<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: view]]></title>
    <link>http://securityratty.com/tag/view</link>
    <description></description>
    <pubDate>Thu, 18 Sep 2008 10:59:47 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Trick or Treat]]></title>
      <link>http://securityratty.com/article/c004eff4c879f49ca081346223fc7909</link>
      <guid>http://securityratty.com/article/c004eff4c879f49ca081346223fc7909</guid>
      <description><![CDATA[October's here, and you can't escape the coming onslaught of Halloween. Children (and quite a few adults) dressed up as vampires, ghosts, goblins and other scary creatures, going around asking people...]]></description>
      <content:encoded><![CDATA[<p>October's here, and you can't escape   the coming onslaught of Halloween. Children (and quite a few adults) dressed up   as vampires, ghosts, goblins and other scary creatures, going around asking   people for treats and threatening them with tricks if they don't provide them. A   cynical person might boil it down to a a combination of scare tactics and   extortion. So what does this have to do with IT security and compliance?   Unfortunately, the way   security and compliance professionals have traditonally gone about obtaining   funds and resources for tools and projects necessary to do their jobs all too   closely parallels what happens on Halloween. <B>We frequently use scare tactics   such as new threats (the trick) to get management to cough up the funding and   resources (the treats) we need to accomplish what we view as our jobs...</b>]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/scare tactics">scare tactics</category>
      <category domain="http://securityratty.com/tag/compliance professionals">compliance professionals</category>
      <category domain="http://securityratty.com/tag/compliance">compliance</category>
      <category domain="http://securityratty.com/tag/resources">resources</category>
      <category domain="http://securityratty.com/tag/jobs">jobs</category>
      <category domain="http://securityratty.com/tag/closely parallels">closely parallels</category>
      <category domain="http://securityratty.com/tag/scary creatures">scary creatures</category>
      <category domain="http://securityratty.com/tag/treats">treats</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1361">Trick or Treat</source>
    </item>
    <item>
      <title><![CDATA[REALLY Cool Presentation: "Grand Challenges" of Log Management]]></title>
      <link>http://securityratty.com/article/6feebc7212f6d02443181f9d9e0283e9</link>
      <guid>http://securityratty.com/article/6feebc7212f6d02443181f9d9e0283e9</guid>
      <description><![CDATA[If you are into logs and, especially, into tools that deal with logs, read this . This is my attempt to summarize everything that is challenging about log processing and analysis into one...]]></description>
      <content:encoded><![CDATA[If you are into logs and, especially, into tools that deal with logs, read <a href="http://www.slideshare.net/anton_chuvakin/grand-challenges-of-log-management-presentation">this</a>.  This is my attempt to summarize everything that is challenging about log processing and analysis into one presentation,  <span style="font-weight: bold;">'"Grand Challenges" of Log Management.'</span>  Logs are fun, but they are also painful to deal with, and there are plenty of things that we need to address before we can consider ourselves "done."<br /><br />The presentation is also embedded below:<br /><br /><div style="width:425px;text-align:left" id="__ss_645029"><a style="font:14px Helvetica,Arial,Sans-serif;display:block;margin:12px 0 3px 0;text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/grand-challenges-of-log-management-presentation?type=powerpoint" title="&quot;Grand Challenges&quot; of Log Management">&quot;Grand Challenges&quot; of Log Management</a><object style="margin:0px" width="425" height="355"><param name="movie" value="http://static.slideshare.net/swf/ssplayer2.swf?doc=innovationlogmgtgrandproblemsrel-1223497009889980-8&stripped_title=grand-challenges-of-log-management-presentation" /><param name="allowFullScreen" value="true"/><param name="allowScriptAccess" value="always"/><embed src="http://static.slideshare.net/swf/ssplayer2.swf?doc=innovationlogmgtgrandproblemsrel-1223497009889980-8&stripped_title=grand-challenges-of-log-management-presentation" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object><div style="font-size:11px;font-family:tahoma,arial;height:26px;padding-top:2px;">View SlideShare <a style="text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/grand-challenges-of-log-management-presentation?type=powerpoint" title="View &quot;Grand Challenges&quot; of Log Management on SlideShare">presentation</a> or <a style="text-decoration:underline;" href="http://www.slideshare.net/upload?type=powerpoint">Upload</a> your own. (tags: <a style="text-decoration:underline;" href="http://slideshare.net/tag/logs">logs</a> <a style="text-decoration:underline;" href="http://slideshare.net/tag/logging">logging</a>)</div></div><br /><br />Enjoy!<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=loZtM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=loZtM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=1mlZM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=1mlZM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=SeNxM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=SeNxM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/415249699" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 08 Oct 2008 12:57:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/log management">log management</category>
      <category domain="http://securityratty.com/tag/log">log</category>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/grand challenges">grand challenges</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/deal">deal</category>
      <category domain="http://securityratty.com/tag/plenty">plenty</category>
      <category domain="http://securityratty.com/tag/fun">fun</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/415249699/really-cool-presentation-grand.html">REALLY Cool Presentation: "Grand Challenges" of Log Management</source>
    </item>
    <item>
      <title><![CDATA[Presentation from SANS 2008 Lunch and Learn in Las Vegas]]></title>
      <link>http://securityratty.com/article/9e013f4069a35954694c89f4bb3e700d</link>
      <guid>http://securityratty.com/article/9e013f4069a35954694c89f4bb3e700d</guid>
      <description><![CDATA[As promised , here is my infamous presentation on &quot;Log management 'Worst Practices'&quot; that I gave at SANS Network Security 2008 yesterday

This presentation can also be considered a sequel to my...]]></description>
      <content:encoded><![CDATA[As <a href="http://chuvakin.blogspot.com/2008/10/my-lunch-presentation-at-sans-network.html">promised</a>, <a href="http://www.slideshare.net/anton_chuvakin/antons-log-management-worst-practices-presentation">here </a>is my infamous presentation on "Log management 'Worst Practices'" that I gave at SANS Network Security 2008 yesterday.<br /><br />This presentation can also be considered a sequel to my <a href="http://www.slideshare.net/anton_chuvakin/choosing-your-log-management-approach-buy-build-or-outsource">"Choosing a Log Management Approach" presentation</a>, which was my previous SANS Lunch and Learn preso.<br /><br />If you are involved / about to be involved with logging, read both (<a href="http://www.slideshare.net/anton_chuvakin/choosing-your-log-management-approach-buy-build-or-outsource">first</a>, <a href="http://www.slideshare.net/anton_chuvakin/antons-log-management-worst-practices-presentation">second</a>)!<br /><br />It is also embedded below:<br /><br /><div style="width: 425px; text-align: left;" id="__ss_635093"><a style="margin: 12px 0pt 3px; font-family: Helvetica,Arial,Sans-serif; font-style: normal; font-variant: normal; font-weight: normal; font-size: 14px; line-height: normal; font-size-adjust: none; font-stretch: normal; display: block; text-decoration: underline;" href="http://www.slideshare.net/anton_chuvakin/antons-log-management-worst-practices-presentation?type=powerpoint" title="Anton's Log Management 'Worst Practices'">Anton's Log Management 'Worst Practices'</a><object style="margin: 0px;" width="425" height="355"><param name="movie" value="http://static.slideshare.net/swf/ssplayer2.swf?doc=sanslmworstpracticesd6oct2008-1223079958645247-8&amp;stripped_title=antons-log-management-worst-practices-presentation"><param name="allowFullScreen" value="true"><param name="allowScriptAccess" value="always"><embed src="http://static.slideshare.net/swf/ssplayer2.swf?doc=sanslmworstpracticesd6oct2008-1223079958645247-8&amp;stripped_title=antons-log-management-worst-practices-presentation" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object><div style="font-size: 11px; font-family: tahoma,arial; height: 26px; padding-top: 2px;">View SlideShare <a style="text-decoration: underline;" href="http://www.slideshare.net/anton_chuvakin/antons-log-management-worst-practices-presentation?type=powerpoint" title="View Anton's Log Management 'Worst Practices' on SlideShare">presentation</a> or <a style="text-decoration: underline;" href="http://www.slideshare.net/upload?type=powerpoint">Upload</a> your own. (tags: <a style="text-decoration: underline;" href="http://slideshare.net/tag/chuvakin">chuvakin</a> <a style="text-decoration: underline;" href="http://slideshare.net/tag/logging">logging</a>)</div></div><br /><br /><br /><span style="font-weight: bold;">Possibly related material:</span><br /><ul><li>All my presentation on Slideshare.<br /></li></ul><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=Ch9yM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=Ch9yM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=27R3M"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=27R3M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=0cfCM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=0cfCM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/411284395" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sat, 04 Oct 2008 07:11:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/log management">log management</category>
      <category domain="http://securityratty.com/tag/log management approach">log management approach</category>
      <category domain="http://securityratty.com/tag/infamous presentation">infamous presentation</category>
      <category domain="http://securityratty.com/tag/slideshare">slideshare</category>
      <category domain="http://securityratty.com/tag/worst practices">worst practices</category>
      <category domain="http://securityratty.com/tag/previous sans lunch">previous sans lunch</category>
      <category domain="http://securityratty.com/tag/sans network security">sans network security</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/411284395/presentation-from-sans-2008-lunch-and.html">Presentation from SANS 2008 Lunch and Learn in Las Vegas</source>
    </item>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[Fun Presentation from Recent ISSA e-Conference]]></title>
      <link>http://securityratty.com/article/729255ecd910e8e121a27073e3b64f2f</link>
      <guid>http://securityratty.com/article/729255ecd910e8e121a27073e3b64f2f</guid>
      <description><![CDATA[Again, while I am not blogging like mad, here is another presentation on logging. This baby is a big philosophical and mildly inspired by Dan Geer and it looks into connections between logging and...]]></description>
      <content:encoded><![CDATA[Again, while I am not blogging like mad, here is another presentation on logging.  <a href="http://www.slideshare.net/anton_chuvakin/logs-accountability-presentation">This baby</a> is a big philosophical  and mildly inspired by Dan Geer and it looks into connections between logging and broader concept of "accountability," as it is defined in IT and even beyond. I also explore the ideas that "controls don't scale, while monitoring/logging does."<br /><br />The presentation is also embedded below:<br /><br /><div style="width:425px;text-align:left" id="__ss_620729"><a style="font:14px Helvetica,Arial,Sans-serif;display:block;margin:12px 0 3px 0;text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/logs-accountability-presentation?type=powerpoint" title="Logs = Accountability">Logs = Accountability</a><object style="margin:0px" width="425" height="355"><param name="movie" value="http://static.slideshare.net/swf/ssplayer2.swf?doc=isc2logsaccountabilityjul2008rel-1222464889669894-9&stripped_title=logs-accountability-presentation" /><param name="allowFullScreen" value="true"/><param name="allowScriptAccess" value="always"/><embed src="http://static.slideshare.net/swf/ssplayer2.swf?doc=isc2logsaccountabilityjul2008rel-1222464889669894-9&stripped_title=logs-accountability-presentation" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object><div style="font-size:11px;font-family:tahoma,arial;height:26px;padding-top:2px;">View SlideShare <a style="text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/logs-accountability-presentation?type=powerpoint" title="View Logs = Accountability on SlideShare">presentation</a> or <a style="text-decoration:underline;" href="http://www.slideshare.net/upload?type=powerpoint">Upload</a> your own. (tags: <a style="text-decoration:underline;" href="http://slideshare.net/tag/logs">logs</a> <a style="text-decoration:underline;" href="http://slideshare.net/tag/chuvakin">chuvakin</a>)</div></div><br /><br />Enjoy!<br /><br /><span style="font-weight: bold;">Possibly related posts:</span><ul><li><h3 class="post-title"><a href="http://chuvakin.blogspot.com/2008/01/logs-accountability.html">Logs = Accountability!</a></h3></li></ul><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=A39AL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=A39AL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=gWcgL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=gWcgL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=19vlL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=19vlL" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/406929430" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 14:13:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/presentation">presentation</category>
      <category domain="http://securityratty.com/tag/logs chuvakin">logs chuvakin</category>
      <category domain="http://securityratty.com/tag/chuvakin">chuvakin</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/logs">logs</category>
      <category domain="http://securityratty.com/tag/accountability">accountability</category>
      <category domain="http://securityratty.com/tag/dan geer">dan geer</category>
      <category domain="http://securityratty.com/tag/broader concept">broader concept</category>
      <category domain="http://securityratty.com/tag/connections">connections</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/406929430/fun-presentation-from-recent-issa-e.html">Fun Presentation from Recent ISSA e-Conference</source>
    </item>
    <item>
      <title><![CDATA[Presentation from GOVCERT.NL 2008: Log Forensics]]></title>
      <link>http://securityratty.com/article/1090cdb96e29f72b502edcce4e86634c</link>
      <guid>http://securityratty.com/article/1090cdb96e29f72b502edcce4e86634c</guid>
      <description><![CDATA[While I am too busy too blog [I will explain why soon!], I wanted to give my readers some fun logging and security stuff to read

So, I am releasing one of my favorite presentations, the one on log...]]></description>
      <content:encoded><![CDATA[While I am too busy too blog [I will explain why soon!], I wanted to give my readers some fun logging and security stuff to read.<br /><br />So, I am releasing one of my favorite presentations, the one on log forensics, in its newest expanded form: "<a href="http://www.slideshare.net/anton_chuvakin/logs-for-incident-response-and-forensics-key-issues-for-govcertnl-2008-presentation-620704">Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008</a>"<br /><br />Here it is also embedded below:<br /><br /><div style="width:425px;text-align:left" id="__ss_620704"><a style="font:14px Helvetica,Arial,Sans-serif;display:block;margin:12px 0 3px 0;text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/logs-for-incident-response-and-forensics-key-issues-for-govcertnl-2008-presentation-620704?type=powerpoint" title="Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008">Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008</a><object style="margin:0px" width="425" height="355"><param name="movie" value="http://static.slideshare.net/swf/ssplayer2.swf?doc=logsincidentforensicsgovcert08rel-1222463958016243-9&stripped_title=logs-for-incident-response-and-forensics-key-issues-for-govcertnl-2008-presentation-620704" /><param name="allowFullScreen" value="true"/><param name="allowScriptAccess" value="always"/><embed src="http://static.slideshare.net/swf/ssplayer2.swf?doc=logsincidentforensicsgovcert08rel-1222463958016243-9&stripped_title=logs-for-incident-response-and-forensics-key-issues-for-govcertnl-2008-presentation-620704" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="425" height="355"></embed></object><div style="font-size:11px;font-family:tahoma,arial;height:26px;padding-top:2px;">View SlideShare <a style="text-decoration:underline;" href="http://www.slideshare.net/anton_chuvakin/logs-for-incident-response-and-forensics-key-issues-for-govcertnl-2008-presentation-620704?type=powerpoint" title="View Logs for Incident Response and Forensics: Key Issues for GOVCERT.NL 2008 on SlideShare">presentation</a> or <a style="text-decoration:underline;" href="http://www.slideshare.net/upload?type=powerpoint">Upload</a> your own. (tags: <a style="text-decoration:underline;" href="http://slideshare.net/tag/chuvakin">chuvakin</a> <a style="text-decoration:underline;" href="http://slideshare.net/tag/response">response</a>)</div></div><br /><br />Enjoy!<br /><br /><span style="font-weight: bold;">Possibly related:</span><br /><ul><li><a href="http://www.slideshare.net/anton_chuvakin/slideshows">All my presentations on slideshare</a></li><li><a href="http://www.chuvakin.org/secpublic.html">My speaking ops (past and future)</a><br /></li></ul><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=gNGSL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=gNGSL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=DexnL"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=DexnL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=mBV0L"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=mBV0L" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/404193461" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 26 Sep 2008 11:24:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/log forensics">log forensics</category>
      <category domain="http://securityratty.com/tag/forensics">forensics</category>
      <category domain="http://securityratty.com/tag/slideshare">slideshare</category>
      <category domain="http://securityratty.com/tag/govcert">govcert</category>
      <category domain="http://securityratty.com/tag/incident response">incident response</category>
      <category domain="http://securityratty.com/tag/view slideshare presentation">view slideshare presentation</category>
      <category domain="http://securityratty.com/tag/key issues">key issues</category>
      <category domain="http://securityratty.com/tag/favorite presentations">favorite presentations</category>
      <category domain="http://securityratty.com/tag/chuvakin">chuvakin</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/404193461/presentation-from-govcertnl-2008-log.html">Presentation from GOVCERT.NL 2008: Log Forensics</source>
    </item>
    <item>
      <title><![CDATA[Network World Coverage of ScienceLogic at Interop]]></title>
      <link>http://securityratty.com/article/27b0a46be99117829b3a5801b8947a5d</link>
      <guid>http://securityratty.com/article/27b0a46be99117829b3a5801b8947a5d</guid>
      <description><![CDATA[We were all really excited to have the opportunity to illuminate Sevick and Wetzel about ScienceLogics value proposition at Interop
Yesterday, they posted a terrific blog post about what they saw at...]]></description>
      <content:encoded><![CDATA[<p>We were all really excited to have the opportunity to illuminate Sevick and Wetzel about ScienceLogic’s value proposition at Interop.
<p>Yesterday, they <a href="http://www.networkworld.com/community/node/33059" target="_blank">posted a terrific blog post</a> about what they saw at Interop. Fortunately, ScienceLogic was one of the technologies that they highlighted from the show. I have written earlier posts about <a href="http://blog.sciencelogic.com/whats-up-with-the-washington-posts-biz-section-coverage-of-local-business/05/2008" target="_blank">how difficult it has been</a> to gain smart, insightful coverage for our solutions with technology media.
<p>I have to say that they really got it! And it feels so good. We know that we have a bit of a hidden gem of a product here at ScienceLogic and will be working overtime in the coming months to take our business and products to a “Blue Ocean” environment that will shock and surprise many others in the media. However Sevick and Wetzel will be amongst the first to get a close-up on why and how we will deliver a new paradigm to this marketplace in 2009!
<p>A few excerpts from their post:<br />
<blockquote>
<p>“We noticed yet more specialty network management vendors, leading us to wonder how the market can support such a plethora of them, and we felt empathy for IT teams that have to master yet more interfaces.”
<p>“Application performance management and application acceleration vendors were well represented. Such products play well in today’s climate because they allow enterprises to get the most out of existing IT investments instead of buying more “stuff”. One particularly interesting vendor we talked to was <a href="http://www.sciencelogic.com/">ScienceLogic</a>. They are integrating IT infrastructure and application monitoring into a single, not-very-expensive platform that will serve mainstream business well. This is smart, and we predict they will give the CA’s, BMC’s, HP’s and IBM’s of the world a run for their money.”</p>
</blockquote>
<p>&nbsp;
<p>Check out the <a href="http://www.networkworld.com/community/node/33059" target="_blank">blog post here</a> and keep <a href="http://www.networkworld.com/community/appview" target="_blank">App Performance View</a> on your radar..<a href="http://www.networkworld.com/community/node/33059"></a></p>
]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 11:36:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/terrific blog post">terrific blog post</category>
      <category domain="http://securityratty.com/tag/post">post</category>
      <category domain="http://securityratty.com/tag/application acceleration vendors">application acceleration vendors</category>
      <category domain="http://securityratty.com/tag/application">application</category>
      <category domain="http://securityratty.com/tag/blog post">blog post</category>
      <category domain="http://securityratty.com/tag/sciencelogic">sciencelogic</category>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <category domain="http://securityratty.com/tag/business">business</category>
      <category domain="http://securityratty.com/tag/application performance management">application performance management</category>
      <source url="http://blog.sciencelogic.com/network-world-coverage-of-sciencelogic-at-interop/09/2008">Network World Coverage of ScienceLogic at Interop</source>
    </item>
    <item>
      <title><![CDATA[CCTV Firm Threatens The Researcher Who Found Vulnerable Products That Reveal Cam Images Without Authentication]]></title>
      <link>http://securityratty.com/article/004b60ada89c39b7a3f4bb4d0ecf0735</link>
      <guid>http://securityratty.com/article/004b60ada89c39b7a3f4bb4d0ecf0735</guid>
      <description><![CDATA[A flaw discovered by security researcher Mike Stephens, affects The LookC 44 server and Pro IX server, which allows anyone to view static images from any camera connected to its servers. This product...]]></description>
      <content:encoded><![CDATA[A flaw discovered by security researcher Mike Stephens, affects The LookC 4&#215;4 server and Pro IX server, which allows anyone to view static images from any camera connected to its servers. This product is installed in some primary and secondary schools. The flaw requires no authentication to exploit and vulnerable servers might be found via [...]]]></content:encoded>
      <pubDate>Sat, 20 Sep 2008 04:22:21 +0000</pubDate>
      <category domain="http://securityratty.com/tag/flaw requires">flaw requires</category>
      <category domain="http://securityratty.com/tag/vulnerable servers">vulnerable servers</category>
      <category domain="http://securityratty.com/tag/flaw">flaw</category>
      <category domain="http://securityratty.com/tag/view static images">view static images</category>
      <category domain="http://securityratty.com/tag/servers">servers</category>
      <category domain="http://securityratty.com/tag/secondary schools">secondary schools</category>
      <category domain="http://securityratty.com/tag/authentication">authentication</category>
      <category domain="http://securityratty.com/tag/server">server</category>
      <category domain="http://securityratty.com/tag/pro">pro</category>
      <source url="http://cyberinsecure.com/cctv-firm-threatens-the-researcher-who-found-vulnerable-products/">CCTV Firm Threatens The Researcher Who Found Vulnerable Products That Reveal Cam Images Without Authentication</source>
    </item>
    <item>
      <title><![CDATA[Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!]]></title>
      <link>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</link>
      <guid>http://securityratty.com/article/b7bfb8c522ce436676068950e32e11a9</guid>
      <description><![CDATA[I am participating in the 4th annual Hosting Transformation Summit in sunny Las Vegas today and have just listened to some heartwarming news from Dan Golding the head of Tier1 Research . Dan kicked...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/datacenter-ani-optimized.gif" border="0" alt="Datacenter_ani_optimized" width="242" height="249" align="left" /> I am participating in the <a href="http://www.hostingtransformation.com/na/2008/" target="_blank">4th annual Hosting Transformation Summit</a> in sunny Las Vegas today and have just listened to some heartwarming news from <a href="http://www.hostingtransformation.com/na/2008/panelists.php" target="_blank">Dan Golding</a> the head of <a href="http://www.t1r.com/" target="_blank">Tier1 Research</a>. Dan kicked off the morning with his Keynote “Managed Hosting and Colocation in 2009 and beyond.” As you may know, ScienceLogic has maintained a large group of customers in the Managed Service Provider industry so we love to keep our ears to the pavement regarding industry trends. (<em><a href="http://www2.sea.siemens.com/NR/rdonlyres/4866BFD6-9181-41BD-90EA-D8380255E826/0/Datacenter_ani_optimized.gif" target="_blank">image from: Siemens</a>)</em></p>
<p>Dan described the Managed Hosting and colocation sector as “on fire” The sector is humming – incredible growth, outstanding execution, blowing away expectations. I must say, looking back 5 years ago after the tech bubble collapse, I can’t believe how strong the <a href="http://blog.wired.com/business/2008/09/why-the-tech-in.html" target="_blank">sector bounced back</a> from those very difficult times.</p>
<p>His presentation was focused on a future, and a longer view for the industry. The HTS conference is packed this year with the largest attendance of Datacenter owners, Managed hosting and colocation companies ever to attend this conference.</p>
<ul>
<li>Demand steady or increasing in all markets, driven largely by capex constraints and greater awareness and choices.</li>
<li>Supply is growing more slowly in the past 18 months as the credit crunch has hurt the ability of providers to expand ( it is very hard to get mortgages, loans only on new datacenter projects). Expansion build-out of existing shells is occurring, but very little on spec.</li>
<li>Demand Growth of 15% in 2008. (Steady and increasing in the out years) However after supply growth peaked at 7.5% in 2007 supply growth now has slowed to 5%</li>
<li>Dan believes that supply growth will pick back up again in 2011</li>
</ul>
<p>Conclusions – supply is tight, demand is high and growing…this very good news for the industry.</p>
<ul>
<li>Some other trends:
<ul>
<li>The <a href="http://royal.pingdom.com/?p=327" target="_blank">green initiatives</a> are more than just a <a href="http://www.greenm3.com/2008/09/cisco-and-ibm-s.html" target="_blank">trend as datacenter owners</a> who don’t figure out how to <a href="http://www.greenm3.com/2008/08/modeling-for-gr.html" target="_blank">maximize power efficiency</a> will be painted as villains.</li>
<li><a href="http://www.webpronews.com/topnews/2008/09/02/us-getting-dominated-in-internet-traffic" target="_blank">Internet traffic</a> and services consumption are linked as Internet traffic growth has been doubling every year (2005-2007)</li>
<li>Prediction: 2011 -2012 - <a href="http://mashable.com/2008/08/31/is-the-us-becoming-a-part-of-the-internet-backwater/" target="_blank">internet traffic</a> will get an exaflood – it is coming with a new breed of applications (set to boxes HD Video, games, etc.) that will drive new traffic patterns. <a href="http://www.nytimes.com/2008/08/30/business/30pipes.html?_r=1&amp;ref=technology&amp;oref=slogin" target="_blank">Growth driven by consumer broadband</a> + applications (HD video) applications, which in turn will drive demand for Managed Hosting / Colocation Services…</li>
</ul>
</li>
</ul>
<p>Managed Hosting Services Highlights</p>
<ul>
<li>Incredibly fast growth 30%+</li>
<li>$10 Billion worldwide revenue by end of 2008</li>
<li>We’ll keep growth pace until at least 2011</li>
<li>Good news, Dan believes that fears about slowdown in growth are wildly overblown.</li>
</ul>
<p>Why is managed hosting growing so fast?</p>
<ul>
<li>Demographic shifts – new breed of IT employees that <a href="http://www.crcexchange.com/outsource-your-it" target="_blank">embrace outsourcing</a></li>
<li>Growth in internet applications <a href="http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html?source=rss&amp;url=http://www.infoworld.com/article/08/07/30/Clear_strategy_key_for_SaaS_ecommerce_success_1.html" target="_blank">(SaaS)</a> The acceptance and growth of browser based applications has been enormous!</li>
<li>Ambiguity between web hosting and managed hosting has turned positive</li>
</ul>
<p>Dan’s Key success factors <a href="http://blog.adspotlive.com/managed-hosting-and-related-things-to-be-considered/" target="_blank">managed hosting and services</a></p>
<ul>
<li>High margin services – and not too many – it is so tempting in our day to day business when a customer comes along and wants to come and give us money for a unique on-off service… at this point the answer has to be no – or do it through a partner.</li>
<li>High level of support delivery is critical – don’t cut pay in support people or outsource support to save a nickel… what you are selling is support. Keep doing this well or you will head into a bad place… just as examples in retail like Home Depot and others who have struggled with customer service challenges – the whole business starts to slide into the toilet… High levels of support delivers a strong word of mouth buying cycle</li>
</ul>
<p>Final thoughts, the industry is healthy and will continue to thrive. Customers are looking for the one stop shop, one company that is a trusted advisor to the customer. As customers place more eggs in the Managed Service bucket, the industry will need to tighten-up those SLA’s. Today some parts of the industry have been getting away with loose SLA’s… as customers get more sophisticated and have more on the line, they will become more demanding and require robust multi-component SLAs and back-it –up.</p>
]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 11:00:18 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fast">fast</category>
      <category domain="http://securityratty.com/tag/demand steady">demand steady</category>
      <category domain="http://securityratty.com/tag/demand">demand</category>
      <category domain="http://securityratty.com/tag/incredibly fast growth">incredibly fast growth</category>
      <category domain="http://securityratty.com/tag/growth">growth</category>
      <category domain="http://securityratty.com/tag/drive demand">drive demand</category>
      <category domain="http://securityratty.com/tag/drive">drive</category>
      <category domain="http://securityratty.com/tag/internet traffic growth">internet traffic growth</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <source url="http://blog.sciencelogic.com/can-you-believe-it-with-the-financial-markets-in-turmoil-the-hosting-industry-continues-to-thrive/09/2008">Can You Believe It? With the Financial Markets in Turmoil, the Hosting Industry Continues to Thrive!</source>
    </item>
    <item>
      <title><![CDATA[So Logically, If She Weighs The Same As A DuckShes A Witch!]]></title>
      <link>http://securityratty.com/article/3fa3a2c5641e284f4fc5fc76430d2faa</link>
      <guid>http://securityratty.com/article/3fa3a2c5641e284f4fc5fc76430d2faa</guid>
      <description><![CDATA[I usually try to stay far away from politics and current events, but my friend Rich has put up a blog post blaming the credit crisis on quantitative analysis, and then positing that because the...]]></description>
      <content:encoded><![CDATA[<p>I usually try to stay far away from politics and current events, but my friend <strong><a href="http://securosis.com/2008/09/17/the-fallacy-of-complete-and-accurate-risk-quantification/">Rich has put up a blog post</a></strong> blaming the credit crisis on quantitative analysis, and then positing that because the economy sucks, Information Security should be only qualitative.</p>
<p>Now I&#8217;ve been &#8220;accused&#8221; of being a quant in the past (hi rybolov!) but in reality the only dogs I have in this fight are the model and the application of scientific method - and really, ethically speaking, I have to be tied to the latter while applying the former.</p>
<p>And I see a false dichotomy in this whole Quant vs. Qual thing.  We, as a profession, tend to create a political divide between the two which, if it even exists, I&#8217;d say is based more on our ignorance rather than our expertise.  After all, we are the profession that regularly multiplies across ordinal scales and uses wonderful models like R=VxTxI.   As someone  learning to deal in probabilities and rationalism, I have to recognize that this discussion is really just about the act of observation using different metrics of measurement.</p>
<p>But how we&#8217;re going about observing does not change the fact that there is measurement based on observation.  So if I&#8217;m working with you I can easily turn your qualitative scale into a quantitative one, and vice-versa.  Yes, Shrdlu, if we had the time, even your most seemingly Qual things could be Quant! (This flexible world view, btw, is an outcome of that new-fangled Bayesian thing).</p>
<p><strong>COGNITIVE BIAS A-PLENTY</strong></p>
<p>But back to what Rich is saying there about information security and risk - and he isn&#8217;t/won&#8217;t be the only one saying these sorts of things - we should try to understand what&#8217;s really going on rather than get caught up in the emotional hurricane.  Our profession suffers several forms of cognitive bias.  The nature of our jobs and what we do can cause us to be focused on the outcome and not the quality of the decision at the time it was made.  We want to bring in things from other professions that are useful, but at times we do view things outside our profession with false correlation to our own (unfortunately for those who write these sorts of articles, financial risk is <em><strong>completely different</strong></em> than operational risk).  We also have the tendency to focus on negative outcomes without acknowledging the positive outcomes (For example, I hear that Alan Greenspan&#8217;s new firm is up a couple of $billion in all this mess since he joined them, short sellers are doing quite well - must be because they have qualitative models or something <em>-grin-</em>).  The effect of these biases are compounded by the facts that proper correlation takes more work than we usually give it, and rational thought is not that easy when there&#8217;s a witch-hunt mentality.</p>
<div class="wp-caption alignnone" style="width: 257px"><a href="http://www.youtube.com/watch?v=zrzMhU_4m-g"><img src="http://www.riskmanagementinsight.com/media/images/weblog/peasants.png" alt="Burn her anyway!" width="247" height="219" /></a><p class="wp-caption-text">What also floats in water? (link to Youtube)</p></div>
<p><strong>WHAT SHOULD WE BE THINKING ABOUT?</strong></p>
<p>So as you and I read opinions that seem to be the polar opposite of irrational exuberance (and there will be plenty between now and the election) we&#8217;ll have to ask ourselves, &#8220;what really failed here?&#8221;  At the risk (pun) of over-simplification:</p>
<ul>
<li>Was There an Error on the part of Probability Theory?</li>
</ul>
<p>After all, Probability Science like all other fields of knowledge is always &#8220;advancing&#8221; as they say.  So perhaps probability theory is wrong somehow?</p>
<p>I&#8217;m personally disinclined to put the blame here, primarily because I would think that there would be evidence from other fields (like Quantum Mechanics) that something is amiss waaaaay before it hit a field like economics.</p>
<ul>
<li>Was There Error In The Model Used to Determine Risk?</li>
</ul>
<p>Some people who understand real estate valuation and complex derivatives and financial risk want to put the blame here.  It&#8217;s a little too early to tell, but one thing is for sure - Financial risk is so different from operational risk I couldn&#8217;t begin to hazard an opinion on the subject.   But it would seem that this is really somewhere we might look.</p>
<ul>
<li>Was There Error In The  Scale Used (Quantitative vs. Qualitative)?</li>
</ul>
<p>Honestly?  I find it extremely difficult to understand how this could be the source of financial ruin.</p>
<ul>
<li>Was There Error on the part of the Decision Maker?</li>
</ul>
<p>What if all of the above were just fine, and the decision maker chose short term gain over long term stability?  What if this was (to simplify the matter greatly) a choice of &#8220;heads&#8221; over &#8220;tails&#8221; and the coin landed on tails?  What if the model represented the right risk (probability of negative outcome vs. positive outcome), but the complex derivative was sold to someone else who had poor &#8220;risk management&#8221; (ability to make a good decisions)?</p>
<p>Now I have no clue about complex derivatives, and I&#8217;m oversimplifying to be sure - chances are like most things, there are several problems that helped create the primary cause. But it seems to me that as we go into incident response mode for the economy, it&#8217;s more helpful to do so in a rational, logical manner.<br />
<strong><br />
OTHER THINGS WE MIGHT WANT TO CONSIDER</strong></p>
<p><span style="color: #008000;"><strong>Consider the Source</strong></span><br />
Some authors (who I think tend to exploit outcome and hindsight bias,and then combine those with indirect ad hominem attacks in order to sell their books), are actually putting forth arguments against the use of analytics.  The source of this is a current epistemic debate between those who believe that only falsification is certain, and those who maintain that neither proof nor falsification are certain, there are only probabilities.    So before you go believing any &#8220;quadrants&#8221; of usefulness on faith - I encourage you to understand what is at the heart of the discussion.<br />
<span style="color: #008000;"><strong><br />
We All Have to Live In The Real World</strong></span><br />
The sun will rise tomorrow, and someone will try to find the source of the problem and do a better job.  Now chances are, they&#8217;ll be doing it in a quantitative manner.  Chances are also that at some point their models will fail and we&#8217;ll need to build new ones.  And this will happen whether the field is cosmology, economics, meteorology, information security, or professional baseball.<br />
<strong><br />
WHAT ABOUT YOU, ALEX?</strong></p>
<p>I&#8217;m far from certain and subject to change, but these days I lean towards <strong><a href="http://www.overcomingbias.com/2008/09/who-to-blame.html">Robin Hanson &amp; MIchael Lewis</a></strong> w/regards to placing blame.</p>
]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 10:59:47 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/financial risk">financial risk</category>
      <category domain="http://securityratty.com/tag/poor risk management">poor risk management</category>
      <category domain="http://securityratty.com/tag/operational risk">operational risk</category>
      <category domain="http://securityratty.com/tag/outcome">outcome</category>
      <category domain="http://securityratty.com/tag/exploit outcome">exploit outcome</category>
      <category domain="http://securityratty.com/tag/probability">probability</category>
      <category domain="http://securityratty.com/tag/qualitative models">qualitative models</category>
      <category domain="http://securityratty.com/tag/models">models</category>
      <source url="http://riskmanagementinsight.com/riskanalysis/?p=420">So Logically, If She Weighs The Same As A DuckShes A Witch!</source>
    </item>
  </channel>
</rss>
