<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: utah]]></title>
    <link>http://securityratty.com/tag/utah</link>
    <description></description>
    <pubDate>Fri, 14 Mar 2008 07:39:01 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Judgment favors Novell in ongoing SCO case]]></title>
      <link>http://securityratty.com/article/96bfa437341bf9601536ce45152a3e27</link>
      <guid>http://securityratty.com/article/96bfa437341bf9601536ce45152a3e27</guid>
      <description><![CDATA[Another chapter in the lengthy legal saga between SCO and Novell is closed, with the release of a final judgment by a Utah court on...]]></description>
      <content:encoded><![CDATA[Another chapter in the lengthy legal saga between SCO and Novell is closed, with the release of a final judgment by a Utah court on Thursday.<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:4ff28c707cf46d8d506beaaf53841a5d:M9YdWEukrtUA%2F9z%2BPzsK5i9gm9d0IdMS1RRjPx4Pl6maRgJUv%2FB1LnaM46GapNSZlZKKhbdAoLdq'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:5e912ec1d7789ff090d1d906d570124b:%2BGH87alV0EsjGBC3v9xO6yeguUql8CN1Gd7mh6Hm4X4W%2FlLIwzN4Xyp0joptHlPUeNs61B7pG6QUgw%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:d9ac2223cc5f3246d1d4df250c23fa9d:qZwrHhrUgtOA%2FfJKgt2Tb%2BPTKF5AH%2Be5L%2FiZJgzuYKnRsWeHVdx%2F6tRZZXMhQ6lsFX%2B%2FgR1nfb%2BL2Q%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:7ee59097baad0ddff832e14986688268:ZZftZlmJzEl2Y3Z%2BPgf6Lzp5vLF4sl0rcXYOahdqN3y65l1Pl6JEm0mq9Mx2cQO04nx98SJpwW5T%2Bw%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=1aff7d4078665299738babffd3ab6be7&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=1aff7d4078665299738babffd3ab6be7&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=1aff7d4078665299738babffd3ab6be7" style="display: none;" border="0" height="1" width="1" alt=""/>
]]></content:encoded>
      <pubDate>Fri, 21 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/lengthy legal saga">lengthy legal saga</category>
      <category domain="http://securityratty.com/tag/final judgment">final judgment</category>
      <category domain="http://securityratty.com/tag/sco">sco</category>
      <category domain="http://securityratty.com/tag/utah court">utah court</category>
      <category domain="http://securityratty.com/tag/novell">novell</category>
      <category domain="http://securityratty.com/tag/chapter">chapter</category>
      <category domain="http://securityratty.com/tag/release">release</category>
      <category domain="http://securityratty.com/tag/thursday">thursday</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=1aff7d4078665299738babffd3ab6be7">Judgment favors Novell in ongoing SCO case</source>
    </item>
    <item>
      <title><![CDATA[Utah's FrontRunner Commuter Rail Unwired]]></title>
      <link>http://securityratty.com/article/c32729dbad65ab09b47b60140c9883c3</link>
      <guid>http://securityratty.com/article/c32729dbad65ab09b47b60140c9883c3</guid>
      <description><![CDATA[The newly launched 40-mile commuter rail line, FrontRunner, goes official with its free Wi-Fi: Nomad Digital, one of the longest-established firms providing connectivity to trains, has unwired the 12...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/train.jpg" align="right" border="0" hspace="5" /><strong>The newly launched 40-mile commuter rail line, FrontRunner, goes official with its free Wi-Fi:</strong> Nomad Digital, one of the longest-established firms providing connectivity to trains, has unwired the 12 double-decker trains on this new line, which opened for service in late April. About 1,000 passengers ride the route from Ogden to Salt Lake City each day (as of mid-May), and the service logged 700 users per day just a few days ago. Speeds aren't noted. Nomad worked with local firm Wasatch Electric and uses Redline gear. (The press release isn't up at this writing, nor has either the rail authority nor Nomad's site been updated.)</p>

<p>That's an insanely large percentage of riders using the service, so it's possible ridership has increased even more than the mid-May figures indicate, or the commuters are really intense computer and handheld users. Also, note that the FAQ for the authority's overall Wi-Fi service <a href="http://www.rideuta.com/ridingUTA/amenities/faq.aspx"><strong>requires you to be 18 years or older</strong></a>. It is Utah, after all--a minor might do something dirty with the service and the transit authority would be held responsible. The authority offers Wi-Fi on some buses, too.</p>

<p>The network is backed by fiber that runs alongside the track, which can make a huge difference in the ability to bring in backhaul. Other train lines have to work with either or both cellular and satellite backhaul, although Nomad typically uses fixed WiMax, as they are in this deployment. They're finishing up a 600 km London to Glasgow route for Virgin in the UK, which will be vastly larger than any other Internet-equipped route in the world.</p>

<p>This is one of the first major production service launches of train-based Wi-Fi in the U.S. VIA Rail in Canada is the only other in-production system offering in-transit Wi-Fi on a train line in North America. There are several trials, pilots, and phased-in plans underway. I thought 2007 would be the year that train-based Internet access took off; looks like it will leave the station worldwide in 2009, perhaps due to better 3G cell cover and improved antenna designs, as well as new commuter rail systems like FrontRunner that are designed with the idea of connectivity.</p>]]></content:encoded>
      <pubDate>Fri, 13 Jun 2008 09:34:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi service requires">wi-fi service requires</category>
      <category domain="http://securityratty.com/tag/rail">rail</category>
      <category domain="http://securityratty.com/tag/rail authority">rail authority</category>
      <category domain="http://securityratty.com/tag/authority">authority</category>
      <category domain="http://securityratty.com/tag/in-transit wi-fi">in-transit wi-fi</category>
      <category domain="http://securityratty.com/tag/free wi-fi">free wi-fi</category>
      <category domain="http://securityratty.com/tag/authority offers wi-fi">authority offers wi-fi</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <source url="http://wifinetnews.com/archives/008358.html">Utah's FrontRunner Commuter Rail Unwired</source>
    </item>
    <item>
      <title><![CDATA[2.2 million billing records missing on stolen backup tape]]></title>
      <link>http://securityratty.com/article/5c8436d56efb6533033af7a1ca7f75d9</link>
      <guid>http://securityratty.com/article/5c8436d56efb6533033af7a1ca7f75d9</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/10/08

Organization
University of Utah

Contractor/Consultant/Branch
University of Utah Hospitals &amp; Clinics
Perpetual Storage, Inc

Victims
Patients
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/uhc.jpg" align="right" height="49" width="201"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>6/10/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.utah.edu/portal/site/uuhome/">University of Utah</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://healthcare.utah.edu/index.cfm">University of Utah Hospitals &amp; Clinics</a> <br><a href="http://www.perpetualstorage.com/index_home.htm">Perpetual Storage, Inc.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>"approximately 2.2 million"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, related demographic information and diagnostic codes" additionally, "Records for a subset of 1.3 million patients also contained Social Security numbers"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"SALT LAKE CITY (AP) - Billing records of 2.2 million patients at the University of Utah Hospitals and Clinics were stolen from a vehicle after a courier failed to immediately take them to a storage center"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://healthcare.utah.edu/publicaffairs/news/current/billing_theft.html">University of Utah Hospitals &amp; Clinics</a> <br><a href="http://www.sltrib.com/ci_9540210">The Salt Lake Tribune</a> <br><a href="http://www.kutv.com/content/news/local/story.aspx?content_id=76de0817-3ffe-4f8e-9764-506795954fa1">Associated Press via KUTV Channel 2 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>University of Utah Hospitals &amp; Clinics<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>SALT LAKE CITY (AP) - Billing records of 2.2 million patients at the University of Utah Hospitals and Clinics were stolen from a vehicle after a courier failed to immediately take them to a storage center<br><span style="font-style: italic;">[Evan] There is no mention of encryption in any of the news reports I have read regarding this breach, so I am going to go ahead and assume that it was not used.&nbsp; As you read through the publicly available details of this breach below, you will probably agree that the courier driver made an idiotic mistake that he almost certainly regrets, but the University of Utah Hospitals &amp; Clinics is the custodian of this information that should have identified the risks involved with transporting confidential patient records off-site.&nbsp; One of those risks is the possibility that a backup tape may become lost of stolen, which is obviously the case in this breach.&nbsp; Where were preventative controls to account for this unacceptable (in most cases) risk, like encryption?</span><br><br>The records, described only as backup information tapes, contained Social Security numbers of 1.3 million people treated at the university over the last 16 years<br><br>people would be notified by a letter at a cost of $500,000 just for stamps and envelopes<br><span style="font-style: italic;">[Evan] How much would it have cost to encrypt the information on the tapes?&nbsp; The State of Utah has an exemption in their breach notification law for encrypted information.</span><br><br>The hospital also pledged free credit monitoring<br><br>The records were in a gray metal box<br><br>The courier, whose name was not released, picked them up in his Ford Explorer on June 1<br><br>instead of driving directly to a storage center, he worked a second job and then went home<br><span style="font-style: italic;">[Evan] This is the idiotic mistake I was writing about earlier.</span><br><br>The next day, he discovered that someone had broken into his Ford Explorer outside his Kearns home and taken the box<br><br>The driver worked for Perpetual Storage Inc. for 18 years and was fired.<br><br>Authorities declined to say how easy or difficult it would be to read the records.<br><br>The sheriff believes the thief probably thought the box contained money.<br><span style="font-style: italic;">[Evan] What it contains could probably be turned into a helluva lot of money!</span><br><br>"The investigation indicates that the theft was probably a random car burglary, and there is no evidence that the information on the tapes has been accessed or used for identity theft," said Salt Lake County Sheriff Jim Winder.<br><span style="font-style: italic;">[Evan] Eight days (June 2nd - June 10th) is probably a little too soon for evidence to appear of identity theft.</span><br><br>There's no evidence any of the information on the tapes has been accessed; besides, anyone trying to use the tapes would need specialized equipment to view the contents, Winder said.<br><span style="font-style: italic;">[Evan] Specialized equipment like a tape drive?</span><br><br>Eighty percent of the 2.2 million people live in Utah or Idaho, Betz said. The hospital is offering a $1,000 reward for the records. (Lorris Betz, M.D., Ph.D, Senior Vice President for Health Sciences)<br><br>The University of Utah Hospitals &amp; Clinics is offering a $1,000 reward for the return of the tapes, no questions asked.&nbsp; Those wishing to claim the reward may call the Sheriff’s Department at (801) 743-7000.<br>[Evan] To think of this in pure financial terms.&nbsp; A person could return the tape for $1,000 or could access the tape, sell the information and make maybe $5,000.000+.&nbsp;&nbsp;&nbsp; Maybe a good preventative control for organizations is to assume that criminals are stupid as part of your risk management program (seriously though, it's not).</font><br><font size="2"><br>"We understand this is unwelcome news to our patients," said Betz.<br><br>The university had worked with Perpetual Storage for 12 years before the theft<br><br>The University of Utah Hospitals &amp; Clinics has suspended deliveries of backup tapes to Perpetual Storage pending the review of all procedures and protocols for transporting and storing backup data.<br><br>Additionally, the health-care system is taking the following steps on behalf of its 2.2 million patients.<br></font><ul><li><font size="2">Mailing notification letters to all 2.2 million patients and guarantors;</font></li><li>Providing free credit monitoring and restoration service to patients whose records included Social Security numbers;</li><li>Providing a toll-free information line at 1-866-581-3599 to respond to questions; and</li><li>Establishing a website at <a href="http://healthcare.utah.edu/billingrecordstheft">healthcare.utah.edu/billingrecordstheft</a> that provides information and resources.<br></li></ul><font size="2"><br><span style="font-weight: bold;">Victim Reaction:</span><br>Tuesday's news was especially unsettling for people like Will Taylor, of West Valley City, whose premature daughter is a patient at University Hospital. Taylor has already been the victim of identity theft once, when thieves racked up credit card charges in his name. <br><br>"I will ask [the hospital] what precautions I can take and what they are doing about it," he said.<br><br>"If our information isn't safe, then what is?" patient Dan Christenson, of Salt Lake City, said Tuesday after learning of the theft. <br><br><span style="font-weight: bold;">Commentary:</span><br>I would be more understanding if this were the first breach ever reported where a backup was stolen that contained personal information, but it's not.&nbsp; Employing backup tapes without encryption is a very well documented risk, so why do large organizations still accept it? <br><br><span style="font-weight: bold;">Past Breaches:</span><br>March, 2008 - <a href="http://breachblog.com/2008/03/14/uhc.aspx">Stolen University Health Care laptop requires notification of 4800</a> </font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/06/11/uhc.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 11 Jun 2008 08:33:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/backup">backup</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/backup information tapes">backup information tapes</category>
      <category domain="http://securityratty.com/tag/million">million</category>
      <category domain="http://securityratty.com/tag/utah">utah</category>
      <category domain="http://securityratty.com/tag/million people live">million people live</category>
      <source url="http://breachblog.com/2008/06/11/uhc.aspx">2.2 million billing records missing on stolen backup tape</source>
    </item>
    <item>
      <title><![CDATA[Thieves steal tapes holding 2.2M billing records]]></title>
      <link>http://securityratty.com/article/1c25fa2ae1fefe4f1ef18ea3eba16bea</link>
      <guid>http://securityratty.com/article/1c25fa2ae1fefe4f1ef18ea3eba16bea</guid>
      <description><![CDATA[University of Utah officials this week acknowledged that a metal box of backup tapes containing billing records of some 2.2 million patients was stolen early this month from the car of a courier who...]]></description>
      <content:encoded><![CDATA[University of Utah officials this week acknowledged that a metal box of backup tapes containing billing records of some 2.2 million patients was stolen early this month from the car of a courier who left it in a parked car overnight outside his home.]]></content:encoded>
      <pubDate>Tue, 10 Jun 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/car">car</category>
      <category domain="http://securityratty.com/tag/car overnight">car overnight</category>
      <category domain="http://securityratty.com/tag/utah officials">utah officials</category>
      <category domain="http://securityratty.com/tag/records">records</category>
      <category domain="http://securityratty.com/tag/million patients">million patients</category>
      <category domain="http://securityratty.com/tag/backup tapes">backup tapes</category>
      <category domain="http://securityratty.com/tag/metal box">metal box</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/month">month</category>
      <source url="http://www.networkworld.com/news/2008/061108-thieves-steal-tapes-holding-22m.html?fsrc=rss-security">Thieves steal tapes holding 2.2M billing records</source>
    </item>
    <item>
      <title><![CDATA[Wee-Fi: Go, Go, Wires! Go, Go, Cablevision!]]></title>
      <link>http://securityratty.com/article/cdedd3da82c24f62b8e4ae94b3d799f1</link>
      <guid>http://securityratty.com/article/cdedd3da82c24f62b8e4ae94b3d799f1</guid>
      <description><![CDATA[OSnews explains why wiring a house still makes sense in the 21st century c.e.: A very well-reasoned article from OSnews explains why the site still backs residential wiring. They're involved in the...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/weefi.jpg" align="right" border="0" hspace="5" /><a href="http://www.osnews.com/story/19748/Wired_vs_Wireless:_Sometimes_Theres_No_Substitute_for_a_Cable"><strong>OSnews explains why wiring a house still makes sense in the 21st century c.e.:</strong></a> A very well-reasoned article from OSnews explains why the site still backs residential wiring. They're involved in the build-out of a Utah home partly as a technology demonstration, and they've put coax and Cat 5E Ethernet cable throughout, as well as conduits for future wire pulls. Fundamentally, wire has more capacity; I'd argue it does across several dimensions, too. You can run 1 Gbps raw across a Cat 5E or 6 Ethernet cable <em>in both directions at the same time</em> versus best performance of unidirectional nearly 100 Mbps in my testing of Draft N. But you also get switching with Ethernet--multiple simultaneous symmetrical 1 Gbps--and if you need more capacity you simply pull more wires and put in more switches. Wire is cheap and switches are now, too. It's a good read if you're thinking of rewiring (or unwiring) your home.</p>

<p><a href="http://www.cablerant.com/index.php?topic=697.0"><strong>Cablevision's already started its rollout:</strong></a> An observant tri-stater at the Cable Rant site spotted Cablevision installers putting up BelAir gear on their cable line. He took some photos.</p>]]></content:encoded>
      <pubDate>Fri, 16 May 2008 07:12:08 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cablevision">cablevision</category>
      <category domain="http://securityratty.com/tag/ethernet cable">ethernet cable</category>
      <category domain="http://securityratty.com/tag/future wire pulls">future wire pulls</category>
      <category domain="http://securityratty.com/tag/wire">wire</category>
      <category domain="http://securityratty.com/tag/ethernet">ethernet</category>
      <category domain="http://securityratty.com/tag/utah home partly">utah home partly</category>
      <category domain="http://securityratty.com/tag/cable rant site">cable rant site</category>
      <category domain="http://securityratty.com/tag/home">home</category>
      <category domain="http://securityratty.com/tag/osnews explains">osnews explains</category>
      <source url="http://wifinetnews.com/archives/008323.html">Wee-Fi: Go, Go, Wires! Go, Go, Cablevision!</source>
    </item>
    <item>
      <title><![CDATA[McAfee's open source statements are fighting words to Matt Asay]]></title>
      <link>http://securityratty.com/article/12adc07c3754f5d82ae8755be3b4610d</link>
      <guid>http://securityratty.com/article/12adc07c3754f5d82ae8755be3b4610d</guid>
      <description><![CDATA[Matt Asay has become rather predictible. Say anything negative at all about open source and out comes the Utah bulldog from the dog house straining to break free of his leash. Now Matt is saying that...]]></description>
      <content:encoded><![CDATA[<p><img title="Bulldog" alt="Bulldog" src="http://www.stillsecureafteralltheseyears.com/photos/uncategorized/2008/04/14/bulldog.jpg" border="0" style="FLOAT: left; MARGIN: 0px 5px 5px 0px"></img> Matt Asay has become rather predictible. Say anything negative at all about open source and out comes the Utah bulldog from the dog house straining to break free of his leash. Now Matt is <a href="http://www.cnet.com/8301-13505_1-9917989-16.html#comments">saying that the McAfee folks have libeled open source</a> in a recent white paper they released on botnets. Here is the quote in question:</p><blockquote><p><em>Taking the bot controller ofﬂine may kill a botnet. As a result, many bots use a Dynamic Domain Name System (DDNS) or have a list of backup IP addresses to survive such an event. Bot technology is rapidly evolving, <strong>often aided and abetted, unfortunately, by the open-source movement</strong>. [Emphasis Matt's.]<br></em></p></blockquote><p>So Matt does his due dilligence and cannot find any evidence to back up what McAfee says. On top of this Matt remembers that McAfee said in in a recent financial statement that <a href="Taking%20the%20bot%20controller%20of%C3%AF%C2%AC%C2%82ine%20may%20kill%20a%20botnet.%20As%20a%20result,%20many%20bots%20use%20a%20Dynamic%20Domain%20Name%20System%20%28DDNS%29%20or%20have%20a%20list%20of%20backup%20IP%20addresses%20to%20survive%20such%20an%20event.%20Bot%20technology%20is%20rapidly%20evolving,%20often%20aided%20and%20abetted,%20unfortunately,%20by%20the%20open-source%20movement.%20%5BEmphasis%20mine.%5D">open source licensing is a threat to its business</a> (again these are Matt's words). From there Matt looks up botnets in Wikipedia or some other such place and finds out that botnets are mostly installed on Windows machines. Well that is all this open source watchdog needs to get him going! Of course Windows gets more botnets, after all it is not as secure or as good and the people who use it are not as smart as Linux, the darling of the open source crowd.</p>

<p>So here is my problem with Matt's positions. Number one on the white paper, I don't think McAfee was talking about Linux versus Windows at all (as much as Matt would like to think so). I think McAfee is referring to open source applications like dynamic domain name systems (DDNS) and other open source enabling technologies. There is more to open source than Linux Matt. McAfee is saying that hackers are using the same open source components and network enablers that many legitimate applications are using, to make more effective and dangerous malware. The open source crowd is not doing it on purpose, but it is being used. What is the big deal here. Matt don't you agree that people can use tools for good and bad. Just because it is open source does not mean it cannot be abused or used for malicous purposes. Stop being so sensitive Matt!</p>

<p>Further on McAfee's earlier statement about open source licensing being a threat. Come on guys. It was boiler plate provisions that some of the applications and products that McAfee itself sells contain open source components. Depending how and when a real court ever interperts OSI licenses like the GPL it could have a profound impact on McAfee's business. It could have a profound impact on a lot of businesses for that matter.</p>

<p>Bottom line Matt, I think you are barking up the wrong tree here. Why not head back to the doghouse and wait for the next unsuspecting stranger to walk by and who tries to say anything bad about open source. Me, I think I will appreciate all of the good that open source brings, but realize it can be used as an agent for evil as well.</p>
<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=6hWnh7"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=6hWnh7" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=9BiZrOG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=9BiZrOG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=mQri3kG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=mQri3kG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=ZFSlaAG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=ZFSlaAG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=za9UFhG"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=za9UFhG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=lLkRMQg"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=lLkRMQg" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=YO9k2Pg"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=YO9k2Pg" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/270718783" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 15 Apr 2008 04:47:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/matt">matt</category>
      <category domain="http://securityratty.com/tag/source brings">source brings</category>
      <category domain="http://securityratty.com/tag/matt asay">matt asay</category>
      <category domain="http://securityratty.com/tag/source applications">source applications</category>
      <category domain="http://securityratty.com/tag/linux">linux</category>
      <category domain="http://securityratty.com/tag/linux versus windows">linux versus windows</category>
      <category domain="http://securityratty.com/tag/source watchdog">source watchdog</category>
      <category domain="http://securityratty.com/tag/mcafee">mcafee</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/270718783/mcafees-open-so.html">McAfee's open source statements are fighting words to Matt Asay</source>
    </item>
    <item>
      <title><![CDATA[Charting a Landscape with Wi-Fi Signals]]></title>
      <link>http://securityratty.com/article/434db1e308ede3a31239935afee5bd55</link>
      <guid>http://securityratty.com/article/434db1e308ede3a31239935afee5bd55</guid>
      <description><![CDATA[Driving, biking, and walking to gain a sense of Wi-Fi geographies: Paul Torrens wore out the patience of his friends and family, but gathered 500,000 Wi-F samples across a 12 sq km area of Salt Lake...]]></description>
      <content:encoded><![CDATA[<p><strong><a href="http://www.geosimulation.org/wifi/">Driving, biking, and walking to gain a sense of Wi-Fi geographies:</a></strong> Paul Torrens wore out the patience of his friends and family, but gathered 500,000 Wi-F samples across a 12 sq km area of Salt Lake City, Utah, for his paper "<strong><a href="http://www.informaworld.com/smpp/content?content=10.1080/00045600701734133">Wi-Fi Geographies</a></strong>," published in the 1 March 2008 issue of Annals of the Association of American Geographers. (The paper can be downloaded for a fee, but may be available through local public or academic libraries, too.)</p>

<p>In an interview recently, Dr. Torrens, an assistant professor at Arizon State University in the School of Geographical Sciences, said that he used his extended family to help him gather the data necessary to draw real conclusions. "Any time they were going anywhere, I got them to stick the rig to their car."</p>

<p>Dr. Torrens said that he decided to attack Wi-Fi because it was hard in the geographic field to find a subject area that hadn't been throughly explored, and that his interest in patterns and process over a landscape led him to Wi-Fi. His exploration looked at Wi-Fi as a topology overlaying population, demographics, and architecture.</p>

<p><a href="http://wifinetnews.com/images/torrens_AP_density.jpg"><img src="http://wifinetnews.com//images/2008/torrens_AP_density_small.jpg" alt="torrens_AP_density_small.jpg" border="0" width="200" height="133" align="right" /></a>In examining the literature to see if scholarly research had been carried out, he found a lot of wardriving details, but not a lot of accuracy or analysis. The maps of Wi-Fi coverage that are out there "rely on people going out and wardriving and submitting the data to some sort of online repository," Dr. Torrens said. While they may use GPS for timestamping and logging samples, "Unless you really know what you're doing with it, it provides very weak spatial accuracies [and] positional accuracies." </p>

<p>Dr. Torrens said, "I was able to come up with a much better accuracy." Some of his work is patented, and he said that while the university assembled the materials to file against his work, he remained a bit quiet about it. (As with most universities these days, ASU actively seeks to patent and license research as one means of funding the university's future.)</p>

<p>The data that he found in wardriving databases didn't account for quality, very few samples had timestamps, and where he found huge clusters, it didn't account for the timeframe, and thus was hard to tell whether the clusters existed at the same point in time. Dr. Torrens was collecting his data in 2005; wardriving databases may have improved in that time.</p>

<p>Dr. Torrens said that using techniques from the field, he could associate samples together, determining whether a cluster was legitimately such, or an abberration in the data--"whether a cluster is a cluster," in other words.</p>

<p>The research revealed some expected results, such as an extremely high number of access points in the most densely inhabited parts of town, but Dr. Torrens said he didn't expect to find that less-populated parts of town would also have a nearly ubiquitous spread of nodes. One area "that's relatively underpopulated is a whole warehouse district," he said, and they had lots of access points. </p>

<p>In the least-covered areas of the city, about seven access points were "visible"; in some places, that number was as high as 43 access points.</p>

<p>Also interesting to note was that security was most frequently enabled on Wi-Fi nodes in the parts of town dominated by students, who obviously had the technical jobs and understanding to prevent others from gaining access to their networks.</p>

<p>Dr. Torrens may carry out more Wi-Fi related geographic research, but that partly depends on having the resources or capability to gather information on a large scale. He'd love to gather live data that would allow him to show patterns as they change across the time of day or over a period of time.</p>

<p>"What I would like to do is to look at a temporal snapshot of the city, to look at how the Wi-Fi cloud is changing over time, over the course of a week," he said. "What is the temporal topography, the space-time topography of a city."</p>

<p>"To collect this kind of data set in real time would require a couple hundred thousand people with iPhones, citizen volunteers," he noted, but that might be possible with the capabilities of an iPhone software toolkit, promised by Apple in June, or through data sets gathered by firms like Skyhook Wireless.<br />
</p>]]></content:encoded>
      <pubDate>Mon, 14 Apr 2008 09:55:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi geographies">wi-fi geographies</category>
      <category domain="http://securityratty.com/tag/gather live data">gather live data</category>
      <category domain="http://securityratty.com/tag/gather">gather</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/wi-fi cloud">wi-fi cloud</category>
      <category domain="http://securityratty.com/tag/data sets">data sets</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/space-time topography">space-time topography</category>
      <source url="http://wifinetnews.com/archives/008274.html">Charting a Landscape with Wi-Fi Signals</source>
    </item>
    <item>
      <title><![CDATA[Overestimating Threats Against Children]]></title>
      <link>http://securityratty.com/article/1e066e0d1ba135d3a1c23ef42d97cbd4</link>
      <guid>http://securityratty.com/article/1e066e0d1ba135d3a1c23ef42d97cbd4</guid>
      <description><![CDATA[This is a great essay by a mom who let her 9-year-old son ride the New York City subway alone: No, I did not give him a cell phone. Didn't want to lose it. And no, I didn't trail him, like a mommy...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.nysun.com/editorials/why-i-let-my-9-year-old-ride-subway-alone">This</a> is a great essay by a mom who let her 9-year-old son ride the New York City subway alone:</p>

<blockquote>No, I did not give him a cell phone. Didn't want to lose it. And no, I didn't trail him, like a mommy private eye. I trusted him to figure out that he should take the Lexington Avenue subway down, and the 34th Street crosstown bus home. If he couldn't do that, I trusted him to ask a stranger. And then I even trusted that stranger not to think, "Gee, I was about to catch my train home, but now I think I'll abduct this adorable child instead."

<p>Long story short: My son got home, ecstatic with independence.</p>

<p>Long story longer, and analyzed, to boot: Half the people I've told this episode to now want to turn me in for child abuse. As if keeping kids under lock and key and helmet and cell phone and nanny and surveillance is the right way to rear kids. It's not. It's debilitating -- for us and for them.</blockquote></p>

<p>It's amazing how our fears blind us.  The mother and son appeared on <i>The Today Show</i>, where they both <a href="http://www.msnbc.msn.com/id/23935873/">continued to explain</a> why it wasn't an unreasonable thing to do:</p>

<blockquote>And that was Skenazy's point in her column: The era is long past when Times Square was a fetid sump and taking a walk in Central Park after dark was tantamount to committing suicide. Recent federal statistics show New York to be one of the safest cities in the nation -- right up there with Provo, Utah, in fact.

<p>"Times are back to 1963," Skenzay said. "It's safe. It's a great time to be a kid in the city."</p>

<p>The problem is that people read about children who are abducted and murdered and fear takes over, she said. And she doesn't think fear should rule our lives.</blockquote></p>

<p>Of course, <i>The Today Show</i> interviewer didn't get it:</p>

<blockquote>Dr. Ruth Peters, a parenting expert and TODAY Show contributor, agreed that children should be allowed independent experiences, but felt there are better -- and safer -- ways to have them than the one Skenazy chose.

<p>"I'm not so much concerned that he's going to be abducted, but there's a lot of people who would rough him up," she said. "There's some bullies and things like that. He could have gotten the same experience in a safer manner."</p>

<p>"It's safe to go on the subway," Skenazy replied. "It's safe to be a kid. It's safe to ride your bike on the streets. We're like brainwashed because of all the stories we hear that it isn't safe. But those are the exceptions. That's why they make it to the news. This is like, 'Boy boils egg.' He did something that any 9-year-old could do."</blockquote></p>

<p>Here's an <a href="http://www.wnyc.org/shows/bl/episodes/2008/04/02/segments/96153">audio interview</a> with Skenazy.</p>

<p>I am reminded of <a href="http://img.dailymail.co.uk/i/pix/2007/06_02/playgraphicDM1406_736x800.jpg">this great graphic</a> depicting childhood independence diminishing over four generations.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lunc4oG"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lunc4oG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ZKHHvHG"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ZKHHvHG" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 10 Apr 2008 09:00:16 +0000</pubDate>
      <category domain="http://securityratty.com/tag/subway">subway</category>
      <category domain="http://securityratty.com/tag/lexington avenue subway">lexington avenue subway</category>
      <category domain="http://securityratty.com/tag/york city subway">york city subway</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/skenazy">skenazy</category>
      <category domain="http://securityratty.com/tag/skenazy chose">skenazy chose</category>
      <category domain="http://securityratty.com/tag/safe">safe</category>
      <category domain="http://securityratty.com/tag/york">york</category>
      <category domain="http://securityratty.com/tag/9-year-old">9-year-old</category>
      <source url="http://www.schneier.com/blog/archives/2008/04/overestimating.html">Overestimating Threats Against Children</source>
    </item>
    <item>
      <title><![CDATA[Utah Department of Administrative Services reports web site breach]]></title>
      <link>http://securityratty.com/article/883dd2dacd88c8bc868eb90194b1c1db</link>
      <guid>http://securityratty.com/article/883dd2dacd88c8bc868eb90194b1c1db</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
3/15/08

Organization
State of Utah

Contractor/Consultant/Branch
Department of Administrative Services
Division of Finance

Victims
Citizens

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/utahas.jpg" align="right" height="130" width="100">
<font size="2"><span style="font-weight: bold;">Date Reported: </span><br>3/15/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.utah.gov/">State of Utah</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://das.utah.gov/main/">Department of Administrative Services</a> <br><a href="http://finance.utah.gov/main/">Division of Finance</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Citizens<br><br><span style="font-weight: bold;">Number Affected:</span><br>~500<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Computer files containing the personal information of approximately 500 individuals may have been accessed by unauthorized persons during a security breach at the Utah Division of Finance."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://deseretnews.com/article/1,5143,695261923,00.html">Deseret Morning News</a> <br><a href="http://www.sltrib.com/news/ci_8580949">The Salt Lake Tribune</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The Salt Lake Tribune<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The personal information of nearly 500 people may have been hacked into at the Department of Administrative Services. <br><br>Computer files containing the personal information of approximately 500 individuals may have been accessed by unauthorized persons during a security breach at the Utah Division of Finance.<br><br>Officials there say it is highly unlikely that the perpetrator accessed the personal information, but the department is attempting to contact everyone whose information may have been breached. <br><span style="font-style: italic;">[Evan] Due to the fact that the individuals that were affected are the actual owners of the information in question, additional details are required so that they can judge the risk for themselves.</span><br style="font-style: italic;"><br>"We are now taking steps to determine the amount of information, if any, that was accessed by unauthorized persons. Utah attorney general special agents assigned to the Identity Theft Task Force are investigating this matter,"<br><br>The state withstands more than 100,000 potential attacks a day and the Department of Technology Services has stringent security policies in place.<br><span style="font-style: italic;">[Evan] I'm not sure why it this is important.&nbsp; 100,000 daily attacks is not really that much for any web site with a moderate presence on the internet.&nbsp; This number probably takes into account port scans and probes.&nbsp; I would guess that port scans, probes, scripts, and errant traffic account for 95+% of these attacks.&nbsp; It is good to read that Utah DTS is keeping tabs and blocking at the perimeter.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>There are few details available pertaining to this breach.&nbsp; I was unable to find the press release mentioned in the article(s). <br><br><span style="font-weight: bold;">Past Breaches:</span><br>State of Utah:<br>September, 2007 - <a href="http://breachblog.com/2007/09/24/utahdws.aspx">Stolen Utah Department of Workforce Services laptop exposes 2,000</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/17/utahas.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 17 Mar 2008 08:34:28 +0000</pubDate>
      <category domain="http://securityratty.com/tag/utah">utah</category>
      <category domain="http://securityratty.com/tag/utah department">utah department</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/utah division">utah division</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/department">department</category>
      <category domain="http://securityratty.com/tag/utah attorney">utah attorney</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/03/17/utahas.aspx">Utah Department of Administrative Services reports web site breach</source>
    </item>
    <item>
      <title><![CDATA[Stolen University Health Care laptop requires notification of 4800]]></title>
      <link>http://securityratty.com/article/e9555f16d1d087d7b85993176f2956f2</link>
      <guid>http://securityratty.com/article/e9555f16d1d087d7b85993176f2956f2</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
3/13/08

Organization
University of Utah

Contractor/Consultant/Branch
University Health Care

Victims
patients

Number Affected
4,800

Types of Data...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/uhc.jpg" align="right" height="49" width="201"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>3/13/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.utah.edu/portal/site/uuhome/">University of Utah</a><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://healthcare.utah.edu/index.cfm">University Health Care</a><br><br><span style="font-weight: bold;">Victims:</span><br>patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>4,800<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, social security numbers and personal health information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Possibly 4,800 patient’s information could be compromised, when a laptop with names, social security numbers and personal health information was stolen from University Healthcare"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.kutv.com/content/news/topnews/story.aspx?content_id=5843cde8-1fb5-4945-b396-df5b682ddbb4">KUTV Channel 2 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>KUTV Channel 2<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Possibly 4,800 patient’s information could be compromised, when a laptop with names, social security numbers and personal health information was stolen from University Healthcare over two weeks ago.&nbsp; <br><br>The hospital says that someone broke into a locked office and took a lap top and a flash drive.<br><br>The hospital does not believe that whoever stole the laptop was searching for the patient’s information.<br><span style="font-style: italic;">[Evan] What leads the hospital to believe this?&nbsp; There's no money in selling or using compromised confidential information, right?&nbsp; WRONG!</span><br><br>The hospital also says that the laptop is password protected and it is confident that the person who stole the laptop will not be able to access the information.<br><span style="font-style: italic;">[Evan] Seriously, remarks like this demonstrate complete information security incompetence.</span><br><br>The information on the laptop is varies for patients. Not all patients have social security numbers listed with the hospital.<br><br>University Healthcare began mailing out letters to people affected by the theft this week<br><br>The University Healthcare is trying to figure out which patients had information on that computer and what the information was. The hospital says that this process caused the notification delay.<br><span style="font-style: italic;">[Evan] Not knowing what confidential information is where is a very common problem in today's organizations.</span><br><br>University Healthcare is providing the 4800 patients with a year of free credit monitoring and is making changes in their policy.<br><span style="font-style: italic;">[Evan] I feel like doing some math.&nbsp; The cost for full disk laptop encryption, maybe $100 - 150.&nbsp; The cost for investigation of the breach (say 20 hours @ $100/hr.), reconstruction (say 20 hours @ $100/hr.), notification ($300 to draft letter and maybe $2,400 to address and mail), and credit monitoring ($15/mo. x 12 months x 4800 customers) might cost $870,000.&nbsp; Maybe the hospital didn't believe they would ever lose a laptop or have one stolen that contained sensitive information.&nbsp; Risk management anyone?!</span><br><br>Employees will no longer be allowed to download sensitive information onto laptops, even if they're password protected.<br><span style="font-style: italic;">[Evan] This is not the root of the problem.&nbsp; We have an information security governance and management problem.&nbsp; No easy fix. </span><br><br>University Healthcare apologizes for the problem and the notification delay.<br><br><span style="font-weight: bold;">Commentary:</span><br>It's Friday!&nbsp; I have some time on my hands, and I am getting tired of poor security of personal information.&nbsp; I go through phases.<br><br>One thing that is worth mentioning, we (meaning information security personnel) must go through the arduous task of data inventory and classification if we are to be effective.&nbsp; We should know what confidential information we create, collect, store, transfer, and/or destroy.&nbsp; We need to know where confidential information is throughout the lifecycle.&nbsp; We need to know what the threats are.&nbsp; We need to know what the vulnerabilities are.&nbsp; We need to know what the risks are.&nbsp; We need to know the costs of compromise (hard and soft dollars) when possible.&nbsp; We need to know the costs of protection.&nbsp; Maybe most importantly, we need to measure all of our efforts against the organizational goals and objectives.&nbsp; The list goes on and on and on.<br><br>If you are charged with securing your company's information assets, you need to understand that this is a serious business and not for the faint of heart.&nbsp; We don't just password protect and install firewalls for a living.&nbsp; We solve complex technical and political problems every day.&nbsp; If you need additional training (we all do) then get it.&nbsp; Don't look for shortcuts, because there aren't any.&nbsp; The dichotomy is that most effective solutions are simple and not complex.&nbsp; Simple sometimes gets confused with shortcut, but a shortcut is lazy.&nbsp; The money is good, but the challenges are GREAT.<br><br>OK, I've rambled enough.&nbsp; I'm stepping down from the podium now.&nbsp; Thanks for reading! <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/03/14/uhc.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 14 Mar 2008 07:39:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information assets">information assets</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/information security governance">information security governance</category>
      <category domain="http://securityratty.com/tag/patients information">patients information</category>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/information security personnel">information security personnel</category>
      <source url="http://breachblog.com/2008/03/14/uhc.aspx">Stolen University Health Care laptop requires notification of 4800</source>
    </item>
  </channel>
</rss>
