A look at the infrastructure model behind Facebook

Based on my kids heavy use of these Web 2.0 tools, this provider must be doing a fairly good job keeping the lights on for Cloud services such as Facebook.

DECAF

Hackers have released Decaf, a tool which hinders the work of Microsoft's 'Computer Online Forensic Evidence Extractor' (COFEE).


DECAF Link

ADOBE SECURITY LINK

No different than the process to monitor frequently the Microsoft Patches and Security Activity, we need to stay on-top of the ADOBE platform as it seems to be a focus for code.

Adobe Security Blog

Cisco 2009 Annual Security Report

The Cisco® Annual Security Report provides an overview of the combined security intelligence of the entire Cisco organization. The report encompasses threat information and trends collected between January and December 2009. It also provides a snapshot of the state of security for that period, with special attention paid to key security trends expected for 2010.

CISCO ANNUAL SECURITY REPORT 2009

Virtual Desktops Today - Cloud Claims

I have taken a cursory look at the following:

EyeOS

GHOST Cloud

Glide OS 3.0

Another challenging path to secure.

Google DNS or OPENDNS....Hmmmm

Sure seems google has caught onto the idea that OPENDNS has had for a few years now and provides additional content filtering via DNS.

Google Public DNS Link here

Cloud Computing - What we really should discuss

I have put many links in recently concerning products, strategies and directional links. I am taking a few minutes to post a few words on information cloud computing. Cloud services are active today whether they are Google, Amazon, or others and carry both business and financial transactional data for consumers. One of the concerns I have remains, the ability to audit and know controls are in place for information protection. Some cloud technologies are putting some interesting architectural decisions in front of security professionals. These decisions are often being posed as "faster", "less cost" and "more efficient" and even " you won't need your firewalls anymore". The basic premise by security practitioners is that we need layered defenses for data, application, network segmentation. The "blur" of these points and traditional security design occured when mobility came forward and third parties were requiring trust within the organizations backend systems. Today, we are rapidly moving towards a mixed architecture where some applications will truly be cloud enabled, yet others will remain traditional security architecture and controlled. I remain somewhat skeptical at cloud based security models and how processes such as vulnerability analysis will occur in the "cloud".

IBM takes positive step forward with database security aquisition...

Article

Report on TVA Information Security

GAO Report

Microsoft's Ripley

Web Security Tool Copies Apps' Moves

NIST Firewall 800-41 Rev 1

Published Sept 2009

Microsoft cloud security - approach

MS Cloud Security - May 2009 Publication

Microsoft releases free tool designed to harden software applications against attacks

EMET, short for Enhanced Mitigation Evaluation Toolkit, allows developers and administrators to add specific security protections to applications

Tool

More info here

Los Angeles City Council Approves Google E-Mail Plan

Read here...

Forbes Video : The different roles of corporate security and corporate information

Video

Microsoft Patch Tuesday Oct 13, 2009 Priorities

“Experts in the security field said the focus should be on the end-user and IT should first patch holes in Internet Explorer (IE) and in Windows Graphics Device Interface (GDI).

Those two technologies are addressed in MS09-054 (IE) and MS09-062 (GDI)”

I tend to agree here, as the GDI goes across multiple products, and we use IE everyday.

Customer Data Lost in the Cloud - An example of why DR Planning should be part of cloud strategy

Sidekick example TMobile


Microsoft says most if not all data recovered...some confidence, same basic issue to validate before jumping to Cloud.

Security First's - DataCentric Secure Parser

SecureParser

Format-Preserving Encryption (FPE)

Currently reviewing this product.

Format-Preserving Encryption (FPE), Voltage SecureData maintains data format and eliminates
business process changes.

http://www.voltage.com/end-to-end/index.htm

Zeus Trojan Writeup

A good writeup on the Zeus Trojan and its proliferation.

Zeus

Google Apps Link for Outlook Clients

I find this impressive and Google's move to get infrastructure costs out of IT.

Take a look.

http://www.google.com/apps/intl/en/business/outlook_sync.html

Windows 7 Applocker - a quick look

Applocker Screen

Flash Cookies and What to Do

Flash cookies cannot be deleted thru standard cookie removal in the browser.

Firefox has an add-on Better Privacy you should consider as it removes these tracking elements.

Here is a terrific article from the guys in California.

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1446862

Directshow Fix Available from MS

http://support.microsoft.com/kb/971778

Data Protection Basics

There is alot of press around the DLP meaning and concept. There are basic principles one must consider as part of the planning, strategy in putting a plan together.

1. Determine the critical data stores from a business perspective ( Rank your data's value)
2. Identify if the information in item 1 is data at rest or data in motion ( Classify the data type)
3. Determine if the data is on clients(pda's, laptops, servers), network ( communications streams), or hard prints. ( Discovery )
4. Align with financial or brand protection objectives
5. Put your requirements to paper
6. Evaluate your product space
7. Test in a controlled environment with test data!!
8. Deploy in production

Product selection before strategy

It seems to be a recurring discussion i have weekly with peers. The topic tends to be the fact that products/services/technologies are purchased to solve risk and security issues before certain other considerations are complete.

The problem statement: How do we implement this product / solution into our environment.

One might think that a logical approach would be:

1. Strategy Formulation

2. Strategy Implementation/Communication

3. Architecture Review of AS-IS technology and process

4. Review of Strategy and Architecture TO-BE

5. Vendor review and selection

6. Implementation plans

Instead, Sales professionals do a great job of selling a product or service. Companies are then challenged to find a method for worrking on implementation. Basic issue step 6 before step 1-4 have occurred.

Providing technology solutions for problems and issues is only one component of solution delivery.

People, Process and Technology are all to be considered.