Friday Summary: July 15, 2010By Rich
I’ve been living full time in Phoenix, Arizona for about 5 years now, and about 2 years part time before that. This was after spending my entire adult life in Boulder Colorado thanks to parole at the age of 18 from New Jersey. Despite still preferring the Broncos over the Cardinals, I think I’ve mostly adjusted to the change.
But damn, sometimes I wonder about this place.
First there’s the heat. It’s usually pretty tolerable up to about 100-105 Fahrenheit, thanks to the low humidity. When the humidity starts to creep up in the summer it leads directly to the monsoon rains which cool things down. Usually. Right now we’re hitting humidity as high as 30% with temps breaking 110F. The high this week is expected to hit 116F. We’re talking it’s so hot that the health department issued a warning that kids could get second degree burns from the pavement.
The heat also seems to be frying brains a bit.
- First up is our politicians, who don’t seem to realize that when you claim to be the number 2 kidnapping capital in the world (totally untrue), people might not come and visit no matter how many tourism ads you fund.
- Then there’s my neighbor. I’m not sure exactly which neighbor, but the one that lets their dog out in the morning while the coyotes are out. I was running today when I saw the dog outside, completely unmonitored, during prime snack time. Coyotes might actually play with bigger dogs, but the little ones are pretty much yappy snausages with legs.
- Finally, back on crime, we find the most awesome local news crime story in history. The good news? An armed home invader was shot. The bad news? By the 3 better-armed invaders already in the home holding the family hostage. It’s like the DefCon CTF. With guns.
I think it’s kind of cool I live in a state where I don’t need a gun, because if someone breaks into my home the odds are I’ll either be holed up in a trunk while my family finds ransom money, or the early bird bad guys will defend their turf and property (me and what was previously my property).
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich quoted in an article on Websense’s release of downloadable DLP.
- Rich and Adrian in Essentials Guide to Data Protection.
- Rich mentioned in Bill Brenner’s article on security terminology.
Favorite Securosis Posts
- Adrian Lane: Tokenization Architecture: The Basics.
- Mike Rothman: Preliminary Results from the Data Security Survey. We still suck at sharing information, but Rich’s survey is a good start. Can’t wait to see the more detailed analysis.
- David Mortman: Home Business Payment Security.
- Rich: Color-blind Swans and Incident Response.
Other Securosis Posts
- Simple Ideas to Start Improving the Economics of Cybersecurity.
- Incite 7/14/2010: Mello Yello.
- Top 3 Steps to Simplify DLP without Compromise.
- Taking the High Road.
Favorite Outside Posts
- Adrian Lane: Core Data and Enterprise iPhone Applications. Interesting comments on iPhone/iPad data security.
- Mike Rothman: The exception IS the rule. Shrdlu nails it here. Read this, but only if you want to have a fighting chance at being a security professional. If you just want to whinge about how crappy life is, don’t read this.
- David Mortman: Network Forensics Vendors: Get in the Cloud!.
- Chris Pepper: Firefox security test add-on was backdoored. User/Password capture snuck into a fraudulent Mozilla plugin, which was publicly posted and downloaded – and apparently bundled in a pen-testing kit!
- Chris Pepper: The exception IS the rule. Shrdlu: “This IS normal, you idiot.”
Project Quant Posts
- NSO Quant: Define Policies Sub-Process.
- NSO Quant: Enumerate and Scope Sub-Processes.
- DB Quant: Protect Metrics, Part 2, Patch Management.
Research Reports and Presentations
- White Paper: Endpoint Security Fundamentals.
- Understanding and Selecting a Database Encryption or Tokenization Solution.
- Low Hanging Fruit: Quick Wins with Data Loss Prevention.
Top News and Posts
- Oracle to release 59 critical patches in security update. Is it just me, or do they have more security patches than bug fixes nowdays?
- Connecticut AG reaches agreement with Health Net over data breach.
- Visa Tokenization Recommendations (PDF). I’ll have more to say about this in a follow-up post tomorrow.
- Justices Uphold Sarbanes-Oxley Act. Laughably, some parties complained SOX is not being followed by foreign companies? Heck, U.S. companies don’t follow SOX! Off balance sheet assets? Synthetic CDO’s? Please, stop pretending.
- Alleged Russian agents used high-tech tricks. Review of how the alleged Russian spies allegedly moved data. Interesting mix of old techniques and new technologies. But as any information can be digitized, the risk of being caught is far less, and prosecution much more difficult if spy and spy-handler are never in the same place.
- Microsoft opens center to report identity theft data repositories. A great idea.
- Talk on Chinese cyber armies pulled from Black Hat. Due to pressure on the presenter from the Taiwanese government.
- Large number of attacks using the Windows 0day dropped by a Google employee.
- Microsoft issues final security patches for Windows XP SP2 and Windows 2K.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Jesse Krembs, in response to Simple Ideas to Start Improving the Economics of Cybersecurity.
Having incident response costs borne by the the business unit that is breached/responsible seems like a great idea. Tying it to performance bonuses seems like an idea worth exploring as well. Maybe a little $$$ motivation for stopping people in the hall who don’t have there badge for example. It makes me think that security groups inside a company should act in a consultant/regulator roll. Enforce a minimum rule set, that each department must live up to. Sell added security to departments as needed/affordable.
Figuring out how to tie the money to security performance without rolling a giant FUD ball is key and difficult.