Security Pie

RSA Conference, the biggest security event of the year will take place next month.

IMO now is a good time to review how we are doing as an industry, fulfilling our destination (that is, securing).

On Jone 2003, Gartner declared that IDS are dead and “recommends that enterprises redirect the money they would have spent on IDS toward defense applications such as those offered by thought-leading firewall vendors that offer both network-level and application-level firewall capabilities in an integrated product.”

6.5  years later, are we there yet?

We have people with keen enough an eye and an ear to detect these pigeons. Trained as they are, they sit in pairs in the highest tower of your castle, ever watching for pigeons. Not all pigeons, your majesty, only what we call “egress” pigeons, who fly in a direction clearly meant to depart your kingdom. Targeting only “egress” pigeons is easier because it saves on the drugged arrows they use to fell them.

Then once a pigeon is felled, the trained hounds are released. These specially trained hounds find the pigeon and bring it back into your castle unharmed and intact. Then, the pigeon is take to a special room where it is left to recover the effect of the drug. If the message carries the royal seal, which only your majesty wears, then it is reattached to the pigeon and sent – while a cryptologist reads the rest of the messages and deliver it to your majesty after it has been duly decoded.

After you get to trust our cryptologists, you may order them to perform an action on your behest your majesty, for example, to burn the message so it never reaches its destination, or to send it unharmed, based on its content. Some messages may not be of interest to your majesty, and may be taken to one of your trusted viziers for consultation to await their decision, so your majesty may be free to rule the kingdom. Others may be delivered to your majesty directly, while others may just be copied verbatim and saved for later reference.

OK. So this blog is both not about security at all and all about security at the same time. That is like catching two stones with one bird.

My inbox today carried a fresh bit of news from CIO magazine. An opinion column by Eric Lundquist, labelled “We need a national CIO, not a CTO” stipulated that CIO are a better match for US national role than a CTO. To paraphrase Lundquist’s message, CIO’s are firmly planted in the business realities of the day, while CTO focus on technologies “looking for uses”. Reminds me of the old adage of “legs firmly planted” vs. “head in the clouds”.

I firmly disagree.

Read the rest of this entry »

Ok – So I have a vested interest in DLP. Sue me.

But here is a real cool use of DLP to detect plagurizing of dissertations:
http://ondlp.com/?p=9#respond

Notes:
1. Really cool use of the fingerprinting technology
2. I did not know that Dave’s wife was a professor

/al

In his latest posting (http://securitypie.com/workers-more-prone-to-lie-in-email-so-what/), Sharon refers to a hypothetical detector for lying over email. Now such things exist, and have existed for quite some time. Plotters connected to sensors have been used as lie detectors since its evolutionary invention spanning some 40 years and multiple devices during the turn of the last century. Every so often a handheld lie detector would appear on the classified ads of some local newspaper or one of the inflight magazines or skymall.

Now everyone knows (or should know) that the jury is out about the accuracy of lie detectors. Now why is that significant?

There are 4 possible outcomes of a lie detector test:

Read the rest of this entry »