<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: volumes]]></title>
    <link>http://securityratty.com/tag/volumes</link>
    <description></description>
    <pubDate>Sat, 30 Aug 2008 09:04:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Spam levels fluctuate as crooks try to revive botnets]]></title>
      <link>http://securityratty.com/article/6898619aa3a97b2f0095f1e166d4812f</link>
      <guid>http://securityratty.com/article/6898619aa3a97b2f0095f1e166d4812f</guid>
      <description><![CDATA[Two weeks after McColo's shutdown sent global spam volumes plummeting, some researchers said junk mail rates remain dramatically down, while others said spam has already bounced...]]></description>
      <content:encoded><![CDATA[Two weeks after McColo's shutdown sent global spam volumes plummeting, some researchers said junk mail rates remain dramatically down, while others said spam has already bounced back.<br style="clear: both;"/>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:b0fed0ce5178f3587db4effbbdc8eed7:Lo%2FW5xpdBG%2FsznStumMGozfEojqBtLGIIXuNUFYZWl%2B5qvGzdJ%2BpQASooXQmgrG2oYHMZO9YiVDi'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:16fdd31edbefc269672d8a97a96c121f:b%2FZNtr7oyHtqVN7%2FilzZcuuykWH%2FRfO%2F30LJI1SNV3GqdJ3gZ%2FX%2Bp1yGp6%2BECWCv1ZDqqPZ7QeAVMA%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:b6c12602f83177ff8c65b195f959c201:qas1ST%2BeSRE9hvUz8fiZ%2BmOdZsUHFST3Hp5Zbf4%2BCM%2BhKMztSXIw%2FhilOqXMTMKYZBjcbAPWa25WkA%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
  <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:773d13ecfd32259359b55a2a0b0d31b2:iw0QTWJE%2FRz4m5R%2B0ig3NfDmOG%2Ffl0h4o1%2FoIDZ2UA8r6eWG3bpa8diMerKneYf1KBSPkbEtJyooxw%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>
<a href="http://www.pheedo.com/click.phdo?s=f3ac179d37d16170c07fbfda45195466&p=1"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=f3ac179d37d16170c07fbfda45195466&p=1"/></a>
<img src="http://www.pheedo.com/feeds/tracker.php?i=f3ac179d37d16170c07fbfda45195466" style="display: none;" border="0" height="1" width="1" alt=""/>
]]></content:encoded>
      <pubDate>Tue, 25 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/global spam volumes">global spam volumes</category>
      <category domain="http://securityratty.com/tag/junk mail">junk mail</category>
      <category domain="http://securityratty.com/tag/remain">remain</category>
      <category domain="http://securityratty.com/tag/shutdown">shutdown</category>
      <category domain="http://securityratty.com/tag/researchers">researchers</category>
      <category domain="http://securityratty.com/tag/mccolo">mccolo</category>
      <category domain="http://securityratty.com/tag/weeks">weeks</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=f3ac179d37d16170c07fbfda45195466">Spam levels fluctuate as crooks try to revive botnets</source>
    </item>
    <item>
      <title><![CDATA[Spam levels fluctuate as crooks try to revive botnets]]></title>
      <link>http://securityratty.com/article/56f12388b579b846be1e8a67255946c1</link>
      <guid>http://securityratty.com/article/56f12388b579b846be1e8a67255946c1</guid>
      <description><![CDATA[Two weeks after a hosting firm's shutdown sent global spam volumes plummeting, some researchers continue to claim that junk mail rates remain dramatically down, while others say spam has already...]]></description>
      <content:encoded><![CDATA[Two weeks after a hosting firm's shutdown sent global spam volumes plummeting, some researchers continue to claim that junk mail rates remain dramatically down, while others say spam has already bounced back.]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/spam">spam</category>
      <category domain="http://securityratty.com/tag/global spam volumes">global spam volumes</category>
      <category domain="http://securityratty.com/tag/junk mail">junk mail</category>
      <category domain="http://securityratty.com/tag/researchers continue">researchers continue</category>
      <category domain="http://securityratty.com/tag/remain">remain</category>
      <category domain="http://securityratty.com/tag/firm">firm</category>
      <category domain="http://securityratty.com/tag/claim">claim</category>
      <category domain="http://securityratty.com/tag/shutdown">shutdown</category>
      <category domain="http://securityratty.com/tag/weeks">weeks</category>
      <source url="http://www.networkworld.com/news/2008/112508-spam-levels-fluctuate-as-crooks.html?fsrc=rss-security">Spam levels fluctuate as crooks try to revive botnets</source>
    </item>
    <item>
      <title><![CDATA[Hosting firm shutdown forces botnets to relocate]]></title>
      <link>http://securityratty.com/article/4f4f997274a541f5854267f9851c99fe</link>
      <guid>http://securityratty.com/article/4f4f997274a541f5854267f9851c99fe</guid>
      <description><![CDATA[The shutdown Tuesday of a California-based hosting company not only cut spam volumes, it also put a dent in malware-spreading botnets and other criminal activity, researchers said...]]></description>
      <content:encoded><![CDATA[The shutdown Tuesday of a California-based hosting company not only cut spam volumes, it also put a dent in malware-spreading botnets and other criminal activity, researchers said today.<br style="clear: both;"/>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:6ee380da8eb1f27477166de1324a4816:Ugmgn9IP8%2BxskOkzR5BWUy420Jx%2BgrmHypS6kmu6AsWQSlUYSardMeHUlaPrJMn5PyyQEMC9pFs3'><img border='0' title='Add to digg' alt='Add to digg' src='http://www.pheedo.com/images/mm/digg.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:fefbbebd0da74766f037b339d8d21351:tnQXCjtu0ZGZLwWRqx3HXpQRZEre%2FZYTU%2F0jqqCKpUI6ZHaQAPs5UkAjzTmvhuTD0ylflKHbhNEi7A%3D%3D'><img border='0' title='Add to StumbleUpon' alt='Add to StumbleUpon' src='http://www.pheedo.com/images/mm/stumbleit.gif'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:3cb42d7365956d982dab8e4cdc8887df:qzLiq5XZ5AqTT0F0%2Fl5sP3hY%2Bq%2Bja4pwHGUR34m8gpx2jX7yTn5qUMPZ0YedCaU7GUKG4EXECkQ99w%3D%3D'><img border='0' title='Add to Twitter' alt='Add to Twitter' src='http://www.pheedo.com/images/mm/twitter.png'/></a>
    <a style='font-size: 10px; color: maroon;' href='http://www.pheedo.com/hostedMorselClick.php?hfmm=v3:bba0a8f27c13855c1516ebb5eeeb396e:cpcghEVeBC2DVPXeiijRnxF3BM34LBkQT9%2BaotkyhOiL1e%2FMxplXHAAvKq%2F%2FFnM8ZowxsV%2F781ko%2BA%3D%3D'><img border='0' title='Add to Slashdot' alt='Add to Slashdot' src='http://www.pheedo.com/images/mm/slashdot.png'/></a>
<br style="clear: both;"/>      <a href="http://www.pheedo.com/click.phdo?s=403c642d88ddb213ab3c0995650848fb"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=403c642d88ddb213ab3c0995650848fb"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=403c642d88ddb213ab3c0995650848fb" style="display: none;" border="0" height="1" width="1" alt=""/>]]></content:encoded>
      <pubDate>Thu, 13 Nov 2008 02:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/cut spam volumes">cut spam volumes</category>
      <category domain="http://securityratty.com/tag/shutdown tuesday">shutdown tuesday</category>
      <category domain="http://securityratty.com/tag/botnets">botnets</category>
      <category domain="http://securityratty.com/tag/criminal activity">criminal activity</category>
      <category domain="http://securityratty.com/tag/researchers">researchers</category>
      <category domain="http://securityratty.com/tag/dent">dent</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://feeds.computerworld.com/click.phdo?i=403c642d88ddb213ab3c0995650848fb">Hosting firm shutdown forces botnets to relocate</source>
    </item>
    <item>
      <title><![CDATA[Hosting firm shutdown forces botnets to relocate]]></title>
      <link>http://securityratty.com/article/74749d0330fd99de7fc082bdc412a231</link>
      <guid>http://securityratty.com/article/74749d0330fd99de7fc082bdc412a231</guid>
      <description><![CDATA[The shutdown Tuesday of a California-based hosting company not only knocked down spam volumes but has also put a dent in malware-spreading botnets and other criminal activity, researchers said...]]></description>
      <content:encoded><![CDATA[The shutdown Tuesday of a California-based hosting company not only knocked down spam volumes but has also put a dent in malware-spreading botnets and other criminal activity, researchers said today.]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/shutdown tuesday">shutdown tuesday</category>
      <category domain="http://securityratty.com/tag/botnets">botnets</category>
      <category domain="http://securityratty.com/tag/criminal activity">criminal activity</category>
      <category domain="http://securityratty.com/tag/spam volumes">spam volumes</category>
      <category domain="http://securityratty.com/tag/researchers">researchers</category>
      <category domain="http://securityratty.com/tag/dent">dent</category>
      <category domain="http://securityratty.com/tag/company">company</category>
      <source url="http://www.networkworld.com/news/2008/111308-hosting-firm-shutdown-forces-botnets.html?fsrc=rss-security">Hosting firm shutdown forces botnets to relocate</source>
    </item>
    <item>
      <title><![CDATA[Spam plummets after hosting service shuttered]]></title>
      <link>http://securityratty.com/article/e24dd0fc12cd739fb6d0cb67154cec84</link>
      <guid>http://securityratty.com/article/e24dd0fc12cd739fb6d0cb67154cec84</guid>
      <description><![CDATA[Spam volumes plunged by more than 40% after a major bot hosting network was shut down, researchers at IronPort Systems Inc. said...]]></description>
      <content:encoded><![CDATA[Spam volumes plunged by more than 40% after a major bot hosting network was shut down, researchers at IronPort Systems Inc. said Wednesday.]]></content:encoded>
      <pubDate>Tue, 11 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/major bot">major bot</category>
      <category domain="http://securityratty.com/tag/ironport systems">ironport systems</category>
      <category domain="http://securityratty.com/tag/spam volumes">spam volumes</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/wednesday">wednesday</category>
      <category domain="http://securityratty.com/tag/researchers">researchers</category>
      <source url="http://www.networkworld.com/news/2008/111208-spam-plummets-after-hosting-service.html?fsrc=rss-security">Spam plummets after hosting service shuttered</source>
    </item>
    <item>
      <title><![CDATA[Corporate Greed and the Destabilization of Society]]></title>
      <link>http://securityratty.com/article/155810725ba943a1b35e1c2b39138f7a</link>
      <guid>http://securityratty.com/article/155810725ba943a1b35e1c2b39138f7a</guid>
      <description><![CDATA[In The Audacity of Capital Markets we briefly touched on the culture of arrogance and greed in financial services. It is interesting because if you look at the various software players that are...]]></description>
      <content:encoded><![CDATA[<p>In <a title="The Audacity of Capital Markets" rel="bookmark" href="../2008/09/19/the-audacity-of-capital-markets/">The Audacity of Capital Markets</a> we briefly touched on the culture of arrogance and greed in financial services.  It is interesting because if you look at the various software players that are focused on selling to financial services, you will easily see that they have bought into the same &#8220;feed the beast&#8221; culture that has contributed to the destabilization of the economy and, in turn, society.</p>
<p>For example, the &#8220;Average Joe Investor&#8221; does not care about &#8220;best order execution&#8221; or &#8220;smart order routing,&#8221; this is for &#8220;the big boys.&#8221;  As we all know, saving a few pennies or dollars per transaction to &#8220;Average Joe Investor&#8221; does nothing for them when their retirement nest egg is lost due to corporate greed and negligence.     The folks who &#8220;really care&#8221; about shaving a few milliseconds off market execution are the companies that are trading high volumes of exotic derivatives and baskets who have, for the most part, zero interest in the personal financial portfolio of &#8220;Jane in Iowa&#8221; or &#8220;Joe in Kansas.&#8221;</p>
<p>I am really amazed to see the dominance of greed in corporate America and the lack of corporate social responsibility.  Risk taking and &#8220;split second trading&#8221; does little for any small. individual investor and has proven to destabilize our society.    Who cares about saving a few pennies or dollars in market executive?</p>
<p>The answer: Only the greedy corporations, the same people responsible for the current destabilization, chao and near collaspe of our entire financial system.   Homes lost, unprecedented bankruptcies. and money market funds less than par value!   You no doubt have read that folks in the <a href="http://www.reservefunds.com/" target="_blank">Reserve Money Market funds</a> cannot even withdraw their &#8220;safe money.&#8221;  Investors in the Reserve Funds are being told that for every dollar they invested in a money market, they now only have 97 cents and cannot withdraw their capital as the Reserve waits for a government bailout.</p>
<p>What is to blame? Greed and profits over corporate social responsibility are to blame.</p>
<p>I read where some folks think the government needs to regulate market-related news, supposedly to stabilize trading based on news.   Regulating news has another name -  &#8220;censorship&#8221; - but who cares about the US Constitution when money and split second algo trading is involved?    I am amazed.   Folks in financial services just will say or do anything to make a buck, or keep from losing one, even at the expense of society and our basic constitutional freedoms.  News is not regulated in our democratic society, nor should it be to make algorithmic trading &#8220;better&#8221;.     What we need is less split second, computerized algo trading and more stablity.   Machine processing should not dicate nor mandate changes to our democratic principles.</p>
<p>Nor should our lives in a free society be censored or regulated because of the trading requirements for split second transactions that benefit large corporations.    The average investor does not need an unstable financial system trading exotic derivatives and baskets at the speed of light.  This requirement is driven by corporate greed that destabilizes the core economy and fabric of our society.</p>
<p>Of couse, many of the same folks would like for us to believe that technology is the answer.  This is a fallacy.</p>
<p>Corporate greed is destabilizing society.   What need to be regulated is not the news, but corporate risk taking and corporate goverance.  Individual investors do not need lightspeed transactions in an unstable world.   Citizens and families need a secure, stable economic infrastructure, something that has been lost in the culture of corporate greed, but hopefully not forever.</p>
]]></content:encoded>
      <pubDate>Tue, 23 Sep 2008 14:24:22 +0000</pubDate>
      <category domain="http://securityratty.com/tag/society">society</category>
      <category domain="http://securityratty.com/tag/greed">greed</category>
      <category domain="http://securityratty.com/tag/safe money">safe money</category>
      <category domain="http://securityratty.com/tag/money">money</category>
      <category domain="http://securityratty.com/tag/money market funds">money market funds</category>
      <category domain="http://securityratty.com/tag/democratic society">democratic society</category>
      <category domain="http://securityratty.com/tag/average joe investor">average joe investor</category>
      <category domain="http://securityratty.com/tag/free society">free society</category>
      <category domain="http://securityratty.com/tag/joe">joe</category>
      <source url="http://www.thecepblog.com/2008/09/23/corporate-greed-and-the-destabilization-of-society/">Corporate Greed and the Destabilization of Society</source>
    </item>
    <item>
      <title><![CDATA[Wakeup Call for Risk Management]]></title>
      <link>http://securityratty.com/article/5c961827ce1d8ef57419fb5d2d847236</link>
      <guid>http://securityratty.com/article/5c961827ce1d8ef57419fb5d2d847236</guid>
      <description><![CDATA[Blogger: Dan Blum
With the crisis in financial markets still unfolding, it is important to draw what lessons we can from the experience. Since the roots of the crisis lie in a monumental failure of...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p>Blogger: Dan Blum</p>

<p>With the crisis in financial markets still unfolding, it is important to draw what lessons we can from the experience. Since the roots of the crisis lie in a monumental failure of risk management, it’s important to understand more about what happened, and then draw some parallels to our business risk management and&nbsp; IT risk management situations.</p>

<p>The risk management failure in the housing market and on Wall Street had multiple interdependent dimensions:</p>

<ul><li><strong>Mortgage lenders abandoned long standing prudent loan practices</strong>. They made too many loans that buyers might not be able to repay. Exotic instruments like ARMs, option ARMs, and interest only loans proliferated. In many cases, all pretense of lending standards were abandoned, so-called “liar loans” approved.</li>

<li><strong>Capital was grossly over-leveraged</strong>. Mortgage lenders and other financial services packaged loans into securities, which they sold to raise capital to support more lending. Real capital reserve requirements to back loans were reduced. Of course, if borrowers could not repay loans, all or parts of the derivative securities would become worthless.</li>

<li><strong>Risk was aggregated at Fannie Mae, Freddie Mac, and mortgage loan insurance companies</strong>. These companies bought or insured some mortgage loans, providing something of a backstop should loans fail. Government sponsored enterprises (GSEs) Fannie and Freddie in turn became over-leveraged and securities that they sold were in turn repackaged in the murky brew of mortgage-backed securities called collateralized debt obligations (CDOs) and other exotic instruments returning generous yields. </li>

<li><strong>Non-Caveat Emptor.</strong> Institutional wealth funds and financial services firms who should have known better bought securities that had been deliberately structured to obfuscate risk. They bought securities they didn’t understand with buried tranches of toxic subprime loans..</li></ul>

<p>It was a great Ponzi scheme – one that kept working as long as housing prices were going up; the recipients of subprime loans could always flip that house to the next buyer. Everyone made money. As Chuck Prince of Citigroup famously put it during <a href="http://search.ft.com/ftArticle?sortBy=gadatearticle&amp;queryText=chuck+prince+dancing&amp;y=0&amp;aje=true&amp;x=0&amp;id=070710000610&amp;ct=0&amp;page=6&amp;nclick_check=1">a July, 2007 interview</a>: “So long as the music is playing, you’ve got to keep dancing. We’re still dancing.” But one month later, the music stopped. Since then, Citigroup and other financial institutions have taken massive writeoffs with more to come. Wall Street titans like Bear Sterns, Lehman Brothers, Merrill Lynch, and AIG have fallen or been bought out.</p>

<p>What can we learn from this risk management debacle?</p>

<p>As business risk managers and investors, we should ask questions like these:</p>

<ul><li><strong>Does the executive incentive structure of the company encourage managers to dance around risk?</strong> Many Wall Street firms paid senior managers 5 times their salary in bonuses tied to annual growth alone.</li>

<li><strong>Is the company over-leveraged?</strong> Is it borrowing too much money and betting it on ventures with uncertain outcomes?</li>

<li><strong>Are financial models used for risk management realistic?</strong> Earlier, I described the mortgage market of the past few years as a Ponzi scheme, where risk management models must have assumed prices would keep rising. Unlike the dotcom boom whose demise many predicted, very few in the industry foresaw the sharp declines to come in housing prices and sales volumes. Historically, the U.S. housing market has been a steadily rising one, but on the other hand the 2000s saw unprecedented rates of price increases. In reality, what goes up must come down. </li>

<li><strong>Has your company’s risk council ever performed worst case scenario analysis and built adequate reserves?</strong> In the days before economics emerged as a would-be “hard” deterministic science, business leaders may have been more cautious, more aware of and more accepting of uncertainty. Events like the Great Tulip Bubble came once in decades or centuries – not every few years. Note that legendary investor George Soros has proposed a Theory of Reflexivity that, if true, helps explain the recent extremes of boom and bust cycles. This theory holds that market participants model market behaviors based on self-interest, and for a time, their manipulations change the reality of the market – until gravitational forces bring it back to earth. Has the music of ephemeral success played to the backbeat of deterministic-sounding economic models gone to your heads and infected your risk management models? </li>

<li><strong>Are cost cutting efforts pursued blindly?</strong> Outsourcing and other forays into treacherous global waters may be giving away the crown jewels. Smart companies cut costs, but they do it in smart ways. Smart companies think like intelligence agencies as they parcel out work to different partners with varying levels of dependability, and they check on those partners.</li></ul>

<p>Risk management failures can also occur at the more technical level of IT security. As IT risk managers, we might ask questions like these:</p>

<ul><li><strong>Are the accounting and financial systems your IT department supports under adequate control?</strong> As Fred Cohen wrote in <a href="http://www.burtongroup.com/Client/Research/Document.aspx?cid=750">one of our documents</a>: “Many companies use computers to manage financial systems, and despite the Sarbanes-Oxley Act (SOX) claims about accounts being properly kept, there are many attacks on financial systems that remain. For example, most of the largest financial systems in the world running on common financial databases do not use <a href="http://en.wikipedia.org/wiki/Double-entry_bookkeeping">double-entry bookkeeping</a> and are thus susceptible to all manner of frauds by insiders.” We find it troubling that a prudent control dating back to the 12th century is going out of style in the name of convenience and cost cutting. Kind of like credit checking became anachronistic during the housing bubble, eh?</li>

<li><strong>Is the “separation” in your “separation of duty” (SoD) for real?</strong> Sure the SOX auditors are looking for SoD, and maybe you have different administrators with different accounts maintaining different systems or functions. But when they say Western civilization may be but one weak password from collapse they’re not lying. Look what happened to Sarah Palin’s email account! Weak and straggly SoD is a problem across all critical IT systems where deperimiterization and server consolidation may be bringing down protective barriers, identity management is weak, and strong process controls (e.g., where two people must sign on, one perform a critical operation such as backbone router reconfiguration, and the second observe) abandoned in the name of expediency. </li>

<li><strong>Are risks being aggregated to unacceptable levels in centralized control systems?</strong> There are many ways that risks aggregate within enterprise IT infrastructures as we pursue automation and cost cutting. Network risks aggregate when centralized domain name system control is implemented. Application risks aggregate when common infrastructure is shared among applications. And enterprises aggregate platform risks when they use low-assurance endpoints, authentication, and directory systems with single sign-on to access large numbers of resources and don’t separate high consequence systems. </li>

<li><strong>Non-caveat emptor:</strong> Has IT security really done the worst case consequence analysis, attack graphs, and vulnerability analysis to know when putting more eggs in a supposedly stronger basket aggregates risks to an unacceptable level? Or are you depending only on vendor claims about some black box appliance equivalent of a risk-obfuscated CDO security? Caveat emptor (buyer beware) again! (The good news is we’ll keep talking about promoting vendor and product rating systems so you don’t have to do all the detailed product analysis yourself, but that’s another post.)</li></ul>

<p>There are many parallels between the monumental risk management failure in the financial markets, and the probable weaknesses in our day to day business risk management and IT risk management. Abandonment of prudent practices for profit; excessive leverage and centralization; ill-constructed risk analysis models; risk obfuscation; and a failure of caveat emptor seem to be common problems. Please take this as a wakeup call to sharpen up the risk management thinking, process, and execution.</p></div>
<img src="http://feeds.feedburner.com/~r/SecurityAndRiskManagementStrategiesBlog/~4/397240912" height="1" width="1"/>]]></content:encoded>
      <pubDate>Fri, 19 Sep 2008 06:11:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/risk management">risk management</category>
      <category domain="http://securityratty.com/tag/risk management debacle">risk management debacle</category>
      <category domain="http://securityratty.com/tag/risk management failure">risk management failure</category>
      <category domain="http://securityratty.com/tag/failure">failure</category>
      <category domain="http://securityratty.com/tag/risk management realistic">risk management realistic</category>
      <category domain="http://securityratty.com/tag/business risk management">business risk management</category>
      <category domain="http://securityratty.com/tag/risk management models">risk management models</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <category domain="http://securityratty.com/tag/risk management situations">risk management situations</category>
      <source url="http://feeds.feedburner.com/~r/SecurityAndRiskManagementStrategiesBlog/~3/397240912/wakeup-call-for.html">Wakeup Call for Risk Management</source>
    </item>
    <item>
      <title><![CDATA[Sorry, Qantas, No Unfettered Broadband]]></title>
      <link>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</link>
      <guid>http://securityratty.com/article/e46bb700b1a972d41bfd64aba65817f9</guid>
      <description><![CDATA[Qantas backs off from earlier plans, changes provider for in-flight broadband: The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/plane.jpg" align="right" border="0" hspace="5" /><a href="http://www.smh.com.au/news/travel/qantas-limits-access-to-web/2008/09/17/1221330929870.html"><strong>Qantas backs off from earlier plans, changes provider for in-flight broadband:</strong></a> The Sydney Morning Herald somewhat erratically and incompletely reports that Qantas has delayed and modified its in-flight broadband plans. Aeromobile was the provider when the service <a href="http://www.breakingtravelnews.com/article.php?story=2007081609481129&query=qantas"><strong>was tested in second quarter 2007</strong></a>, but OnAir is now described as the airline's partner. This was noted by colleague Fabio Zambelli, who emailed me the news, and <a href="http://www.setteb.it/content/view/4742"><strong>has his own account</strong></a> at 7BIT (in Italian).</p>

<p><a href="http://www.onair.aero/index.php?pid=123"><strong>OnAir</strong></a> has so far tested their calling/texting-only service on two aircraft--one operated by Air France, one by TAP Portugal--even though RyanAir announced plans that its planes would started being unwired with the service by late 2007. Still no word on that fleet progress.</p>

<p>Qantas will apparently launch cached Web browsing and limited Web email (probably through a proxy) along with instant messaging, with full Internet service coming "later in 2009." This is clearly due to a lack of satellite coverage that was just remediated a few weeks ago (see below). The first plane with limited service, a new A380, should be in flight 20-October-2008.</p>

<div style="float:right; margin:0px; padding-left: 10px; padding-bottom: 0px;"><p><img src="http://wifinetnews.com//images/2008/SorryQantas.jpg" alt="SorryQantas.jpg" border="0" width="100" height="152"></p><p style="font-size: 10px">I hate in-flight<br/>broadband</p></div>To Qantas' credit, note that each seat on the plane will have a laptop opower socket, a USB port, and a multimedia system that can show 100 movies and 500 TV show episodes, play the contents of 1,000 CDs and 20 radio stations, and offer 80 games. 

<p>The Morning Herald seems to overstate the importance and scope of a complaint filed by the union representing American Airlines' flight attendants. The detailed coverage in the U.S. had more to do with the potential for issues, and likely attendants lack of interest in policing yet another media on the plane. Filtering doesn't work, the attendants probably already know, and this may just be a negotiating point with the airline.</p>

<p>On why Qantas is waiting until late 2009? This requires unwinding how OnAir gets its signal.</p>

<p>Aeromobile and OnAir both rely on Inmarsat satellites for their service. Both companies had several years ago staked their futures on the fourth-generation network Inmarsat was to inaugurate with three satellites that would use beamforming to allow precise delivery of nearly 500 Kbps per receiver, with hundreds or thousands of regions being able to be targeted from a single satellite. Inmarsat's third-gen network--don't confuse this with 3G cellular ground-based networks--can deliver about 64 Kbps per channel.</p>

<p>Now, unfortunately, Inmarsat was three years late on launching its trans-Pacific bird. While the company <a href="http://www.inmarsat.com/About/Newsroom/Press/00021465.aspx?language=EN&textonly=False"><strong>claims 85 percent coverage of the earth</strong></a> and 98 percent coverage of population, there's a big gap over the Pacific that also prevents them from having good overlap between the U.S. and Japan/China/Korea, as well as the southern Pacific, covering Australia. Since the biggest market for long-haul flights would likely be Australia, Japan, and China, traveling trans-Pacific or trans-hemispheric routes, that gap is rather large.</p>

<p>Aeromobile opted to build out a service, deployed only by Emirates airline as far as I can tell, that uses the 3G service since it was available, and most necessary equipment is already installed on most over-water planes. OnAir was waiting for 4G, which has necessitated a long wait, but allowed them to launch in Europe with a seemingly next-generation service. Given that OnAir is controlled by an airline-owned integration firm, SITA, and by Airbus, they're not going anywhere.</p>

<p>Inmarsat finally <a href="http://spaceflightnow.com/proton/i4f3/"><strong>lofted its third satellite on Baikonur Cosmodrome in Kazakhstan</strong></a> on 19-August-2008, and the launch and separation was reported as successful. Previously, the company has needed up to a year to verify and deploy its 4G satellites. (You can <a href="http://forum.nasaspaceflight.com/index.php?topic=12380.105"><strong>read extremely close coverage of the launch</strong></a> at a Web site devoted to space enthusiasm.)</p>

<p>However, the dirty little secret about Inmarsat's BGAN is that it costs a fortune to heft bandwidth across it. Thus, in-flight broadband over BGAN, if it's ever available, is going to be changed on an extremely high per-MB rate. None of the providers want to say this. This is in contrast to Row 44 (and, once, Connexion by Boeing), which relies on leased Ku-band transponders where they can fix costs and they require high volumes to keep per-bit costs efffectively low.</p>

<p>OnAir's launch of calling on Air France's service involves paying a few euros per minute for calls, which might help you understand what data costs could ultimately run.</p>]]></content:encoded>
      <pubDate>Thu, 18 Sep 2008 06:33:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/satellite coverage">satellite coverage</category>
      <category domain="http://securityratty.com/tag/coverage">coverage</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/service involves">service involves</category>
      <category domain="http://securityratty.com/tag/internet service">internet service</category>
      <category domain="http://securityratty.com/tag/in-flight broadband plans">in-flight broadband plans</category>
      <category domain="http://securityratty.com/tag/plans">plans</category>
      <category domain="http://securityratty.com/tag/inmarsat satellites">inmarsat satellites</category>
      <category domain="http://securityratty.com/tag/inmarsat">inmarsat</category>
      <source url="http://wifinetnews.com/archives/008448.html">Sorry, Qantas, No Unfettered Broadband</source>
    </item>
    <item>
      <title><![CDATA[Supporting CEP with Solace Content Routers]]></title>
      <link>http://securityratty.com/article/8d902f5832f1d3b5efbfc1f409e130b5</link>
      <guid>http://securityratty.com/article/8d902f5832f1d3b5efbfc1f409e130b5</guid>
      <description><![CDATA[Interested in content routing and event preprocessingsupporting futureCEP applications? Check out Solace Systems . You can click on the image below for a better picture of the Solace architecture for...]]></description>
      <content:encoded><![CDATA[<p>Interested in content routing and event preprocessing supporting future CEP applications?  Check out <a href="http://wwww.solacesystems.com" target="_blank">Solace Systems</a>.  You can click on the image below for a better picture of the Solace architecture for event processing.</p>
<p style="text-align: center;"><a href="http://www.solacesystems.com/images/solutions/cep_architecture.gif" target="_blank"><img class="aligncenter" src="http://www.solacesystems.com/images/solutions/cep_architecture.gif" alt="" width="450" height="283" /></a></p>
<p>Solace provides <a href="http://www.solacesystems.com/solutions/fs_event_processing.asp" target="_blank">sophisticated middleware functionality</a> in hardware to monitor, filter, route, transform and secure very large volumes of events in real time and with minimal processing overhead.  Solace uses leading-edge FPGA, ASIC and network processor technology to increase throughput and lower latency of event processing. Applications such as fraud detection, algorithmic trading, compliance, insider trade monitoring, risk management and more can be tackled more effectively by separating the simple monitoring, filtering and normalization of raw events from the complex processing of select events. This event pre-processing takes the burden off CEP engines allowing individual engines to be much more effective. </p>
]]></content:encoded>
      <pubDate>Sat, 06 Sep 2008 07:42:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/solace">solace</category>
      <category domain="http://securityratty.com/tag/solace systems">solace systems</category>
      <category domain="http://securityratty.com/tag/events">events</category>
      <category domain="http://securityratty.com/tag/raw events">raw events</category>
      <category domain="http://securityratty.com/tag/event">event</category>
      <category domain="http://securityratty.com/tag/solace architecture">solace architecture</category>
      <category domain="http://securityratty.com/tag/network processor technology">network processor technology</category>
      <category domain="http://securityratty.com/tag/select events">select events</category>
      <category domain="http://securityratty.com/tag/applications">applications</category>
      <source url="http://www.thecepblog.com/2008/09/06/supporting-cep-with-solace-3230-and-solace-3260-content-routers/">Supporting CEP with Solace Content Routers</source>
    </item>
    <item>
      <title><![CDATA[McIrony: An unexpected response from McAfee]]></title>
      <link>http://securityratty.com/article/b7777c8973f62604f441965769aa7200</link>
      <guid>http://securityratty.com/article/b7777c8973f62604f441965769aa7200</guid>
      <description><![CDATA[Irony: incongruity between what might be expected and what actually occurs

Right before Black Hat, I put together what I believed was a pretty strong arguement against McAfee Secure - Hacker Safe, at...]]></description>
      <content:encoded><![CDATA[Irony: incongruity between what might be expected and what actually occurs.<br /><br />Right before Black Hat, I put together what I believed was a pretty strong  arguement against McAfee Secure - Hacker Safe, at a level heretofore unexplored. I believe it was more damaging than anything I've said to date, and as such, presented potential risk for me. So I ran it by some friends before publishing it. Then a most extraordinary thing happened. I had a long chat with <a href="http://blogs.zdnet.com/security/?p=1668" target="_blank">Nate McFeters</a>, who described an awakening he'd recently experienced. He shared with me the belief that a better approach to potentially negative security research might be to try to create a positive outcome, and worry less about press cycles or exposure, the 15 minutes of fame if you will. He pointed to people like <a href="http://blogs.zdnet.com/security/?p=1030" target="_blank">Mark Dowd</a> as an example of people who conduct crushingly good research, and steer clear of the petty, ego driven  bulls**t. <br />There I sat, repose like the thinking <a href="http://www.downshoredrift.com/photos/uncategorized/thinking_man.gif" target="_blank">man</a>, frozen for minutes. "Nate", I said, "I think you're right." <br />What do I aspire to as an information security professional; more readership or street cred than the next guy, or the respect of my peers for contributing to the greater <a href="http://holisticinfosec.org/content/view/21/31/" target="_blank">good</a>? Attention, press cycles, 15 minutes...it all has its allure, trust me on this. <br />But at the end of the day, I really do want to contribute to the greater good.<br />So I did something different. I sent my findings to McAfee and offered them an opportunity to respond, rather than publish first, ask questions later. <br />Here's the real kicker. <br />They responded.<br />I had a three hour lunch this past Thursday with two gentlemen from McAfee, who flew up from the Bay Area to Seattle to have a face to face with me. This, all by itself, speaks volumes to me. In addition to meeting with Kirk Lawrence, the new Director of Product Management for McAfee Secure, there I sat with, of all people, Joe Pierini, the very guy who has suffered more than his share of abuse, up to and including the <a href="http://pwnie-awards.org/2008/awards.html">Pwnie</a>.  As I have been a direct contributor and participant in heckling Joe, you can imagine our meeting could have been uncomfortable. It was not. <br />I have had expectations of McAfee and Scan Alert that to date have not been met, or my (your) perception has been that they have not been met.<br />This meeting was designed as an opportunity to voice some of these expectations, and see if McAfee, in turn, believed there was any merit to them.<br />Surprisingly, at least as spoken, we weren't all that far apart.<br />While, as a naive idealist, I believe that security should come before conversions, I am also grounded enough of a realize that the most attainable goal can be a marriage of both. This premise frames my expectations of McAfee. <br />Can they not be more of a "thought leader" for all the Ma & Pa websites who rely on McAfee Secure, first for a higher conversion rate, then security?<br />Can they not hold merchants to a higher standard, without alienating them and losing business?<br />Can they not embrace the security research community in a fashion that McAfee, the security community, the merchants, and consumers can all benefit from?<br />Can they not be more transparent in their approach, providing more details and feedback about their methods, their findings, and their vision?<br />I know McAfee Secure - Hacker Safe scans can find vulnerabilities.<br />I know they report the vulnerabilities to merchants.<br />What happens thereafter is where things begin to break down. <br />Can the scan engine be improved to find more vulns? Sure. That's really not that big a deal; technology can always be improved.<br />But, regarding holding merchants to a higher standard; therein is the whole point of this debate. <br />Anyone can throw a badge on a site. <br />But what happens when the site proves vulnerable is the key. I'll be candid here: I don't give a damn about the merchant at that point; it's the consumer who is at risk and needs something better from McAfee and their peers.<br />So, here begins a different approach. I know that making changes at a company the size of McAfee can be likened to the three miles it takes to turn around an aircraft carrier. I'm willing to work with them, and allow for a positive outcome.<br />I have been told that, in two or three weeks, we can expect a published standard, that clearly defines exactly what the McAfee Secure product offering adheres to, inclusive of their expectations for merchant remediation timelines, potential badge downgrades for unresolved vulnerabilities, and hopefully even a more clear stance on XSS.<br />I have been told that I will have the opportunity to discuss this standard, and invite feedback. Any <a href="http://holisticinfosec.org/content/view/19/29/" target="_blank">standard</a> is better than no standard. <br />I have also been told that this is just the beginning of changes that will lead to more of what I have hoped for in my expectations, over the next 6 months or so.<br />I am hopeful that we can take McAfee at their word, and even if slowly, see a positive outcome.<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/08/mcirony-unexpected-response-from-mcafee.html&title=McIrony:%20An%20unexpected%20response%20from%20McAfee " title="McIrony: An unexpected response from McAfee ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/08/mcirony-unexpected-response-from-mcafee.html" title="McIrony: An unexpected response from McAfee ">digg</a>]]></content:encoded>
      <pubDate>Sat, 30 Aug 2008 09:04:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/mcafee">mcafee</category>
      <category domain="http://securityratty.com/tag/mcafee secure">mcafee secure</category>
      <category domain="http://securityratty.com/tag/negative security research">negative security research</category>
      <category domain="http://securityratty.com/tag/research">research</category>
      <category domain="http://securityratty.com/tag/mcafee secure product">mcafee secure product</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security research community">security research community</category>
      <category domain="http://securityratty.com/tag/information security professional">information security professional</category>
      <category domain="http://securityratty.com/tag/positive outcome">positive outcome</category>
      <source url="http://holisticinfosec.blogspot.com/2008/08/mcirony-unexpected-response-from-mcafee.html">McIrony: An unexpected response from McAfee</source>
    </item>
  </channel>
</rss>
