An Information Security Place

Commentary on the State of Information Security
  • About
RSS

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 14 other subscribers

Blog Post Calendar

May 2013
M T W T F S S
« Apr    
 12345
6789101112
13141516171819
20212223242526
2728293031  
Feb07

InfoSec is a Waffle (just like life)

by Michael Farnum on February 7, 2011 at 4:58 pm
Posted In: Security

I was running through some Twitter posts from some friends / colleagues / random InfoSec folks, and I saw one from Jack Daniel that led me to his latest blog post.  In the post, Jack quickly covers the topic of preaching to the choir and staying in our own infosec echo chamber.  He says it is fine to listen to and have discussions with like-minded people in conferences, etc, but he also correctly points out that it becomes a problem “when we never leave these enclaves”, and how we need to “share what we learn” and “get our teeth kicked in by the realities of the real world, business needs, people’s priorities and biases”.

And as I read through the post, it struck me how much it reminded of the sermon at my church from yesterday (Jack kinda reminds me of Jesus sometimes – it’s the beard thing – but that’s not where I am going here).  In the sermon, the pastor talked about how “the World is a Waffle”.  He demonstrated by showing how when you pour syrup on a pancake, it immediately spreads out over the pancake, but when you pour syrup on a waffle, it gets stuck in each chamber of the waffle.  His point was that many of us never venture out to talk to others outside of our comfortable little group, and how we could show a lot of people a lot of love if we would just dare to get uncomfortable.

That is really just human nature.  There are a few of us out there who are cool with getting to know all kinds of people, who actually feel comfortable when they feel uncomfortable (if that makes sense).  But most of us are not like that.  We want to stay in our little area of comfort.  And that is very true when it comes to our chosen profession.  We are just human, after all, so we like it when people agree with us or at least like to talk about the same thing we do.  But if we would just get out and converse, get to know people, get out of our shell, we would not only learn a lot of new stuff and new perspectives, we would actually teach them a thing or two!

Just try it.  You might like it!

Comments Off
Feb04

An Information Security Place Podcast – Episode 01-2011

by Michael Farnum on February 4, 2011 at 10:16 am
Posted In: Podcasts, Security

 

Thomas Jefferson said, “Delay is preferable to error.” Martin Luther said, “Who waits until circumstances completely favor his undertaking will never accomplish anything.” So depending on which quote you like, we either took a long time to record a new episode so we would do it right, or we are just a bunch of slackers. I prefer the former, but I am biased…

In either case, we’re back, and in the immortal words of Rivethead, we’re “Stirring It Up Again” (you’ll read about Riverthead below and hear about them in the podcast).  Jim, Dan, and I got together on a cold and stormy night (at least in Houston and Denver) to talk about all things InfoSec.  Show notes are below.  Oh, and yes, we are going with a new theme for numbering our episodes.  I think it takes away the pressure a little myself since I don’t have to worry about huge numbers for episodes.  Of course, I’ll have to count now, which sucks (thanks Jim).

Show Notes:

InfoSec News Update -

  • Study shows non-compliance more expensive than compliance (study was sponsored by Tripwire) – Article Link / Report Link
  • Security Fail – When Trusted IT members go bad!! – Link Here
  • “It’s a CIO’s worst nightmare: You get a call from the Business Software Alliance (BSA), saying that some of the Microsoft software your company uses might be pirated.

    You investigate and find that not only is your software illegal, it was sold to you by a company secretly owned and operated by none other than your own IT systems administrator,
    a trusted employee for seven years. When you start digging into the admin’s activities, you find a for-pay porn Web site he’s been running on one of your corporate servers.
    Then you find that he’s downloaded 400 customer credit card numbers from your e-commerce server.

    And here’s the worst part: He’s the only one with the administrative passwords.”

  • Looking back at old security news – have we made progress?? – Link Here (Registration required for full article)
  • A SLOW Death! – Link Here
  • Egypt gets Internet connection back – Link Here
  • Ever Cookie’s Anyone? – Link Here

Discussion Topic #1 – CSRF and Clickjacking – Link Here

Music Notes:

Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

Tour dates:

  • Feb 19th – Playing Curtain Club Dallas, TX
  • Feb 26th -  in Carlsbad, NM
  • March 19th – American Airlines Center at a Dallas Stars Hockey game
  • Intro – RivetHead – “Stirring It Up Again”
  • Outro – RivetHead – “Zero Gravity”
  • Link to MP3

    Comments Off
    Jun23

    An Information Security Place Podcast – Episode 37

    by Michael Farnum on June 23, 2010 at 6:19 am
    Posted In: Podcasts

     

    All three of us are on this time. Some good talk about disclosure and web app firewalls, and Google, and some other stuff. Enjoy!

    Show Notes:

    InfoSec News Update -

    • Web App Firewall Discussion Continues – Link 1 / Link 2 / Link 3 / Link 4
    • Good Ole’ Firmware Hack – Link Here
    • Small and MidSize Businesses are Getting Serious About Security – Link Here
    • Looking for the Next Generation of Security Folks -Link Here
    • “POET” Released – Link Here
    • Fingerprinting the Bad Guys – Link Here
    • Careful Where You Sext! – Link Here
    • Encouraging Everyone to Participate in the Survey -Link Here

    Discussion Topic #1 – Google Is Watching Your Wifi, But do You Really Care?

    Discussion Topic #2 - Ye’ Old “Disclosure” Debate…Again?!? Link 1 / Link 2

    Music Notes –

    • Intro / Outro – Digital Breaks – “Therapy”
    • Segway #1 – Building Rome – “Bored”
    • Segway #2 – This is Fiction – “Breathe”
    • Segway #3 – Patent Pending – “Los Angeles”

    Link to MP3

    └ Tags: data, firmware hack, Google, POET, Rsnake, sexting, Supreme Court, web application firewall, WiFi, wireless
    Comments Off
    Jun02

    An Information Security Place Podcast – Episode 36

    by Michael Farnum on June 2, 2010 at 10:33 pm
    Posted In: Podcasts, Security

     

    So do we suck or what? Sorry that its taken so long for us to get another episode out… things have been crazy busy for all of us.

    Anyway for this episode, Dan and Jim found themselves with 30 minutes or so of spare time, not much of a script, and working mics (Michael was working on a couple of proposals and an RFP that is due in two days); so they sat down and simply recorded an unscripted show of rambling about things that are going on for the moment.

    Info Sec News Moments:

    • Kudos to MS’ IE 8 Add Campaign – Link Here
    • Jim’s 4.5 Seconds of fame – DenverGov website Hack – Link Here
    • Android and the SMS Rootkit Hack – Link Here
    • Google Ditching Windows due to Security Concerns – Link Here
    • Denver OWASP – SnowFroc Con – Link Here

    Music Notes:

    • Intro / Outro – Digital Breaks – “Therapy”

    Link to MP3

    └ Tags: Android, Denver, denvergov, Google, hacked, IE8, interview, Microsoft, OWASP, Security, SMS Rootkit, website, Windows
    Comments Off
    May03

    An Information Security Place Podcast – Episode 35

    by Michael Farnum on May 3, 2010 at 9:00 am
    Posted In: Podcasts, Security

     

    Episode 35 is here. The format is different today. Instead of you listening to Dan, Jim, and me yap about news and pontificate about security topics, you are going to hear a talk I gave at the Texas Technology Summit in early April 2010. The talk title and synopsis are below, along with a link to the slide deck.

    Title: Breaking Down the Enterprise Security Assessment

    Synopsis: Many enterprise security assessments look at too few attack vectors or do not dig far enough into the attack vectors once a vulnerability has been discovered. Come join a discussion on the breakdown of a security assessment, explore the essential attack vectors, and debate the depth to which the assessment should go.

    Link to MP3

    Link to slides

    └ Tags: assessment, enterpirse, Security
    Comments Off
    • Page 5 of 140
    • « First
    • «
    • 3
    • 4
    • 5
    • 6
    • 7
    • »
    • Last »

    That’s me

    ©0-2013 An Information Security Place | Powered by WordPress with Easel | Subscribe: RSS | Back to Top ↑