Earlier this week I was at the gym. I’d just finished a pretty tough workout and dropped down to the cafe area to grab one of those adult candy bars that tastes like cardboard and claims to give you muscles, longer life, and sexual prowess while climbing mountains. At least, that’s what I think they claim based on the pictures on the box. (And as a former mountain rescue professional, the technical logistics of the last claim aren’t worth the effort and potential injuries to sensitive bits).
Anyway, there was this woman in front of me, and her ordering process went like this:
- Ask for item.
- Ask for about 5-6 different options on said menu item, essentially replacing all ingredients.
- Look surprised when a number following a dollar sign appears on the little screen facing her on the cash register.
- Reach down to gym bag.
- Remove purse.
- Reach into purse.
- Remove wallet.
- Begin scrounging through change.
- See salad in cooler out of corner of eye.
- Say, “Oh! I didn’t see that!”
- Walk to cooler, leaving all stuff in front of register, with transaction in the middle.
- Fail to see or care about line behind her.
At this point, as she was rummaging through the pre-made salads, the guy behind the register looked at me, I looked at him, and we both subconsciously communicated our resignation as to the idiocy of the display in front of us. He moved over and unlocked the next register so I could buy my mountain-prowess-recovery bar, at which point the woman returned to the register and looked surprised that he was helping other (more decisive and prepared) customers.
One of my biggest pet peeves is people who lack awareness of the world around them. Which is most people, and probably explains my limited social life. But they probably hate judgmental sanctimonious jerks like me, so it all works out.
Just think about how many fewer security (and other) problems we’d have in the world if people would just swivel their damn heads and consider other people before making a turn? John Lennon should write a song about that or something.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Mike and Adrian on Open Network Podcast. Talking Open Source software vulnerabilities.
- Rich, Martin and Zach on the Network Security Podcast.
- Rich quoted on DLP in eWeek.
Favorite Securosis Posts
- Adrian Lane: IBM gets a BigFix for Tivoli Endpoint Management. Congratulations to the BigFix team!
- Mike Rothman: IBM gets a BigFix. Normally I don’t toot my own horn, but this was a good deal of analysis. Fairly balanced and sufficiently snarky…
- David Mortman: Understanding and Selecting a Tokenization Solution: Introduction.
- Rich: Ditto.
Other Securosis Posts
- Understanding and Selecting SIEM/LM: Integration.
- Know Your Adversary.
- Tokenization: the Business Justification.
- Understanding and Selecting SIEM/LM: Advanced Features.
- Incite 6/30/2010: Embrace Individuality.
- Understanding and Selecting SIEM/LM: Data Management.
- DB Quant: Manage Metrics, Part 3, Change Management.
Favorite Outside Posts
- Adrian Lane: Full Disclosure: Our Turn Not only does this show just how easily this can happen – to anyone – but it underscores the difficulty for sites built from dozens of components from different vendors. The “weakest link in the chain” rule applies.
- David Mortman: Same for me – Full Disclosure, Our Turn.
- Rich: A great TED talk on self deception. I really love better understanding our own biases.
Project Quant Posts
- DB Quant: Protect Metrics, Part 2, Patch Management.
- DB Quant: Manage Metrics, Part 1, Configuration Management.
- DB Quant: Protection Metrics, Part 4, Web Application Firewalls.
Research Reports and Presentations
- White Paper: Endpoint Security Fundamentals.
- Understanding and Selecting a Database Encryption or Tokenization Solution.
- Low Hanging Fruit: Quick Wins with Data Loss Prevention.
Top News and Posts
- Rich and Adrian in Essentials Guide to Data Protection.
- Justices Uphold Sarbanes-Oxley Act. Laughably, some parties complained SOX is not being followed by foreign companies! Heck, US comapnies don’t follow SOX! Off balance-sheet assets? Synthetic CDO’s? Please, stop pretending.
- Alleged Russian agents used high-tech tricks. Review of how the alleged Russian spies allegedly moved data. Interesting mix of old techniques and new technologies. But as any information can be digitized, the risk of being caught is far less, and prosecution much more difficult, if spy and spy-handler are never in the same spot together.
- Twitter mandated to establish information security program.
- Destimation Hotels breached.
- FBI fails to crack TrueCrypt.
- Top applications fail to leverage Windows security protections. This is a huge deal – if the apps don’t opt into anti-exploitation, they are essentially a dagger straight to the heart of the OS if an attacker finds a vuln.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Michael O’Keefe, in response to The Open Source Database Security Project.
Adrian – thanks for the reply. Maybe risk assessment wasn’t the right word – I was thinking of some sort of market analysis to determine which open source databases to focus on. I was using selection criteria like “total number of installations” and “total size in bytes”, etc, but user groups is indeed a good criterion to use, since you are targeting an audience of actual ordinary users, not mega companies like facebook and twitter that should be managing the security themselves.
Maybe these types of distributed databases (bigtable, Cassandra) should be the focus of separate project? A quick search of Securosis shows one mention of bigtable, so while I don’t want to expand the scope of the current project, these “storage systems” do offer some interesting security problems. For example here Peter Fleischer from Google discusses the difficulty in complying with the EU Data Protection Directive:
http://peterfleischer.blogspot.com/2009/04/cloud-policy-consequences-for-privacy.html
Reader interactions
2 Replies to “Friday Summary: July 1, 2010”
I hate that bloody woman. I wish she’d stay in Phoenix.
Had the same sort of thing at the museum today. Standing there in front of an exhibit and some moron (who was reading the info blurb aloud to himself) stepped directly in front of me so *I* couldn’t see it. He jumped quite well when I said “excuse me” directly into his right ear, from about an inch away.. and perhaps a little louder than is kosher in a museum. 🙂
I can fully feel your pain on the transaction at the gym cafe….obliviousness is PAINFUL.