<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Security Pie &#187; Snafu</title>
	<atom:link href="http://securitypie.com/tag/snafu/feed/" rel="self" type="application/rss+xml" />
	<link>http://securitypie.com</link>
	<description>The ramblings of three security curmudgeons</description>
	<lastBuildDate>Thu, 30 Dec 2010 23:25:54 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>The (WTF) Launch Party</title>
		<link>http://securitypie.com/the-wtf-launch-party/</link>
		<comments>http://securitypie.com/the-wtf-launch-party/#comments</comments>
		<pubDate>Fri, 25 Sep 2009 19:45:22 +0000</pubDate>
		<dc:creator>sharon</dc:creator>
				<category><![CDATA[marketing]]></category>
		<category><![CDATA[Snafu]]></category>
		<category><![CDATA[thoughts]]></category>

		<guid isPermaLink="false">http://securitypie.com/?p=637</guid>
		<description><![CDATA[Finally a bold contester for the &#8220;big bucks spent for nothing in a marketing movie&#8221;, &#8220;what did they think&#8221; and &#8220;you are so cool. NOT&#8221; categories. Someone from the Windows 7 marketing team thought that the following movie would be funny and interesting. Well, it is not. Personally I feel so stupid spending 6:14 minutes trying to understand if [...]]]></description>
			<content:encoded><![CDATA[<p>Finally a bold contester for the &#8220;big bucks spent for nothing in a marketing movie&#8221;, &#8220;what did they think&#8221; and &#8220;you are so cool. NOT&#8221; categories.</p>
<p>Someone from the Windows 7 marketing team thought that the following movie would be funny and interesting. Well, it is not. Personally I feel so stupid spending 6:14 minutes trying to understand if there is a hidden message. I even tried to run it backwards and looked at other movies in this channel, trying to determine if this is indeed an original / legal <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="560" height="340" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0"><param name="allowFullScreen" value="true" /><param name="allowscriptaccess" value="always" /><param name="src" value="http://www.youtube.com/v/1cX4t5-YpHQ&amp;hl=en&amp;fs=1&amp;" /><param name="allowfullscreen" value="true" /><embed type="application/x-shockwave-flash" width="560" height="340" src="http://www.youtube.com/v/1cX4t5-YpHQ&amp;hl=en&amp;fs=1&amp;" allowscriptaccess="always" allowfullscreen="true"></embed></object><br />
Microsoft publication (it looks legit).</p>
<p>They got the cast right: a young and an older women. The stereotypical geek and a black person (humm, is a <a href="http://industry.bnet.com/advertising/10003668/microsoft-edits-black-person-out-of-ad-everyone-offended/" target="_blank">real </a>black person? ) but what about the plot?</p>
<p>WTF?</p>
]]></content:encoded>
			<wfw:commentRss>http://securitypie.com/the-wtf-launch-party/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Enemy at The Watercooler</title>
		<link>http://securitypie.com/enemy-at-the-watercooler/</link>
		<comments>http://securitypie.com/enemy-at-the-watercooler/#comments</comments>
		<pubDate>Tue, 13 Jan 2009 08:24:01 +0000</pubDate>
		<dc:creator>sharon</dc:creator>
				<category><![CDATA[Snafu]]></category>
		<category><![CDATA[Add new tag]]></category>

		<guid isPermaLink="false">http://securitypie.com/?p=419</guid>
		<description><![CDATA[  January &#8211; It&#8217;s this time of the year. Sales Kick Off. SKO. Many high technology companies are having their annual or bi annual sales meeting this week.  Flights to the Silicon Valley are fully booked, hotels are crowded and the bartenders are busy.  The company I&#8217;m working for is not different. We&#8217;ll have our [...]]]></description>
			<content:encoded><![CDATA[<p> </p>
<p class="MsoNormal"><span><span>January &#8211; It&#8217;s this time of the year. Sales Kick Off. SKO. Many high technology companies are having their annual or bi annual sales meeting this week.  Flights to the Silicon Valley are fully booked, hotels are crowded and the bartenders are busy.  The company I&#8217;m working for is not different. We&#8217;ll have our bi annual meeting event in one of the Silicon Valley&#8217;s finest hotel later this week.  Some of us gathered together at the hotel to have more in depth discussion before the entire sales and marketing force will arrive. </span> </span></p>
<p><span><span>This hotel was chosen by a different company as their SKO launch pad. Apparently, this company competes with one of our products. At the same time, we are also very synergetic. (Think about PCI 6.6 WAF + VA synergy).  Keeping the <a href="http://www.amazon.com/Enemy-Water-Cooler-Enterprise-Countermeasures/dp/1597491292">insider threat and the real enemy in mind, t</a>hose who run sales for this company should take a look at Brian&#8217;s book (link to</span></span><span><span> </span></span><span><span><a href="http://www.amazon.com/Enemy-Water-Cooler-Enterprise-Countermeasures/dp/1597491292" target="_blank">Amazon</a>) </span></span></p>
<p><span id="more-419"></span></p>
<div id="attachment_420" class="wp-caption aligncenter" style="width: 307px"><a href="http://www.amazon.com/Enemy-Water-Cooler-Enterprise-Countermeasures/dp/1597491292" target="_blank"><img class="size-medium wp-image-420" title="enemy-at-the-water-cooler" src="http://securitypie.com/wp-content/uploads/2009/01/enemy-at-the-water-cooler-297x300.png" alt="enemy at the water cooler" width="297" height="300" /></a><p class="wp-caption-text">enemy at the water cooler</p></div>
<p> </p>
<p>I&#8217;ve unintentionaly learned so many things about this company&#8230; All I had to do was &#8211; nothing.</p>
<p>Jsut stand at the bar, smile, nod when other people say hello and listen&#8230;..</p>
]]></content:encoded>
			<wfw:commentRss>http://securitypie.com/enemy-at-the-watercooler/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Poor Aaron, Good for Data Protection?</title>
		<link>http://securitypie.com/poor-aaron-good-for-data-protection/</link>
		<comments>http://securitypie.com/poor-aaron-good-for-data-protection/#comments</comments>
		<pubDate>Thu, 11 Dec 2008 20:54:40 +0000</pubDate>
		<dc:creator>sharon</dc:creator>
				<category><![CDATA[Data protection]]></category>
		<category><![CDATA[Risk Management]]></category>
		<category><![CDATA[leaks]]></category>
		<category><![CDATA[Snafu]]></category>
		<category><![CDATA[yahoo!]]></category>

		<guid isPermaLink="false">http://securitypie.com/?p=341</guid>
		<description><![CDATA[Yahoo! is reducing costs and sending people home. In my opinion they could have saved a lot of money just by not sending all those proxy letters and tons of other items to my address. (Yea, I have some few shares). As expected, the internal presentation explaining how to cut employees was leaked to the [...]]]></description>
			<content:encoded><![CDATA[<p><a href="http://securitypie.com/wp-content/uploads/2008/12/shhh-do-not-forward.png"><img class="alignleft size-medium wp-image-342" title="shhh-do-not-forward" src="http://securitypie.com/wp-content/uploads/2008/12/shhh-do-not-forward-300x223.png" alt="" width="300" height="223" /></a>Yahoo! is reducing costs and sending people home. In my opinion they could have saved a lot of money just by not sending all those proxy letters and tons of other items to my address. (Yea, I have <span style="text-decoration: line-through;">some </span>few shares). As expected, the internal presentation explaining how to cut employees was <a href="http://valleywag.com/5106184/yahoos-secret-layoff-doublespeak-revealed?view=full" target="_blank">leaked </a>to the Internet. I guess that the Internet Protocol (IP) doesn&#8217;t really work that well when the Do Not Forward bit is defined as text on a Power Point.</p>
<p>As a second thought, maybe there&#8217;s an opportunity for a new start up to create the technology to embed &#8216;Do Not Forward&#8217; text into packets that can never leave the network.</p>
<p>So Aaron got the sack and articles regarding the threats of a slugging economy and recession era (such as <a href="http://www.darkreading.com/security/attacks/showArticle.jhtml?articleID=212201861" target="_self">this</a>) are common.   Organizations should protect sensitive data at all times based on their risk management strategy. Unfortunately, such times help us to understand the risk better. I&#8217;m not saying that the damage of leaked presentations (BTW, I think that the content itself is good, but the context is awful) is on Yahoo!&#8217;s top risk matrix, but I do think that organizations should set their strategy for data protection.</p>
]]></content:encoded>
			<wfw:commentRss>http://securitypie.com/poor-aaron-good-for-data-protection/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Cisco&#8217;s Greatest Hit</title>
		<link>http://securitypie.com/ciscos-greatest-hit/</link>
		<comments>http://securitypie.com/ciscos-greatest-hit/#comments</comments>
		<pubDate>Fri, 17 Oct 2008 17:40:24 +0000</pubDate>
		<dc:creator>sharon</dc:creator>
				<category><![CDATA[Risk Management]]></category>
		<category><![CDATA[Security Business]]></category>
		<category><![CDATA[Snafu]]></category>
		<category><![CDATA[cisco]]></category>
		<category><![CDATA[Diego Rivas]]></category>
		<category><![CDATA[music]]></category>
		<category><![CDATA[paranoia]]></category>
		<category><![CDATA[software]]></category>

		<guid isPermaLink="false">http://securitypie.com/?p=215</guid>
		<description><![CDATA[  Dave, a developer from Melbourne, Australia brings an interesting story . He was installing a newly purchased VPN product. When he loaded the VPN client software, he discovered that in the place of the usual boring software was an audio disk with 12 tracks of Spanish music (see Cisco\&#8217;s Hit). A lively discussion on Dave&#8217;s blog tried [...]]]></description>
			<content:encoded><![CDATA[<div id="attachment_216" class="wp-caption alignleft" style="width: 310px"><a href="http://securitypie.com/wp-content/uploads/2008/10/diego-rivas.jpg"><img class="size-medium wp-image-216" title="diego-rivas" src="http://securitypie.com/wp-content/uploads/2008/10/diego-rivas-300x293.jpg" alt="Cisco is promoting Diego Rivas" width="300" height="293" /></a> </p>
<p> </p>
<p><p class="wp-caption-text">Cisco is promoting Diego Rivas</p></div>
<p> </p>
<p>Dave, a developer from Melbourne, Australia brings an interesting <a href="http://dave.fumberger.com/2008/10/08/cisco-networks-new-album/" target="_blank">story </a>. He was installing a newly purchased VPN product. When he loaded the VPN client software, he discovered that in the place of the usual boring software was an audio disk with 12 tracks of Spanish music (see <a href="http://sites.google.com/a/collect3.com.au/files/Home/cisco.mp3?attredirects=0">Cisco\&#8217;s Hit</a>). A lively discussion on Dave&#8217;s blog tried and successfully managed to identify the musician.  You can watch the video below.</p>
<p>Beyond the anecdotal story there are few things that we can learn from this incident. I&#8217;m not picking on Cisco specifically: In the past, one of the products that I was managing was built by very large OEM partner that was responsible for building the appliance, packaging, forwarding etc. Though it was very rare, we had few incidents when customer X received parts of a printer with his order (inside the appliance package), while another customer received  the wrong CDs etc. Errors do occur and I believe that Cisco will do everything it can to learn from this manufacturing snafu and improve its quality assurance process. However from a security risk management point of view , this incident is a reminder to trust no one:</p>
<p>Every CD should be considered suspicious, even if it arrived inside a box that has the Cisco logo. Due to the popularity of Cisco&#8217;s gear there&#8217;s a second hand market and also some <a href="http://www.networkworld.com/news/2006/102306counterfeit.html" target="_blank">fake </a>devices. <a href="http://news.softpedia.com/news/FBI-039-s-Own-Offices--Infected-with-Counterfeit-Cisco-Hardware-85312.shtml" target="_blank">Softpedia tells </a>that even the United States government is reportedly using some 3500 fake Cisco-branded network devices, including routers, network switches and hubs. &#8220;According to the investigation results, the fake devices are worth up to $3.5 million.&#8221; </p>
<p> </p>
<p>Trust no one is the moral of this story.  On a side note, this story also explains why the DOD is investing so much money looking for the <a href="http://blog.imperva.com/2008/05/the-hunt-for-the-kill-switch.html" target="_blank">kill switch</a>. </p>
<p>Enjoy the music!</p>
<p>(Arik, What&#8217;s going on down there in Australia?, we&#8217;re getting a steady stream of weird reports recently <img src='http://securitypie.com/wp-includes/images/smilies/icon_smile.gif' alt=':-)' class='wp-smiley' />  </p>
<p><object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" width="425" height="344" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,40,0"><param name="allowFullScreen" value="true" /><param name="src" value="http://www.youtube.com/v/JTXBCvAzM5o&amp;hl=en&amp;fs=1" /><embed type="application/x-shockwave-flash" width="425" height="344" src="http://www.youtube.com/v/JTXBCvAzM5o&amp;hl=en&amp;fs=1" allowfullscreen="true"></embed></object></p>
]]></content:encoded>
			<wfw:commentRss>http://securitypie.com/ciscos-greatest-hit/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

