An Information Security Place

OK, so I broke down and bought a Jawbone Bluetooth headset.  They are ususally about $120, but I got a killer deal on Ebay for under $40, including shipping.  But when I was buying it, I noticed that most of them do not come with the USB charger cable (I think someone intercepted a shipment somewhere - hope the cops don’t come for me), so basically the thing is nice-looking but useless.  So I needed to buy a charger.

Well, as I started looking around, most of the chargers were about $20.  Since my PayPal fund was depleted, and since I am pretty cheap, I was trying to find a better deal.  So I started doing some Google searches, and I ran across this site.  Basically, someone figured out how to rig a regular USB cable to charge his Jawbone.  It’s really not that hard.  Just cut the cable, tie on a couple of paper clips, and hook the right leads to the right pins on the Jawbone.  BAM!!  It charges!

So I decided to try it out myself, and here it is:

Too sweet.

Vet

Not sure about you, but I usually celebrate my anniversary by taking the wife out to dinner and a movie, and occasionally she gets some jewelry.  I guess Hamas looks at it a little differently.

Using the immortal words of Rodney King, I have to say, “People, I just want to say, you know, can we all get along?”

Vet

Pretty dang funny.

Scroll down to see comments.  This blog needs Akismet!

Vet

So what has my buddy Cutaway got himself into here??  Looks like the Hoff and the Roth are smacking him around a bit about his stance on UTM.  Mike says Cutaway doesn’t know sh*t from Shinola about UTM’s (in defense of Rothman, Cutaway admits he doesn’t).  Hoff says Cutaway is smoking crack if he thinks UTM’s add complexity since you are putting everything in one box.  Cutaway just wants a beer (see end of post).

As I read through all of this, I had to say that I agreed with Mike and Hoff more than Cutaway.  My major beef with Cutaway is his assertion that risk is increased because of the possibility of vulnerabilities due to so much functionality being loaded into one box.  While on the face that seems to be true, Cutaway and Andy seem to be assuming that a UTM = big Linux box with a bunch of security apps thrown on it.  My guess is most companies don’t have uber-geek working for them and are more likely to buy a box from Juniper, Checkpoint, Fortinet, etc.  These are proprietary OS’s that do not typically fall prey to the same problems that a Linux server with Squid, Snort, and SpamAssassin installed on it.  The theory is still feasible to be sure, but a LOT less likely with purpose-built hardware and OS. 

Also, the single point of failure is a real problem, but a good network design mitigates that, so that only comes into play if you have a problem spending a few thousand more dollars.

Also, to take this to another level, I wonder if Cutaway would think that a multi-segmented firewall or IPS is dangerous because if the box is compromised then each segment becomes vulnerable?  That is also a true assertion, but is the risk worth the cost savings and convenience?

But just to show that I am not only disagreeing with Cutaway (I will buy you a beer next time we see each other, buddy), let’s look at this statement from Mike:

Consolidating hardware and more importantly the management of these disparate network security functions is critical to helping today’s security folks to keep their heads above water.

First of all, if you standardize on one manufacturer’s hardware, you’ll find that many (if not most) have a management application that makes management a lot easier, even if you have multiple functions dispersed among different hardware.  Also, with the advent and (hopefully soon-to-be) maturation of the configuration management solutions out there, this may not be as big of an issue in a few years.  Mike’s statement is true, but not as significant as it once was.

Vet

Ah ha!  I got one:

z » Culinary contraband counterculture cascade | {website.info}/1969/12/31/culinary-contraband-counterculture-cascade | IP: xxx.xxx.xxx.xxx

[…] Check it out! While looking through the blogosphere we stumbled on an interesting post today.Here’s a quick excerptAstrophysicist amphitheater anteater aardvark Agathokakological Alcomiroziropoulopilousitounitapignac. PNEUMONOULTRAMICROSCOPICSILICOVOLCANOCONIOSIS … … … … OK, for those of you wondering if I got back on the crack pipe, I am running a … […]

Vet

I just read through this article about different types of users and how to deal with them.  The article didn’t really give much solid advice since it was mostly opinions from a bunch of different IT people who had their own ideas about the problem.  It really all came down to managers saying something like “don’t lose your temper.”

But this one paragraph about the “know-it-all” user struck me:

You know this user. He knows a little HTML, and he defragged his hard drive once, so now he thinks he’s an engineer who knows more than you. He often refuses to follow policies and instructions and has been known to poke his head in the server room “just to see what you’re up to.”

Ummmm, if a user can “poke his head in the server room”, then you might need to think about security.

Vet

Astrophysicist amphitheater anteater aardvark Agathokakological Alcomiroziropoulopilousitounitapignac

PNEUMONOULTRAMICROSCOPICSILICOVOLCANOCONIOSIS

…

…

…

…

OK, for those of you wondering if I got back on the crack pipe, I am running a test to see what happens with splogs (spam blogs) when I post.  I get quite a trackbacks from splogs every time I post now, so I want to see what kind of filters (if any) they have in place.  I don’t know how far I will carry this.  Just thought it would be fun.  Here’s the link for that long sucker up there that starts with “P”.

Vet

Jenna Bush called her mom and dad’s private number to talk to them on the Ellen Degeneres show.  When my wife told me about it, all I could think was Holy crap!  Now Ellen has the president’s provate residence telephone number!

Jenna appeared nervous about doing it, and she even asked if the number was being recorded.  Ellen hid the numbers from the camera, and the phone appeared to be just a simple phone with no memory capability.  But that was just dumb.  I wonder if they are changing the President’s private number at the Whitehouse?

Here’s the vid:

Vet

If you don’t ever visit xkcd.com, you are missing out.  Sometimes the stuff is plain weird, sometimes I don’t get them at all, but most of the time they are pure genius.  This one is fairly recent, and it is on of my favorites so far.

Vet

There is a pretty good article by Frank Hayes over at Computerworld about security being a business problem.  Others have been preaching this for a while.  I have preached this time and time again over the last year or so on my blog and before that in my recommendations to my bosses, so I am not surprised it comes out again.

Frank was inspired to write his own version by the latest SANS top 20 that says security is a people problem.  But Frank REALLY does not like the recommendation of testing your users and cutting off their Internet access if they fail.  I don’t like that suggestion either.  Seems very harsh.  Of course, he is also right that it will do nothing to help and everything to hurt the relationship between users and security.

Then Frank said this:

And that animosity won’t stop with the security group. The IT people who take the brunt of it will be those on the help desk and development teams and anyone else who deals directly with users.

And?  Isn’t that what the help desk is for??

Vet

I had a client call me right before Thanksgiving in emergency mode (one of the Dallas clients that I am starting to work with).  Looks like he has a remote office that uses the local cable company as their ISP and connects back to corporate via a site-to-site VPN.  I found out that they have never setup a persistent IP address for their firewall / router.  Basically, they had been depending on the DHCP lease renewing rather than spending the money for a persistent IP (bad choice).   

This client is new to me, so I had no idea what their network is like.  My counterpart in Dallas (this has been his account for a while) was out for the week, and it was proving very hard to get in touch with him since his wife had just had a baby on that Sunday.  The client was understanding, but he was also starting to freak because the remote site had a few VPN tunnels terminated there because of a server at the location that was used for processing orders.  Anyway, to shorten this down so I can get to the point, I finally got in touch with the SE in Dallas and got it all straightened out (I will be fixing it again for him tonight since he finally decided to get a persistent IP), and the guy was happy.

So I talked to the account manager and the Dallas SE, and I learned a few things about the account.  First of all, this guy was running (obviously) a mish-mash of ISP’s at his sites, so management of that sucked when a site went down or had other issues since he had to keep all those ISP’s info.  Also, he used to have a couple of people on staff to work on their IT issues, but he let them go a while back, even though the company is in growth mode and doing well.  And I learned that the AM and the Dallas SE had tried to get this guy to buy Netscreen Security Manager (he has Netscreen 5gt’s in his remote sites and a NS25 at corporate) to make his network manageable.

So essentially, even though this guy was growing and was adding sites, he wanted to run everything on the cheap.  And he was depending on us to fix his problems when he had them, even though Accuvant is not a break / fix type of company.  We do everything project based - the only real flexible assets we have are our SE’s like me, and we are supposed to be pre-sales only, so we were basically helping the guy out on the hopes of new business.

So I went up to meet the guy after we got everything straightened out in the hopes of getting the guy to bite off on some enterprise-level networking.  Of course, I should have known better.  I have known guys like this all my IT career.  They will do everything in their power to get something for free, and they won’t quit until you realize you are getting screwed by doing a bunch of free work.  And though I can’t say I blame the guy, it also aggravates me that this guy could not recognize that he was becoming too large an organization to manage in this kind of piss-poor manner.  I understand making business decisions, but at some point the term “cheap” starts coming into play.

If you want to be an enterprise, act like one in all respects.

Vet