<![CDATA[[SecurityRatty] tag: sam]]> http://securityratty.com/tag/sam Wed, 17 Sep 2008 14:25:32 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Speaking of Security Podcast #126]]> http://securityratty.com/article/c8facd4cb501769126c5a011ee14e2ff http://securityratty.com/article/c8facd4cb501769126c5a011ee14e2ff Click to Download/Listen (07:52)

At this week's RSA Conferece Europe we released a new survey to track wireless network security in London, Paris and New York. The survey shows strong growth in wireless access points, both corporate and personal, but reveals that many are protected by the now discredited WEP encryption. RSA VP, Sam Curry goes over the numbers in our latest podcast.
]]> Mon, 27 Oct 2008 21:00:00 +0000 rsa conferece europe rsa wireless access sam curry wep encryption strong growth survey podcast week Speaking of Security Podcast #126 <![CDATA[Speaking of Security Podcast #125]]> http://securityratty.com/article/0e9eda4f189c52480b99566f994beae6 http://securityratty.com/article/0e9eda4f189c52480b99566f994beae6 Click to Download/Listen (07:52)

On Monday, October 13 RSA, The Security Division of EMC, released the results of a new insider threat survey. The survey shows that employees are well aware of the restrictions placed upon them by their corporate IT departments, yet many often work around these controls in order to get their jobs done. RSA VP, Sam Curry, digs deeper into the issue in our latest podcast.


]]> Mon, 20 Oct 2008 11:52:45 +0000 insider threat survey survey sam curry digs deeper security division rsa podcast october employees Speaking of Security Podcast #125 <![CDATA[Infinite Diversity in Infinite Combinations]]> http://securityratty.com/article/1b69dad9851d1b4f6a223171096d2b5c http://securityratty.com/article/1b69dad9851d1b4f6a223171096d2b5c Followers of Star Trek might have noticed the small IDIC symbol Mr. Spock wore in events requiring official Vulcan dress code.  IDIC stands for “Infinite Diversity in Infinite Combinations” a remarkable philosophy in spite of its pop origins and an enduring legacy of the late Mr. Roddenberry.

Hello folks: my name is Sam.  My first anniversary at RSA just passed, and it seemed like as good a time as any to plunge into the security blog-o-sphere. I sit in a unique position within RSA: in the middle of the customers, the partners, the markets and the technology. In the course of the last year, I’ve met with hundreds of people with whom we do business, with whom we do science and with whom we look to change the way the world works. And, let me tell you this: things are becoming more complex...

]]> Wed, 15 Oct 2008 20:00:00 +0000 infinite combinations infinite diversity idic symbol idic stands pop origins remarkable philosophy unique position security blog-o-sphere rsa Infinite Diversity in Infinite Combinations <![CDATA[John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008]]> http://securityratty.com/article/e6411fe452b9021fd4b58bf9559f9797 http://securityratty.com/article/e6411fe452b9021fd4b58bf9559f9797 John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008
John Strand gave this presentation for the Kentuckiana ISSA at the Louisville Infosec 2008 conference. He gives a fascinating talk about why "security in depth" is dead, and lives again. John then goes on to demo Evilgrade, using msfpayload and obscuring it against signature based malware detection, dumping SAM hashes with the Metasploit Meterpreter and using a patched Samba client to pass the hash and compromise a system. I'd like to thank John for letting me record his talk.

]]> Sat, 11 Oct 2008 12:08:29 +0000 john strand john louisville infosec msfpayload demo evilgrade defenses samba client demos sam hashes John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008 <![CDATA[John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008]]> http://securityratty.com/article/fd6c91a824e7a3323c2dfe7cbb90f1c6 http://securityratty.com/article/fd6c91a824e7a3323c2dfe7cbb90f1c6 John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008
John Strand gave this presentation for the Kentuckiana ISSA at the Louisville Infosec 2008 conference. He gives a fascinating talk about why "security in depth" is dead, and lives again. John then goes on to demo Evilgrade, using msfpayload and obscuring it against signature based malware detection, dumping SAM hashes with the Metasploit Meterpreter and using a patched Samba client to pass the hash and compromise a system. I'd like to thank John for letting me record his talk.]]> Sat, 11 Oct 2008 12:08:29 +0000 john strand john louisville infosec msfpayload demo evilgrade defenses samba client demos sam hashes John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008 <![CDATA[John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008]]> http://securityratty.com/article/b46f67574af73084896129f5834a688d http://securityratty.com/article/b46f67574af73084896129f5834a688d John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008
John Strand gave this presentation for the Kentuckiana ISSA at the Louisville Infosec 2008 conference. He gives a fascinating talk about why "security in depth" is dead, and lives again. John then goes on to demo Evilgrade, using msfpayload and obscuring it against signature based malware detection, dumping SAM hashes with the Metasploit Meterpreter and using a patched Samba client to pass the hash and compromise a system. I'd like to thank John for letting me record his talk.

]]> Sat, 11 Oct 2008 12:08:29 +0000 john strand john louisville infosec msfpayload demo evilgrade defenses samba client demos sam hashes John Strand - "Advanced Hacking Techniques and Defenses" (and demos of evilgrade/passing the hash/msfpayload) from Louisville Infosec 2008 <![CDATA[Teaching Hacking at College by Sam Bowne]]> http://securityratty.com/article/f464683006bea78fdf7801ca7073794b http://securityratty.com/article/f464683006bea78fdf7801ca7073794b http://www.samsclass.info/ if you want to use his teaching curriculum.

]]> Tue, 23 Sep 2008 16:15:53 +0000 sam sam bowne college administration post ethical check defcon info Teaching Hacking at College by Sam Bowne <![CDATA[Teaching Hacking at College by Sam Bowne]]> http://securityratty.com/article/cd344a5acaad8db0548e1b3c2c0e15a3 http://securityratty.com/article/cd344a5acaad8db0548e1b3c2c0e15a3 http://www.samsclass.info/ if you want to use his teaching curriculum.]]> Tue, 23 Sep 2008 16:15:53 +0000 sam sam bowne college administration post ethical check defcon info Teaching Hacking at College by Sam Bowne <![CDATA[Teaching Hacking at College by Sam Bowne]]> http://securityratty.com/article/1bb4052fa80af63823401fbb4d73b801 http://securityratty.com/article/1bb4052fa80af63823401fbb4d73b801 http://www.samsclass.info/ if you want to use his teaching curriculum.

]]> Tue, 23 Sep 2008 16:15:53 +0000 sam sam bowne college administration post ethical check defcon info Teaching Hacking at College by Sam Bowne <![CDATA[Interop NY: Cloud Language: The Taxonomy of On-Demand Computing]]> http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8 http://securityratty.com/article/69fa97ea284dec188b278c522ed18fd8 This session on cloud computing was presented by Peter Laird of Oracle Corporation. Peter is a lead architect for the WebCenter product family. He previously worked with BEA as an architect for SaaS efforts. He also blogs at Laird On Demand.

Defining Cloud Computing

Cloud computing is a very active community. The Google Group gets 600 posts per month and many bloggers are covering the space. However, “cloud computing” is impossible to define in a way that satisfies everyone (or even most). Cloud computing is not alone in this controversy, consider the definition and meaning of “Web 2.0″, “mashups” or “RESTful architecture”. All of these terms are relatively recent. According to Google Trends, these terms became popular to the general public sometime between 2005 and 2007:

  • Web 2.0 - often confused with RIA, AKA Social Computing, Long-Tail Apps, Crowdware (2005 by O’Reilly Media)
  • Mashup - made popular by Google Maps, AKA Composite/Situational Apps. (2005)
  • REST - Has a strict definition, but many don’t understand it and abuse the term. (2006 by R. Fielding)
  • Cloud computing - collides with many other terms, such as SaaS, Grid, Utility, PaaS, etc. (2007)

The definition of cloud computing is in progress:

There’s a Darwinian evolution of the exact definition of cloud computing running around. We’re about a country mile away from “knowing when I see it”, which is excellent progress. The cloud to everyone’s silver-lining has enough material to write a 3 volume desktop reference at this point. - Michael Cote, June 2008

Definition #1 - “Cloud computing is the realisation of Internet (”Cloud”) based development and use of computer technology (”Computing”) delivered by an ecosystem of providers. - Sam Johnston, July 2008

Definition #2 - “Cloud computing = network computing. I love the idea of cloud computing, the next evolution of the most network intensive architecture possible, but one that if it works well, is transparent. It’s all about the transparency.” - Douglas Gourlay, Cisco, May 2008

Definition #3 - “There seems to be a group myopia around so-called “cloud computing” and its definitions. What we’re really talking about are “cloud services” of which, “computing” is only a subset…Cloud services are not SaaS. They are far more akin to web services…” - Randy Bias, neoTactics, May 2008

(Anti-)Definition #4 - “Note that I refer to cloud services, not to the could. I am not interested in defining cloud as a term, because I don’t think it’s very useful. For those of us in the distributed computing’s pace

The Working Definition (Winner!):

“…the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don’t know where the resources are, and for the most part, you don’t care. What’s really important is the capability to access your application anywhere, move it freely and easily, and inexpensively add resources for instant scalability.” - Mitchell Crandell, Rightscale, June 2008

Taxonomies of the Cloud Space

Taxonomies are useful to provide insight into a market. It classifies a multitude of players into a smaller bucket.

Andreessen’s Platforms - September 2007

Provided an early taxonomy model for emerging cloud platforms

Platform being a system that can be programmed

  • Access API - platform that provides web service endpoints
  • Plug-In API - platform invokes your code, that you have deployed remotely
  • Runtime Environment - your code runs inside the platform’s process space.

Mehta 11 Layer Stack, April 2008

  1. Facilities (space, power, cooling)
  2. Network
  3. Hardware (e.g. servers Amazon EC2 runs)
  4. Hardware virtualization (e.g. Xen for EC2) - optional
  5. O/S (e.g. Linux)
  6. Systems Management (e.g., tools to manage EC2 instances)
  7. Application Middleware (e.g., MySQL on EC2)
  8. Application Code
  9. Application APIs / Web Services
  10. GUI for Application
  11. GUI for Application Development / Customization

Croll Cloud Stack, June 2008

7 layer stack within Turnkey app and Generic Platform.

Turnkey app

  • SaaS
  • Extensible app
  • Generic IDE
  • Constrained APIs
  • App Cluster
  • Virtual Data Center
  • Virtual Servers

Generic Platform

The bottom of Alistair’s stack includes “root access “style compute clouds.

Robert Anderson, July 2008

3 layer stack

  • Software (SaaS)
  • Platform (PaaS)
  • Infrastructure (IaaS)

This is the model taxonomy for this session.

Related Concepts and Terms

  • Infrastructure as a Service (IaaS), Hardware as a Service (HaaS) are synonyms to cloud infrastructure.
  • Virtualization
  • Hosting
  • Autonomic computing
  • Distributed computing
  • Grid computing

Cloud Applications

  • SaaS
  • S+S (Software+Services)
  • Managed Service Provider (MSP)
]]> Wed, 17 Sep 2008 14:25:32 +0000 cloud cloud applications croll cloud stack cloud infrastructure platforms process space space cloud space cloud platforms cloud services Interop NY: Cloud Language: The Taxonomy of On-Demand Computing