<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: universities]]></title>
    <link>http://securityratty.com/tag/universities</link>
    <description></description>
    <pubDate>Fri, 27 Jun 2008 11:49:56 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[10 IT security companies to watch]]></title>
      <link>http://securityratty.com/article/7fb33fcd59f537407a873ba5e7e9ba75</link>
      <guid>http://securityratty.com/article/7fb33fcd59f537407a873ba5e7e9ba75</guid>
      <description><![CDATA[If there's a common theme among most of these vendors, as with 2007s top 10, it's that trusted personal relationships forged in universities, business and the military played an essential role in...]]></description>
      <content:encoded><![CDATA[If there's a common theme among most of these vendors, as with 2007’s top 10, it's that trusted personal relationships forged in universities, business and the military played an essential role in inspiring their founders and convincing employees to join them.<img src="http://feedproxy.google.com/~r/digg/topic/security/popular/~4/7DPG74Esezw" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 19 Nov 2008 07:00:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/essential role">essential role</category>
      <category domain="http://securityratty.com/tag/2007s top">2007s top</category>
      <category domain="http://securityratty.com/tag/common theme">common theme</category>
      <category domain="http://securityratty.com/tag/personal relationships">personal relationships</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/military">military</category>
      <category domain="http://securityratty.com/tag/vendors">vendors</category>
      <category domain="http://securityratty.com/tag/join">join</category>
      <category domain="http://securityratty.com/tag/founders">founders</category>
      <source url="http://feeds.digg.com/~r/digg/topic/security/popular/~3/7DPG74Esezw/10_IT_security_companies_to_watch_2">10 IT security companies to watch</source>
    </item>
    <item>
      <title><![CDATA[IT security education continues to evolve]]></title>
      <link>http://securityratty.com/article/12f71b7b79d710d8bc043972aaa1f439</link>
      <guid>http://securityratty.com/article/12f71b7b79d710d8bc043972aaa1f439</guid>
      <description><![CDATA[The majority of programs at colleges and universities around the country are certainly doing a good job of training people to go into positions in IT. In fact, we have a greater demand among employers...]]></description>
      <content:encoded><![CDATA[The majority of programs at colleges and universities around the country are certainly doing a good job of training people to go into positions in IT. In fact, we have a greater demand among employers for students than we have students to fill positions. That said, there are some areas where we lack students who graduate with the right amount of expertise and focus. IT security and cyber forensics are areas where we have a critical need for workers in the field.<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=55251?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=55251?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Sun, 16 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/students">students</category>
      <category domain="http://securityratty.com/tag/lack students">lack students</category>
      <category domain="http://securityratty.com/tag/fill positions">fill positions</category>
      <category domain="http://securityratty.com/tag/positions">positions</category>
      <category domain="http://securityratty.com/tag/cyber forensics">cyber forensics</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/workers">workers</category>
      <category domain="http://securityratty.com/tag/focus">focus</category>
      <category domain="http://securityratty.com/tag/critical">critical</category>
      <source url="http://www.networkworld.com/news/2008/111708-it-security-education-continues-to.html?fsrc=rss-security">IT security education continues to evolve</source>
    </item>
    <item>
      <title><![CDATA[America's CTO]]></title>
      <link>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</link>
      <guid>http://securityratty.com/article/7370017881b0de9957b3253bdde1e5eb</guid>
      <description><![CDATA[I hope this message gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as...]]></description>
      <content:encoded><![CDATA[<p>I hope <a href="http://bits.blogs.nytimes.com/2008/11/05/john-doerrs-advice-for-barack-obama-hire-bill-joy/">this message</a> gets through to the Obama people - Bill Joy would be an amazingly good pick for the newly created CTO cabinet post. A grand slam to the upper deck. You can count the people with as a good a track record in technology on one hand.</p><br /><div>Also, I could not agree more with John Doerr on these points:</div><br /><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The next question from the president-elect was what single policy issue he could focus on that would most help entrepreneurs.</span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“The most important thing he’s got to do is kick-start a huge amount of research and innovation in energy,” said Mr. Doerr, who backed Google and Amazon.com and has invested heavily in clean energy technology for the last few years.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">The nation now invests less than $1 billion a year in renewable energy versus $32 billion a year in health care, Mr. Doerr said. “I think we’ve just scratched the surface in terms of clean ways to use energy, to produce energy. It’s the challenge of our generation.”</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">How to do that? Double the number of engineers who graduate from American universities each year to 60,000, Mr. Doerr said. Bring more women into the field, and encourage foreigners who study engineering here to stay here.</span><br /><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; "><br /></span></p></blockquote><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;"><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px; ">“What we do is bring foreign nationals to the world’s greatest universities. We train them, invest in them and make them go home,” he said. “What kind of national strategy is that? So I would staple a green card to the diploma.”</span></p></blockquote><p><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></p><div><span style="color: #333333; font-family: georgia; font-size: 10px; "><p style="margin-top: 0px; margin-right: 0px; margin-bottom: 1em; margin-left: 0px; font-size: 1.4em; line-height: 1.5em; "><span id="more-1803"></span></p></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">While it is amazing that it took until 2009 for the US to have a CTO as a cabinet level position, it is very cool to think about all the things that could happen going forward. As Neal Stephenson said the US is only world class at three things - 1. Movies, 2. High speed pizza delivery and 3. Software development.</span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"><br /></span></div><div><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">If you read your </span><a href="http://edgeperspectives.typepad.com/edge_perspectives/">John Hagel</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;"> and </span><a href="http://www.johnseelybrown.com/">JSB</a><span style="color: #333333; font-family: georgia; font-size: 14px; line-height: 21px;">, then you know that innovation is the only sustainable edge. Luckily its hard wired into our system, but it will be helpful to have a seat at the table for certain things. &#0160;</span></div>]]></content:encoded>
      <pubDate>Sat, 08 Nov 2008 13:08:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/energy">energy</category>
      <category domain="http://securityratty.com/tag/produce energy">produce energy</category>
      <category domain="http://securityratty.com/tag/renewable energy versus">renewable energy versus</category>
      <category domain="http://securityratty.com/tag/cto">cto</category>
      <category domain="http://securityratty.com/tag/clean energy technology">clean energy technology</category>
      <category domain="http://securityratty.com/tag/clean">clean</category>
      <category domain="http://securityratty.com/tag/doerr">doerr</category>
      <category domain="http://securityratty.com/tag/john doerr">john doerr</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/11/americas-cto.html">America's CTO</source>
    </item>
    <item>
      <title><![CDATA[P2P legislation forcing university IT to get tough on piracy]]></title>
      <link>http://securityratty.com/article/ce474834bcbcbf28fb06a36647808e4f</link>
      <guid>http://securityratty.com/article/ce474834bcbcbf28fb06a36647808e4f</guid>
      <description><![CDATA[A new law aimed at stopping illegal peer-to-peer file-sharing of digital entertainment content, such as music and videos, requires the nation's colleges and universities to educate students that P2P...]]></description>
      <content:encoded><![CDATA[A new law aimed at stopping illegal peer-to-peer file-sharing of digital entertainment content, such as music and videos, requires the nation's colleges and universities to educate students that P2P piracy is illegal and strongly encourages the use of technology to monitor and block illegal P2P.]]></content:encoded>
      <pubDate>Wed, 22 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/illegal">illegal</category>
      <category domain="http://securityratty.com/tag/block illegal p2p">block illegal p2p</category>
      <category domain="http://securityratty.com/tag/illegal peer-to-peer">illegal peer-to-peer</category>
      <category domain="http://securityratty.com/tag/digital entertainment content">digital entertainment content</category>
      <category domain="http://securityratty.com/tag/law aimed">law aimed</category>
      <category domain="http://securityratty.com/tag/p2p piracy">p2p piracy</category>
      <category domain="http://securityratty.com/tag/strongly encourages">strongly encourages</category>
      <category domain="http://securityratty.com/tag/nation">nation</category>
      <category domain="http://securityratty.com/tag/monitor">monitor</category>
      <source url="http://www.networkworld.com/news/2008/102308-p2p-college-legislation.html?fsrc=rss-security">P2P legislation forcing university IT to get tough on piracy</source>
    </item>
    <item>
      <title><![CDATA[Nigeria establishes university database]]></title>
      <link>http://securityratty.com/article/430f02b4bc7ecbdb37433ccee05d8f91</link>
      <guid>http://securityratty.com/article/430f02b4bc7ecbdb37433ccee05d8f91</guid>
      <description><![CDATA[Worried about poor online data management and certificate forgery among students, the Nigerian government has established the National Universities Commission Data Base...]]></description>
      <content:encoded><![CDATA[Worried about poor online data management and certificate forgery among students, the Nigerian government has established the National Universities Commission Data Base (NUCDB).]]></content:encoded>
      <pubDate>Wed, 15 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/nigerian government">nigerian government</category>
      <category domain="http://securityratty.com/tag/nucdb">nucdb</category>
      <category domain="http://securityratty.com/tag/students">students</category>
      <category domain="http://securityratty.com/tag/forgery">forgery</category>
      <source url="http://www.networkworld.com/news/2008/101608-nigeria-establishes-university.html?fsrc=rss-security">Nigeria establishes university database</source>
    </item>
    <item>
      <title><![CDATA[Is an incorrectly implemented security program better than a non-existent one ?]]></title>
      <link>http://securityratty.com/article/5893399324f415d7cb19e54c1340401b</link>
      <guid>http://securityratty.com/article/5893399324f415d7cb19e54c1340401b</guid>
      <description><![CDATA[Think carefully before you answer that one. A large majority of you would be inclined to give a resounding 'yes' - but I really want you to think carefully on this one. Think long term. Think about...]]></description>
      <content:encoded><![CDATA[Think carefully before you answer that one. A large majority of you would be inclined to give a resounding 'yes' - but I really want you to think <em>carefully </em>on this one. Think long term. Think about implementation hurdles, think about project documentation.<br /><br />The answer to this IMHO is a big "DEPENDS". <br /><br />To explain:<br /><br />Imagine you're working in a company that has no security controls in place - and is in desperate need of getting a security program impemented. They hire a new CISO to make sure their physical and logical controls are in place, network and applications are secured appropriately and their incident management and forensics capabilities are upto date. At this point the CISO clearly  knows that he needs to create and implement a number of programs and hires a bunch of people to perform and manage a series of tasks. Till this point, things are going smoothly. Everyone understands the need, and is working towards meeting a common goal. The program is not in place yet, but people know and understand the urgency need to act immediately. The CISO's risk radar has a list of projects ranked by priority and everone begins to tackle them. <br /><br />Now consider the scenario when certain security programs are not done right - say, a few of the high risk  applications are not considered in the initial risk matrix or there are certain business units that have been granted an 'exception'to the process that is being put in place, with the most common excuses of:<br /><br />1. This is a pilot<br />2. We will get to this in the next phase<br />3. The group has a number of high profile clients who don't want it implemented right now<br />4. &ltplug your own excuse here&gt<br /><br />Well - initially, everyone is completely aware that they have more issues to remediate and and have honest intentions to fix that too, once the pilot and<br />PoC is well established and in place. But then things change. Leaders change. Managers change. People's roles change. What doesn't, is the documentation regarding the project. But documents usually tend to highlight what the project <em>does</em>, not what it <em>doesn't do</em>. Nobody seems to remember there are additional tasks that need to get completed. People take a quick look at documents detailing what was done in the program and begin to assume that it is well established, completely ignoring the fact that a very important Phase 2 still needs to be in place. A false sense of security is now well in place... and life goes on. <br /><br />Till you get hacked. <br /><br />..and then a forensics team attempts to determine the cause. A new CISO comes in, reviews the existing program, decides it is too complex and structureless and decides to do away with it entirely and create a new security program.. and the cycle continues.<br /><br />The moral of the story: When you have no security program - be very careful while diligently working to get one in place<br /><br />But when you have a partial one, be extremely careful and don't leave any loose ends while getting it completely and correctly put in place.<br /><br /><br />On a lighter note - here's an email I received from a school I was doing some courses from ..<br /><a href="http://4.bp.blogspot.com/_XTqu2iQGpYM/SL8CCfFxwwI/AAAAAAAAAq8/dQfN6tdLU-M/s1600-h/blog1.JPG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;" src="http://4.bp.blogspot.com/_XTqu2iQGpYM/SL8CCfFxwwI/AAAAAAAAAq8/dQfN6tdLU-M/s400/blog1.JPG" border="0" alt=""id="BLOGGER_PHOTO_ID_5241910733011272450" /></a><br />Beautiful !! Here is your PIN (username). But we will not give you your password over email. I was sooo impressed when I got that! - Could it be that schools and universities are finally waking up and trying to understand security ? No more SSNs as IDs ? No more default 'password' passwords ?  This was great. I followed the procedure outlined to receive a new password - it asked for my name, DOB and email.. and then .. I receive this:<br /><br /><a href="http://2.bp.blogspot.com/_XTqu2iQGpYM/SL7-9CTJaKI/AAAAAAAAAq0/ZY9Q0SqaxkU/s1600-h/blog2.JPG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;" src="http://2.bp.blogspot.com/_XTqu2iQGpYM/SL7-9CTJaKI/AAAAAAAAAq0/ZY9Q0SqaxkU/s400/blog2.JPG" border="0" alt=""id="BLOGGER_PHOTO_ID_5241907340848490658" /></a><br /><br /><br />For those who cannot see the image:<br /><br /><br />the email says:<br /><br />blah blah blah blah blah blah..<br />your PIN: <my PIN><br />your password: password1234<br /><br />blah blah blah blah blah blah]]></content:encoded>
      <pubDate>Wed, 03 Sep 2008 12:02:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security program">security program</category>
      <category domain="http://securityratty.com/tag/program">program</category>
      <category domain="http://securityratty.com/tag/security controls">security controls</category>
      <category domain="http://securityratty.com/tag/change">change</category>
      <category domain="http://securityratty.com/tag/leaders change">leaders change</category>
      <category domain="http://securityratty.com/tag/programs">programs</category>
      <category domain="http://securityratty.com/tag/security programs">security programs</category>
      <category domain="http://securityratty.com/tag/roles change">roles change</category>
      <source url="http://securitycoin.blogspot.com/2008/09/is-incorrectly-implemented-security.html">Is an incorrectly implemented security program better than a non-existent one ?</source>
    </item>
    <item>
      <title><![CDATA[While I Was Out: Compendium of the Last Week's News]]></title>
      <link>http://securityratty.com/article/9b2e491a24c669b08b8cfdf0d0df0b47</link>
      <guid>http://securityratty.com/article/9b2e491a24c669b08b8cfdf0d0df0b47</guid>
      <description><![CDATA[You wouldn't listen, but continued to generate products, news stories, and analysis about wireless networking in my absence: Here's the run down of the last week or so's Wi-Fi and wireless stories....]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><strong>You wouldn't listen, but continued to generate products, news stories, and analysis about wireless networking in my absence:</strong> Here's the run down of the last week or so's Wi-Fi and wireless stories. (Yes, I enjoyed my time off.)</p>

<p><a href="http://www.informationweek.com/news/services/data/showArticle.jhtml?articleID=210200880"><strong>Fourth US airline to go Wi-Fi:</strong></a> Aircell says they have a fourth airline--after American, Delta, and Virgin America--on board for its in-flight Wi-Fi service. The aerial broadband provider's latest partner will be announced soon. Aircell's service went live in 15 American Airlines planes two weeks ago, and there's been a surprising lack of reporting from regular travelers or journalists since the big splash at the launch.</p>

<p><a href="http://seattlepi.nwsource.com/business/376308_software25.html"><strong>Microsoft, two universities research methods for better Wi-Fi handoff for vehicles:</strong></a> The researchers developed a method they call Vi-Fi, writes the Seattle Post-Intelligencer's Todd Bishop, which allows a system to maintain connections with several base stations at once, using a primary access point for traffic until a discontinuity is predicted or encountered. This allows seamless handoffs and continuous voice conversations. </p>

<p><a href="http://www.nytimes.com/2008/08/24/technology/24digi.html?_r=1&oref=slogin"><strong>Speaking of autos and Wi-Fi, concerns raised about Chrysler's in-car Wi-Fi option:</strong></a> Randall Stross wrote nearly two weeks ago in The New York Times about the problem of distraction. With the Internet at your fingertips, can you restrain yourself? The only problem with the humorous and accurate analysis is that millions of business travelers have 3G access via laptop cards already, so you'd think we'd already be seeing the bad effects of automotive area networks.</p>

<p><a href="http://www.omaha.com/index.php?u_page=2798&u_sid=10415031"><strong>A Wi-Fi booster can't post availability signs on highway:</strong></a> The Nebraska town of Louisville has free Wi-Fi downtown, and wanted to post "Visitor Wi-Fi" on a highway sign as another amenity. The state highway department has a policy that doesn't allow the promotion of Wi-Fi, because they believe they'd be inundated. A resident who runs a local Internet firm installed his own signs on the highway; the roads department removed them; he remounted them; they were removed again. The idea of zoning and mounting a billboard apparently hasn't come to the city officials' minds (or perhaps they're prohibited).</p>

<p><a href="http://www.lisburntoday.co.uk/news/PRIMARY-PULLS-PLUG-ON-WIFI.4435678.jp"><strong>The folks spreading misinformation about Wi-Fi health effects cause Ulster school to disable network:</strong></a> I can understand why non-technical folks might think that Wi-Fi has been proven to be unsafe, given the kind of information that's available on the Internet about wireless safety. While there are ongoing studies about the safety of cellular signals--and I'm convinced at this point there's no increased risk to an adult's health by using a cell phone--there is no specific and credible research linked to Wi-Fi, which broadcasts signals at a far lower level than a cell phone, most of the time in most uses.</p>

<p><a href="http://blog.seattlepi.nwsource.com/thebigblog/archives/147374.asp"><strong>Washington state shuts down rest-area Wi-Fi:</strong></a> The $3 for 15 minutes, $7 per day, or $30 per month Wi-Fi service at 28 of Washington's 42 rest areas has been turned off after a year for lack of use. Figures. The fees charged by Parsons and Road Connect aren't unreasonable for a nationally scoped plan, but are ridiculous for limited use. States should either bite the bullet and offer these service for free, partner with national roaming operators who can resell service into large networks of business travelers, or use ads to support the service. Highways in remote areas can typically pick up cell data networks, and ongoing costs should be minimal to operate such networks.</p>

<p><a href="http://www.techworld.com/news/index.cfm?RSS&NewsID=103501"><strong>IEEE approves fast-roaming standard, 802.11r:</strong></a> This new standard is designed to improve the handoff of devices between base stations. This is accomplished in part by allowing base stations to communicate security and quality of service information so that a VoIP over WLAN phone can immediately reassociate without the delay of authentication and other handshaking.</p>

<p><a href="http://www.marketwatch.com/news/story/freefi-networks-releases-figures-wi-fi/story.aspx?guid={5252EF0E-2563-42B7-8A95-2F893580E6F6}&dist=hppr"><strong>Denver airport sees 7,000 connections on a single day last week due to Democratic National Convention:</strong></a> FreeFi released the usage figures recently to show how their service is operating. The network started with about 600 daily users when the switchover from fee to free happened 10 months ago, and now carries about 3,500 daily connections.</p>

<p><a href="http://www.centredaily.com/living/travel/story/804003.html"><strong>Coffee Bean & Tea Leaf goes free:</strong></a> The chain of about 700 cafes will have free Wi-Fi installed by now in all its company-owned stores (about 300).</p>]]></content:encoded>
      <pubDate>Tue, 02 Sep 2008 10:55:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/in-car wi-fi option">in-car wi-fi option</category>
      <category domain="http://securityratty.com/tag/wi-fi handoff">wi-fi handoff</category>
      <category domain="http://securityratty.com/tag/free wi-fi downtown">free wi-fi downtown</category>
      <category domain="http://securityratty.com/tag/month wi-fi service">month wi-fi service</category>
      <category domain="http://securityratty.com/tag/rest-area wi-fi">rest-area wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi booster">wi-fi booster</category>
      <category domain="http://securityratty.com/tag/in-flight wi-fi service">in-flight wi-fi service</category>
      <source url="http://wifinetnews.com/archives/008428.html">While I Was Out: Compendium of the Last Week's News</source>
    </item>
    <item>
      <title><![CDATA[Open Wireless Networks on University Campuses]]></title>
      <link>http://securityratty.com/article/853802f13943f6fe01ed0f94bb57cde5</link>
      <guid>http://securityratty.com/article/853802f13943f6fe01ed0f94bb57cde5</guid>
      <description><![CDATA[Open wireless networks raise privacy issues and entail increased risk of malicious attacks and illegal downloading activities. Such networks are nonetheless attractiveparticularly to...]]></description>
      <content:encoded><![CDATA[Open wireless networks raise privacy issues and entail increased risk of malicious attacks and illegal downloading activities. Such networks are nonetheless attractive—particularly to universities—because they enhance usability and thus expand access to nonsensitive system resources. At universities, such access brings numerous benefits to students, faculty, and the surrounding community alike. Here, the authors describe the challenges of removing individual user authentication requirements at the perimeter of a university network in which mobile device users access system resources over wireless links to the wired infrastructure. The authors discuss how to mitigate the security and privacy risks entailed in an open network of this sort, and also describe how IT departments can vary the network's degree of openness.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=886fadebac38b82b1bf95eab60070589"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=886fadebac38b82b1bf95eab60070589"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=886fadebac38b82b1bf95eab60070589" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Thu, 31 Jul 2008 09:30:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/university network">university network</category>
      <category domain="http://securityratty.com/tag/authors describe">authors describe</category>
      <category domain="http://securityratty.com/tag/nonsensitive system resources">nonsensitive system resources</category>
      <category domain="http://securityratty.com/tag/describe">describe</category>
      <category domain="http://securityratty.com/tag/malicious attacks">malicious attacks</category>
      <category domain="http://securityratty.com/tag/wired infrastructure">wired infrastructure</category>
      <category domain="http://securityratty.com/tag/authors discuss">authors discuss</category>
      <category domain="http://securityratty.com/tag/privacy risks">privacy risks</category>
      <source url="http://www.pheedo.com/click.phdo?i=886fadebac38b82b1bf95eab60070589">Open Wireless Networks on University Campuses</source>
    </item>
    <item>
      <title><![CDATA["Metro" employee information mistakenly posted to Web]]></title>
      <link>http://securityratty.com/article/cd2d242bebb5e31e3d326420f3f89e22</link>
      <guid>http://securityratty.com/article/cd2d242bebb5e31e3d326420f3f89e22</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/14/08

Organization
Washington Metropolitan Area Transit Authority (&quot;Metro

Contractor/Consultant/Branch
None

Victims
past and present employees
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/metro.jpg" width="45" align="right" height="54"><font size="2"><b>Date Reported: </b><br>7/14/08<br><br><b>Organization: </b><br><a href="http://www.wmata.com/default.cfm">Washington Metropolitan Area Transit Authority ("Metro")</a> <br><br><b>Contractor/Consultant/Branch:</b><br>None<br><br><b>Victims:</b><br>"past and present employees"<br><br><b>Number Affected:</b><br>4,675<br><br><b>Types of Data:</b><br>Names and Social Security numbers<br><br><b>Breach Description:</b><br>"Metro has advised nearly 4,700 past and present employees that their social security numbers were published accidentally on the transit agency’s Web site last month."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wmata.com/about/MET_NEWS/PressReleaseDetail.cfm?ReleaseID=2194">Metro Press Release</a> <br><a href="http://www.forbes.com/feeds/ap/2008/07/14/ap5213364.html">Associated Press via Forbes.com</a> <br><a href="http://www.nbc4.com/news/16881050/detail.html">NBC Channel 4 News</a> <br><a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/07/14/AR2008071402245.html">The Washington Post</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Washington Metropolitan Area Transit Authority<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Metro has advised nearly 4,700 past and present employees that their social security numbers were published accidentally on the transit agency’s Web site last month.<br><br>The information was posted between June 9 and 25 as part of a solicitation from Metro to companies interested in providing worker’s compensation and risk management services.<br><span style="font-style: italic;">[Evan] Rather than post this information to a public web site, why wasn't a more secure method of tranmission used such as VPN or secure FTP?</span><br><br>The document mistakenly included the social security numbers of 4,675 employees.<br><span style="font-style: italic;">[Evan] According to Metro spokeswoman Candace Smith the sensitive information was supposed to be redacted.&nbsp; I wonder how well this mandate was communicated to the employee(s) responsible for compiling and posting the information.</span><br><br>A smaller group of employees had their names and social security numbers posted in the lengthy document. Metro officials continue to analyze the information for any other data breaches.<br><br>Three Metro employees have been disciplined<br><br>The three disciplined employees, including a manager, have been suspended for up to a month without pay, officials said.<br><span style="font-style: italic;">[Evan] This implies that the employees responsible for the mistake should have known better.&nbsp; We can probably assume that they were informed of the proper procedure, but did not follow it.</span><br><br>Letters warning of the breach were sent out to the affected employees.<br><br>The letter urges employees to watch their credit reports for signs of identity theft.<br><br>Last week, the agency set up a separate Web site where employees can determine whether their numbers were among those posted. <br><br>The agency is offering the 4,700 employees one year of free credit report monitoring, $25,000 in identity theft insurance and counseling services.<br><br>"We deeply regret this incident, and believe the likelihood of misuse of the information is low," said Metro Chief Safety Officer Ronald Keele.<br><br>"However, we have taken additional steps to protect employee information by bolstering Internet security and requiring more checks and balances of materials before they are being released publicly."<br><span style="font-style: italic;">[Evan] Checks and balances are typically lacking in these types of breaches, so I think it’s a good sign that Metro is addressing these.</span><br><br>Metro officials say they are not alone in this type of data breach.<br><span style="font-style: italic;">[Evan] So what?</span><br><br>According to the Identity Theft Resource Center, data breaches at businesses, governments and universities were up 69 percent in the first half of 2008 compared with a similar period in 2007.<br><br><span style="font-weight: bold;">Commentary:</span><br>The end result of this oversight is three disciplined employees (with no pay for a month) and nearly 4,700 people with an increased risk of identity theft.&nbsp; Forethought is there for a reason, whether or not you use it is your choice. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/15/metro.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 06:39:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/metro officials continue">metro officials continue</category>
      <category domain="http://securityratty.com/tag/metro officials">metro officials</category>
      <category domain="http://securityratty.com/tag/metro">metro</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/letter urges employees">letter urges employees</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/metro employees">metro employees</category>
      <category domain="http://securityratty.com/tag/employees responsible">employees responsible</category>
      <source url="http://breachblog.com/2008/07/15/metro.aspx">"Metro" employee information mistakenly posted to Web</source>
    </item>
    <item>
      <title><![CDATA[The Infant, the Elephant and the Intelligent Event]]></title>
      <link>http://securityratty.com/article/69d5df2507ada50dcc8e08da37c1e831</link>
      <guid>http://securityratty.com/article/69d5df2507ada50dcc8e08da37c1e831</guid>
      <description><![CDATA[Fellow blogger Opher Etzion, replies to On Elephants andAnalytics with On Unicorn,Professor and Infant . Opher is kindly givingus another metaphor to consider, the Infant and the Profession, since we...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p>Fellow blogger Opher Etzion, replies to  <a title="On Elephants and Analytics" rel="bookmark" href="http://thecepblog.com/2008/06/26/on-elephants-and-analytics/">On Elephants and Analytics</a> with <a href="http://epthinking.blogspot.com/2008/06/on-unicorn-professor-and-infant.html" target="_blank">On Unicorn, Professor and Infant</a>.   Opher is kindly giving us another metaphor to consider, the Infant and the Profession, since we are both big fans of big gentle elephants, babies and our universities.  </p>
<p>Opher and I agree that Infants are not Professors, and we also agree that CEP is in its Infancy and there is overhype by folks often implying CEP is a Professor.     So it seems we all have a huge elephant in the room with an Infant Professor hanging on the end of a wildly swinging Elephant&#8217;s trunk!</p>
<p>To keep the blogopoints interesting, I should point out that with all this agreement and <a href="http://en.wikipedia.org/wiki/Kumbaya" target="_self">Kumbaya</a><strong> </strong>campfire singing, there are a couple of things I do disagree with in Opher&#8217;s amusing counterpoint. </p>
<p>First of all, Opher uses the well know debate technique of falsely attributing some easily refutable discussion point and then offering a slam dunk counterpoint.   He does this in this clever, but completely inaccurate Opher quote,</p>
<blockquote><p> <em>&#8220;I [Opher] respectfully disagree with Tim &#8230; in his claim that what has been done until today is just hype and hence totally worthless&#8230;&#8221;</em></p></blockquote>
<p>Folks reading my blog know that I have never said &#8220;what has been done until today is &#8230; totally worthless.&#8221;    This is a misfortunate misquote.  Shame on you Opher!  </p>
<p>What I said, easily read in the blog, was that CEP is overhyped and that most of the self-described CEP software on the market today does not live up to the inflated claims we read and hear from CEP software vendors, the analysts and reporters they influence.</p>
<p>The second counterpoint that I find interesting is Opher&#8217;s consistent attempt to redress the dramatic lack of capability and analytics in current generation self-described CEP software by repositioning CEP as &#8220;intelligent event processing&#8221; (IEP) as he is continues in <a href="http://epthinking.blogspot.com/2008/06/on-intelligent-event-processing-aaai.html" target="_self">On Intelligent Event Processing</a>.   </p>
<p>Perhaps Opher will be successful in repositioning the vast majority of the original CEP problem space as IEP.   This is a interesting slippery slope, in my opinion.   The new positioning that Opher is offering is that when &#8220;event processing&#8221; has advanced analytics, it is not CEP anymore, it becomes IEP because CEP is really &#8220;Simple Event Processing&#8221; (SEP) - event processing with little to no analytical capability.</p>
<p>I don&#8217;t know about most of our readers, but all this positioning and repositioning to match the capabilities, or lack of capabilities, in the current portfolio of self-described CEP software vendors is fascinating.</p>
<p>Here is the next logical question is:</p>
<p>What is the difference between a &#8220;Complex Event&#8221; and an &#8220;Intelligent Event&#8221; ?</p>
<p>This could get quite interesting, so stay tuned!</p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/261/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/261/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/261/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/261/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/261/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/261/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/261/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/261/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/261/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/261/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/261/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/261/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=261&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Fri, 27 Jun 2008 11:49:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cep software">cep software</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/intelligent event">intelligent event</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/original cep">original cep</category>
      <category domain="http://securityratty.com/tag/cep software vendors">cep software vendors</category>
      <category domain="http://securityratty.com/tag/opher quote">opher quote</category>
      <category domain="http://securityratty.com/tag/opher">opher</category>
      <category domain="http://securityratty.com/tag/complex event">complex event</category>
      <source url="http://thecepblog.com/2008/06/27/the-infant-the-elephant-and-the-intelligent-event/">The Infant, the Elephant and the Intelligent Event</source>
    </item>
  </channel>
</rss>
