Simple Questions, Difficult Answers
June 6th, 2010 admin
Recently I had a discussion with one of the CISOs in my company. He asked a simple question: “Can you tell me when something bad happens to any of my 100 servers?” That’s a very reasonable question. Don’t get hung up on the wording. If it makes you feel better, replace “something bad happens to” with “an intruder compromises,” or any other wording that conveys the question in a way you like. It’s a simple question, but the answer is surprisingly difficult. Let’s consider the factors that affect answering this question. We need to identify the servers…
Related Videos from Youtube
phone security and cybersecurity ar...taosecurity.blogspot.com another of my two in one videos but this time i want to say to my subbers, that i will protect you guys from hackers, whenever i can in any form, cell phone security or pc i'm here for you guys and the youtube cominuty at large....
is prillo a nice security person or...geeks.pirillo.com i wouldn't mind if i got more subscribers who can watch my videos and i could help them in a friendly way and a good way, i'm not like prillo in any way i don't get mad at hateful comments etc taosecurity.blogspot.com
Zombie aware month.......avi...blog.fortinet.com come on join me and help in the fight against pc zombies..... i will deffend the youtube comminuty against hackers...... taosecurity.blogspot.com
AFCERT circa 2000...This video shows the United States Air Force Computer Emergency Response Team (AFCERT) in 2000. Kelly AFB, Security Hill, and Air Intelligence Agency appear. The colonel who leads the camera crew into room 215 is James Massaro, then commander of the Air Force Information Warfare Center. The old Web-based interface to the Automated Security Incident Measurement (ASIM) sensor is shown, along with a demo of the "TCP reset" capability to terminate TCP-based sessions. We have a classic quote about a "digital Pearl Harbor" from Winn Schwartau, "the nation's top information security analyst." Hilarious, although Winn nails the attribution and national leadership problems; note also the references to terrorists in this pre-9/11 video. "Stop the technology madness!" Incidentally, if the programs shown were "highly classified," they wouldn't be in this video!
Related Posts
Ally Bank wants its customers to invent their own personal secret questions and answers; the idea is that an operator will read the question over the phone and listen for an answer. Ignoring for the moment the problem of the operator now knowing the question/answer pair, what are some good pairs? Some suggestions: Q: Do you know why I think…...
Q: What is this all about? A: It’s about a site called jailbreakme.com that enables you to Jailbreak your iPhones and iPads just by visiting the site. Q: So what’s the problem? A: The problem is that the site uses a zero-day vulnerability to execute code on the device. Q: How does the vulnerability work? A: Actually, it’s two vulnerabilities....
Jim Manico invited me to speak on the OWASP Podcast . If you’d like me to try answering specific questions, please email them to podcast at owasp.org. When the show is posted I will let everyone know here. Thank you. Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Read More →
Once in a while I’m asking my Thoughts on Military Service . An anonynous blog reader sent the following questions. It’s been a while since I wore the uniform, but at least some of you readers might care to offer your own thoughts? I’ll try to answer what I can. I got into IT after graduating from college with non-technical majors...
Norbt (no robot) is a low-security web application to encrypt web pages. You can create and encrypt a webpage. The key is an answer to a question; anyone who knows the answer can see the page. I’m not sure this is very useful….
Read More →
Good commentary from former CIA analyst Ray McGovern: The short answer to the second sentence is: Yes, it is inevitable that “certain plots will succeed.” A more helpful answer would address the question as to how we might best minimize their prospects for success. And to do this, sorry to say, there is no getting around the necessity...
Research paper: Detecting Deceptive Discussions in Conference Calls, by David F. Larcker and Anastasia A. Zakolyukina. Abstract: We estimate classification models of deceptive discussions during quarterly earnings conference calls. Using data on subsequent financial restatements (and a set of criteria to identify especially serious accounting problems),...
Google now wants to be your browser’s phone book, launching a DNS service Thursday in hopes that users will let the ad and search giant take over yet another part of their net experience. Browsers ask Domain Name System (DNS) servers to translate URLs like http://wired.com into the web addresses where the servers are (e.g., http://69.22.138.130)....
What if a crippling attack struck the country’s digital infrastructure? Experts including current and former officials tackle the question. The results show that the peril is real and growing. Excellent article in the L.A. Times, by Bob Drogin. The crisis began when college basketball fans downloaded a free March Madness application to their...
Interesting research: Analysing our data for security, though, shows that essentially all human-generated names provide poor resistance to guessing. For an attacker looking to make three guesses per personal knowledge question (for example, because this triggers an account lock-down), none of the name distributions we looked at gave more than 8 bits...
Related Tweets from Twitter
|
taosecurity (Richard Bejtlich) : Thanks to Kevin Mandia for inviting me to his IR Dream Team panel @mandiant Incident Response Con http://bit.ly/9S1XnS 12-13 Oct in NoVA.. Updated : 2010-09-08T00:23:44Z | Reply | View Tweet |
|
SRA_OneVault (Fed Cybersecurity) : RT @taosecurity: India v China http://bit.ly/atVzum Reporter notes Chinese exploitation of Indian assets, but also insider threat using remo.. Updated : 2010-09-07T19:26:04Z | Reply | View Tweet |
|
Cyber_Adam_SRA (Adam_RSA) : RT @taosecurity: India v China http://bit.ly/atVzum Reporter notes Chinese exploitation of Indian assets, but also insider threat using remo.. Updated : 2010-09-07T19:24:10Z | Reply | View Tweet |
|
shreyasonline (Shreyas Zare) : RT @taosecurity: India v China http://bit.ly/atVzum Reporter notes Chinese exploitation of Indian assets, but also insider threat using remo.. Updated : 2010-09-07T17:40:14Z | Reply | View Tweet |
|
MyJourneyNews (Beth Misenhimer) : TaoSecurity: India v China http://bit.ly/czCfOj.. Updated : 2010-09-07T16:21:36Z | Reply | View Tweet |
Related News from Digg
Leave a comment
| Trackback
