[SecurityRatty] tag: task

Developing and Retaining a Security Testing Mindset

Wed, 08 Oct 2008 00:42:08 +0000

Developing a security testing mindset is a hard task. Moreover, as hard as it is to develop it, it's just as hard to retain it and effectively apply it during testing. The authors discuss what it takes to conduct successful software security testing, primarily by describing how to develop a security testing mindset, retain it, and effectively apply it. In particular, they explore the different roles and processes an organization needs to maintain a high level of security assurance.

In the News: Hacking Sarah's Email, TSA-Approved Laptop Bags

Wed, 24 Sep 2008 11:47:43 +0000

Hacking Palin's EmailIt's no secret in the IT community that hacking into someone's email account is a fairly trivial task, but now that VP-candidate Sarah Palin's account has been cra...

MySpace, Facebook show off tools that can ward off child predators

Wed, 24 Sep 2008 00:00:00 +0000

Top social networks MySpace and Facebook outlined their measures for keeping child predators off their sites at a task force meeting in Cambridge, Mass.

Good to Great, Built to Last Whats Next for Creating Great Companies

Mon, 22 Sep 2008 14:16:23 +0000

I attended the Inc. 500 conference on Friday and absorbed one of the best conference keynote presentations I have ever witnessed delivered by Jim Collins – Author of “Built to Last” and “Good to Great”.

I have to admit that I was already a fan of Collins’ quantitative style blended with clever insight, but this was the first time that I had seen him in person, and he was just spectacular. He has a vivid, animated way of telling a story, and had a great sense of humor. This combination of presentation skill was put to immediate use with his first statement drawing a hearty laugh from the audience full of entrepreneurs.

“How many of you in the room are constitutionally unemployable?”

Much of his remaining presentation provided interesting stories and insight from the research that he has done to understand the make-up of exceptional companies.

As Jim said, he has spent years studying the contrast between average companies and exceptional companies. They faced the same set of variables… similar economic conditions, similar competition for top human resources, and a similar set of huge unknowns.

What is the single biggest element of difference?

Not a function of the cards you are dealt, or circumstance… it is conscious choice and discipline.

Jim’s key principles & disciplines that have come from the studies we have worked on:

Building greatness is a cumulative never ending process! The idea that no matter how exceptional, you are always only relatively as good as to what you can do next.
Most overnight successes are 20 years in the making…. Wal-mart took 13 years to get to 125 stores. Starbucks required 17 years to get to 38 stores.

“If you start to break Packard’s law, and there are very few laws of business, it is like breaking a law of physics for building great companies.” - David Packard (Co-founder of HP)

If you allow growth to exceed your ability to get enough of the right people to fill the key seats to execute on the growth brilliantly, you will fall as surely as a stone dropped from your hand. This is one of those timeless truths that extends beyond technology and economics.

The number one constraint on growth and sustained success…

An ability to get enough of the right people in the key seats to achieve that sustained growth.

The discipline that WHO comes before WHAT. Collins always kept coming back to the “who” thing over and over again. He said, “The more turbulent the world, (given the great current economic uncertainty of our financial system) the more important this issue is.”

A question from the audience came near the end of his session… How do you figure out who are the right people to put in key seats on the bus?

Collins responded with “Given that I stand here amidst a room full of unmotivated people… the right people are self motivated, self disciplined, self managed, The task is not to motivate unmotivated people, the task is not to have to manage people… self motivated, figured it out from there… self motivated people don’t need tons of management … when you have to start managing, you know that you have the wrong person at the task.”

Final thoughts:

Greatness is not a function of circumstance. Greatness is a function of conscious choice and discipline. It is not a matter of circumstance, it is one of choices.

I believe that every one of the Inc. 500 companies that I met at this conference achieved the list because they did not embrace the status quo. Incredible passion, an unwillingness to accept failure and an excessive and compulsive willingness to solve customer’s problems were key ingredients in the business building formula for the entrepreneurs that were at the conference.

Links for 2008-09-15 [del.icio.us]

Mon, 15 Sep 2008 20:00:00 +0000

Quest grabs NetPro to strengthen Windows management wares - Network World
NetPro’s lineup includes tools focused on security/compliance, infrastructure administration and identity/access. Those tools include auditing, backup/recovery, policy enforcement, event log management, Exchange migration, group policy management, health/performance and user self-service password management
Are common logging and audit standards emerging? :: SearchSecurity.com.au
SaaS market will 'collapse' in two years | Tech News on ZDNet
Q: Won't people avoid the mistakes of "previous" SaaS incarnations, as you mentioned? A: People are stupid. History has shown it repeats itself, and people make the same mistakes.
CRM Outsiders » Blog Archive » Lawson CEO: SaaS Will “Collapse” In Two Years
I couldn’t disagree more, but than again it was also Harry Debes that predicted that many of today’s Web 2.0, cell phone gadgets would never catch on either. SaaS is certainly here to say. I
Nerd News: Eventlog to Syslog
(ISC)2 Blog: Event Correlation
Speaking of Security... | Blog Entry: Paul Stamp | Correlation is no silver bullet: 1301
So, when deploying SIEM to improve your security operations, remember that correlation only really works when backed up by real data about what is the biggest problem in your environment, and how that problem manifests itself in the event logs. I call it "working out what type of needles you'll find in your haystack."
Systems log analytics offers operators performance insights that set stage for IT transformation | Dana Gardner’s BriefingsDirect | ZDNet.com
Sharpening Stones and Walking on Coals | Nemertes Research
When hunting for a needle in a haystack, after all, making the haystack larger is not an obviously productive course; getting a tool that can assist in the hunt - a magnet, or a metal detector - makes more sense!
Search or Destroy | Nemertes Research
It's not all about security, it's not all about events, it's not all about compliance. All those things are critically important to IT, of course, but even more fundamental is the task of keeping things running.
jdm's Blog: How worthwhile is logging?
Logs are like a warm blanket; verbose logging means you can know what's happening on your systems if you keep up with the logs. At the same time, logs become a burden very very easily, and they are easy to ignore.
Rainer's Blog: What is an Event? And what an Event Log?
Enterprise Architecture: From Incite comes Insight...: Taming the Documentum Audit Trail
First and foremost, it is a good security principle to separate log data from the system.
Log management is a pain | Thomas Nicholson
So for an administrator to not care about logs was a shock.
thebaumblog » Blog Archive » Life after SIEM. Situational Awareness is next.
Life after SIEM. Situational Awareness is next.

Group: US DHS should lose its cybersecurity authority

Mon, 15 Sep 2008 20:00:00 +0000

The U.S. Department of Homeland Security has been ineffective in coordinating government cybersecurity efforts and should be stripped of its authority in the area, members of a private cybersecurity task force told members of the U.S. Congress.

Data security now 10% of IT operating budgets, Forrester says

Wed, 03 Sep 2008 20:00:00 +0000

Abstract: IT security budgets are on the rise, reflecting growing concern over data breaches and increasing CEO involvement in the task of protecting sensitive data.

Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk

Wed, 03 Sep 2008 15:54:03 +0000

Synopsis: Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

A year ago in September 2007, I (Dan York) spoke at Astricon 2007 in Arizona, USA, about "Hacking and Attacking VoIP Systems: What You Need To Worry About" My presentation covered a lot of the typical VoIP security threats, tools and best practices but also expanded a bit into specific security issues with Asterisk. Please do keep in mind that it has been a year since this presentation and so some of the issues I mention have been addressed. (Astricon, for those who don't know, is an annual developer conference for those who work with the Asterisk open source telephony platform. Astricon 2008 is, in fact, coming up in about 3 weeks but I will not be attending this year.)

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know

View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Production assistance on this Special Edition was provided by Michael Graves who had a very tough task given the poor quality of the recording that I gave to him! Kudos to Michael for getting it to sound as good as it does.

Comments, suggestions and feedback are welcome either as replies to this post or via e-mail to blueboxpodcast@gmail.com. Audio comments sent as attached MP3 files are definitely welcome and will be played in future shows. You may also call the listener comment line at either +1-415-830-5439 or via SIP to 'bluebox@voipuser.org' to leave a comment there.

Thank you for listening and please do let us know what you think of the show.

Blue Box SE#026 - Astricon 2007 presentation on VoIP security and Asterisk

Wed, 03 Sep 2008 14:54:03 +0000

Synopsis: Blue Box Special Edition #26: Astricon 2007 presentation - "Hacking and Attacking VoIP Systems: What you need to worry about"

Welcome to Blue Box: The VoIP Security Podcast Special Edition #26, a 55-minute podcast from Dan York and Jonathan Zar covering VoIP security news, comments and opinions.

Download the show here (MP3, 6MB) or subscribe to the RSS feed to download the show automatically.

You may also listen to this podcast right now:

Show Content:

The slides for this talk are available from Slideshare:

Hacking and Attacking VoIP Systems - What You Need To Know

View SlideShare presentation or Upload your own. (tags: voip voipsecurity)

(And yes, at some point I'll sync the audio with the slides.)

Thank you for listening and please do let us know what you think of the show.

Real Artists Ship

Wed, 03 Sep 2008 07:23:08 +0000

For a number of reasons I follow emerging economies, the biggies being China and India. The BRIC countries (Brazil, Russia, India, and China) generally get lumped in together as the "next big thing", but they are at very, very different stages of development and more importantly are taking different paths. You can easily think of software security as an emerging discipline - despite a lot of talk and papers about Saltzer and Schroeder, we really don't have this stuff figured out.

So China is following a well worn path similar to South Korea, Japan, and the early US. India is taking a totally different and unproven path towards growth. Tata Motors has been innovative in building the cheapest car - the Tata Nano which is a $2500 car, and engineering triumph, driven by a mantra that an engineer would stand behind "do we really need that?"

Now the progress to executing on this is held back by India's dysfunctional environment:

In a tale rich with incongruities, the Communist-run government of West Bengal State invited the Tata Group, a symbol of Indian capitalism, to set up its plant in an area called Singur. It acquired 1,000 acres from farmers on the company’s behalf.
As the project advanced, some farmers who had sold their land demanded it back. The main state-level opposition party, the Trinamool Congress, led protests demanding that the land be returned. Most people sympathetic to Tata accused the opposition of inducing the farmers to protest, while Tata’s critics said the farmers had legitimate grievances.

The issue simmered for months. But in recent days, protesters began surrounding the plant, blocking roads and preventing Tata workers from reaching the plant. “The existing environment of obstruction, intimidation and confrontation has begun to impact the ability of the company to convince several of its experienced managers to relocate and work in the plant,” Tata said in a statement on Tuesday.

The halt to the plant has caused many Indian business people to warn of a chilling effect on investment in the country. It is also unclear how Tata will be able to keep the Nano’s cost so low, since part of the affordable price reflects the company’s savings on the land in Singur.

Arvind Subramanian compares China and India's trajectories:

There is a fundamental asymmetry between state and markets. It is easier to create markets than it is to create state capacity or to prevent its deterioration. Creating markets is a lot about letting go, establishing a reasonable policy framework, and allowing the natural hustling instinct to take over. In other words, hustling is the natural state. Building state capacity, on the other hand, is quite different. It involves overcoming collective action problems, mediating conflict, creating accountability mechanisms where outputs are multiple and fuzzy and links between inputs and outputs murky, and contending with the deep imprints of history. In Weber’s memorable words, building public institutions is like the “slow boring of hard boards”.

In that light, China’s task of improving its private sector seems easier to accomplish than India’s task of arresting institutional decline. So, while China and India can probably both count on more years of high growth, the odds still favour China pulling off that feat than India. That, and not just the meagre medal tally, should be what India mulls over after the Beijing Olympics.

The Economist summarizes:

It's easier to liberalise a functional state than it is to functionalise a dysfunctional one, of any ideological stripe.

What does all this have to do with ostensibly the topic at hand - Information Security? Well Tata Motors had the innovation but they didn't have the deployment model, at least not yet. More to the point, a lot of software security gets driven by infosec groups but real change is only coming when its driven by the development group. Why? Development groups are functional, they ship code. A lot of the success in software security is predicated by who you choose to partner with, it is more effective and easier to add security into a functional development group that ships code.