Research

New IE Flaw Exploited on Porn Sites Now we did warn you, and I quote: Especially if you go to “those” sites. Yes, you. Stop pretending you don’t know what I’m talking about. For the record “those sites” are porn and gambling. So you poker addicts are next. And you file sharers- don’t start thinking you’re all safe or something. Those torrent trackers are web pages you know. Of course Disney World fingerprints everyone these days, so maybe they’ll pick this up. Share:

To whom it may concern, While, as a security professional, I take great care to protect all of my systems and data, I cannot guarantee that I am fully compliant with both the HIPAA security and privacy requirements. I have never undergone a HIPAA audit, nor any official HIPAA training or evaluations of any kind beyond those provided to first responders. For your information I do take extensive security precautions including: Hardware and software firewalls on all systems and networks Home directory encryption on my primary Mac Antivirus/antispyware on all Windows systems OS hardening and service minimization Rapid deployment of all security updates Despite these precautions I believe you should discontinue faxing medical records to my online fax system as I cannot guarantee I am handling said records within HIPAA guidelines. While I appreciate the amnio results and insurance records disputes (for multiple patients) they do not directly affect the patient care I administer as a former ski patroller and disaster medic. It is, however, good to know that should I manage to perform an amniocentesis on my pregnant patients in the middle of a ski slope you will be able to provide me with accurate and timely results. By faxing my online system (which forwards to my work email) your medical records are subject to a number of possible security risks, including, but not limited to: Interception on my corporate email server Review by unauthorized persons Loss due to lost backup tapes of said email system Other standard security vulnerabilities I do appreciate you value my medical opinion (since I’m only an EMT/washed-up paramedic) and my input on billing issues (for which I have no training). That said, you should probably remove me from your consultation list. Sincerely, Rich ((Doesn’t it make you feel just peachy that the entire healthcare industry still runs on fax for medical orders, results, and billing? And may have sent me your colonoscopy results?)) Share:

Symantec has just reported a new 0day security vulnerability in Internet Explorer that could allow someone to take over your computer. For you non-geeks a 0day (or zero-day, or 0-day) is a vulnerability without a patch. In other words, you can’t fix the flaw on your computer so you either have to block the attacks before they hit you or disable the vulnerable software. While details are sketchy it looks like this particular vulnerability could allow an attacker to take over your computer when you visit a website with the attack code on it. This isn’t the first time we’ve seen this in Internet Explorer (and a few other browsers) but if you’ve ever found some nasty spyware or a bot on your computer it’s quite possible this is how you got it. Especially if you go to “those” sites. Yes, you. Stop pretending you don’t know what I’m talking about. While you can turn off ActiveX in your browser at this point I recommend using an alternate browser until this flaw is patched. If you’re reading this site odds are you already use Firefox, but if not go and install it right now by clicking here. You can also download the beta of Internet Explorer 7, which seems to be safe. You Mac users are safe. Personally I use Safari and Firefox on my Mac, but I still use Internet Explorer for some sites on my PCs. Rumor is IE7 is pretty good, and much more secure than current versions, for those of you that want to keep using IE. Don’t forget to tell grandma… Share:

I travel a lot, and on occasion I’ll run Nmap or some other scanner from my hotel room to get an idea of what’s out there, and how dangerous these hotel networks really are. To be honest it’s not something I do all that much anymore since even scanning an open network is running the risk of being considered over the line. But I just discovered a new security tool. It’s free. And it even plays music! Yes, the ever venerable and recently updated iTunes turns out to be an honest to goodness, if limited, security scanner. How? Well, I arrived in my hotel room last night, connected to the network, and launched iTunes for some background working music. Very quickly I saw four shared iTunes libraries on the network (without even looking actively, if you have iTunes set to find shared libraries they pop up all on their own after that). Some of my fellow traveler’s musical tastes are fairly interesting. In three of the four libraries the users conveniently included their personal name in their shared library name. One user even had the word “Limewire” in his (judging by his real name) library name. Huh. I wonder if he acquired all the music legally? Thus iTunes is now my new network security tool- I can instantly tell if I’m connected to a switched or segregated network, and even pick up the names and listening habits of other hotel guests. Anyone know if the RIAA offers a bounty? I mean they sue grandmothers and children, I don’t see why they wouldn’t start a confidential informant project. (Update 9/16 : DM and Chris Pepper remind me this feature isn’t anything new. Actually, I’ve used it for years on my home network, but this is the first time I’ve noticed random users on a hotel network and I found it amusing.) Share:

Electronic voting seems to be popping up again thanks to our favorite digital ostrich, Diebold. Martin Mckeay’s also writing on this a bit, and it’s well worth reading. This isn’t the first time I’ve mentioned this, and I didn’t come up with the idea, but with the most recent Diebold gossip I think it bears repeating. Gambling systems, electronic or physical, undergo extensive testing, validation, and auditing. We’re not just talking hacking, they shock the darn things with cattle prods and attack them using such phenomenally creative techniques that I’m awestruck the few times they show it on Discovery channel specials. And it’s the complete system that’s tested and audited constantly- even the odds distributions among video poker clusters in casinos (which are audited externally by various gambling commissions in the sin city of your choice). What does this have to do with voting? Gambling systems are somewhat unique in that pretty much everyone involved has an incentive to cheat everyone else. Were talking about a system where no one can really trust anyone. Sure, casinos (at least in Vegas) are on the up and up, but do any of you really trust them? They sure can’t afford to trust us, and pretty much no one trusts the government. The result? Some fracking good security. So here we have a highly secure system of numerous specialized electronic devices operating in a networked (or non-networked) environment with near-perfect auditability. Hmm, where else might we want a similar system? Heck- they even already have testing labs and audit standards. Funny how closely related gambling and politics are. I wonder if cattle prods are illegal in voting booths? I wonder how long Diebold would survive in Vegas? (I’ll be the first to admit us security types have a habit of blabbing on any topic we can possibly stuff into the security bucket, but electronic voting happens to be one of the areas where our experience is directly applicable. I don’t know too many (any) security types that try to justify Diebold’s positions. They’re either criminal or mentally incompetent.) ((And speaking of casinos- one of my favorite memories of Defcon was how none of the stores in the casino would take credit cards during the event.)) Share:

I’m out on the road this week, right now spending two days at a strategic planning session with a large energy company. This is the kind of trip I actually enjoy- working with an end-user on strategic issues at the executive level where they really want to solve the problem. The theme of the day is major disruptions- how to stay in business in the face of massive disasters that go well beyond disaster recovery. I’m just one of about a dozen outsiders brought in to try and get people thinking in new directions. Someone saw one of my presentations on responding to Katrina (I’m a reservist on a federal team) and thought a little on the ground experience might liven the discussions. I’m more than happy to stay at a nice hotel and tell rescue war stories while drinking fine wine (as opposed to pissing off my friends telling the same damn story for the 50th time after too many drinks). One of the presentations on crisis communications was particularly interesting. No, not ham radios, but how do governments and organizations communicate with the public during a disaster? The academic they brought in had some very compelling examples ranging from nuclear power accidents, to the air quality in lower Manhattan after 9/11, to chemical spills, to product recalls. One message emerged load and clear- liars always get caught… eventually. But they’ll probably get away with it in the short term. I asked him directly if he knows of any successful cases where a corporation or government attempted to spin a situation through obfuscation or outright deception and actually got away with it. His answer? In the long term- no. In the short term- yes, but the long term impact is usually magnified when the truth emerges. The most successful crisis communications? Honesty, transparency, and openness (even if spun a little). Seems like a pretty valuable lesson to us in security. Any security professional will eventually deal with a breach, or on the vendor side with a bad vulnerability. The more we try and cover something up the worse it is for us in the long run. A few quick examples? Look at Cisco and the Mike Lynn situation. I hear there are some job openings at Ohio State. Choicepoint swapped CISOs after their breach, even though it wasn’t an IT security failure. We can go on and on- can anyone think of a single security breach or vulnerability disclosure where the organization involved didn’t get caught in a lie or cover up? Same goes for vendors exaggerating product capabilities. I know one that recently changed their entire management team because the old CEO thought he could fool the market just long enough to get bought. Too bad the board didn’t buy it. He’s out of a job (but I’m sure he got a nice package). The bad news is you can get away with it in the short term, but I’m not sure how that really helps you as an individual, or your company, if eventually you’ll get fired. You see lying is like crack- a short term high, but in the end you’ll end up naked in front of a dumpster with a crack pipe in an uncomfortable orifice. I suppose that’s okay if it’s what you’re into. Personally, I’ll stick to the truth and head downstairs for some free wine. (P.S.- the exception to all of this, of course, is politicians. I think it’s either because we’re lazy as voters, or because they all eventually smell the same. Probably a little of both) Share:

From http://www.september11victims.com/september11victims/victims_list.htm WORLD TRADE CENTER Gordon McCannel Aamoth, 32, New York, N.Y. Maria Rose Abad, 49, Syosset, N.Y. Edelmiro (Ed) Abad, 54, New York, N.Y. Andrew Anthony Abate, 37, Melville, N.Y. Vincent Abate, 40, New York, N.Y. Laurence Christopher Abel, 37 William F. Abrahamson, 58, Cortland Manor, N.Y. Richard Anthony Aceto, 42, Wantagh, N.Y. Erica Van Acker, 62, New York, N.Y. Heinrich B. Ackermann, 38, New York, N.Y. Paul Andrew Acquaviva, 29, Glen Rock, N.J. Donald L. Adams, 28, Chatham, N.J. Shannon Lewis Adams, 25, New York, N.Y. Stephen Adams, 51, New York, N.Y. Patrick Adams, 60, New York, N.Y. Ignatius Adanga, 62, New York, N.Y. Christy A. Addamo, 28, New Hyde Park, N.Y. Terence E. Adderley, 22, Bloomfield Hills, Mich. Sophia B. Addo, 36, New York, N.Y. Lee Adler, 48, Springfield, N.J. Daniel Thomas Afflitto, 32, Manalapan, N.J. Emmanuel Afuakwah, 37, New York, N.Y. Alok Agarwal, 36, Jersey City, N.J. Mukul Agarwala, 37, New York, N.Y. Joseph Agnello, 35, New York, N.Y. David Scott Agnes, 46, New York, N.Y. Joao A. Aguiar Jr., 30, Red Bank, N.J. Lt. Brian G. Ahean, 43, Huntington, N.Y. Jeremiah J. Ahen, 74, Cliffside Park, N.J. Joanne Ahladiotis, 27, New York, N.Y. Shabbir Ahmed, 47, New York, N.Y. Terrance Andre Aiken, 30, New York, N.Y. Godwin Ajala, 33, New York, N.Y. Gertrude M. Alagero, 37, New York, N.Y. Andrew Alameno, 37, Westfield, N.J. Margaret Ann (Peggy) Jezycki Alario, 41, New York, N.Y. Gary Albero, 39, Emerson, N.J. Jon L. Albert, 46, Upper Nyack, N.Y. Peter Craig Alderman, 25, New York, N.Y. Jacquelyn Delaine Aldridge, 46, New York, N.Y. Grace Alegre-Cua, 40, Glen Rock, N.J. David D. Alger, 57, New York, N.Y. Ernest Alikakos, 43, New York, N.Y. Edward L. Allegretto, 51, Colonia, N.J. Eric Allen, 44, New York, N.Y. Joseph Ryan Allen, 39, New York, N.Y. Richard Lanard Allen, 30, New York, N.Y. Richard Dennis Allen, 31, New York, N.Y. Christopher Edward Allingham, 36, River Edge, N.J. Janet M. Alonso, 41, Stony Point, N.Y. Anthony Alvarado, 31, New York, N.Y. Antonio Javier Alvarez, 23, New York, N.Y. Telmo Alvear, 25, New York, N.Y. Cesar A. Alviar, 60, Bloomfield, N.J. Tariq Amanullah, 40, Metuchen, N.J. Angelo Amaranto, 60, New York, N.Y. James Amato, 43, Ronkonkoma, N.Y. Joseph Amatuccio, 41, New York, N.Y. Christopher Charles Amoroso, 29, New York, N.Y. Kazuhiro Anai, 42, Scarsdale, N.Y. Calixto Anaya, 35, Suffern, N.Y. Jorge Octavio Santos Anaya, 25, Aguascalientes, Aguascalientes, Mexico Joseph Peter Anchundia, 26, New York, N.Y. Kermit Charles Anderson, 57, Green Brook, N.J. Yvette Anderson, 53, New York, N.Y. John Andreacchio, 52, New York, N.Y. Michael Rourke Andrews, 34, Belle Harbor, N.Y. Jean A. Andrucki, 42, Hoboken, N.J. Siew-Nya Ang, 37, East Brunswick, N.J. Joseph Angelini, 38, Lindenhurst, N.Y. Joseph Angelini, 63, Lindenhurst, N.Y. Laura Angilletta, 23, New York, N.Y. Doreen J. Angrisani, 44, New York, N.Y. Lorraine D. Antigua, 32, Middletown, N.J. Peter Paul Apollo, 26, Hoboken, N.J. Faustino Apostol, 55, New York, N.Y. Frank Thomas Aquilino, 26, New York, N.Y. Patrick Michael Aranyos, 26, New York, N.Y. David Gregory Arce, 36, New York, N.Y. Michael G. Arczynski, 45, Little Silver, N.J. Louis Arena, 32, New York, N.Y. Adam Arias, 37, Staten Island, N.Y. Michael J. Armstrong, 34, New York, N.Y. Jack Charles Aron, 52, Bergenfield, N.J. Joshua Aron, 29, New York, N.Y. Richard Avery Aronow, 48, Mahwah, N.J. Japhet J. Aryee, 49, Spring Valley, N.Y. Carl Asaro, 39, Middletown, N.Y. Michael A. Asciak, 47, Ridgefield, N.J. Michael Edward Asher, 53, Monroe, N.Y. Janice Ashley, 25, Rockville Centre, N.Y. Thomas J. Ashton, 21, New York, N.Y. Manuel O. Asitimbay, 36, New York, N.Y. Lt. Gregg Arthur Atlas, 45, Howells, N.Y. Gerald Atwood, 38, New York, N.Y. James Audiffred, 38, New York, N.Y. Kenneth W. Van Auken, 47, East Brunswick, N.J. Louis F. Aversano, Jr, 58, Manalapan, N.J. Ezra Aviles, 41, Commack, N.Y. Ayodeji Awe, 42, New York, N.Y Samuel (Sandy) Ayala, 36, New York, N.Y. Arlene T. Babakitis, 47, Secaucus, N.J. Eustace (Rudy) Bacchus, 48, Metuchen, N.J. John James Badagliacca, 35, New York, N.Y. Jane Ellen Baeszler, 43, New York, N.Y. Robert J. Baierwalter, 44, Albertson, N.Y. Andrew J. Bailey, 29, New York, N.Y. Brett T. Bailey, 28, Bricktown, N.J. Tatyana Bakalinskaya, 43, New York, N.Y. Michael S. Baksh, 36, Englewood, N.J. Sharon Balkcom, 43, White Plains, N.Y. Michael Andrew Bane, 33, Yardley, Pa. Kathy Bantis, 44, Chicago, Ill. Gerard Jean Baptiste, 35, New York, N.Y. Walter Baran, 42, New York, N.Y. Gerard A. Barbara, 53, New York, N.Y. Paul V. Barbaro, 35, Holmdel, N.J. James W. Barbella, 53, Oceanside, N.Y. Ivan Kyrillos Fairbanks Barbosa, 30, Jersey City, N.J. Victor Daniel Barbosa, 23, New York, N.Y. Colleen Ann Barkow, 26, East Windsor, N.J. David Michael Barkway, 34, Toronto, Ontario, Canada Matthew Barnes, 37, Monroe, N.Y. Sheila Patricia Barnes, 55, Bay Shore, N.Y. Evan J. Baron, 38, Bridgewater, N.J. Renee Barrett-Arjune, 41, Irvington, N.J. Arthur T. Barry, 35, New York, N.Y. Diane G. Barry, 60, New York, N.Y. Maurice Vincent Barry, 49, Rutherford, N.J. Scott D. Bart, 28, Malverne, N.Y. Carlton W. Bartels, 44, New York, N.Y. Guy Barzvi, 29, New York, N.Y. Irna Basina, 43, New York, N.Y. Alysia Basmajian, 23, Bayonne, N.J. Kenneth William Basnicki, 48, Etobicoke, Ontario, Canada Lt. Steven J. Bates, 42, New York, N.Y. Paul James Battaglia, 22, New York, N.Y. W. David Bauer, 45, Rumson, N.J. Ivhan Luis Carpio Bautista, 24, New York, N.Y. Marlyn C. Bautista, 46, Iselin, N.J. Jasper Baxter, 45, Philadelphia, Pa. Michele (Du Berry) Beale, 37, Essex, Britain Paul F. Beatini, 40, Park Ridge, N.J. Jane S. Beatty, 53, Belford, N.J. Larry I. Beck, 38, Baldwin, N.Y. Manette Marie Beckles, 43, Rahway, N.J. Carl John Bedigian, 35, New York, N.Y. Michael Beekman, 39, New York, N.Y. Maria Behr, 41, Milford, N.J. Yelena Belilovsky, 38, Mamaroneck, N.Y. Nina Patrice Bell, 39, New York, N.Y. Andrea Della Bella, 59, Jersey City, N.J. Debbie S. Bellows, 30, East Windsor, N.J. Stephen Elliot Belson, 51, New York, N.Y. Paul Michael Benedetti, 32, New York, N.Y. Denise Lenore Benedetto, 40, New York,

A few months ago I picked up a Western Digital external hard drive at Costco since my MacBook’s internal drive was a bit stuffed with digital photos. The WD drive is a pretty nice USB drive and really portable. The problem? I started having some intermittent failures on the drive. Since this is where I now keep my wedding photos (backed up somewhere else, of course) I decided to return it before it totally died on me. I got the replacement drive, packed up the original, and heading to the shipping store… … where I realized I hadn’t wiped the drive. While it’s just photos, and none of them are of an embarrassing nature, I still don’t relish the idea of seeing them “enhanced” and posted on MySpace. Lucky for me I use a Mac and safe erasing is an integral part of Disk Utility. I ran the program, clicked the security options button, and chose the 7 times overwrite option. 7x might be overkill for some non-sensitive photos, but I figured it would be a good test to see how long it takes. The answer is about 7 hours for a 120 GB USB 2.0 external drive. For the record. Oh well, I guess it isn’t going out today. But I’m darn glad I remembered to wipe the drive before shipping it back. I’d really hate to see any pictures of our cat show up on some sick kitty-porn site. And I’m really glad Apple makes it so easy. Microsoft also has secure formatting options, but generally you need a third party tool (or write your own script) to get the same degree of security. Unless the data is encrypted, without overwriting it’s pretty likely someone can recover it. Then again, smashing is probably faster. But Western Digital might not appreciate a smashed return. I’d probably lose my deposit. (edited 9/10 to add disk size of 120 GB) Share:

I’m sitting in the Martini Monkey in San Jose airport, by far the best airport bar in history and possibly my favorite bar anywhere in the US. This place is a seriously funky oasis for those of us banished to the purgatory of airport terminals and solitary $10 crap beers in our hotel rooms. Okay, I might be on my 2nd-ish beer. I just spent the past two days working with clients out in the Valley area. Both are security startups, both are in pretty exciting markets, and I’ve worked with both for a while now. One is about to kick serious donkey, the other may fail despite possibly the best technology in the market. What’s the difference? Giving the audience what they want. Many of the vendors I’ve worked with over the years will probably tell you I’m a royal pain in the ass. I consider my objectivity to be the most important asset I bring to the analyst market and I do everything I can to protect it. You’ll never see a custom quote in a press release out of me (any quotes are lifted from published research), I don’t take gifts over $10 (which limits me to t-shirts I’ll never wear or USB drives of dubious capacity), I rarely do dinners, and I tell all vendors, even the ones I like, that I assume nothing they tell me is true until I hear it from a client. I don’t even tell vendors I have this blog, won’t ever discuss a vendor I’m working with, and won’t talk about this site with anyone I cover. But there’s one way you vendors can influence me- it’s by making a good product that meets customer needs. Back to the two vendors (who hopefully aren’t reading this). As egotistical as I am the one point I consistently emphasize with vendors I work with is shame on you if you don’t validate every piece of advice I give you with your users. End users are a mixed blessing. As a former developer, they either save you or destroy you; especially when it comes to interfaces. This is particularly problematic in the security market where we deal with multiple demographics- ranging from highly technical security experts to some dude that’s just off the help desk. Users can drag you through development cycles where you’re constantly adding features or UI widgets to meet the specific needs of one individual, that don’t apply anywhere else. But the best product managers separate the wheat from the chaff, and rather than being distracted, focus efforts on those few fundamental features that appeal to the broadest client base. Why is this important? Because UI is everything. Not just because it makes your product look pretty, but because a good UI increases the productivity of your users. A bad UI can add hours to someone’s workday, hide the best features of your product, and banish you to the shelf. Not that some UI flash compensates for a lack of function, but a bad UI leads to an unmanageable product that’s nearly useless no matter its core functionality. One of the biggest transitions a startup can make is from an engineering-driven product, focused purely on technical functions to a polished product that slides right into an enterprise security arsenal. From “cool” to “useful” to “operational”. I know some of you command line geeks disagree, but today’s security professionals can barely keep up with enterprise demands and an effective management interface makes all the difference. Besides, when you’re looking at two nearly-functionally-identical products odds are you’ll choose the pretty one. My wife is an extremely intelligent and amazing individual, but the fact that she’s attractive sure didn’t hurt. (if she reads this I might be in a bit of trouble- damn Martini Monkey). Back to my vendors- what’s the difference? One of the vendors today showed me the most significant UI advancements in a short time I’ve ever seen- and definitely the biggest advancement I’ve seen in the security market. Aside from making a more marketable product, I believe these changes will seriously impact their user base and increase the usefulness of the product. It’s not perfect, but in one quarter these guys pulled off some hard core advancements- all validated with their user base. It’s not just looks- they now have a serious competitive advantage because the product is more useful. The best function in the world is worthless if the user can’t find it and use it effectively. And just think how much easier the sales cycle will be when clients see the first product demo and all the functionality is right in their face. The other vendor? They’ve also made some very significant product advances and have one of the best technologies in the market, but the UI still needs some big work. Not only is it hard for the users to find all the functions, but the UI limitations make it seriously hard to pull all the value out of the product. My rough estimate is some operations take 2-3 times as long as they need to. It’s an excellent product, functionally superior to most of the competition, but those functions are so hidden it hurts in both sales situations and day to day operations. In rescue work we spend an obsessive amount of time packing and repacking our gear. Our goal is to optimize our ability to operate by making our tools an extension of our body. When I’m hanging off a cliff face 1000 feet off the ground at night I need to know, intuitively, where every piece of gear is hanging off of me and I need to use them effectively blindfolded. Users shouldn’t have to spend weeks in training, and months in operations, to figure out security products. A well designed user interface can hide reams of functionality while increasing user productivity. It’s about helping the users get their day to day jobs done as efficiently as possible. Nothing else matters. Listen to

It’s been a while since Richard Stiennon and I worked together, and I’m learning one of the more enjoyable aspects of blogging is the opportunity to pick on him again. In a post today over at Threat-Chaos Richard states, Most of the premise of this week’s Security Standard conference in Boston appears to be that CIO’s, CSO’s and IT security practitioners have to treat security as a business process just like any other. My perspective is that treating IT security like a business process is like treating a tactical military strike force as a business. While maintaining the capability of military forces could be a process open for improvement by applying some business discipline, actually fighting battles and overcoming opposing forces does not have much of the “business process” about it. Security is much more akin to fighting a battle than it is to “aligning business objectives”. I admit I have a penchant for taking analogies a little too far, but I think comparing IT security to a military strike force might be a bit much. Sure, some of us have short haircuts and we like to talk in acronyms, but the whole never-getting-shot-at thing is a pretty significant difference. And the occasional conference t-shirt isn’t nearly as cool as all the free military swag. Richard is trying to make a valid point that tactical operations in security aren’t as amenable to business objectives and process as perhaps some other areas of IT. But I, of course, disagree. Back when I was a paramedic and firefighter we spent an inordinate amount of time optimizing our processes for dealing with crisis situations (I’ve moved onto firefighting instead of the military since my 4 years in NROTC probably don’t qualify as hardened battle experience). It was only by turning crisis (battle) into process that we could manage the challenges of life or death emergencies. It’s all about process. From the algorithms of CPR to the steps of rapid sequence intubation. Without process you have chaos. The more efficient you are at process, the more you can operationalize crisis management, the more effectively you can manage incidents. And these processes are even aligned to business objectives- some small (don’t kill the patient too much) some large (retain capacity for multiple operations, manage resources). Once everyday crisis is process it takes something really extreme to break operations and force you into incident management mode. I define incident management as “what you do when you’ve exceeded regular process”. This definition is stolen from what we refer to in emergency services as a “Mass Casualty Incident”; which is anything that exceeds your current capacities. In IT security the more incidents you can manage through efficient process, the less you spend on a day to day operational basis, and the more resources you have available for “the big one”. Security that isn’t optimized and aligned with the business is really expensive; and unsustainable in the long run. Even the Army can’t treat every battle as a one-off. It’s still all about business objectives… … and business is good. (bonus points to whoever identifies the source of the slaughtered paraphrase I used for the title) Share: