Final call for the 50% discount on my current Security On Wheels audio programs. Just enter OCT09 as the discount code when checking out!
Friday, 30 October 2009
Thursday, 29 October 2009
In this recent SearchCIO.com bit, the executive director of the Disaster Recovery Institute International says that disaster recovery is dead. He goes on to say that "disaster recovery (DR) and business continuity have become synonymous" and (here's the kicker) "We don't do recovery anymore, because what everybody wants is continuous operations...We have auto failover now. We have redundancy in data. We do have more continuity. And that is because recovery is almost impossible..."
Really!? Where is he seeing this? Maybe in the largest of large corporations? Perhaps government agencies with unlimited budgets or maybe it's some Utopian society where every business can justify to have every control in place necessary to keep the business running at whatever cost?
That's not what I'm seeing...That's not reality. Amazing how people see what they want to see and nothing more.
Really!? Where is he seeing this? Maybe in the largest of large corporations? Perhaps government agencies with unlimited budgets or maybe it's some Utopian society where every business can justify to have every control in place necessary to keep the business running at whatever cost?
That's not what I'm seeing...That's not reality. Amazing how people see what they want to see and nothing more.
Wednesday, 21 October 2009
The day I never thought I'd see has come. Once HD Moore announced "Metasploit is hiring" I knew something was going on. Metasploit has been acquired by Rapid7...huh!? Too bad Qualys - maker of my favorite OS/network vulnerability scanner - missed this opportunity!
According to the Rapid7 acquisition FAQ Metasploit will remain open source but with a commercial twist. I hope it only gets better...fingers crossed.
Hey at least Capitalism prevailed...it's dying slowly but surely in this country but I'm glad to see this kind of stuff is still happening. Kudos to HD Moore and company!!
According to the Rapid7 acquisition FAQ Metasploit will remain open source but with a commercial twist. I hope it only gets better...fingers crossed.
Hey at least Capitalism prevailed...it's dying slowly but surely in this country but I'm glad to see this kind of stuff is still happening. Kudos to HD Moore and company!!
Friday, 16 October 2009
As I reported a couple of days ago, my email security provider stopped working. Maybe they took a hiatus...a sabbatical...an extended vacation - and didn't tell me. Seriously, I did end up calling them a few times trying to work things out. I got what seemed to be a knowledgeable tech rep trying to help me. The problem was he never could. He said he'd call me back two different times. He made several promises to get "development" involved so they could release my 2, no 3, days worth of emails stuck in their queue. Care to guess the outcome?
No emails recovered. No call back. I'm stuck on my own. The tech rep said they were sent. I never received them...That's a tough one prove but the fact of the matter is that I lost over 100 emails. Odds are only 10-15 were legitimate emails that matter to my business, but that's not the point. The very thing I've depended on for business continuity in the event my email server or Internet connection was down - their email queue - ended up creating a business continuity problem for me. I wanted to give them the benefit of the doubt. No such luck.
The vendor is St. Bernard. Their service is iPrism. I've had a "free" account with them since the Singlefin days back in 2003. Another case of you get what you pay for?
The funny thing is that Google is apparently having similar email delivery problems of their own. Postini had an outage and people went 20 hours without email....woooo, big deal! How about several days worth like I experienced? The ironic thing is that I'm considering moving to Postini. Who would've thought...
I'm telling you folks, you have to be careful hopping on this "cloud computing" bandwagon...as in St. Bernard's case and apparently in Google's case as well (with Postini and the recent Gmail outages), these "SaaS" providers don't always have our best interests in mind. Free service or not, customer no-service is always an option so you'd better plan for it advance.
No emails recovered. No call back. I'm stuck on my own. The tech rep said they were sent. I never received them...That's a tough one prove but the fact of the matter is that I lost over 100 emails. Odds are only 10-15 were legitimate emails that matter to my business, but that's not the point. The very thing I've depended on for business continuity in the event my email server or Internet connection was down - their email queue - ended up creating a business continuity problem for me. I wanted to give them the benefit of the doubt. No such luck.
The vendor is St. Bernard. Their service is iPrism. I've had a "free" account with them since the Singlefin days back in 2003. Another case of you get what you pay for?
The funny thing is that Google is apparently having similar email delivery problems of their own. Postini had an outage and people went 20 hours without email....woooo, big deal! How about several days worth like I experienced? The ironic thing is that I'm considering moving to Postini. Who would've thought...
I'm telling you folks, you have to be careful hopping on this "cloud computing" bandwagon...as in St. Bernard's case and apparently in Google's case as well (with Postini and the recent Gmail outages), these "SaaS" providers don't always have our best interests in mind. Free service or not, customer no-service is always an option so you'd better plan for it advance.
Wednesday, 14 October 2009
This has to be the fastest security startup/acquisition I've ever seen. I'm pretty sure the company - which is here in my neck of the woods - was less than a year old.
You know how I feel about SaaS and "the cloud" but kudos to Paul Judge, Chris Tilton, and those guys for growing and turning this thing around so quickly. Capitalism at its finest!!
You know how I feel about SaaS and "the cloud" but kudos to Paul Judge, Chris Tilton, and those guys for growing and turning this thing around so quickly. Capitalism at its finest!!
I never thought I could be so productive. This week I've had less pressure to deliver. I've been able to turn "things" off. All while I'm attending a conference when I usually get even more behind. Well you see, my email isn't working. My email security "application service provider", I mean "managed service", dang it, actually my "cloud computing" provider delivering "software as a service" has apparently decided to take a break from things. I haven't received but 1 or 2 emails in the past two days...I normally get 75+ per day. It's actually been a nice break - especially from all the spam. But it's not what I was looking for.
This outage is actually nothing new with my provider...It's actually an ongoing issue I've had over the years. But the problem usually corrects itself within a few hours. Not this time. So I emailed the company last night using a personal email account and actually got a quick response. Impressive. I thought we were going to be able to have a dialog but apparently their support team decided that leaving for the day was more important. I've followed up with them twice since then...nothing. No response. But I'm going to give them the benefit of the doubt and not mention any names. It's probably something simple. Likely something stupid on my part - I am the "dumb customer" after all.
Side note: I know I can set my MX record to point directly to my email server and get my email back running again...or I could choose another provider. The problem is that I have over a day's worth of emails stuck in my email security provider's queue - likely several days worth since this problem started over a week ago. So I can't give up hope on them just yet...I have to get my emails out.
I'm telling you this story because you have a big, no grand, responsibility to make good IT and information security choices for your business. Buyer beware with cloud computing. Know that just because some cloud computing provider promises the moon that you're actually going to get the service you need. They don't know your business. They don't understand your needs. Cloud computing providers are in business to make money, not coddle you with loving support and bend over backwards to get you up and running. I know, I know, there are lots of good cloud computing providers out there...but how do you know who they are? You usually won't until you find out the hard way...as I am now. Just because your lawyers and their lawyers agreed upon certain terms in a contract doesn't mean some yahoo in tech support is going to care when the time comes.
I'm a one-man shop...imagine if this was a problem someone was having in a large corporation. Someone's rear end would be in a sling right now. His or her job on the line. Speaking of cloud computing gone wrong, was your business affected by the Sidekick debacle? Maybe you're already looking for work because of that...
Don't lose sight of the fact that security and managing information risks is about control and visibility. If you don't have those because of some customer no-service situation then no matter how "cool" cloud computing is at the moment this hype over substance the marketers are pushing is probably not worth the risk.
Enough said, I've got to get back to work and fix this...
This outage is actually nothing new with my provider...It's actually an ongoing issue I've had over the years. But the problem usually corrects itself within a few hours. Not this time. So I emailed the company last night using a personal email account and actually got a quick response. Impressive. I thought we were going to be able to have a dialog but apparently their support team decided that leaving for the day was more important. I've followed up with them twice since then...nothing. No response. But I'm going to give them the benefit of the doubt and not mention any names. It's probably something simple. Likely something stupid on my part - I am the "dumb customer" after all.
Side note: I know I can set my MX record to point directly to my email server and get my email back running again...or I could choose another provider. The problem is that I have over a day's worth of emails stuck in my email security provider's queue - likely several days worth since this problem started over a week ago. So I can't give up hope on them just yet...I have to get my emails out.
I'm telling you this story because you have a big, no grand, responsibility to make good IT and information security choices for your business. Buyer beware with cloud computing. Know that just because some cloud computing provider promises the moon that you're actually going to get the service you need. They don't know your business. They don't understand your needs. Cloud computing providers are in business to make money, not coddle you with loving support and bend over backwards to get you up and running. I know, I know, there are lots of good cloud computing providers out there...but how do you know who they are? You usually won't until you find out the hard way...as I am now. Just because your lawyers and their lawyers agreed upon certain terms in a contract doesn't mean some yahoo in tech support is going to care when the time comes.
I'm a one-man shop...imagine if this was a problem someone was having in a large corporation. Someone's rear end would be in a sling right now. His or her job on the line. Speaking of cloud computing gone wrong, was your business affected by the Sidekick debacle? Maybe you're already looking for work because of that...
Don't lose sight of the fact that security and managing information risks is about control and visibility. If you don't have those because of some customer no-service situation then no matter how "cool" cloud computing is at the moment this hype over substance the marketers are pushing is probably not worth the risk.
Enough said, I've got to get back to work and fix this...
Tuesday, 13 October 2009
Have you seen the new - OK, it's not that new any more - version of LANguard (formerly LANguard Network Security Scanner)? It's certainly a tool worth checking out if you do vulnerability scanning.
I've been using LANguard for years for share finding and authenticated scanning and it does both very well. The biggest change in the latest version is the user interface. I've never been a big fan and I'm still not, but I'm getting used to it. Many of the improvements in the latest version involve authenticated scans. The quick-view dashboard is a nice improvement and I really like the scan progress.
When performing untrusted/unauthenticated scans I've found that LANguard won't find nearly the number of vulnerabilities than QualysGuard especially with regards to missing patch vulns that are exploitable via Metasploit. Hopefully that'll continue to evolve. But it does a very good job with this during authenticated scans (as would be expected if you have login credentials).
I'm still waiting for the ability to test your authentication credentials like what Sunbelt Network Security Inspector offers - at least used to, haven't used it lately. You have to plug in your credentials and hope that your login works. It'd also be nice to be able to sort through the network share finder results and filter based on permissions found (i.e. shares where Everyone has full access).
Here's a screenshot of the main interface:
In the interest of getting you hooked on good tools, here's a link to GFI's free version of LANguard. Hope this helps!
I've been using LANguard for years for share finding and authenticated scanning and it does both very well. The biggest change in the latest version is the user interface. I've never been a big fan and I'm still not, but I'm getting used to it. Many of the improvements in the latest version involve authenticated scans. The quick-view dashboard is a nice improvement and I really like the scan progress.
When performing untrusted/unauthenticated scans I've found that LANguard won't find nearly the number of vulnerabilities than QualysGuard especially with regards to missing patch vulns that are exploitable via Metasploit. Hopefully that'll continue to evolve. But it does a very good job with this during authenticated scans (as would be expected if you have login credentials).
I'm still waiting for the ability to test your authentication credentials like what Sunbelt Network Security Inspector offers - at least used to, haven't used it lately. You have to plug in your credentials and hope that your login works. It'd also be nice to be able to sort through the network share finder results and filter based on permissions found (i.e. shares where Everyone has full access).
Here's a screenshot of the main interface:
In the interest of getting you hooked on good tools, here's a link to GFI's free version of LANguard. Hope this helps!
Monday, 12 October 2009
Elcomsoft has a neat - and relatively new - tool called Advanced SQL Password Recovery I thought you may be able to benefit from. It can be used to change any SQL Server databases protected by a password included SQL Server 2000, 2005 and 2008. All you need is access to the master.mdf file. SQL Server optional.
I was going to show a screenshot but there's not that much to show...you load the program, you point it to the master.mdf file and it'll crack the passwords - simple as that. Very cool.
Yet another reason to keep your Windows systems patched and your share/file permissions in check.
I was going to show a screenshot but there's not that much to show...you load the program, you point it to the master.mdf file and it'll crack the passwords - simple as that. Very cool.
Yet another reason to keep your Windows systems patched and your share/file permissions in check.
Friday, 9 October 2009
Here are a couple of new articles of mind that were just published. Many more to come. Enjoy!
Balancing Windows security with reasonable password policies
Storage encryption essentials
Be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, screencasts, Twitter updates, and more.
Balancing Windows security with reasonable password policies
Storage encryption essentials
Be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, screencasts, Twitter updates, and more.
Thursday, 8 October 2009
One of the elements of being successful in security is asking the right questions - and not being afraid to do so. As information security professionals we can, and should, question the funding of security projects, management being on board with the business risks at hand, and so on.
I recently came across two great quotes regarding questioning. First, Anthony Robbins said "Quality questions create a quality life. Successful people ask better questions, and as a result, they get better answers." Second, Albert Einstein said "The important thing is to not stop questioning."
We don't have to be pests and we certainly need to be careful and not do more harm than good when getting people on our side. But if you approach your security initiatives with enough finesse and confidence and show how you're concerned about the business your questioning might be just what the doctor ordered.
I recently came across two great quotes regarding questioning. First, Anthony Robbins said "Quality questions create a quality life. Successful people ask better questions, and as a result, they get better answers." Second, Albert Einstein said "The important thing is to not stop questioning."
We don't have to be pests and we certainly need to be careful and not do more harm than good when getting people on our side. But if you approach your security initiatives with enough finesse and confidence and show how you're concerned about the business your questioning might be just what the doctor ordered.
Tuesday, 6 October 2009
Napoleon Hill once said "The majority of men meet with failure because (they don't create) new plans to take the place of those that fail."
I see this a lot: people with big plans who are met with a setback, they get discouraged, and give up. If you feel strongly about doing something - writing a book, changing careers, getting a degree, whatever - don't be this person.
I see this a lot: people with big plans who are met with a setback, they get discouraged, and give up. If you feel strongly about doing something - writing a book, changing careers, getting a degree, whatever - don't be this person.
I've written various articles on hardening Windows XP over the years and am always seeking out new nuggets since XP's going to be around a while. Eric Shultze has a neat list of 5 registry keys you can use to further harden your Windows XP systems that you may not have heard about. Enjoy!
Here's a good piece on keeping your job and growing your career:
10 Ways to Become Indispensable at Work
I'd also add network to build your relationships, focus on your communications skills, and always, always - put things in terms of the business - what's in it for them. Here are some IT and security career tips (that can apply to anyone) I've written that dive into these areas and more.
10 Ways to Become Indispensable at Work
I'd also add network to build your relationships, focus on your communications skills, and always, always - put things in terms of the business - what's in it for them. Here are some IT and security career tips (that can apply to anyone) I've written that dive into these areas and more.
Monday, 5 October 2009
You may recall my appearance on CNN television earlier this year when a hard drive went missing from the National Archives and Records Administration. Well, apparently some lessons don't sink in. This time around the National Archives folks sent an unsecured hard drive containing personal info on 70 million+ veterans to a vendor for "repair and recycling" (huh?). Apparently an employee subverted a policy then had to go on leave and one thing led to another...Interesting story - I'm not surprised at the outcome.
In the spirit of our current govern-by-reaction mentality in Washington maybe a few new laws can be passed to keep this from happening. Oh wait, it's the government failing to listen to itself in the first place. Unbelievable.
In the spirit of our current govern-by-reaction mentality in Washington maybe a few new laws can be passed to keep this from happening. Oh wait, it's the government failing to listen to itself in the first place. Unbelievable.
Here's my latest information security content. Enjoy!
Are you earning what you're worth in information security?
Understanding the politics of information security
Be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, screencasts, Twitter updates, and more.
Are you earning what you're worth in information security?
Understanding the politics of information security
Be sure to check out www.principlelogic.com/resources.html for all of my information security articles, podcasts, webcasts, screencasts, Twitter updates, and more.
Friday, 2 October 2009
Researchers at Duke University have found out how to use the basic features of cell phones to determine specific traits of the "space" you're in. Big Brother tracking at its finest. Once mainstream, it'll be at this point when I stop using a cell phone.
If you've been following me for any length of time you've probably noticed that development of my Security On Wheels audio programs has slowed way down. Let me explain why.
In a nutshell, I'm practicing what I preach: "focus on your highest payoff tasks". With this economic mess we're in I've had to really buckle down and focus on billable work this year to keep my momentum up and ride out this storm. Existing sales are good but I'm striking a balance between time/costs associated with developing and producing new content with the reality that so many people aren't buying much right now. Being self-employed I don't have a choice. That said I will return! I'm putting together my next audio program now.
Mega thanks to those of you who've provided such positive feedback on my existing audio programs. It confirms that I indeed have a good thing going here.
If you're not currently on my Security On Wheels mailing list and wish to be notified of new audio programs and special offers you can sign up on the home page at securityonwheels.com.
If you're interested in trying out either of my existing audio programs, I'm offering a 50% discount on any purchase to get you on board...and get you hooked. Just enter OCT09 as the discount code when checking out. It's good through the end of October.
Thanks for your patience and stay tuned for great new things with Security On Wheels in the near future.
All the best,
Kevin
In a nutshell, I'm practicing what I preach: "focus on your highest payoff tasks". With this economic mess we're in I've had to really buckle down and focus on billable work this year to keep my momentum up and ride out this storm. Existing sales are good but I'm striking a balance between time/costs associated with developing and producing new content with the reality that so many people aren't buying much right now. Being self-employed I don't have a choice. That said I will return! I'm putting together my next audio program now.
Mega thanks to those of you who've provided such positive feedback on my existing audio programs. It confirms that I indeed have a good thing going here.
If you're not currently on my Security On Wheels mailing list and wish to be notified of new audio programs and special offers you can sign up on the home page at securityonwheels.com.
If you're interested in trying out either of my existing audio programs, I'm offering a 50% discount on any purchase to get you on board...and get you hooked. Just enter OCT09 as the discount code when checking out. It's good through the end of October.
Thanks for your patience and stay tuned for great new things with Security On Wheels in the near future.
All the best,
Kevin
I just came across a great quote by "The Donald" (Trump) that contains a great little nugget to inspire us to do the best we can in our careers:
"As long as you're going to be thinking anyway, think big."
Practice this over and over and you'll eventually become what you think about. Sure, small and large annoyances will get in your way (like my rants here and on my Twitter page) but just get them out of your system and move on to bigger and better things. Let the joke be on someone else.
"As long as you're going to be thinking anyway, think big."
Practice this over and over and you'll eventually become what you think about. Sure, small and large annoyances will get in your way (like my rants here and on my Twitter page) but just get them out of your system and move on to bigger and better things. Let the joke be on someone else.
Subscribe to:
Posts (Atom)
