Friday Summary: January 13, 2012By Adrian Lane
You’ve probably noticed we have not been doing a lot of blogging lately. Sorry about that – we’ll start back up with a bang very soon. This will be a very exciting year for Securosis – we have a bunch of projects in the pipe. I’ll be launching a re-start of the Database Activity Monitoring 2.0 series now that we have finally settled on the terminology and done sufficient research on the trends to actually convey what’s going on. Mike and I want to cover some Log Management topics, and I have a data masking research project underway as well. All that is over and above new developments with the Securosis Nexus, the Cloud Security Alliance Training, and our RSA Guide – so Q1 will be very busy and we will be writing a lot. I’ll publish my Q2 research agenda in the coming weeks, so if you have anything you want to talk about at RSA we can go into detail then. And I wanted to comment on a ton of great posts I have seen, but alas…
On a personal note, during the Christmas break I was wandering the local mall, when I saw this guy with a mountain bike. It’s cool! It’s got carbon fiber, big-azz shocks, and hydraulic disk brakes. He let me pick it up and it’s like 20 lbs. 20 lbs is less than a tire from my old bike! So I was fascinated. I had to have one. I did some looking on the Internet and decided to visit the last couple bike shops still in business in my area. I found a bike I like, they threw some pedals on it, and I headed out.
I got on the bike and the first thing that ran through my mind was “FREEDOM! I can go anywhere. And I should!” Weird. Freedom. I felt like a kid with my first new bike – which would prove prophetic as I crashed it 4 times a few days later, just as I did with my first bike at age four. That was a weird sensation. It’s not like I don’t have freedom, and I have owned cars since I was sixteen, so I can pretty much go anywhere I want. But this was different. I went back into the shop, and the guy asked me how I liked it. “Beautiful” I said, and bought it. I got home, saddleed up, and headed straight out into the desert. I just pointed the bike in a direction I had never gone, over a hill I had never seen the other side of, and started pedaling. Open desert. Cactus, coyotes, and boulders be dammed! And it was awesome.
Of course there are practical downsides to this freedom – other than plucking thorns out of my skin with tweezers and bathing road rash in betadine. I have over 10k hours on a BMX bike as a kid, and 5k hours on road bikes, so I considered myself an expert rider. Wrong! This is a totally difference experience. I am a novice, as proven emphatically by the four crahes on my second ride. Well, ‘crashed’ is not quite correct – technically the bike and I just swapped places, with the bike taking me for a short ride. And as with a new pair of shoes, you should make sure everything is broken in and comfortable before you go pushing the envelope. I found out – about 2 milliseconds after I needed to bail out – that my new snap-in pedals were much too tight. Jumping simply meant the bike followed me, turning the tables, so it was – ahem – in the driver’s seat. And I learned that mountain bikes have a variable stall speed: when pedaling furiously uphill in low gear you don’t actually have sufficient momentum to go over boulders like a badass – instead you can quickly find yourself going backwards. It’s a thought-provoking experience.
Regardless, I am hooked. And now Christmas break is over and I am back at work. But like a little kid I keep looking out the window, wishing I could play with my new Christmas toy instead of talking to this vendor about a product of questionable quality, with its suspect value proposition. “Please tell me more about how you stop APT in a totally new way nobody has ever thought of before.” sigh
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian quoted in Sandhill Channels.
- Rich’s guest post on Trustworthy Computing.
- Mike and Jack Daniel on Continuous Monitoring.
- Checking out a bootable Windows TPM thumb drive.
- Incite 1/11/2012: Spoilsport.
- Social Security Blogger Awards: Voting Open!
- Network-based Malware Detection: Where to Detect the Bad Stuff?
Favorite Outside Posts
- Mike Rothman: Costco’s Value Chain. Of course it’s Gunnar who points out a great perspective on understanding your company’s value and sticking to that, using an example from Costco. Even if it’s hard. Even if it costs money in the short term.
- Rich: Nick Selby on how we need to stop blaming the victims. I’m not going to defend Stratfor’s massive mistakes, but we need to stop acting like a room full of a-holes, blaming the victims of crimes for being stupid… especially because we will all be eventual victims. And for the record, good luck using my 20-character random Stratfor password.
- Adrian Lane: Apple iWallet Security? Leverage “what you have” security – provided you don’t leave it in your hotel room!
- Dave Mortman: AES on the iPhone isn’t broken by Default.
Project Quant Posts
- Malware Analysis Quant: Find Infected Devices.
- Malware Analysis Quant: Defining Rules.
- Malware Analysis Quant: The Malware Profile.
- Malware Analysis Quant: Dynamic Analysis.
- Malware Analysis Quant: Static Analysis.
- Malware Analysis Quant: Build Testbed.
- Malware Analysis Quant: Confirm Infection.
- Malware Analysis Quant: Process Map (Draft 1).
Research Reports and Presentations
- Applied Network Security Analysis: Moving from Data to Information.
- Tokenization Guidance.
- Security Management 2.0: Time to Replace Your SIEM?.
- Fact-Based Network Security: Metrics and the Pursuit of Prioritization.
- Tokenization vs. Encryption: Options for Compliance.
- Security Benchmarking: Going Beyond Metrics.
- Understanding and Selecting a File Activity Monitoring Solution.
- Database Activity Monitoring: Software vs. Appliance.
Top News and Posts
- STRATFOR’s response. A worthwhile listen. And they have done another smart thing by hiring SecTheory to sort it out.
- Schneier’s rants on the TSA Cupcake and the Cupcake in a Jar are pretty funny and worth reading.
- Internet Access not a Human Right.
- US Citizen? Vote No! Not to get all preachy and political, but this bill is bad news!
- Not punch-drunk yet from the never-ending series of Adobe patches? Good, because here comes another one.
- Couple sues US bank for acting like the IRS.
- OpenSSL patched.
- Shazzer – the Online Fuzzer.
Blog Comment of the Week
No comments this week.