About
Eric Rachner's observations on information security, hacking, and the business of IT risk and compliance.
Accounts
Friends
Newer posts are loading.
You are at the newest post.
Click here to check if anything new just came in.
Click here to check if anything new just came in.
July 28 2010
Congratulations, Dan Kaminsky
Also, I know where you live. One down, four to go. ;)
(Oh, wait. The problem with these secret-sharing schemes is, you can never be sure which one gave you a bogus fragment of the key. Back to the drawing board, I guess.)
July 18 2010
Told ya so.
What was I saying about spies in the workplace? Something like, "...not just Google, and not just in China, and not just by China."
Like, perhaps, at Microsoft, in Redmond, by Russia? From the Seattle Post-Intelligencer:
March 21 2010
January 19 2010
Offshoring Partners & The Hand That Feeds
People are catching on to what the smart kids knew all along: of course Google's Chinese offices were compromised. And not just Google, and not just in China, and not just by China.Ten years ago, the disloyal insider was a fact of life about which there wasn't much to be done. You'd mitigate as best you could with careful access control (right?) and handle incidents as they occurred. Beyond that, what? Fire all your foreign visa holders?
Times have changed. Global enterprises are investing in China, India, Russia, and elsewhere, creating new opportunities for an entire generation of workers to succeed without having to emigrate from their own cultures and communities.
And that's how I, Eric the Prophet, can predict roughly what Hillary Clinton is going to say to China on Thursday:
All of this investment is supposed to give you guys some skin in the game. Surely you don't prefer the previous arrangement, in which the "developed" world lures China's best and brightest abroad, and China's role in the global economy is relegated to "factory?"
Is anybody else just a little bit curious as to the global economy's capacity to issue pink slips in countries whose governments can't or won't prevent the emission of cyberattacks?
p.s. On a personal note, I helped Microsoft select candidates for IT Security positions in China back in 2004. As I recall, wages for Chinese IT staff were on the order of US $5.00/hr. Whatever resentment I felt towards Microsoft at the time for not cutting me in on the expected savings has given way to something more like schadenfreude.
January 13 2010
Duly Noted
From the Blackberry Enterprise Server administration manual:
"To ensure [system] email is not blocked or modified, the blackberry.net domain should be whitelisted against any anti-virus, anti-spam, or blacklisting software utilized by the email system or gateway."
Translation:
"Hackers interested in bypassing any anti-virus, anti-spam and blacklisting software utilized by Blackberry customers are hereby advised to use forged source addresses ending in blackberry.net."
"To ensure [system] email is not blocked or modified, the blackberry.net domain should be whitelisted against any anti-virus, anti-spam, or blacklisting software utilized by the email system or gateway."
Translation:
"Hackers interested in bypassing any anti-virus, anti-spam and blacklisting software utilized by Blackberry customers are hereby advised to use forged source addresses ending in blackberry.net."
October 26 2009
A Grain of Salt for Digital Asset Values
<!--[if gte mso 9]><xml>
<w:worddocument>
<w:view>Normal</w:view>
<w:zoom>0</w:zoom>
<w:trackmoves/>
<w:trackformatting/>
<w:punctuationkerning/>
<w:validateagainstschemas/>
<w:saveifxmlinvalid>false</w:saveifxmlinvalid>
<w:ignoremixedcontent>false</w:ignoremixedcontent>
<w:alwaysshowplaceholdertext>false</w:alwaysshowplaceholdertext>
<w:donotpromoteqf/>
<w:lidthemeother>EN-US</w:lidthemeother>
<w:lidthemeasian>X-NONE</w:lidthemeasian>
<w:lidthemecomplexscript>X-NONE</w:lidthemecomplexscript>
<w:compatibility>
<w:breakwrappedtables/>
<w:snaptogridincell/>
<w:wraptextwithpunct/>
<w:useasianbreakrules/>
<w:dontgrowautofit/>
<w:splitpgbreakandparamark/>
<w:dontvertaligncellwithsp/>
<w:dontbreakconstrainedforcedtables/>
<w:dontvertalignintxbx/>
<w:word11kerningpairs/>
<w:cachedcolbalance/>
</w:compatibility>
<m:mathpr>
<m:mathfont m:val="Cambria Math"/>
<m:brkbin m:val="before"/>
<m:brkbinsub m:val="--"/>
<m:smallfrac m:val="off"/>
<m:dispdef/>
<m:lmargin m:val="0"/>
<m:rmargin m:val="0"/>
<m:defjc m:val="centerGroup"/>
<m:wrapindent m:val="1440"/>
<m:intlim m:val="subSup"/>
<m:narylim m:val="undOvr"/>
</m:mathpr></w:worddocument>
</xml><![endif]--><!--[if gte mso 9]><xml>
<w:latentstyles deflockedstate="false" defunhidewhenused="true"
defsemihidden="true" defqformat="false" defpriority="99"
latentstylecount="267">
<w:lsdexception locked="false" priority="0" semihidden="false"
unhidewhenused="false" qformat="true" name="Normal"/>
<w:lsdexception locked="false" priority="9" semihidden="false"
unhidewhenused="false" qformat="true" name="heading 1"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 2"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 3"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 4"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 5"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 6"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 7"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 8"/>
<w:lsdexception locked="false" priority="9" qformat="true" name="heading 9"/>
<w:lsdexception locked="false" priority="39" name="toc 1"/>
<w:lsdexception locked="false" priority="39" name="toc 2"/>
<w:lsdexception locked="false" priority="39" name="toc 3"/>
<w:lsdexception locked="false" priority="39" name="toc 4"/>
<w:lsdexception locked="false" priority="39" name="toc 5"/>
<w:lsdexception locked="false" priority="39" name="toc 6"/>
<w:lsdexception locked="false" priority="39" name="toc 7"/>
<w:lsdexception locked="false" priority="39" name="toc 8"/>
<w:lsdexception locked="false" priority="39" name="toc 9"/>
<w:lsdexception locked="false" priority="35" qformat="true" name="caption"/>
<w:lsdexception locked="false" priority="10" semihidden="false"
unhidewhenused="false" qformat="true" name="Title"/>
<w:lsdexception locked="false" priority="1" name="Default Paragraph Font"/>
<w:lsdexception locked="false" priority="11" semihidden="false"
unhidewhenused="false" qformat="true" name="Subtitle"/>
<w:lsdexception locked="false" priority="22" semihidden="false"
unhidewhenused="false" qformat="true" name="Strong"/>
<w:lsdexception locked="false" priority="20" semihidden="false"
unhidewhenused="false" qformat="true" name="Emphasis"/>
<w:lsdexception locked="false" priority="59" semihidden="false"
unhidewhenused="false" name="Table Grid"/>
<w:lsdexception locked="false" unhidewhenused="false" name="Placeholder Text"/>
<w:lsdexception locked="false" priority="1" semihidden="false"
unhidewhenused="false" qformat="true" name="No Spacing"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 1"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 1"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 1"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 1"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 1"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 1"/>
<w:lsdexception locked="false" unhidewhenused="false" name="Revision"/>
<w:lsdexception locked="false" priority="34" semihidden="false"
unhidewhenused="false" qformat="true" name="List Paragraph"/>
<w:lsdexception locked="false" priority="29" semihidden="false"
unhidewhenused="false" qformat="true" name="Quote"/>
<w:lsdexception locked="false" priority="30" semihidden="false"
unhidewhenused="false" qformat="true" name="Intense Quote"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 1"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 1"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 1"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 1"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 1"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 1"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 1"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 1"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 2"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 2"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 2"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 2"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 2"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 2"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 2"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 2"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 2"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 2"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 2"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 2"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 2"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 2"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 3"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 3"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 3"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 3"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 3"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 3"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 3"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 3"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 3"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 3"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 3"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 3"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 3"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 3"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 4"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 4"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 4"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 4"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 4"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 4"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 4"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 4"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 4"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 4"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 4"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 4"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 4"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 4"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 5"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 5"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 5"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 5"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 5"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 5"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 5"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 5"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 5"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 5"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 5"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 5"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 5"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 5"/>
<w:lsdexception locked="false" priority="60" semihidden="false"
unhidewhenused="false" name="Light Shading Accent 6"/>
<w:lsdexception locked="false" priority="61" semihidden="false"
unhidewhenused="false" name="Light List Accent 6"/>
<w:lsdexception locked="false" priority="62" semihidden="false"
unhidewhenused="false" name="Light Grid Accent 6"/>
<w:lsdexception locked="false" priority="63" semihidden="false"
unhidewhenused="false" name="Medium Shading 1 Accent 6"/>
<w:lsdexception locked="false" priority="64" semihidden="false"
unhidewhenused="false" name="Medium Shading 2 Accent 6"/>
<w:lsdexception locked="false" priority="65" semihidden="false"
unhidewhenused="false" name="Medium List 1 Accent 6"/>
<w:lsdexception locked="false" priority="66" semihidden="false"
unhidewhenused="false" name="Medium List 2 Accent 6"/>
<w:lsdexception locked="false" priority="67" semihidden="false"
unhidewhenused="false" name="Medium Grid 1 Accent 6"/>
<w:lsdexception locked="false" priority="68" semihidden="false"
unhidewhenused="false" name="Medium Grid 2 Accent 6"/>
<w:lsdexception locked="false" priority="69" semihidden="false"
unhidewhenused="false" name="Medium Grid 3 Accent 6"/>
<w:lsdexception locked="false" priority="70" semihidden="false"
unhidewhenused="false" name="Dark List Accent 6"/>
<w:lsdexception locked="false" priority="71" semihidden="false"
unhidewhenused="false" name="Colorful Shading Accent 6"/>
<w:lsdexception locked="false" priority="72" semihidden="false"
unhidewhenused="false" name="Colorful List Accent 6"/>
<w:lsdexception locked="false" priority="73" semihidden="false"
unhidewhenused="false" name="Colorful Grid Accent 6"/>
<w:lsdexception locked="false" priority="19" semihidden="false"
unhidewhenused="false" qformat="true" name="Subtle Emphasis"/>
<w:lsdexception locked="false" priority="21" semihidden="false"
unhidewhenused="false" qformat="true" name="Intense Emphasis"/>
<w:lsdexception locked="false" priority="31" semihidden="false"
unhidewhenused="false" qformat="true" name="Subtle Reference"/>
<w:lsdexception locked="false" priority="32" semihidden="false"
unhidewhenused="false" qformat="true" name="Intense Reference"/>
<w:lsdexception locked="false" priority="33" semihidden="false"
unhidewhenused="false" qformat="true" name="Book Title"/>
<w:lsdexception locked="false" priority="37" name="Bibliography"/>
<w:lsdexception locked="false" priority="39" qformat="true" name="TOC Heading"/>
</w:latentstyles>
</xml><![endif]-->
&amp;amp;amp;amp;amp;lt;!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;
mso-font-charset:2;
mso-generic-font-family:auto;
mso-font-pitch:variable;
mso-font-signature:0 268435456 0 0 -2147483648 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;
mso-font-charset:1;
mso-generic-font-family:roman;
mso-font-format:other;
mso-font-pitch:variable;
mso-font-signature:0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;
mso-font-charset:0;
mso-generic-font-family:swiss;
mso-font-pitch:variable;
mso-font-signature:-1610611985 1073750139 0 0 159 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-parent:"";
margin-top:0in;
margin-right:0in;
margin-bottom:10.0pt;
margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;
text-underline:single;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-noshow:yes;
mso-style-priority:99;
color:purple;
mso-themecolor:followedhyperlink;
text-decoration:underline;
text-underline:single;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
margin-top:0in;
margin-right:0in;
margin-bottom:10.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-unhide:no;
mso-style-qformat:yes;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:10.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
.MsoChpDefault
{mso-style-type:export-only;
mso-default-props:yes;
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:Calibri;
mso-fareast-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
.MsoPapDefault
{mso-style-type:export-only;
margin-bottom:10.0pt;
line-height:115%;}
@&amp;amp;amp;amp;lt;a href="http://page.soup.io"&amp;amp;amp;amp;amp;gt;page&amp;amp;amp;amp;amp;lt;/a&amp;amp;amp;amp;amp;gt; Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1023358003;
mso-list-type:hybrid;
mso-list-template-ids:-1676016582 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--&amp;amp;amp;amp;amp;gt;
<!--[if gte mso 10]>
<style>
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin-top:0in;
mso-para-margin-right:0in;
mso-para-margin-bottom:10.0pt;
mso-para-margin-left:0in;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
</style>
<![endif]-->
A recent
flurry
of blog
posts
by some very smart people has reminded me of how in my former life at Microsoft,
I often found myself in meetings whose agenda included tallying up the
so-called "digital assets" related to a given project.
For the uninitiated, the "digital asset" is the starting point in
pretty much every formal and semi-formal IT risk analysis exercise, to
wit: What are we protecting, after all, if not assets? What uniquely
digital threats imperil these assets, and how awful would it be if any of those
threats should be realized, and what are the potential mitigations for each
threat, and what is the cost of each contemplated mitigation, and can I somehow
avoid being summoned to any more of these meetings, or do I need to step up my
search for a new position in the company?
Granted, as a starting point for getting a handle on your security spend, it seems only reasonable to boil everything down to a finite list of items. The obvious next step is, let’s appraise the items in our list according to some kind of valuation scheme, and start sorting. There’s plenty of methodologies to pick from.
Except that we’re not insuring Tina Turner’s legs here. I contend that there is no useful relationship between asset value and loss-per-incident.
With that claim in mind, let’s review the types of costs associated with typical real-world hacking incidents, and ask ourselves which of these costs will vary according to some pre-estimated value of the compromised digital assets:
* Engagement of incident response specialists
* Damage to reputation / loss of future business
* Loss of business advantage (e.g., leakage of details concerning payroll, pending deals, R&D, etc.)
* Direct financial loss (e.g., fraudulent transactions)
* Disruption of regular business operations
* Fines and penalties
<!--[if !supportLists]-->Actually, I wrote that list in order, ranging from “no relationship to asset values” to “perhaps some vague, tenuous relationship.”
Sure, the cost of an hour’s operational disruption might be estimable in advance, especially when service level agreements are in place. But when we attempt to quantify the cost of downtime, are we even talking about assets any more?
And is it possible that when we fetishize over the valuations of individual data assets, we’re taking our eyes off the loss-avoidance ball?March 31 2009
Rebooting.
It's been quite a while since my old blog was a casualty of the Dreamhost hacking incident, and I've been more than a little remiss about restoring things.
But Soup.io seems to be a pretty cool way to publish, so I'm giving it a whirl.
Those of you looking for Alcatraz, GPCul8r, or Scurvy will find them published again on this page in the very near future.
Cheers,
- Eric
But Soup.io seems to be a pretty cool way to publish, so I'm giving it a whirl.
Those of you looking for Alcatraz, GPCul8r, or Scurvy will find them published again on this page in the very near future.
Cheers,
- Eric
Older posts are this way
If this message doesn't go away, click anywhere on the page to continue loading posts.
Could not load more posts
Maybe Soup is currently being updated? I'll try again automatically in a few seconds...
Maybe Soup is currently being updated? I'll try again automatically in a few seconds...
Just a second, loading more posts...
You've reached the end.
