[SecurityRatty] tag: unstable

TIBCO BusinessEvents 3.0

Wed, 24 Sep 2008 01:54:39 +0000

I was pleased to read the Paul Vincent’s post, TIBCO BusinessEvents 3.0. TIBCO has always had a forward thinking vision for distributed computing and this release of BE 3.0 is another step in the right direction. TIBCO now has the only commercial-off-the-shelf (COTS) event processing platform on the market that supports distributed event processing, multi-agent architectures, distributed object caching, extensibility, continuous queries, state management and state-of-the-art rules.

Even thought TIBCO’s BusinessEvents does not yet support Bayesian Classifiers, Artificial Neural Networks and other advanced decision support algorithms, it is just a matter of time before TIBCO will add these advanced features “out of the box”. On the other hand, the extensible nature of TIBCO’s BE makes it possible to add probabalistic computing functionality, however this requires quite a lot of programming and integration work.

When I see a great release like this for TIBCO, it makes me a little nostalgic for “the good old days” travelling the world in the front of the aircraft for TIBCO. TIBCO has a rich and diverse customer base. This customer base includes financial services companies; however, TIBCO is much less dependent on financial services than other event processing companies. So, with TIBCO you not only get great technology, but rock-solid stability in an unstable and uncertain business world.

As a side note, an S&P analyst recently downgraded TIBCO’s stock (TIBX), primarily due to chao in the financial services sector. Because of TIBCO’s global reach and stability, plus forward vision, advanced technologies and many years of commericial success, the S&P downgrade will create a buying opportunity for TIBCO stock.

Corporate Greed and the Destabilization of Society

Tue, 23 Sep 2008 14:24:22 +0000

In The Audacity of Capital Markets we briefly touched on the culture of arrogance and greed in financial services. It is interesting because if you look at the various software players that are focused on selling to financial services, you will easily see that they have bought into the same “feed the beast” culture that has contributed to the destabilization of the economy and, in turn, society.

For example, the “Average Joe Investor” does not care about “best order execution” or “smart order routing,” this is for “the big boys.” As we all know, saving a few pennies or dollars per transaction to “Average Joe Investor” does nothing for them when their retirement nest egg is lost due to corporate greed and negligence. The folks who “really care” about shaving a few milliseconds off market execution are the companies that are trading high volumes of exotic derivatives and baskets who have, for the most part, zero interest in the personal financial portfolio of “Jane in Iowa” or “Joe in Kansas.”

I am really amazed to see the dominance of greed in corporate America and the lack of corporate social responsibility. Risk taking and “split second trading” does little for any small. individual investor and has proven to destabilize our society. Who cares about saving a few pennies or dollars in market executive?

The answer: Only the greedy corporations, the same people responsible for the current destabilization, chao and near collaspe of our entire financial system. Homes lost, unprecedented bankruptcies. and money market funds less than par value! You no doubt have read that folks in the Reserve Money Market funds cannot even withdraw their “safe money.” Investors in the Reserve Funds are being told that for every dollar they invested in a money market, they now only have 97 cents and cannot withdraw their capital as the Reserve waits for a government bailout.

What is to blame? Greed and profits over corporate social responsibility are to blame.

I read where some folks think the government needs to regulate market-related news, supposedly to stabilize trading based on news. Regulating news has another name - “censorship” - but who cares about the US Constitution when money and split second algo trading is involved? I am amazed. Folks in financial services just will say or do anything to make a buck, or keep from losing one, even at the expense of society and our basic constitutional freedoms. News is not regulated in our democratic society, nor should it be to make algorithmic trading “better”. What we need is less split second, computerized algo trading and more stablity. Machine processing should not dicate nor mandate changes to our democratic principles.

Nor should our lives in a free society be censored or regulated because of the trading requirements for split second transactions that benefit large corporations. The average investor does not need an unstable financial system trading exotic derivatives and baskets at the speed of light. This requirement is driven by corporate greed that destabilizes the core economy and fabric of our society.

Of couse, many of the same folks would like for us to believe that technology is the answer. This is a fallacy.

Corporate greed is destabilizing society. What need to be regulated is not the news, but corporate risk taking and corporate goverance. Individual investors do not need lightspeed transactions in an unstable world. Citizens and families need a secure, stable economic infrastructure, something that has been lost in the culture of corporate greed, but hopefully not forever.

Communicating about risk - part 1

Mon, 05 May 2008 14:12:14 +0000

In his comments a couple of weeks ago, Walter brought up an important point. Paraphrased, he pointed out that misrepresenting the precision of an analysis is a bad thing. He also pointed out that this isn’t so much a problem with the analysis model (although it’s more likely to occur with a quantitative model), but rather tends to be a problem with how an analyst communicates results to management.

With that in mind, I thought I’d write a couple of posts about communicating risk. In this week’s post, I’ll talk about “risk qualifiers” that can be critical in helping management understand the true nature of some risk scenarios.

“I can live with this…”

Let’s say that you’ve done an analysis and the results look something like what’s shown in the charts below (I’ve included both a qualitative and a quantitative version):

At first glance, a decision maker might think “This doesn’t look so bad. I can live with this level of risk.” But that’s not necessarily the whole story…

Unstable conditions

An unstable risk condition exists when the following characteristics co-exist:

Threat event frequency is low
Vulnerability is high
Probable loss magnitude is significant

When these conditions exist, the low loss event frequency is driven solely by the low threat event frequency. In other words, we’re not actively managing loss event frequency; we’re just trusting to luck. If threat event frequency changes (or an event occurs at all), then significant impact will likely occur. An example might be an internal application that handles a significant volume of sensitive consumer records, but that has little or no authentication or authorization control in place.

Now, if all we provided management was a qualitative “Medium/Low” risk statement or a quantitative statement that “probable loss event frequency is roughly once every ten years with a probable loss magnitude of $500k”, then we haven’t really allowed management to make an informed decision.

This additional information about the unstable nature of the risk condition is critical for a couple of reasons: 1) it allows management to decide whether they want to gamble, and 2) instability can reflect poorly from a due diligence perspective.

Fragile conditions

A fragile condition exists when the following characteristics co-exist:

Threat event frequency is high
Vulnerability is low, but dependent on a single effective control
Probable loss magnitude is significant

At a glance, this will look similar to an unstable condition. In this case however, a single control is all that prevents a high loss event frequency. An example might be a single layer Internet architecture, where the volume of threat events is high but the firewall is generally quite effective.

Differentiation

One big advantage these qualifiers provide is to be able to differentiate between risk conditions that, from a risk chart perspective, look the same. This differentiation allows us to prioritize better, which leads to more cost-effective risk management.

Another advantage is that it provides nomenclature for expressing what our intuition has probably already recognized. In other words, the experienced information security professional would intuitively recognize the difference between an unstable or fragile condition and one that isn’t (but that may look the same on a chart). In my experience, what we tend to do in those instances is label the condition “high risk”. The problem with this is that it lumps these scenarios in with those where loss event frequency and loss magnitude are high, which erodes management’s ability to prioritize effectively.

At the end of the day, effectively managing any complex set of issues requires an ability to differentiate. These qualifiers have proven to be extremely useful in that regard.

High Availability Security In Your Virtual Environment

Wed, 12 Mar 2008 18:41:15 +0000

How many times have security products been the blame for network outages? Many right?

If something goes down and the network team gets a call, they immediately point their finger at the Firewall. If a user can't access something on the network, its the Firewall. If something is running slow on the network, guess what!

Its the firewall.

And with Intrusion Prevention products, because they were very unstable during the early years and would crash or generate false positives a lot, customers started demanding that these devices had some failure mechanisms in them. Customers demanded "Fail Open". Fail Open to a security guy doesn't make a whole lot of sense because it basically says, if there is a problem with the metal detector at the airport, it should just "Fail Open" and let everyone into the gate area to board airplanes!

I'd rather block all traffic until I know it was secure, but I live in a world where most people don't think like me. So.... Why the heck am I blogging about this in a virtualization blog?

Well, I know that Virtual Networks function much like Physical Networks and since network engineers don't always trust security devices I understand that the same set of requirements placed on physical security products will be placed on virtual security products.

Why wouldn't the networking guys demand that virtual security products have either "Fail Open" or what I feel is a better solution "Fail Over".

"Fail Open" is not really possible with virtual security products because true fail open means that you have some sort of physical relay or in the case of optical networks, mirrors that short circuit software to allow bits to bypass and flow around the software application.

"Fail Over" however is possible and customers are going to ask for the same things I believe when it comes to uptime on a virtual network as they do a physical network.

Take a look at the attached picture. It depicts a software solution that has two firewall type products running in Active / Passive.

CLICK PIC TO ENLARGE

So, as you are looking at security solutions for your virtual environment, you should ask the question of whether or not they provide any high availability and if so, what level of high availability. Active / Active, Active / Passive, Statefull, Stateless, and everything you've asked of your physical vendors.

My guess is that if you ask and they don't have it, they will start developing it and marketing its ability. Its a battle that cant be won completely. Customers will always want high availability be it virtual or physical.

Until the next post...

High Availability Security In Your Virtual Environment

Wed, 12 Mar 2008 18:41:15 +0000

How many times have security products been the blame for network outages? Many right?

Its the firewall.

I'd rather block all traffic until I know it was secure, but I live in a world where most people don't think like me. So.... Why the heck am I blogging about this in a virtualization blog?

Why wouldn't the networking guys demand that virtual security products have either "Fail Open" or what I feel is a better solution "Fail Over".

"Fail Over" however is possible and customers are going to ask for the same things I believe when it comes to uptime on a virtual network as they do a physical network.

Take a look at the attached picture. It depicts a software solution that has two firewall type products running in Active / Passive.

CLICK PIC TO ENLARGE

Until the next post...

Orphaned Symantec Root Certificates

Thu, 02 Aug 2007 11:12:18 +0000

For my recent column on code signing I took a close look at the Trusted Root Certificates dialog on one of my Vista systems and noticed something odd. The selected certificate is one of two Symantec certificates. Three things are of interest, and you can see the first two in the picture: The purposes for the certificate are "". Usually certificates are listed as being used for a more limited set of purposes, such as server authentication or code signing. Also note that the "Friendly Name" field is empty. This means that the certificate was a "roll your own" version generated by Symantec themselves rather than one issued by a trusted certificate authority like VeriSign or Thawte. But the really interesting thing is that there are no Symantec products on this system. There had been some on it but I removed them after they made the system unstable. I used the Norton Removal Tool, which is supposed to do a complete lobotomy on Symantec products on the system, to uninstall them. (Symantec conceded that the problem was caused initially by a bad update they pushed down. By the time a fix was issued I was already fed up and removed the software.) So it looks like the Norton Removal Tool leaves the certificates on the system. This is probably not that much of a risk, although it would be better if the certificates weren't there (I'll remove them myself later). The attack scenario, I guess, is that someone at Symantec loans their private key to their brother-in-law who uses it to sign malware.which shows up to the user as having been signed by Symantec. Not likely I guess. It does underscore how, to trust a signature, you really need to look up the certification path. Since it's unrealistic to expect normal users to do that the system as a whole (at least on 32-bit Windows) is disappointing. Things are a little different on 64-bit Windows.

Disable Your Computer's Parasites

Wed, 01 Aug 2007 15:23:00 +0000

Disable Your Computer's Parasites

An individual who uses a computer with an Internet connection pretty much practices caution when downloading programs from the Internet and email because of the threat of viruses and worms. These malicious program codes and programs can cause your system to become unstable and worse yet, after it has spread within your system, it further infects other systems connected to yours.

This is why any sensible computer user has anti virus programs installed in one's computer for protection against attacks from viruses and worms that proliferate the Internet. The good thing about viruses and worms is the fact that it is easier to spot them trying to get into your system. For instance, a virus or worm can try to enter your system through a suspicious attachment usually from an unknown source. By now, most Internet users know better than to open suspicious attachments. Also, rigorous anti virus programs can scan attachments before you can open them so that your risk against viruses and worms are properly managed.

However, as an Internet user, you have more to worry about than viruses and worms. Unfortunately, anti virus programs are not designed to detect other types of threats and if you are not careful, you may unwittingly install adware and spyware into your system and once this happens, uninstalling these programs can become problematic. For one thing, most spyware can go undetected in your system. You will continue on your regular computer and Internet habits without realizing that your privacy is immensely violated and your security is greatly hindered.

Since spyware can go undetected and you can continue to use your computer and the Internet as usual, there is no need to worry about uninstalling spyware, right?
Wrong.

Spyware in mild cases infringes on your privacy because it can track and take note of your usage patterns and these information are reported back to the company that created the spyware so that they can build marketing profiles. More than that though, some spyware have the ability to register and take note of key strokes, scan documents within your computer's hard drive, and can steal your passwords and other sensitive information that can make you the victim of identity theft and other situations where your personal information can be used to compromise your security.

On the other hand, adware is used by companies to infect your computer with unsolicited ads. The most problematic kinds are the ones that indiscriminately pop ads on to your screen even if you are not viewing their site or using the parent program that launched the adware. In fact, in some cases, adware continues to work into your system long after you uninstalled the program it came bundled with.

Given the security risks, the invasion of your right to privacy, and the annoying effects of spyware and adware, you will be wise to uninstall these programs from your computer. However, to uninstall adware and spyware from your system is not such a simply task.

For one thing, companies that proliferate the Internet with spyware and adware go to great lengths to ensure that uninstalling them from your system can be difficult. For instance, in most cases, you will be unable to use legitimate software if you attempt to uninstall the adware or spyware it comes bundled with. Adware and spyware are usually bundled with legitimate freeware or shareware and cannot run independently of each other.

Why the Need to Remove Adware and Spyware

Wed, 01 Aug 2007 15:18:00 +0000

Why the Need to Remove Adware and Spyware

Spyware and adware removal nowadays is just a matter of choosing a well equipped anti-spyware program or utility. You install the software into your system and will scan and delete or quarantine spyware and adware programs that were secretly installed in your computer.

The proliferation of spyware and adware programs in the internet has lead an established and highly developed anti-spyware industry. As long as disgruntled internet users abound, the anti-spyware companies will continue to create utilities that will combat the onslaught of spyware and adware on your computers.

Basically a spyware program infects the computer through whatever files a user downloads from the internet. Adware and spyware attaches themselves on these files and can rapidly spread throughout the computer's operating system. The sypware will commonly records information like IP addresses, credit card numbers, lists websites you visit and so on.

But as the spyware infects and spreads your computer, it installs components which affect the overall performance of the computer. They can also cause a degradation of the system resulting to unwanted CPU activity, inappropriate disk usage, and problems with network traffic. All these will cause your computer to low down. It will eventually become unstable and will cause software crashes and will sometimes prevent you from connecting to your networks and to the internet.

Some spyware programs are quite obvious but others are more covert, operating undetected by the user. When problems occur in the computer's operating system, because these spywares are undetectable by ordinary means, users tend to believe that the problems were brought about by problems in the hardware or by a computer virus. But all the while, a spyware program is the one causing the ruckus.

More often not, a computer will be infected with more than one spyware program and have various components installed. Recent studies indicate that when one finds a spyware program installed in his computer, chances are dozens of the components of that spyware is installed all over the computer's system.

And as the number of spyware programs and its components increase, users will encounter problems like computer slowing its functions to a crawl. Other spyware programs are more notorious. Some spyware will disable the computer's firewall system or anti-virus software thus making the computer more vulnerable to spyware, adware and other infectious attacks.

Microsoft Windows platform users are more susceptible from these spyware and adware attacks. Probably because of the popularity of Windows which makes them an attractive and profitable target for spyware agents. Likewise, because of the tight knit Internet Explorer and Windows enjoy, IE users will most likely get an infection from spyware and adware than users of other internet browsers like FireFox.

Meanwhile other computer users are changing to Linux or Apple Macintosh platforms which appear to be less attractive to spyware and adware agents. These two platforms works on Unix underpinnings which restricts access to the operating system unlike with Windows.

It is quite unfortunate and rather irritating that spyware and adware programs grew and developed in the World Wide Web. But we cannot do anything about it now. What we can do is protect ourselves from their attacks by being cautious and by conducting regular spyware scanning and removals as well as performing regular updating of anti-virus and anti-spyware software to ensure that our computers are free from the annoying and damaging spyware.