Friday Summary - July 24, 2009By Adrian Lane
“Hi, my name is Adrian, and, uh … I am a technologist” …
Yep. I am. I like technology. Addicted to it in fact. I am on ‘Hack A Day’ almost once a day. I want to go buy a PC and over-clock it and I don’t even use PCs any more. I can get distracted by an interesting new technology or tool faster than a kid at Toys R Us. I have had a heck of a time finishing the database encryption paper as I have this horrible habit of dropping right down into the weeds. Let’s look at a code sample! What does the API look like? What algorithms can I choose from? How fast is the response in key creation? Can I force a synch across key servers manually, or is that purely a scheduled job? How much of the API does each of the database vendors support? Yippee! Down the rabbit hole I go …
Then Rich slaps me upside the head and I get back to strategy and use cases. Focus on the customer problem. The strategy behind deployment is far more important to the IT and security management audiences than subtleties of implementation, and that should be the case. All of the smaller items are interesting, and may be an indicator off the quality of the product, but are not a good indicator to the suitability of a product to meet a customers need. I’ll head to the technologist anonymous meeting next week, just as soon as I wrap the recommendations section on this paper.
But the character flaw remains. In college, studying software, I was not confident I really understood how computers worked until I went down into the weeds, or in this case, into the hardware. Once I designed and built a processor, I understood how all the pieces fit together and was far more confident in making software design trade-offs. It’s why I find articles like this analysis of the iPhone 3GS design so informative as it shows how all of the pieces are designed and work together, and now I know why certain applications perform they way they do, and why some features kill battery life. I just gotta know how all the pieces fit together!
I think Rich has his addiction under control. He volunteers to do a presentation at Defcon/Black Hat each year, and after a few weeks of frenzied soldering, gets it out of his system. Then he’s good for the remainder of the year. I think that is what he is doing right now: bread board and soldering iron out, and making some device perform in a way nature probably did not intend it to. Last year it was a lamp that hacked your home network. God only knows what he is doing to the vacuum cleaner this year!
A couple notes: We are having to manually approve most comments due to the flood of message spam. If you don’t see your comment, don’t fret, we will usually open it up within the hour. And we are looking for some intern help here at Securosis. There is a long list of dubious qualities we are looking for. Basically we need some help with some admin and site work, and in exchange will teach you the analyst game and get you involved with writing and other projects. And since our office is more or less virtual, it really does not matter where you live. And if you can write well enough you can
help me finish this damned paper and write the occasional blog post or two. We are going to seriously look after Black Hat, but not before, so get in contact with us next month if you are interested. We’re also thinking we might do this in a social media/community kind of way, and have some cool ideas on making this more than the usual slave labor internship.
As both Rich and I will be at Black Hat/Defcon next week, there will not be a Friday summary, but we will return to our regularly scheduled programming on the 7th of August. We will be blogging live and I assume we’ll even get a couple of podcasts in. Hope to see you at BH and the Disaster Recovery Breakfast at Cafe Lago!
Hey, I geek out more than once a year! I use microcontrollers in my friggen Halloween decorations for Pete’s sake! -rich
And now for the week in review:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich and Martin in Episode 159 of the Network Security Podcast.
- Rich wrote an article on iPhone 3GS security over at TidBITS.
Favorite Securosis Posts
- Rich: Adrian’s post on the FTC’s Red Flag rules.
- Adrian: Amazon’s SimpleDB looks like it is going to be a very solid, handy development tool.
Other Securosis Posts
Project Quant Posts
Favorite Outside Posts
- Adrian: Jack Daniel’s pragmatic view on risk and security.
- Rich: Techdulla with a short post that makes a very good point. I have a friend in exactly the same situation. Their CIO has no idea what’s going on, but spends a lot of time speaking at vendor conferences.
Top News and Posts
- Get ready for Badge Hacking!
- RSnake and Inferno release two new browser hacks.
- I want to be a cyber-warrior, I want to live a life of dang-er-ior, or something like that.
- A great interview with our friend Stepto on gaming safety.
- The Pwnie award nominations are up.
- The dhcpclient vulnerability is very serious, and you shouldn’t read this post.
- There is another serious unpatched Adobe Flash/PDF vulnerability.
- George Hulme with some sanity checking on malware numbers.
- Medical breach reports flooding California.
Blog Comment of the Week
This week’s best comment comes from Bernhard in response to the Project Quant: Create and Test Deployment Package post:
I guess I’m mosty relying on the vendor’s packaging, being it opatch, yum, or msi. So, I’m mostly not repackaging things, and the tool to apply the patch is also very much set.
In my experience it is pretty hard to sort out which patches/patchsets to install. This includes the very important subtask of figuring out the order in which patches need to be applied.
Having said that, a proper QA (before rollout), change management (including approval) and production verification (after rollout) is of course a must-have.