For a while now I’ve been lamenting the decline in security blogging. In talking with other friends/associates, I learned I wasn’t the only one. So I finally got off my rear and put together a post in an effort to try kickstarting the community. I don’t know if the momentum will last, but it seems to have gotten a few people back on the wagon.
Alan Shimel reports he’s had about a dozen new people join the Security Blogger’s Network since my post (although in that post he only lists the first three, since it’s a couple days old). We’ve also had some old friends jump back into the fray, such as Andy the IT Guy, DanO, LoverVamp, and Martin.
One issue Alan and I talked about on the phone this week is that since Technorati dropped the feature, there’s no good source to see everyone who is linking to you. The old pingbacks system seems broken. If anyone knows of a good site/service, please let us know. Alan and I are also exploring getting something built to better interconnect the SBN. It’s hard to have a good blog war when you have to Tweet at your opponent so they know they’re under attack.
Another issue was highlighted by Ben Tomhave. A lot of people are burnt out, whether due to the economy, their day jobs, or general malaise and disenchantment with the industry. I can’t argue too much with his point, since he’s not the only semi-depressed person in our profession. But depression is a snowballing disorder, and maybe if we can bring back some energy people will get motivated again.
Anyway, I’m psyched to see the community gearing back up. I won’t take it for granted, and who knows if it will last, but I for one really hope we can set the clock back and party like it’s 2007.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Rich will be on NPR’s Science Friday today! Talking about Facebook and privacy. It’s on at 3 PM ET, and yes, it’s going to his head.
- Adrian’s TechTarget article on DAM. Implementing database monitoring for 201 CMR 17 compliance.
- Anton covers Rich’s Secure360 presentation.
- How to Protect Your Privacy from Facebook. Rich goes pretty in-depth in this TidBITS article on Facebook privacy.
Favorite Securosis Posts
- Adrian Lane: Oracle’s Acquisition of Secerno.
- Mike Rothman: Is Twitter Making Us Dumb? Bloggers, Please Come Back. Get off the Twitter and think full thoughts. Please.
- Rich: Symantec’s Identity Crisis.
Other Securosis Posts
- Quick Wins with DLP Webcast Next Week.
- Privacy is (Still) Personal.
- Australian Border Security Insanity.
- Lessons from LifeLock’s Lucky 13.
- How to Survey Data Security Outcomes?
- Incite 5/19/2010: Benefits of Bribery.
- Understanding and Selecting SIEM/LM: Business Justification.
- Talking Database Assessment with Imperva.
- FireStarter: Killing the Next Generation.
Favorite Outside Posts
- Rich: Anton has a compliance epiphany He gets it. Compliance is only a force to change the economics in a non-self-correcting system.
- Adrian Lane: What The Internet Knows About You Very interesting look at the security implications of web browser caching.
- Mike Rothman: Presenting the humble ukulele: Jake Shimabukuro wows TEDxTokyo Who thought a ukulele could be so cool? But this is really about managing expectations…. (I think I saw him play live at a Jimmy Buffett show –Rich)
Project Quant Posts
- DB Quant: Planning Metrics (Part 4).
- DB Quant: Planning Metrics (Part 3): Planning for Monitoring.
- DB Quant: Planning Metrics (Part 2).
- DB Quant: Planning Metrics (Part 1).
Research Reports and Presentations
- Understanding and Selecting a Database Encryption or Tokenization Solution.
- Low Hanging Fruit: Quick Wins with Data Loss Prevention.
Top News and Posts
- WordPress Attacks Ongoing.
- Fraud Bazaar Carders.cc Hacked.
- Feds seek feedback on “game changing” R&D ideas.
- Commercial Quantum Cryptography System Hacked.
- Hardware Lockdown Initiative Cracks Down On Cloning, Counterfeiting.
- Andy the IT Guy with a great policy post.
- If you’re going to the Cloud, seek the advice of an expert.
- Technical details of the Street View WiFi payload controversy This shouldn’t be a controversy. Rob Graham explains why.
- Heartland Settles with MasterCard.
- Local utility fined for SCADA security violations.
Blog Comment of the Week
Remember, for every comment selected, Securosis makes a $25 donation to Hackers for Charity. This week’s best comment goes to Pablo, in response to How to Survey Data Security Outcomes?
In terms of control effectiveness, I would suggest to incorporate another section aside from ‘number of incidents’ where you question around unknowns and things they sense are all over the place but have not way of knowing/controlling.
I’ll break out my comment in two parts: 1 – “philosophical remarks” and 2 – suggestions on how to implement that in your survey
1 – “philosophical remarks”
If you think about it, effectiveness is the ability to illustrate/detect risks and prevent bad things from happening. So, in theory, we could think of it as a ratio of “bad things understood/detected” over “all existing bad things that are going on or could go on” (by ‘bad things’ I mean sensitive data being sent to wrong places/people, being left unprotected, etc. – with ‘wrong/bad’ being a highly subjective concept)
So in order to have a good measure of effectiveness we need both the ‘numerator’ (which ties to your question on ‘number of incidents’) and also a ‘denominator’
The ‘denominator’ could be hard to get at, because, again, things are highly subjective, and what constitutes ‘sensitive’ changes in the view of not only the security folks, but more importantly, the business. (BTW, I have a slight suggestion on your categories that I include at the bottom of this post)
However, I believe it is important that we get a sense of this ‘denominator’ or at least the perception of this ‘denominator’. My own personal opinion on this, by speaking to select CISOs is they feel things are ‘all over the place’ (i.e., the denominator is quite quite large).
2 – Suggestions on how to implement that in your survey
(We had to cut this quote for space, but they were great, practical suggestions – see the full comment at the original post).
Comments