Friday Summary: December 3, 2010By Rich
What a week.
Last Monday and Tuesday I was out meeting with clients and prospects and was totally psyched at all the cool opportunities coming up. I was a bit ragged on Wednesday, but figured it was the lack of sleep.
Nope. It was the flu. The big FLU, not its little cousin the cold. I was laid up in bed for 4 days, alternating between shivering and sweating. I missed our annual Turkey Trot 10K, Thanksgiving, and a charity dinner at our zoo I’ve been looking forward to all year.
Then a bronchial infection set in, resulting in a chest x-ray and my taking (at one point) five different meds. Today (Thursday) is probably my first almost-normal day of work since this started. Those of you in startups know the joy that is missing unexpected time.
But all is not lost. We are in the midst of some great projects we’ll be able to provide more detail on in the coming months. We are partnering with the Cloud Security Alliance on a couple things, and finally building out our first product. I’m actually getting to do some application design work again, and I forgot how much I miss it. I really enjoy research, but even though the writing and presenting portion is a creative act, it isn’t the same as building something.
Not that I’m doing much of the coding. No one needs a new “Hello World” web app, no matter how cleverly I can use the <BLINK> tag.
On a different note, we are starting (yes, already) to put together our 2011 Guide to RSA. We think we have the trends we will cover nailed, but if you have something you’d like in the guide please let us know. And don’t forget to reserve Thursday morning for the Disaster Recovery Breakfast.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian on Database Password Crackers.
- Rich quoted in SC: WikiLeaks prompts U.S. government to assess security. No easy tech answers for leaks, folks.
- Mike on consumerization of IT security issues at Threatpost.
- Rich wasn’t on the Network Security Podcast, but you should listen anyway.
Favorite Securosis Posts
- Adrian Lane: Criminal Key Management Fail. No Sleep Till…
- David Mortman: Are You off the Grid?
- Mike Rothman: Are You off the Grid? You’ve got no privacy. Get over it. Again.
- Rich: Counterpoint: Availability Is Job #1. Actually, read the comments. Awesome thread.
Other Securosis Posts
- I can haz ur email list.
- Incite 12/1/10: Pay It Forward.
- Holiday Shopping and Security Theater.
- Grovel for Budget Time.
- Ranum’s Right, for the Wrong Reasons.
- Incident Response Fundamentals: Phasing It in.
- Incite 11/24/2010: Fan Appreciation.
- I Am T-Comply.
- Meatspace Phishing Encounter.
- Availability and Assumptions.
Favorite Outside Posts
- Adrian Lane: Security Offense vs. Defense. It’s a week old, but I thought this post really hit the mark.
- David Mortman: Software [In]security: Cyber Warmongering and Influence Peddling.
- Mike Rothman: And Beyond…. We all owe a debt of gratitude to RSnake as he rides off into the sunset. To pursue of all things – happiness. Imagine that.
- Rich: More than just numbers. Jack Jones highlights why no matter what your risk approach – quantitative or qualitative – you need to be very careful in how to interpret your results.
- Mike Rothman: Palo Alto Networks Initiates Search for Top Executive. Rarely do you see a white-hot private start-up take out the CEO publicly over differences in “management philosophy.” Board room conversations must have been ugly.
- Chris Pepper: Modern Espionage and Sabotage.
Project Quant Posts
Research Reports and Presentations
- The Securosis 2010 Data Security Survey.
- Monitoring up the Stack: Adding Value to SIEM.
- Network Security Operations Quant: Metrics Model.
- Network Security Operations Quant Report.
- Understanding and Selecting a DLP Solution.
- White Paper: Understanding and Selecting an Enterprise Firewall.
- Understanding and Selecting a Tokenization Solution.
Top News and Posts
- Chrome Gets a Sandbox for the Holidays.
- Wordpress Fixes Vuln.
- RSnake’s 1000th post.
- Top Web Hacking Techniques Contest. Some great links!
- Robert Graham and the TSA. Kinda fun following his rants about the TSA.
- User Profiles Security Issue on Twitter.
- Ford employee stole $50M worth of secrets.
- Armitage UI for metasploit.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week is a bit different – we had a ton of amazing comments on Firestarter: A Is Not for Availability and Counterpoint: Availability Is Job #1. Far too many to choose just one, so this is a group award that goes to:
Somebloke Mark Wallace endo Steve Paul ds Dean Matt Franz Lubinski LonerVamp Franc mokum von Amsterdam TL sark Andrew Yeomans
And of course, Adrian, Mike, Gunnar, and Mortman.