate investigation. Our results indicate no evidence of a Gmail vulnerability.<br /><br />With help from affected users, we determined that the cause was a phishing scheme, a common method used by malicious actors to trick people into sharing their sensitive information. Attackers sent customized e-mails encouraging web domain owners to visit fraudulent websites such as "google-hosts.com" that they set up purely to harvest usernames and passwords. These fake sites had no affiliation with Google, and the ones we've seen are now offline. Once attackers gained the user credentials, they were free to modify the affected accounts as they desired. In this case, the attacker set up mail filters specifically designed to forward messages from web domain providers.<br /><br />Several news stories referenced a <a title="domain theft from December 2007" href="http://www.davidairey.com/google-gmail-security-hijack/" id="d.kh">domain theft from December 2007</a> that was incorrectly linked to a Gmail CSRF vulnerability</span>. We did have a Gmail CSRF bug reported to us in September 2007 that we fixed and deployed worldwide within 24 hours of private disclosure of the bug details. We know of no affected users. Neither this bug nor any other Gmail bug was involved in the December 2007 domain theft.<br /><br />We recognize how many people depend on Gmail, and we strive to make it as secure as possible. At this time, we'd like to thank the wider security community for working with us to achieve this goal. We're always looking at new ways to enhance Gmail security. For example, we recently gave users the option to <a href="http://gmailblog.blogspot.com/2008/07/making-security-easier.html" id="murn" title="always connect via https">always run their entire session using https</a>.<br /><br />To keep your Google account secure online, we recommend you only ever enter your Gmail sign-in credentials to web addresses starting with https://www.google.com/accounts, and never click-through any warnings your browser may raise about certificates. For more information on how to stay safe from phishing attacks, see our blog post <a href="http://googleblog.blogspot.com/2008/04/how-to-avoid-getting-hooked.html" id="o8q2" title="here">here</a>.<div class="feedflare">
<a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=5ziOaTxJ"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?d=41" border="0"></img></a> <a href="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?a=UypYbMp4"><img src="http://feedproxy.google.com/~f/GoogleOnlineSecurityBlog?i=UypYbMp4" border="0"></img></a>
</div><img src="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~4/jSxgatXB-tY" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 10:22:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/gmail">gmail</category>
      <category domain="http://securityratty.com/tag/bug">bug</category>
      <category domain="http://securityratty.com/tag/bug details">bug details</category>
      <category domain="http://securityratty.com/tag/gmail bug">gmail bug</category>
      <category domain="http://securityratty.com/tag/gmail csrf vulnerability">gmail csrf vulnerability</category>
      <category domain="http://securityratty.com/tag/enhance gmail security">enhance gmail security</category>
      <category domain="http://securityratty.com/tag/gmail csrf bug">gmail csrf bug</category>
      <category domain="http://securityratty.com/tag/gmail sign-in credentials">gmail sign-in credentials</category>
      <category domain="http://securityratty.com/tag/domain theft">domain theft</category>
      <source url="http://feedproxy.google.com/~r/GoogleOnlineSecurityBlog/~3/jSxgatXB-tY/gmail-security-and-recent-phishing.html">Gmail security and recent phishing activity</source>
    </item>
    <item>
      <title><![CDATA[ Here Comes Everybody Review]]></title>
      <link>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</link>
      <guid>http://securityratty.com/article/639cf7107fd08bc70488e1f27a8ec2a3</guid>
      <description><![CDATA[In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market...]]></description>
      <content:encoded><![CDATA[<p>In 1937, Ronald Coase answered one of the most perplexing questions in economics: if markets are so great, why do organizations exist? Why don't people just buy and sell their own services in a market instead? Coase, who won the 1991 Nobel Prize in Economics, answered the question by noting a market's transaction costs: buyers and sellers need to find one another, then reach agreement, and so on. The Coase theorem implies that if these transaction costs are low enough, direct markets of individuals make a whole lot of sense. But if they are too high, it makes more sense to get the job done by an organization that hires people. </p>

<p>Economists have long understood the corollary concept of Coase's ceiling, a point above which organizations collapse under their own weight -- where hiring someone, however competent, means more work for everyone else than the new hire contributes. Software projects often bump their heads against Coase's ceiling: recall Frederick P. Brooks Jr.'s seminal study, <cite>The Mythical Man-Month</cite> (Addison-Wesley, 1975), which showed how adding another person onto a project can slow progress and increase errors. </p>

<p>What's new is something consultant and social technologist Clay Shirky calls &quot;Coase's Floor,&quot; below which we find projects and activities that aren't worth their organizational costs -- things so esoteric, so frivolous, so nonsensical, or just so thoroughly unimportant that no organization, large or small, would ever bother with them. Things that you shake your head at when you see them and think, &quot;That's ridiculous.&quot;</p>

<p>Sounds a lot like the Internet, doesn't it? And that's precisely Shirky's point. His new book, <a href="http://www.amazon.com/exec/obidos/ASIN/1594201536/counterpane/"><cite>Here Comes Everybody: The Power of Organizing Without Organizations</cite></a>, explores a world where organizational costs are close to zero and where ad hoc, loosely connected groups of unpaid amateurs can create an encyclopedia larger than the Britannica and a computer operating system to challenge Microsoft's. </p>

<p>Shirky teaches at New York University's Interactive Telecommunications Program, but this is no academic book. Sacrificing rigor for readability, <cite>Here Comes Everybody</cite> is an entertaining as well as informative romp through some of the Internet's signal moments -- the Howard Dean phenomenon, Belarusian protests organized on LiveJournal, the lost cellphone of a woman named Ivanna, Meetup.com, flash mobs, Twitter, and more -- which Shirky uses to illustrate his points. </p>

<p>The book is filled with bits of insight and common sense, explaining why young people take better advantage of social tools, how the Internet affects social change, and how most Internet discourse falls somewhere between dinnertime conversation and publishing. </p>

<p>Shirky notes that &quot;most user-generated content isn't 'content' at all, in the sense of being created for general consumption, any more than a phone call between you and a sibling is 'family-generated content.' Most of what gets created on any given day is just the ordinary stuff of life -- gossip, little updates, thinking out loud -- but now it's done in the same medium as professionally produced material. Unlike professionally produced material, however, Internet content can be organized after the fact.&quot; </p>

<p>No one coordinates Flickr's 6 million to 8 million users. Yet Flickr had the first photos from the 2005 London Transport bombings, beating the traditional news media. Why? People with cellphone cameras uploaded their photos to Flickr. They coordinated themselves using tools that Flickr provides. This is the sort of impromptu organization the Internet is ideally suited for. Shirky explains how these moments are harbingers of a future that can self-organize without formal hierarchies. </p>

<p>These nonorganizations allow for contributions from a wider group of people. A newspaper has to pay someone to take photos; it can't be bothered to hire someone to stand around London underground stations waiting for a major event. Similarly, Microsoft has to pay a programmer full time, and <cite>Encyclopedia Britannica</cite> has to pay someone to write articles. But Flickr can make use of a person with just one photo to contribute, Linux can harness the work of a programmer with little time, and Wikipedia benefits if someone corrects just a single typo. These aggregations of millions of actions that were previously below the Coasean floor have enormous potential. </p>

<p>But a flash mob is still a mob. In a world where the Coasean floor is at ground level, all sorts of organizations appear, including ones you might not like: violent political organizations, hate groups, Holocaust deniers, and so on. (Shirky's discussion of teen anorexia support groups makes for very disturbing reading.) This has considerable implications for security, both online and off. </p>

<p>We never realized how much our security could be attributed to distance and inconvenience -- how difficult it is to recruit, organize, coordinate, and communicate without formal organizations. That inadvertent measure of security is now gone. Bad guys, from hacker groups to terrorist groups, will use the same ad hoc organizational technologies that the rest of us do. And while there has been some success in closing down individual Web pages, discussion groups, and blogs, these are just stopgap measures. </p>

<p>In the end, a virtual community is still a community, and it needs to be treated as such. And just as the best way to keep a neighborhood safe is for a policeman to walk around it, the best way to keep a virtual community safe is to have a virtual police presence. </p>

<p>Crime isn't the only danger; there is also isolation. If people can segregate themselves in ever-increasingly specialized groups, then they're less likely to be exposed to alternative ideas. We see a mild form of this in the current political trend of rival political parties having their own news sources, their own narratives, and their own facts. Increased radicalization is another danger lurking below the Coasean floor. </p>

<p>There's no going back, though. We've all figured out that the Internet makes freedom of speech a much harder right to take away. As Shirky demonstrates, Web 2.0 is having the same effect on freedom of assembly. The consequences of this won't be fully seen for years. </p>

<p><cite>Here Comes Everybody</cite> covers some of the same ground as Yochai Benkler's <cite>Wealth of Networks</cite>. But when I had to explain to one of my corporate attorneys how the Internet has changed the nature of public discourse, Shirky's book is the one I recommended.</p>

<p>This essay <a href="http://www.spectrum.ieee.org/sep08/6631">previously appeared</a> in <i>IEEE Spectrum</i>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=wZmPN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=wZmPN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=xDcAN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=xDcAN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 04:39:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/shirky">shirky</category>
      <category domain="http://securityratty.com/tag/shirky notes">shirky notes</category>
      <category domain="http://securityratty.com/tag/organizations">organizations</category>
      <category domain="http://securityratty.com/tag/community">community</category>
      <category domain="http://securityratty.com/tag/virtual community safe">virtual community safe</category>
      <category domain="http://securityratty.com/tag/organizations collapse">organizations collapse</category>
      <category domain="http://securityratty.com/tag/internet content">internet content</category>
      <category domain="http://securityratty.com/tag/internet discourse falls">internet discourse falls</category>
      <category domain="http://securityratty.com/tag/internet">internet</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/here_comes_ever.html"> Here Comes Everybody Review</source>
    </item>
    <item>
      <title><![CDATA[Holiday Travel: Ways to Keep Your Laptop, Privacy Safe]]></title>
      <link>http://securityratty.com/article/082c72521b12db999a6c7befaa140a98</link>
      <guid>http://securityratty.com/article/082c72521b12db999a6c7befaa140a98</guid>
      <description><![CDATA[If you're planning on traveling with your laptop this holiday season, you might want to travel prepared. The statistics are overwhelmingly bad: According to Gartner, one laptop is stolen every 53...]]></description>
      <content:encoded><![CDATA[If you're planning on traveling with your laptop this holiday season, you might want to travel prepared. The statistics are overwhelmingly bad: According to Gartner, one laptop is stolen every 53 seconds.<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:c080d0db082c53804353a83308978e35:H4vTCQue5tcMfBczkgN%2BpUhmLgZYTt7eYezBd0yxyAi1dt8A2J2CGmnpw2qi1T54%2Fgi3%2FhQcUJ5q'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:86bf0369de83fa6e51720e3d941cfa62:JFf0B3IplrXQiOOH21JtsNIsEZcII43S2c4u2cdTZZasA7ULXPKf94r%2BeLQP0dnzqbcbFhhGaEzwSg%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:6369b09957540237b5a4866fec02f926:nwL3xksZjMbuoax8%2Bki1ZQ%2BhC9Wwd0%2BlWfwIE4zz1HKM2fLY2sDoYIeNYI4RE7jKxlq7Tqd3VReQSQ%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:6a3912ce03a098632eeed94db76b8e8b:5TGmR43cl9J%2BnGcNQi0v6Wm8J1JzyyBZUcnFs9zd9LqKz1SwdmTjmgwKUX0On5qyIRVw34D6gMNZiQ%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=9af89623baeb85f44de32544d0cd60ae&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=9af89623baeb85f44de32544d0cd60ae&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=9af89623baeb85f44de32544d0cd60ae" style="display: none;" border="0" height="1" width="1" alt=""/>
]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/overwhelmingly bad">overwhelmingly bad</category>
      <category domain="http://securityratty.com/tag/travel">travel</category>
      <category domain="http://securityratty.com/tag/holiday season">holiday season</category>
      <category domain="http://securityratty.com/tag/statistics">statistics</category>
      <category domain="http://securityratty.com/tag/gartner">gartner</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=9af89623baeb85f44de32544d0cd60ae">Holiday Travel: Ways to Keep Your Laptop, Privacy Safe</source>
    </item>
    <item>
      <title><![CDATA[Lego Safe]]></title>
      <link>http://securityratty.com/article/c053eba067cfc430cc20de6b046bac47</link>
      <guid>http://securityratty.com/article/c053eba067cfc430cc20de6b046bac47</guid>
      <description><![CDATA[Nice : You might think that a Lego safe would be easy to open. Maybe just remove a few bricks and you're in. But that's not the case with this thing, the cutting edge of Lego safe technology. The safe...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.slipperybrick.com/2008/11/legos-safe/">Nice</a>:</p>

<blockquote>You might think that a Lego safe would be easy to open. Maybe just remove a few bricks and you're in. But that's not the case with this thing, the cutting edge of Lego safe technology. The safe weighs 14 pounds and has a motion detecting alarm so it can't be moved without creating a huge ruckus.</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=aSpkN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=aSpkN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=SBzvN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=SBzvN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 21 Nov 2008 10:07:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lego safe">lego safe</category>
      <category domain="http://securityratty.com/tag/lego safe technology">lego safe technology</category>
      <category domain="http://securityratty.com/tag/huge ruckus">huge ruckus</category>
      <category domain="http://securityratty.com/tag/safe weighs">safe weighs</category>
      <category domain="http://securityratty.com/tag/remove">remove</category>
      <category domain="http://securityratty.com/tag/moved">moved</category>
      <category domain="http://securityratty.com/tag/pounds">pounds</category>
      <category domain="http://securityratty.com/tag/nice">nice</category>
      <category domain="http://securityratty.com/tag/easy">easy</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/lego_safe.html">Lego Safe</source>
    </item>
  </channel>
</rss>
