Research

How cool would it be if LMFAO (or a reasonable proximity – Beaker, anyone?) did a security version of “Sorry for Party Rocking,” because evidently the security job market is rocking. But it offers a great perspective on the mind of the security professional. Check out the following quotes to get a feel for how things seem, which I can anecdotally validate based on the number of calls I get from CISO types looking to grow and retain their teams. “What’s the unemployment rate for a good cybersecurity person? Zero,” Weatherford said, adding that government agencies and the private sector were stealing the best people from each other. “We are all familiar with the fratricide going on.” Salaries split in 2013, with the median staff salary declining $2,000 to $95,000 this year. Management salaries continued to rise, topping $120,000 in 2013, up $5,000 from the previous year. The trend in total compensation reflects the same split as salaries: Total compensation for staff declined in 2013 to a median of $98,000, down $5,000, while management saw a $2,000 increase, to $129,000. So salaries for staff are down marginally, but still considerably higher than general IT jobs. That’s good, right? Security folks should feel good about their job security and their place in the organization, right? Doesn’t scarcity mean companies need to be taking better care of their security folks? That would be a reasonable conclusion, no? In 2013, security practitioners showed a slight drop in how secure they feel in their jobs. While other IT disciplines continue to feel as secure in their positions as in 2012, IT security staff saw a seven-point drop, to 43%, in the number that feel very secure. It’s totally counterintuitive, or is it? The reality is that when something bad happens, and in security something bad always happens sooner or later, someone is going to take the fall. So I can kind of understand how in the Bizarro World of security, scarcity and higher salaries make folks less secure in their jobs. But here’s the real point: even if your organization throws you under the bus, there are a hundred companies waiting in line for you to chase their windmills and eventually end up under their buses. So rejoice, security professionals! You may not keep a business card for long, but you shouldn’t have to spend much time in the unemployment line. Photo credit: “Help Wanted” originally uploaded by James Share:

Sometimes seeing what you have known for years in print is helpful, even comforting. So Gartner’s Paul Proctor writing about killing compliance in cold blood is good. Paul has a bigger megaphone than the rest of us, so maybe folks will start getting on board with doing security (or risk, depending on your vernacular) and stop worrying so much about the checklists. Compliance is no longer the driver for IT risk and security. Compliance is just one of many risk domains to be addressed in a mature risk management program and approach. Recently the security hyperbole trifecta (APT/advanced malware, BYOD, and Big Data) has been sucking up all the oxygen in security marketing, so compliance is suffocating. Compliance as the primary driver of security/risk is already effectively dead, but many people haven’t noticed yet. More to the point, certain classes of organizations are not sophisticated enough to realize what has happened. That gets down to Paul’s use of the ‘M’ word: maturity. The problem is that the great unwashed are still in security/risk diapers, so they can’t see compliance as only one risk domain among many. Their list of audit deficiencies makes it the only domain they are aware of. But that’s okay – every organization needs to start somewhere, and checklists can be helpful for spurring action and establishing a very very low bar of protection. Then as organizations climb the curve of security and risk maturity, they can and should “stop being a rule following and become a risk leader” as Paul suggests. That’s the goal. Followers are buried in regulatory distraction that impedes their ability to innovate, perform, optimize and adapt their programs. Followers are busy covering their butts. Leaders are able to map risk and security dependencies into desired business outcomes and report these risks into the appropriate decision makers. For example, a modern risk and security program can support mergers and acquisitions through proactive due diligence that guides actual integration decisions by non-IT decision makers. That’s influencing the business! Actually, we’re all busy covering our butts – including leaders. The difference is that leaders proactively identify what will kill them, and tells non-IT decision-makers where they will be hit. And that may be enough to save them when the brown stuff hits the fan. Whereas followers never see it coming because it wasn’t on a checklist… Photo credit: “Murder” originally uploaded by AJ Cann Share:

The hype cycle for Threat Intelligence is just getting going. It will soon join advanced malware, BYOD, and Big Data as terms that mean nothing because they have been poked, prodded, manipulated, and otherwise killed by vendor hyperbole. We have done a bunch of research into how to use threat intelligence (Early Warning, Network-based Threat Intelligence, and Email-based Threat Intelligence), so we get the value of benefiting from other folks’ misfortune and learning from how they were attacked. But I also know that our papers run 15-20 pages and usually fall into the category of tl;dr. So let me point to a few posts Scott Crawford put out there. The first talks about integration and its importance for dealing with the kinds of attacks you face. The other post I want to highlight is next in that series, bringing up the sticky issue of actually integrating threat intelligence into your control sets. It is simply this: in order for intelligence to factor into effective response, proactive defense or environment hardening, security intelligence systems must be able to send data out as well as take it in. Intelligence has historically been positioned as a differentiator for a product and/or service, not as a stand-alone offering with its own value. That’s changing, but not quickly enough. Scott’s points are exactly right – whether you are talking about security intelligence (the new term for SIEM) or threat intelligence, the data needs to be available in a number of formats for import/export to make sure you can actually use it. Scott doesn’t sugarcoat the ongoing concerns of operations folks or their unwillingness to allow any kind of automation to reconfigure controls and defenses. And clearly a filter needs to be applied. The stuff you know is bad should be blocked. If you aren’t sure, your layers need to come into play. Sure, there are lots of reasons beyond the limitations of monitoring technology why we wouldn’t want to do this. Automating blocking at scale would do a little more than step on the toes of IT operations and irk our insect overlords, if what we effectively build is the Mother of All Denial of Service Vehicles that raises existing problems with false positives to an entirely new level. But the point is the point. All that time you have spent collecting data and doing some simple analysis has positioned you to take the next step toward Scott’s concept of data-driven security. Let me simplify the issue a bit more. Having great intelligence doesn’t help if you can’t use it. That would be, well, just dumb. Photo credit: “#dumb” originally uploaded by get directly down Share:

Ever start a simple project – or perhaps ask for something simple to be done on your behalf – and get far more than you bargained for? Sometimes the seemingly simple things reach up and bite you. I was thinking about this two weeks ago, in the middle of some weekend gardening, expecting to tackle a small irrigation leak that popped up during the winter. I went out to the yard with the handful of tools I would need and started scouting around the pool of standing water to locate the source of the leak, and I found it – more or less. It was buried under some mud, so before I could fix the leak I needed to remove the mud around the irrigation line. Before I could remove the mud I needed to remove the giant rat’s nest on top of the mud – stuffed full of Cholla. Literally. It apperas a rat ate the irrigation line and then used it as a private port-o-let. But in order to remove the rat’s nest I needed to remove the 45 lbs of prickly pear cactus that formed the roof of the rat’s nest. Before I could remove that cactus, I needed to remove the 75 lb Agave that arched over the prickly pear. Before I could get to the agave I needed to remove a dead vine. Before I could cut out the vine I need to remove some tree branches. Each step required a new trip to the garage to collect another tool. And so it went for the next three hours, until I finally found the line and fixed the leak. When I finally finished that sequence I was rewarded with 30 minutes tweezing prickly pear micro-thorns from my fingers. What should have taken minutes took the entire morning, and left painful reminders. Which brings me to IT: those who provision data centers and migrate backbone business applications know exactly what this feels like – as I was reminded when I told a couple friends about my experience, and they laughed at me. That described their life. They deal with layers of operational, security, regulatory, and budgetary hurdles – mixed liberally with rat droppings – all the time. Someone asks for a small server to host a small web portal and before you know it someone is asking how PCI compliance will be addressed. Say what you will about cost savings being a driver for cloud services – simplicity (or at least avoidance of complexity) is a major driver too. Sometime it’s just better to have a third party do it on your behalf – and that comes (anonymously of course) from some IT professionals. On to the Summary: Favorite Securosis Posts Gal: Security FUD hits investors. HP bought ArcSight, right? Adrian Lane: Gaming the Narcissist. Fun read, and a topic to consider when weighing potential employers, but I’ll offer an alternative view: 1980 to 2008 was itself a wild period for company performance – see Warren Buffet’s speech from November 1999 for what I mean. I’d say Narcissist CEOs succeeded or simply ran off the tracks faster in that window. David Mortman: Should the Red (Team) be dead? Mike Rothman: Should the Red (Team) Be dead? Yup, it’s mine, but this one created a bit of discussion and even a comment by HD Moore… Other Securosis Posts Incite 4/10/2013: 103. Friday Summary, Gattaca Edition: April 5, 2012. Favorite Outside Posts Rich: Analyzing Malicious PDFs or: How I Learned to Stop Worrying and Love Adobe Reader (Part 1). Adrian Lane: Oracle Details Big Data Strategy. The FUD, it burns, it burns! My not favorite post this week – I recommend you, with your best Borat impersonation, yell not! after every quote and claim. It’s fun and more accurately reflects what’s happening in the big data market. Gal: Alleged Carberp Botnet Ringleader Busted. They’re doing it wrong: Rule #1. You’re supposed to steal from countries where you do not reside, and with whom your home country has no extradition treaty. Rule #2. Don’t steal tons of money from Russian and Ukranian banks regardless of where you live, but especially if you’re violating rule #1 and you live in Russia or Ukraine… Dave Lewis: Secrets of FBI Smartphone Surveillance Tool Revealed in Court Fight. Gunnar: Bitcoin – down ~50% in a day, first DDoS currency crash. David Mortman: Tor Hidden-Service Passive De-Cloaking. Mike Rothman: Who Wrote the Flashback OS X Worm? All of you aspiring security researchers can once again thank Brian Krebs for showing you how it’s done. And be thankful Krebs has figured out how to make a living from doing this great research and sharing it with us. Project Quant Posts Email-based Threat Intelligence: To Catch a Phish. Network-based Threat Intelligence: Searching for the Smoking Gun. Understanding and Selecting a Key Management Solution. Building an Early Warning System. Implementing and Managing Patch and Configuration Management. Defending Against Denial of Service (DoS) Attacks. Securing Big Data: Security Recommendations for Hadoop and NoSQL Environments. Tokenization vs. Encryption: Options for Compliance. Top News and Posts Security Lessons from the Big DDoS Attacks. A couple weeks old but I just saw it. Bitcoin crashes – lose 1/2 value. Vudu resets user passwords after hard drives lost in office burglary. DEA Accused Of Leaking Misleading Info Falsely Implying That It Can’t Read Apple iMessages. Windows XP still maintains 39% overall market share. Speechless. Windows XP Security Updates ending in one year. Update your calendars! North Korean military blamed for “wiper” cyber attacks against South Korea. Lessons from the Spamhaus DDoS incident. Microsoft Reportedly Adding Two-Factor Authentication to User Accounts. Google will fight secretive national security letters in court. FBI’s Smartphone Surveillance Tool Explained In Court Battle. IsoHunt Demands Jury Trial. Critical Fixes for Windows, Flash & Shockwave via Krebs. Blog Comment of the Week This week’s best comment goes to HD Moore, in response to Should the Red (Team) be dead? It isn’t clear why Gene believes that CTF contests have any correlation to professional red teams. A similar comparison would be hackathons to software engineering. In both cases you approach the problem differently and the participants learn a

We have each probably worked for a CEO who we’d just as soon meet in a dark alley (without video surveillance), while carrying a nightstick and a taser. So when I saw Ed Moyle’s blog about Narcissistic CEOs, I was hoping it would end with “You’d better bring a mop. And a body bag.” Unfortunately Ed highlighted some research that these narcissistic douches adopt technology more aggressively (mostly due to their oversized egos) and are more likely to be successful. Humbug. … We find strong support when testing our hypotheses on a sample of 78 CEOs of 33 major pharmaceutical firms, examining their response to the emergence of biotechnology over the period 1980 to 2008… our results suggest that narcissism may be a key ingredient in overcoming organizational inertia. So the nice CEO, who isn’t a total prick usually can’t get the organization to move, and so is tossed out with yesterday’s garbage in favor of some objectionable human, who worries more about having cooler toys than the other CEOs in his or her golf group. Awesome. But aside from my CEO bitterness (you might think, after almost 4 years, the road rash would have healed just a bit), Ed actually draws a conclusion that could actually be helpful. As a pragmatist, my concern is mostly about how practitioners can leverage this. For example, rather than pitching a new technology on the basis of return to the organization, business enablement, cost savings, etc. – maybe harnessing executives competitiveness could be effective. So rather than saying, “this new cloud system will save us 50% over 10 years”, saying something like “Check out the attention our competitor is getting for being so innovative and forward thinking. I wonder if there’s a way for us to lead instead of them” might be more resonant if what these folks say is true. That’s why I think security benchmarking is a good idea. Having a benchmark to compare your organization to another gives you the data to appeal to these ego monsters. And if you have to deal with these folks, at least use their personalities to get what you want. Photo credit: “Hello My Name Is Narcissit” originally uploaded by One Way Stock Share:

My paternal grandmother passed away last week at 103. No, that is not a typo. One hundred and three. Ciento tres for you Spanish speakers out there. She would have been 104 in June. That’s a long time. To give you some perspective, per the infoplease site, William Taft was president in 1909. Robert Peary and Matthew Henson reached the North Pole that year. And the big news in the medical community was finding a cure for syphilis. I’m sure that caused much rejoicing around the world. I guess before 1909 you could actually have gone blind, though my folks somehow forgot to tell me about the cure… My Grandma Hilda was interesting, although I didn’t know her very well. She moved with my grandfather to Florida when I was 5. I’d see them for the occasional winter break trip to North Miami Beach, and they’d come north for some holidays. But they weren’t phone people and long distance calls were pretty expensive back then, so it wasn’t like we’d just chat on the phone. Our kids have it better – they can text, FaceTime, and email their grandparents and cousins. I didn’t have that option. She grew up in Baltimore and the way she met my grandfather was a great story. She was actually on a date with his brother Sam, but my grandfather had a car, so he drove Sam to Baltimore for the date. Evidently my grandfather liked her because when his brother went to get a pack of smokes, my grandfather took off and stood in on the date. I doubt they called it a ‘CB’ like my buddies would today, but they were married for almost 65 years, so it worked out. She couldn’t have been more different from my grandfather. The cantor who presided over the the memorial service called the two of them Ying and Yang. But it was really more like the tortoise and the hare. My Grandpa Harry was fast and explosive. He’s been gone for 16 years but we still talk about his tantrums. He talked fast. He walked fast. He did everything fast and had little tolerance for folks who didn’t keep up. Whereas my grandmother was slow and calm. In the face of a Mt. Vesuvius explosion from Harry, she just wouldn’t be bothered. No matter what happened she was calm. She’d make some snide comment and get back to whatever she was doing. She was the only one who could put him in his place. And she did. It was amazing to see. And when I say slow, I mean sloooooow. She wasn’t in a rush to do anything, not that I can remember anyway. She got there when she got there. She didn’t drive, so if she couldn’t get a ride or didn’t want to take the bus she wouldn’t go. One winter my grandparents took my brother and me to Walt Disney World when we were young. They had just opened EPCOT (yes, I’m dating myself) and I distinctly remember following my grandfather and visiting each ‘country’ in the park. We probably made 4 or 5 loops around the park, and every hour or so we’d pass by my grandmother strolling along at her own pace taking in the sites, not a care in the world. He got to the finish line first, and she took her time to get there. 103 years to be exact. On an interesting side note, my paternal great-grandfather (Hilda’s Dad) also lasted 103 years. Seriously. So we’re running a pool on my father’s side of the family on who of each generation will go for 103. I’m tempted to make a run for it. Why not? I’ve always said I want to stick around long enough to have my kids change my diapers, just to return the favor. And evidently I have the genetics to do it. Though if I do want to stick around that long I’ll need to learn to slow down and be calm, like my grandmother. Living until 103 isn’t for folks in a rush. –Mike Photo credits: 168/365 – President Taft Faces the Future originally uploaded by davidd Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can get all our content in its unabridged glory. And you can get all our research papers too. Understanding Identity Management for Cloud Services Buyers Guide Architecture and Design Integration Newly Published Papers Email-based Threat Intelligence: To Catch a Phish Network-based Threat Intelligence: Searching for the Smoking Gun Understanding and Selecting a Key Management Solution Building an Early Warning System Implementing and Managing Patch and Configuration Management Defending Against Denial of Service Attacks Incite 4 U What’s $300K between friends? Very interesting research by our friend Wendy Nather of 451 Group (highlighted by Shimmy at NetworkWorld) on what to buy if you start a security program in a green field. Yeah, I know there are no green fields, but Wendy determined that a 1000 person company would need to spend $300,000-$400,000 for a bare bones security capability. If they wanted a little more they would at least double the cost. She tends to see 1 security person for 500 employees. This isn’t a low-cost scenario, is it? And it doesn’t really help a company sell more stuff, does it? Sure you can spin your wheels talking about enabling this or that, but security remains a significant cost center. But at least the stuff you buy stops the attackers, right? (No, not really.) So there’s that… – MR Two of these are nothing alike: You know big data is a threat to traditional big iron when entrenched providers start marketing off its coattails, as Alex Gorbachev attempts to do by comparing required IT management skills for Hadoop and Exadata. One of the many problems with this article is that the basic premise is not true: big data is not “a pre-integrated, engineered system with built-in management and automation

I like to see stuff that challenges common wisdom. The inimitable professor Gene Spafford of Purdue goes far against the grain in calling out the excitement of hacking competitions and red teams as counterproductive to training the next generation of security folks. Gene starts with an analogy for how security folks would deal with a bunch of barns on fire: We’re going to have a contest to find who can pass this pail of water the quickest. Yes, it is a small, leaky pail, but we have a lot of them, so that is what we’re going to use in the contest. The winners get to be closest to the flames and have a name tag that says “fire prevention specialist.” He goes through another couple analogies to make the same point, that security folks seem to be holding competitions to show proficiency in stopping yesterday’s problems, but not enough time thinking about how to solve the root cause of the security issues: poor systems design. First, in every case, a mix of short-sighted and ultimately stupid solutions are being undertaken. In each, there are large-scale efforts to address pressing problems that largely ignore fundamental, systemic weaknesses. Second, there are a set of efforts putatively being made to increase the population of experts, but only with those who know how to address a current, limited problem set. Fancy titles, certificates, and seminars are used to promote these technicians. Meanwhile, longer-term expertise and solutions are being ignored because of the perceived urgency of the immediate problems and a lack of understanding of cost and risk. Third, longer-term disaster is clearly coming in each case because of secondary problems and growth of the current threats. That’s uplifting, right? He does highlight a number of potential solutions, or at least things we should focus on to a greater degree, including: Nationally, we are investing heavily in training and recruiting “cyber warriors” but pitifully little towards security engineers, forensic responders, and more. It is an investment in technicians, not in educated expertise. We have a marketplace where we continue to buy poorly-constructed products then pay huge amounts for add-on security and managing response; meanwhile, we have knowledgeable users complaining that they can’t afford the up-front cost required to replace shoddy infrastructure with more robust items. Rather than listen to experts, we let business and military interests drive the dialog. We have well-meaning people who somehow think that “contests” are useful in resolving part of the problem And to put a bow on the issues with contests: Competitions require rapid response instead of careful design and deep thought – if anything, they discourage people who exhibit slow, considerate thinking – discourage them from the contests, and possibly from considering the field itself. If what is being promoted are competitions for the fastest hack on a WIntel platform, how is that going to encourage deep thinkers interested in architecture, algorithms, operating systems, cryptology, or more? But there’s more… So, the next time you hear some official talk about the need for “cyber warriors” or promoting some new “capture the flag” competition, ask yourself if you want to live in a world where the barns are always catching fire, the cars are always breaking down, nearly everyone eats fast food, and the major focus of “authorities” is attracting more young people to minimally skilled positions that perpetuate that situation…until everything falls apart. The next time you hear about some large government grant that happens to be within 100 miles of the granting agency’s headquarters or corporate support for a program of which the CEO is an alumnus but there is no history of excellence in the field, ask yourself why their support is skewed towards building more hot dog stands. I think Gene brings up a number of good points in a very clear manner. I can see the other side of the equation as well, given that red team exercises are fun and give folks a feel for what it’s like to be under fire. But clearly there is a need for both quick twitch security folks (who can respond quickly under fire) and architects who can think deeply about difficult problems. Share:

We ve talked a bit about the need to “be careful what we wish for,” in terms of making security a higher profile issue with senior management. Well, it’s no longer just vendors throwing FUD balloons that can splat at any time. I was perusing the Seeking Alpha investor site over the weekend when I found an article called Pandemic Cyber Security Failures Open An Historic Opportunity For Investors. Yes, I threw up a bit in my mouth when I read that headline. The first sentence doesn’t help: Cyber Security failures in the Western World have reached a pandemic stage. Oy. Then the author goes on to quote lots of different sources designed to scare the crap out of the uneducated. It’s awesome. Then he talks a bit about the reality of current defenses: From my discussions with top security professionals at leading security organizations, including Big 4 consulting and assurance companies, software such as Antivirus and Intrusion Detection and Prevention (IDS/IPS) are currently only marginally effective at catching security threats. Ugh. But it gets better. Of course when you throw this much FUD you need to have solutions, right? The partnership between VMWare and Cisco is going to integrate network defenses into the virtual computing used in cloud deployments, didn’t you know? That will definitely help address the pandemic. And get this beauty about HP’s innovation in the space: In addition, HP (HPQ) has developed software to link operational system logs with security event logging, enabling network operations and security to unite in common defense of corporate networks. Eliminating functional silos in network operations and security means more coordinated and efficient defenses against attackers. Hello! 2004 called and they want their functional silos back. This is when you really wish the uneducated wouldn’t do a few minutes of research and then think they understand security. I don’t feel bad that professional investors may see (and even act on) this kind of crap. But I do worry about unsuspecting individual investors who are most vulnerable to this drivel. Now please excuse me while I take some deep, cleansing breaths… Share:

Now that we have covered all the pesky background information, we can start delving into the best ways to actually protect data. Securing the Storage Infrastructure and Management Plane Your first step is to lock down the management plane and the infrastructure of your cloud storage. Encryption can compensate for many configuration errors and defend against many management plane attacks, but that doesn’t mean you can afford to skip the basics. Also, depending on which encryption architecture you select, a poorly-secured cloud deployment could obviate all those nice crypto benefits by giving away too much access to portions of your encryption implementation. We are focused on data protection so we don’t have space to cover all the ins and outs of management plane security, but here are some data-specific pieces to be aware of: Limit administrative access: Even if you trust all your developers and administrators completely, all it takes is one vulnerability on one workstation to compromise everything you have in the cloud. Use access controls and tiered accounts to limit administrative access, as you do for most other systems. For example, restrict snapshot privileges to a few designated accounts, and then restrict those accounts from otherwise managing instances. Integrate all this into your privileged user management. Compartmentalize: You know where flat networks get you, and the same goes for flat clouds. Except that here we aren’t talking about having everything on one network, but about segregation at the management plane level. Group systems and servers, and limit cloud-level access to those resources. So an admin account for development systems shouldn’t also be able to spin up or terminate instances in the production accounting systems. Lock down the storage architecture: Remember, all clouds still run on physical systems. If you are running a private cloud, make sure you keep everything up to date and configured securely. Audit: Keep audit logs, if your platform or provider supports them, of management-plane activities including starting instances, creating snapshots, and altering security groups. Secure snapshot repositories: Snapshots normally end up in object storage, so follow all the object storage rules we will offer later to keep them safe. In private clouds, snapshot storage should be separate from the object storage used to support users and applications. Alerts: For highly sensitive applications, and depending on your cloud platform, you may be able to generate alerts when snapshots are created, new instances are launched from particular instances, etc. This isn’t typically available out of the box but shouldn’t be hard to script, and may be provided by an intermediary cloud broker service or platform if you use one. There is a whole lot more to locking down a management plane, but focusing on limiting admin access, segregating your environment at the cloud level with groups and good account privileges, and locking down the back-end storage architecture, together make a great start. Encrypting Volumes As a reminder, volume encryption protects from the following risks: Protects volumes from snapshot cloning/exposure Protects volumes from being explored by the cloud provider, including cloud administrators Protects volumes from being exposed by physical drive loss (more for compliance than a real-world security issue) IaaS volumes can be encrypted three ways: Instance-managed encryption: The encryption engine runs within the instance and the key is stored in the volume but protected by a passphrase or keypair. Externally managed encryption: The encryption engine runs in the instance but keys are managed externally and issued to instances on request. Proxy encryption: In this model you connect the volume to a special instance or appliance/software, and then connect the application instance to the encryption instance. The proxy handles all crypto operations and may keep keys either onboard or external. We will dig into these scenarios next week. Share:

Hi folks, Dave Lewis here, and it is my turn to pull the summary together this week. I’m glad for the opportunity. So, a random thought: I have made a lot of mistakes in my career and will more than likely make many more. I frequently refer to this as my well-honed ability to fall on spears. The point? Simple. This is a learning opportunity that people seldom appreciate. Much like toddlers, we learn to walk by mastering the fine art of the faceplant. We learn in rather short order that we really don’t care for the experience of falling on our faces, and soon that behavior is corrected (for most, at least). So why, pray tell, do we continue to suffer massive data breaches? Not a week goes by without some major corporation or government body announcing that they have lost a USB drive or had a laptop stolen. Have we not learned yet that “face + floor = pain” is not an equation worthy of an infinite loop? Just my musing for this week. On to the Summary: Webcasts, Podcasts, Outside Writing, and Conferences Rich quoted by The Macalope. Adrian’s DR paper: Security Implications Of Big Data. Rich quoted on Watering Hole Attacks. Adrian’s DR post: Database Security Operations. Mike’s DR post: You’re A Piece Of Conference Meat. snort Favorite Securosis Posts Rich: 1 in 6 Amazon Web Services users can’t read. This seriously tweaked me. And don’t give me guff for picking my own post – no one else posted this week. You’d think with 3 full timers and 6 contributors, someone else… Adrian Lane: Proposed California Data Law Will Affect Security… but it will take quite a while before companies take it seriously. David Mortman: Flash! And it’s gone… Dave Lewis: Defending Cloud Data: How IaaS Storage Works. Other Securosis Posts Cybersh** just got real. Proposed California Data Law Will Affect Security. Brian Krebs outs possible Flashback malware author. Appetite for Destruction. Get Ready for Phone Security and Regulations. IaaS Encryption: Understanding Encryption Systems. An article so bad, I have to trash it. Favorite Outside Posts Rich: Activists on Front Lines Bringing Computer Security to Oppressed People. Lives really are at stake for these people. Mike Mimoso is doing a great job with this coverage. Adrian Lane: IT for Oppression. And I just thought this was IT culture. Dave Lewis: Googlers exultant over launch of Blink browser engine. Google rolls their own browser engine. This should be interesting. Dave Mortman: Building Technical Literacy in Business Teams. James Arlen: Delivering message w/ impact && Announing our ‘Reverse Job Fair’. This should be a brilliant workshop. Top News and Posts New PoS malware. That’s “point of sale”, not the other thing. Sometimes. How to Dress Like a Cyber Warrior OR Looking Like a Tier-Zero Hero. This amused me far more than it should have. Bill would allow bosses to seek Facebook passwords. …and then Amendment aimed at workers’ passwords pulled. Apple’s iMessage encryption trips up feds’ surveillance. Because encrytion is haaaard. (h/t James Arlen). Aaron Swartz’s Prosecutors Were Threatened and Hacked, DOJ Says. I’ll just bite my tongue Honeypot Stings Attackers With Counterattacks. Top 10 Web Hacks 2012. FBI Pursuing Real-Time Gmail Spying Powers as “Top Priority” for 2013 Attempted child abduction thwarted when girl asks stranger for code word. This article caught my eye for the brilliant simplicity for keeping your kids safe. Blog Comment of the Week This week’s best comment goes to Nate, in response to 1 in 6 Amazon Web Services Users Can’t Read. I’d go out on a limb and wager a good portion of those open buckets were setup by non-IT groups who used Amazon as an end around governance and process. I’d also wager a fair number just used one of the available tools to manage their S3 because they don’t really understand the technology and that tool set the bucket to public unbeknownst to them. That means even if they received and read the email above, they probably didn’t understand it. Is that Amazon’s fault? Absolutely not. It does highlight the issue of kicking governance down the road to IT rather than dealing with it at a business level so it can be easily avoided, or focusing governance only on dollars so small opex spends fly under the radar. Unless business leaders start caring about governance and process a whole awful lot, nothing is going to get better, it’s not. Sorry, the kids have been watching the Lorax movie non stop lately. Share: