<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: thoughtful]]></title>
    <link>http://securityratty.com/tag/thoughtful</link>
    <description></description>
    <pubDate>Thu, 10 May 2007 03:00:33 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[The McAfee Secure Standard: Sort Of]]></title>
      <link>http://securityratty.com/article/93a923291bb66872facd096a29cc894d</link>
      <guid>http://securityratty.com/article/93a923291bb66872facd096a29cc894d</guid>
      <description><![CDATA[I need your help
I am in receipt of the McAfee Secure Standard, drafted to transparently describe the McAfee Secure service, as promised during my meeting with Joe Pierini and Kirk Lawrence of McAfee...]]></description>
      <content:encoded><![CDATA[I need your help.<br />I am in receipt of the McAfee Secure Standard, drafted to transparently describe the McAfee Secure service, as promised during my <a href="http://holisticinfosec.blogspot.com/2008/08/mcirony-unexpected-response-from-mcafee.html" target="_blank">meeting</a> with Joe Pierini and Kirk Lawrence of McAfee some weeks ago. I admit my attitude has soured since last I discussed it here, as the Standard is not yet ready for public release (I last said 2-3 weeks and that was five weeks ago), but bear with me. I can't publish exact quotes from the Standard, as I've promised not to, but let me give you insight on the upside, then the downside.<br /><br />The upside includes all the transparency we'd hoped for. You'll read the McAfee Secure Standard and know exactly where they stand with regard as to what can be expected of the McAfee Secure Service. My discussions with Joe Pierini have been productive and respectful, he means well, and I believe he will try to drive the greater McAfee leadership to officially incorporate suggestions made in this blog. <br />I have even had the pleasure of reading a Researcher/Finder Policy that very succinctly describes what researchers can expect when they submit vulnerabilities found in McAfee Secure sites. That's all good stuff and to be applauded.<br /><br />Now for the downside.<br /><br />The McAfee Secure Standard will draw a clear distinction between "enterprise" customers and all the Ma & Pa websites who have so loved McAfee Secure / ScanAlert Hacker Safe for conversions.<br />The most glaring and painful distinction for me is this. While enterprise customers will have a clearly defined time line in which to remediate script injection vulnerabilities like XSS and open redirects, before losing their McAfee Secure badge, <span style="font-weight:bold;">the Ma & Pa sites will have absolutely no requirement to fix their XSS issues</span>. XSS vulnerabilities and the McAfee Secure badge will remain consistent on all those sites that care more about "convincing" their customers that they're secure with a McAfee Secure badge; a badge that, by its own pending standard, will contradict what we know to be truly secure.<br /><br />My views are clear. I have made every effort to convince McAfee that this stance is counter intuitive to good web application security standards. I believe that, in their own way, they are listening. So here's your chance.<br />1) Is transparency enough?<br />2) Is holding only enterprise customers accountable acceptable?<br />3) Should ALL McAfee Secure customers be expected to fix their vulnerabilities, even if on different timelines?<br />4) What else do you want McAfee to hear, in the form of constructive feedback only?<br />I will publish all well written, thoughtful comments here. Let's keep it positive and see if we can help convince McAfee that script injection vulnerabilities and McAfee Secure can't exist in the same physical space. Like matter and anti-matter. ;-)<br />The floor is yours...<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html&title=The%20McAfee%20Secure%20Standard:%20Sort%20Of " title="The McAfee Secure Standard: Sort Of ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html" title="The McAfee Secure Standard: Sort Of ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 19:47:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mcafee">mcafee</category>
      <category domain="http://securityratty.com/tag/mcafee secure customers">mcafee secure customers</category>
      <category domain="http://securityratty.com/tag/sites">sites</category>
      <category domain="http://securityratty.com/tag/mcafee secure sites">mcafee secure sites</category>
      <category domain="http://securityratty.com/tag/mcafee secure standard">mcafee secure standard</category>
      <category domain="http://securityratty.com/tag/mcafee secure service">mcafee secure service</category>
      <category domain="http://securityratty.com/tag/mcafee secure">mcafee secure</category>
      <category domain="http://securityratty.com/tag/loved mcafee secure">loved mcafee secure</category>
      <category domain="http://securityratty.com/tag/convince mcafee">convince mcafee</category>
      <source url="http://holisticinfosec.blogspot.com/2008/10/mcafee-secure-standard-sort-of.html">The McAfee Secure Standard: Sort Of</source>
    </item>
    <item>
      <title><![CDATA[On DNS]]></title>
      <link>http://securityratty.com/article/31d21f2ad20f7e8c771bd1882b258928</link>
      <guid>http://securityratty.com/article/31d21f2ad20f7e8c771bd1882b258928</guid>
      <description><![CDATA[I was preparing a long and thoughtful post on the &quot;DNS issue&quot; (mentioning this , this , this , etc), but it was all in vain

This is the last and final word on it. Thanks Rich for the link (he...]]></description>
      <content:encoded><![CDATA[I was preparing a long and thoughtful post on the "DNS issue" (mentioning  <a href="http://www.matasano.com/log/1105/regarding-the-post-on-chargen-earlier-today/">this</a>, <a href="http://taosecurity.blogspot.com/2008/07/what-should-dan-have-done.html">this</a>, <a href="http://securityincite.com/TDI-2008-07-22#TBP1">this</a>, etc), but it was all in vain.<br /><br /><a href="http://rationalsecurity.typepad.com/blog/2008/07/the-dns-debacle.html">This</a> is the last and final word on it. Thanks <a href="http://securosis.com/2008/07/22/pure-genius/">Rich</a> for the link (he understates and <a href="http://securosis.com/2008/07/22/pure-genius/">calls it</a> just "genius" :-))<br /><br />All  bow to <a href="http://rationalsecurity.typepad.com">Hoff's wisdom</a> - and <a href="http://rationalsecurity.typepad.com/blog/2008/07/the-dns-debacle.html">poetic super-powers</a>, of course :-)<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=faEpeJ"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=faEpeJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=FcIiXJ"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=FcIiXJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=cAtt7J"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=cAtt7J" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/343232702" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 22 Jul 2008 18:15:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/final word">final word</category>
      <category domain="http://securityratty.com/tag/thoughtful post">thoughtful post</category>
      <category domain="http://securityratty.com/tag/dns issue">dns issue</category>
      <category domain="http://securityratty.com/tag/poetic super-powers">poetic super-powers</category>
      <category domain="http://securityratty.com/tag/link">link</category>
      <category domain="http://securityratty.com/tag/calls">calls</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/wisdom">wisdom</category>
      <category domain="http://securityratty.com/tag/vain">vain</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/343232702/on-dns.html">On DNS</source>
    </item>
    <item>
      <title><![CDATA[Documentary on Wireless Philadelphia Released]]></title>
      <link>http://securityratty.com/article/b4a26adbee21ad0f981568ff19d1da00</link>
      <guid>http://securityratty.com/article/b4a26adbee21ad0f981568ff19d1da00</guid>
      <description><![CDATA[George Rausch decided in advance of the Phila. network shutdown to release his unfinished documentary: It's about 13 minutes, and isn't edited tightly at this point, but it's rather interesting....]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" border="0" hspace="5" /><a href="http://www.vimeo.com/1105623"><strong>George Rausch decided in advance of the Phila. network shutdown to release his unfinished documentary:</strong></a> It's about 13 minutes, and isn't edited tightly at this point, but it's rather interesting. Rausch talked to a few network users, Wireless Philadelphia, and a few other people. These are well-spoken, thoughtful people, and it's well shot. I hope Rausch continues to think about how this all fits together after the Wi-Fi network halts operation in a few days.</p>

<p><object width="400" height="219">	<param name="allowfullscreen" value="true" />	<param name="allowscriptaccess" value="always" />	<param name="movie" value="http://www.vimeo.com/moogaloop.swf?clip_id=1105623&amp;server=www.vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" />	<embed src="http://www.vimeo.com/moogaloop.swf?clip_id=1105623&amp;server=www.vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always" width="400" height="219"></embed></object><br /><span class="posted"><a href="http://www.vimeo.com/1105623?pg=embed&sec=1105623">Change is in the Airwaves: A Documentary about the Philadelphia Wireless Initiative</a> from <a href="http://www.vimeo.com/rausch?pg=embed&sec=1105623">George Rausch</a> on <a href="http://vimeo.com?pg=embed&sec=1105623">Vimeo</a>.</span></p>]]></content:encoded>
      <pubDate>Fri, 06 Jun 2008 06:43:23 +0000</pubDate>
      <category domain="http://securityratty.com/tag/george rausch">george rausch</category>
      <category domain="http://securityratty.com/tag/rausch">rausch</category>
      <category domain="http://securityratty.com/tag/hope rausch continues">hope rausch continues</category>
      <category domain="http://securityratty.com/tag/wireless philadelphia">wireless philadelphia</category>
      <category domain="http://securityratty.com/tag/documentary">documentary</category>
      <category domain="http://securityratty.com/tag/philadelphia wireless initiative">philadelphia wireless initiative</category>
      <category domain="http://securityratty.com/tag/thoughtful people">thoughtful people</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/network shutdown">network shutdown</category>
      <source url="http://wifinetnews.com/archives/008344.html">Documentary on Wireless Philadelphia Released</source>
    </item>
    <item>
      <title><![CDATA[Women in IT: A Note from the Non-Booth-Babe Blogger]]></title>
      <link>http://securityratty.com/article/71b92c6a0b036f7f3af191e431feeef6</link>
      <guid>http://securityratty.com/article/71b92c6a0b036f7f3af191e431feeef6</guid>
      <description><![CDATA[Okay Alan! Your blog this morning has cracked me up, Ive definitely had a good giggle from it. I have to say though, Im surprised, amused and embarrassed all at the same time. Blonde- yes , Blogger-...]]></description>
      <content:encoded><![CDATA[<p>Okay Alan! Your <a class="offsite-link-inline" href="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/04/this-aint-no-bl.html" target="_blank">blog this morning&nbsp;</a>&nbsp;has cracked me up, I&#8217;ve definitely had a good giggle from it. I have to say though, I&#8217;m surprised, amused and embarrassed all at the same time. Blonde- <em>yes</em>, Blogger- <em>yes</em>&#8230; not sure about the other parts!</p><p>I may disagree on the photo comment. First of all, it&#8217;s <em>really</em> bad. Secondly, I&#8217;ve emailed responses to several of my readers&#8217; comments and (much to my surprise) found they didn&#8217;t&nbsp;realize I was &#8216;a girl&#8217;. Shocking right? When they saw &#8216;Jennifer&#8217; in my email signature they figured it out. So, I don&#8217;t know that the photo has any impact on readership, but I could be wrong. However, if you do read my blog because I&#8217;m female and you like the photo- I&#8217;m okay with that- you&#8217;ll still learn something ;)</p><p><em>Note to self: I definitely have to do something about that horrible photo! I&#8217;ve been procrastinating for a while and searching for a photographer and stylist to get some new &#8216;real&#8217; head shots taken. I hate having my photo taken, so I&#8217;ll keep you posted on that. </em></p><p><strong>Women in IT&#8230;</strong></p><p>The timing of your post&nbsp;is amazing as well. Over the past couple of weeks I&#8217;ve received several emails from fellow women in IT who wanted to make a connection, swap stories and find a commerad-ess, or two, in the world. I&#8217;ve even received postcards and written notes from thoughtful ladies who found my information online. I guess I never realized what a struggle some women have in the &#8216;man&#8217;s world&#8217; of IT. I&#8217;m starting to realize it more, as I meet new friends and hear their war stories of moving up and gaining respect in the industry. </p><p>I&#8217;ve been lucky- I grew up in the IT industry and somehow managed to circumvent a lot of the &#8216;gender issues&#8217;. When I was about 16, I&nbsp;developed and taught computer and Internet-related courseware, and had to teach it to adults (and yes, they&#8217;re actually worse than the 2nd graders!) Around that same time, I was sitting on a state agency board as a SME on web usage and development. </p><p><u>I was young and a female (and blonde),</u> so I most certainly had to prove myself and establish a repertoire to gain the respect of my peers; mostly middle-aged and older men who had been in the industry longer than I&#8217;d been alive. </p><p><strong>Knowing what you don&#8217;t know&#8230;</strong></p><p>Getting thrown in early certainly taught me valuable lessons.&nbsp;I made sure I knew my stuff inside and out, and&nbsp;conversely, I&nbsp;made sure I was comfortable asking questions on topics I <em>didn&#8217;t</em> know about. Part of the respect comes from &#8216;knowing <em>what you don&#8217;t know&#8217;</em> and being able to admit it. I think I&#8217;m pretty good at that and it&#8217;s carried me far. :)&nbsp;&nbsp; Plus, I had two great role models to learn from. </p><p>However it happened- through some combination of luck&nbsp;and hard work- I&#8217;m happy to be where I am. Our customers, partners and colleagues look to me for answers and insight. I know they trust me and and that&#8217;s an amazing feeling. It&#8217;s also what drives me to be the best at what I do, and to keep learning, studying and working at it. </p><p><em>They&#8217;ve given me their trust, and I try really hard to give them something back that&#8217;s&nbsp;equally as important.</em> </p><p># # #</p>
]]></content:encoded>
      <pubDate>Thu, 03 Apr 2008 10:58:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/photo">photo</category>
      <category domain="http://securityratty.com/tag/photo-">photo-</category>
      <category domain="http://securityratty.com/tag/horrible photo">horrible photo</category>
      <category domain="http://securityratty.com/tag/photo comment">photo comment</category>
      <category domain="http://securityratty.com/tag/hard work-">hard work-</category>
      <category domain="http://securityratty.com/tag/hard">hard</category>
      <category domain="http://securityratty.com/tag/real head shots">real head shots</category>
      <category domain="http://securityratty.com/tag/mans world">mans world</category>
      <category domain="http://securityratty.com/tag/respect">respect</category>
      <source url="http://www.securityuncorked.com/security-uncorked/2008/4/3/women-in-it-a-note-from-the-non-booth-babe-blogger.html">Women in IT: A Note from the Non-Booth-Babe Blogger</source>
    </item>
    <item>
      <title><![CDATA[Oracle to Buy BEA Systems for $8.5 Billion]]></title>
      <link>http://securityratty.com/article/8c2d7daaa08e89dd24b5343bcd0e9426</link>
      <guid>http://securityratty.com/article/8c2d7daaa08e89dd24b5343bcd0e9426</guid>
      <description><![CDATA[After three months of wrangling over prices, Oracle Corp. will acquire BEA Systems in a $8.5 billion deal
This means that Oracle will now have an event processing platform, the Oracle WebLogic Event...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p>After three months of wrangling over prices, <a href="http://online.wsj.com/quotes/main.html?type=djn&amp;symbol=orcl" class="times rolloverQuote"><font color="#0253b7">Oracle</font></a> Corp. will acquire <a href="http://online.wsj.com/quotes/main.html?type=djn&amp;symbol=beas" class="times rolloverQuote"><font color="#0253b7">BEA Systems</font></a> in a $8.5 billion deal.</p>
<p>This means that Oracle will now have an event processing platform, the <a target="_blank" href="http://www.bea.com/eventserver/">Oracle WebLogic Event Server</a> to compliment their product line.</p>
<p>Reference:  <a target="_blank" href="http://online.wsj.com/article/SB120048691486294361.html?mod=googlenews_wsj">Oracle Strikes Deal to Buy BEA Systems for $8.5 Billion</a>  (Wall Street Journal)</p>
<div style="font:bold 12px times new roman, times, serif;padding:12px 0 0;"><span style="font:bold 12px times new roman, times, serif;">By <b>JOHN FLOWERS</b><br />
<span class="aTime"><em><font size="2" color="#666666">January 16, 2008 8:14 a.m.</font></em></span></span></div>
<p class="times"><a href="http://online.wsj.com/quotes/main.html?type=djn&amp;symbol=orcl" class="times rolloverQuote"><font color="#0253b7">Oracle</font></a> Corp. said it will acquire <a href="http://online.wsj.com/quotes/main.html?type=djn&amp;symbol=beas" class="times rolloverQuote"><font color="#0253b7">BEA Systems</font></a> in a $8.5 billion deal three months after BEA slapped away an Oracle takeover offer as too low.</p>
<p class="times">Oracle would pay $19.38 for each BEA share, a 24% premium to Tuesday&#8217;s close price of $15.58.</p>
<p class="times">Oracle made an unsolicited $6.7 billion, or $17 a share, takeover proposal in October, but the company let it expire weeks later after BEA said the bid was unacceptable. At the same time, BEA added it was looking to start negotiations with interested parties willing to pay at least $21 a share.</p>
<p class="times">&#8220;The addition of BEA products and technology will significantly enhance and extend Oracle&#8217;s Fusion middleware software suite,&#8221; said Oracle Chief Executive Larry Ellison. &#8220;Middleware&#8221; is a general term for any programming that serves to mediate between two separate and often already existing programs.</p>
<p class="times">BEA Chairman and CEO Alfred Chuang called the deal the culmination of a &#8220;diligent and thoughtful process&#8221; to maximize stockholder value. The company&#8217;s largest shareholder, billionaire Carl Icahn, had called for an auction to sell the business-management-software firm.</p>
<p class="times">BEA is one of the few independent, midsize software companies left in Silicon Valley as the technology industry consolidates. Oracle has for years eyed BEA as an acquisition target.</p>
<p class="times">BEA has been battling Oracle, <a href="http://online.wsj.com/quotes/main.html?type=djn&amp;symbol=ibm" class="times rolloverQuote"><font color="#0253b7">International Business Machines</font></a> Corp. and others in the market for middleware. BEA, with a product called WebLogic, pioneered one category of middleware called application servers that are used to build Web services.</p>
<p class="times">Oracle expects the buyout to boost earnings by one cent to two cents a share, excluding items, in the first year after the deal closes. That is slated to happen by midyear.</p>
<p class="times">Shares of Oracle fell in premarket trading to $20.80 after closing Tuesday at $21.31.</p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/173/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/173/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/173/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/173/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/173/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/173/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/173/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/173/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/173/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/173/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/173/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/173/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=173&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Wed, 16 Jan 2008 11:00:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bea systems">bea systems</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/bea">bea</category>
      <category domain="http://securityratty.com/tag/acquire bea systems">acquire bea systems</category>
      <category domain="http://securityratty.com/tag/oracle strikes deal">oracle strikes deal</category>
      <category domain="http://securityratty.com/tag/bea chairman">bea chairman</category>
      <category domain="http://securityratty.com/tag/bea share">bea share</category>
      <category domain="http://securityratty.com/tag/share">share</category>
      <category domain="http://securityratty.com/tag/eyed bea">eyed bea</category>
      <source url="http://thecepblog.com/2008/01/16/oracle-to-buy-bea-systems-for-85-billion/">Oracle to Buy BEA Systems for $8.5 Billion</source>
    </item>
    <item>
      <title><![CDATA[Your Brain on Fear]]></title>
      <link>http://securityratty.com/article/2926978283c67fd3fd6ec80b6ca795ea</link>
      <guid>http://securityratty.com/article/2926978283c67fd3fd6ec80b6ca795ea</guid>
      <description><![CDATA[Interesting article from Newsweek : The evolutionary primacy of the brain's fear circuitry makes it more powerful than the brain's reasoning faculties. The amygdala sprouts a profusion of connections...]]></description>
      <content:encoded><![CDATA[<p>Interesting <a href="http://www.newsweek.com/id/78178">article</a> from <i>Newsweek</i>:</p>

<blockquote>The evolutionary primacy of the brain's fear circuitry makes it more powerful than the brain's reasoning faculties. The amygdala sprouts a profusion of connections to higher brain regions -- neurons that carry one-way traffic from amygdala to neocortex. Few connections run from the cortex to the amygdala, however. That allows the amygdala to override the products of the logical, thoughtful cortex, but not vice versa. So although it is sometimes possible to think yourself out of fear ("I <i>know</i> that dark shape in the alley is just a trash can"), it takes great effort and persistence. Instead, fear tends to overrule reason, as the amygdala hobbles our logic and reasoning circuits. That makes fear "far, far more powerful than reason," says neurobiologist Michael Fanselow of the University of California, Los Angeles. "It evolved as a mechanism to protect us from life-threatening situations, and from an evolutionary standpoint there's nothing more important than that."</blockquote>

<p>I've <a href="http://www.schneier.com/essay-155.html">already written</a> about this sort of thing.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=qeSFcnD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=qeSFcnD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=BQDGAXD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=BQDGAXD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hZC1BzD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hZC1BzD" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 09 Jan 2008 03:10:54 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fear">fear</category>
      <category domain="http://securityratty.com/tag/brain">brain</category>
      <category domain="http://securityratty.com/tag/amygdala">amygdala</category>
      <category domain="http://securityratty.com/tag/amygdala hobbles">amygdala hobbles</category>
      <category domain="http://securityratty.com/tag/fear circuitry">fear circuitry</category>
      <category domain="http://securityratty.com/tag/amygdala sprouts">amygdala sprouts</category>
      <category domain="http://securityratty.com/tag/brain regions">brain regions</category>
      <category domain="http://securityratty.com/tag/overrule reason">overrule reason</category>
      <category domain="http://securityratty.com/tag/cortex">cortex</category>
      <source url="http://www.schneier.com/blog/archives/2008/01/your_brain_on_f.html">Your Brain on Fear</source>
    </item>
    <item>
      <title><![CDATA[Visualization Reloaded]]></title>
      <link>http://securityratty.com/article/eda42b8f2cb0c9e2d6db2643d715369c</link>
      <guid>http://securityratty.com/article/eda42b8f2cb0c9e2d6db2643d715369c</guid>
      <description><![CDATA[Enjoying visualizing a better world, world peace and global coolingin my meditative serene holiday at Divana Nurture Spa , I could not help buttranscend intothoughtsabout a recent post, Visualizations...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p>Enjoying visualizing a better world, world peace and global cooling in my meditative serene holiday at <a target="_blank" href="http://www.divana-dvn.com/spa_nurture_home.html">Divana Nurture Spa</a>, I could not help but transcend into thoughts about a recent post, <a target="_blank" href="http://magmasystems.blogspot.com/2007/12/visualizations-update.html">Visualizations Update</a>.</p>
<p>In his thoughtful post above, Marc Adler briefly mentions heatmaps and visualization in the context of event processing adapters, analytics, and the ecosystem in general.    </p>
<p>In an earlier post, I blogged about <a rel="bookmark" href="http://thecepblog.com/2007/10/26/sls-architecture-for-cep-visualization/" title="SL’s Architecture for CEP Visualization">SL’s Architecture for CEP Visualization</a>.  <a target="_blank" href="http://www.sl.com">SL</a> has been a friend of the CEP community for quite some time supporting <a target="_blank" href="http://www.tibco.com">TIBCO</a>, <a target="_blank" href="http://www.progress.com/apama">Apama</a>, <a target="_blank" href="http://www.streambase.com">StreamBase</a> and more.  </p>
<p>Speaking to everyone interested in visualization, including blogosphere colleague <a target="_blank" href="http://magmasystems.blogspot.com/">Marc</a>,  I kindly recommend you check out the very cool heatmap in this post, <a rel="bookmark" href="http://thecepblog.com/2007/09/16/cep-use-case-stream-processing-in-multiplayer-online-gaming/" title="Stream Processing in Multiplayer Online Gaming">CEP Use Case: Stream Processing in Multiplayer Online Gaming</a>.  </p>
<div style="text-align:center;"><a target="_blank" href="http://thecepblog.com/2007/09/16/cep-use-case-stream-processing-in-multiplayer-online-gaming/"><img border="0" width="433" src="http://www.silkroad.com/blogimgs/simutronics_hero_engine_3.jpg" alt="HERO Engine RTView" height="364" /></a></div>
<p>I thought that StreamBase, partnering with SL for visualization, did a fantastic job in their online gaming use case for <a target="_blank" href="http://www.play.net/corporate/">Simultronics</a>, demonstrating the event processing ecosystem that has Marc&#8217;s attention these days.</p>
<p>Happy New Year!</p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/152/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/152/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/152/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/152/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/152/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/152/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/152/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/152/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/152/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/152/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/152/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/152/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=152&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Sat, 29 Dec 2007 08:08:41 +0000</pubDate>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/visualization">visualization</category>
      <category domain="http://securityratty.com/tag/recent post">recent post</category>
      <category domain="http://securityratty.com/tag/thoughtful post">thoughtful post</category>
      <category domain="http://securityratty.com/tag/divana nurture spa">divana nurture spa</category>
      <category domain="http://securityratty.com/tag/world peace">world peace</category>
      <category domain="http://securityratty.com/tag/world">world</category>
      <category domain="http://securityratty.com/tag/meditative serene holiday">meditative serene holiday</category>
      <category domain="http://securityratty.com/tag/cep community">cep community</category>
      <source url="http://thecepblog.com/2007/12/29/visualization-reloaded/">Visualization Reloaded</source>
    </item>
    <item>
      <title><![CDATA[Lost laptop = Lost data!]]></title>
      <link>http://securityratty.com/article/eb80b6a167dd00574936002c18fa0847</link>
      <guid>http://securityratty.com/article/eb80b6a167dd00574936002c18fa0847</guid>
      <description><![CDATA[Laptop has become our essential travel companion. Lost brand new laptop without personal or company data will result in a loss of current market value of the laptop. Lost laptop with personal or...]]></description>
      <content:encoded><![CDATA[<P><FONT face="Times New Roman,Times,serif">Laptop has become our essential travel companion.&nbsp;Lost&nbsp;brand new laptop without personal or company data will&nbsp;result in a loss of current&nbsp;market value of the laptop. Lost laptop with personal or company data can result in a loss which can depend on the value of the "data". It is easier to make amends for the lost laptop but making amends for lost valuable company data or valuable personal data may not be possible.</FONT></P>
<P><FONT face="Times New Roman,Times,serif">It is very important for us to be "laptop data aware" i.e.&nbsp;the categories of&nbsp;data it has and&nbsp;the consequences of lost data.&nbsp;A good practice is to treat your <STRONG>laptop like your wallet</STRONG>. </FONT></P>
<P><FONT face="Times New Roman,Times,serif">I found these 9 tips on </FONT><A href="http://www.microsoft.com/atwork/stayconnected/laptopsecurity.mspx"><FONT face="Times New Roman,Times,serif">Microsoft website</FONT></A><FONT face="Times New Roman,Times,serif">. These tips are really thoughtful and well written and hence I like to repeat it below:</FONT></P>
<P><FONT face="Times New Roman,Times,serif">Use these 9 tips to learn how you can keep your laptop more secure when you're on the road.</FONT></P>
<P>
<TABLE class=numberedList cellSpacing=0 cellPadding=0 border=0>
<TBODY>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>1.</P></TD>
<TD>
<P>Avoid using computer bags. Computer bags can make it obvious that you're carrying a laptop. Instead, try toting your laptop in something more common like a padded briefcase or suitcase.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>2.</P></TD>
<TD>
<P>Never leave access numbers or passwords in your carrying case. Keeping your password with your laptop is like keeping the keys in the car. Without your password or important access numbers it will be more difficult for a thief to access your personal and corporate information.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>3.</P></TD>
<TD>
<P>Carry your laptop with you. Always take your laptop on the plane or train rather then checking it with your luggage. It's easy to lose luggage and it's just as easy to lose your laptop. If you're traveling by car, keep your laptop out of sight. For example, lock it in the trunk when you're not using it.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>4.</P></TD>
<TD>
<P>Encrypt your data. If someone should get your laptop and gain access to your files, encryption can give you another layer of protection. With Windows XP and Windows Vista you can choose to encrypt files and folders. Then, even if someone gains access to an important file, they can't decrypt it and see your information. Learn more about how to <A href="http://www.microsoft.com/windowsxp/using/security/learnmore/encryptdata.mspx">encrypt your data with Windows XP</A> or <A href="http://windowshelp.microsoft.com/Windows/en-US/Help/5a2b6b98-9833-4d73-967e-9293bd1a54e91033.mspx">encrypt your data with Windows Vista</A>.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>5.</P></TD>
<TD>
<P>Keep your eye on your laptop. When you go through airport security don't lose sight of your bag. Hold your bag until the person in front of you has gone through the metal detector. Many bags look alike and yours can easily be lost in the shuffle.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>6.</P></TD>
<TD>
<P>Avoid setting your laptop on the floor. Putting your laptop on the floor is an easy way to forget or lose track of it. If you have to set it down, try to place it between your feet or against your leg (so you're always aware it's there).</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>7.</P></TD>
<TD>
<P>Buy a laptop security device. If you need to leave your laptop in a room or at your desk, use a laptop security cable to securely attach it to a heavy chair, table, or desk. The cable makes it more difficult for someone to take your laptop. There are also programs that will report the location of a stolen laptop. They work when the laptop connects to the Internet, and can report the laptop's exact physical location. Some tracing programs include <A href="http://www.sentryinc.com/">CyberAngel</A> and <A href="http://www.computrace.com/">ComputracePlus</A>.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>8.</P></TD>
<TD>
<P>Use a screen guard. These guards help prevent people from peeking over your shoulder as you work on sensitive information in a public place. This is especially helpful when you're traveling or need to work in a crowded area. This screen guard from <A href="http://www.secure-it.com/products/privacy_notebook.htm">Secure-It</A> is just one example of a screen guard you could use.</P></TD></TR>
<TR vAlign=top>
<TD class=listNumber noWrap align=right>
<P>9.</P></TD>
<TD>
<P>Try not to leave your laptop in your hotel room or with the front desk. Too many things have been lost in hotel rooms and may not be completely secure. If you must leave your laptop in your room, put the "do not disturb" sign on the door.</P></TD></TR></TBODY></TABLE></P>]]></content:encoded>
      <pubDate>Sat, 18 Aug 2007 04:28:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/lost data">lost data</category>
      <category domain="http://securityratty.com/tag/lost">lost</category>
      <category domain="http://securityratty.com/tag/lost laptop">lost laptop</category>
      <category domain="http://securityratty.com/tag/laptop">laptop</category>
      <category domain="http://securityratty.com/tag/laptop data aware">laptop data aware</category>
      <category domain="http://securityratty.com/tag/lost brand">lost brand</category>
      <category domain="http://securityratty.com/tag/aware">aware</category>
      <category domain="http://securityratty.com/tag/laptop security device">laptop security device</category>
      <source url="http://ravichar.blogharbor.com/blog/_archives/2007/8/18/3166459.html">Lost laptop = Lost data!</source>
    </item>
    <item>
      <title><![CDATA[Catch not-so-smart hackers to send message to smart hackers]]></title>
      <link>http://securityratty.com/article/f9cbec4e00c145ad6789f7e3399d6e11</link>
      <guid>http://securityratty.com/article/f9cbec4e00c145ad6789f7e3399d6e11</guid>
      <description><![CDATA[Hackers interact with software/hardware in order to compromise Confidenitality, Integrity and Availability of software/hardware. The adjective &quot;smart&quot; in the phrase &quot;smart hackers&quot; distinguishes those...]]></description>
      <content:encoded><![CDATA[<P>Hackers interact with software/hardware in&nbsp;order to&nbsp;compromise Confidenitality, Integrity and Availability of software/hardware. The adjective "smart" in the&nbsp;phrase "smart hackers"&nbsp;distinguishes those hackers who can compromise Confidentialy, Integrity and Availability in such a way that they leave minimal or no audit&nbsp;trail.</P>
<P>There are technical controls [tools such as <A href="https://www.blogware.com/www.vontu.com">Vontu</A>] available to monitor deviant&nbsp;computer usage&nbsp;of employees of a company.&nbsp;It is&nbsp;extremely difficult to catch a smart-deviant&nbsp;employee. An intelligent alternative is to catch not-so-smart-deviant employee to trigger a warning&nbsp;message to smart-deviant employee - [smart-deviant employee could either become smarter or they could just shut up!].&nbsp;Typical examples of not-so-smart-deviant employee behaviour are: 1. Sending confidential document to a competitior through an&nbsp;email attachment. 2. FTP'ing confidential document outside of the company. 3. Using webmail to send confidential document.</P>
<P><A href="http://securityincite.com/blog/mike-rothman/the-daily-incite-may-8-2007">Mike Rothman's</A> blog post about <A href="http://news.yahoo.com/s/pcworld/20070503/tc_pcworld/131523">spammer's using encrypted zip files</A> to tunnel thro' filters demonstrates the brilliance of smart hackers. It is&nbsp;well known&nbsp;truth that HTTP is known as UFBP (Universal Firewall Bypass Protocol). What if a hacker&nbsp;tunnels&nbsp;encrypted data thro' a SOAP container which uses HTTP? It would be extremely hard to catch those extreme cases with technical controls. </P>
<P>Jeremiah's thoughtful&nbsp; <A href="http://jeremiahgrossman.blogspot.com/2007/05/how-to-check-if-your-webmail-account.html">blog post</A> about &nbsp;"How to check if your WebMail account has been hacked".&nbsp;A smart hacker who has hacked say your gmail account would not be dumb enough to open a spurious looking email in the first place, moreover they would get around by&nbsp;choosing the option of not displaying images!</P>
<P>Smart hackers get away most of the time. There is no point in spending cycles to catch them. Hope for the good by catching&nbsp;not-so-smart hackers! Do make sure when you catch&nbsp;not-so-smart, it leads to widespread educational opportunity.</P>
<P>&nbsp;</P>]]></content:encoded>
      <pubDate>Thu, 10 May 2007 03:00:33 +0000</pubDate>
      <category domain="http://securityratty.com/tag/not-so-smart hackers">not-so-smart hackers</category>
      <category domain="http://securityratty.com/tag/hackers">hackers</category>
      <category domain="http://securityratty.com/tag/not-so-smart">not-so-smart</category>
      <category domain="http://securityratty.com/tag/smart">smart</category>
      <category domain="http://securityratty.com/tag/smart hackers">smart hackers</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <category domain="http://securityratty.com/tag/smart-deviant employee">smart-deviant employee</category>
      <category domain="http://securityratty.com/tag/hackers interact">hackers interact</category>
      <category domain="http://securityratty.com/tag/smart hacker">smart hacker</category>
      <source url="http://ravichar.blogharbor.com/blog/_archives/2007/5/10/2939873.html">Catch not-so-smart hackers to send message to smart hackers</source>
    </item>
  </channel>
</rss>
