Speaking of supererogation, here's a great quote

Regarding yesterday's post about the word supererogation and how it can help you in your infosec career, here's a great quote by the poet Ovid that supports such an approach:

"Make the workmanship surpass the materials."

Spot on...otherwise you just fall in line with the majority. Not good for your career, not good for business.

Read More

My message to Republicans on this critical day in history

This is a big, big day for the future of the United States of America. The people spoke in the last election telling the jokers in Washington that we don't want their "hope and change" that's running this country into the ground. Today our new Congress gets rolling. But what's it going to lead to? I have my fingers crossed that we won't see more of the same old Big Government nonsense coming from the new Republican leadership in the House.

Republicans: You've let us down so many times in the past that the lines are now blurred between you and the Socialist Democrat party. You've all represented Big Government for years. So what are you going to do differently now?

Republicans: Know that we're watching...if you don't stick by your principles and the Constitution this time around I'm confident that our country as it was intended and your party will become a thing of the past and we'll fall in line with the rest of the sheeple around the world. The standard of living that we've all grown accustomed to in America will slowly erode away in the interest of "the greater good" of the dumb masses - a system proven to fail time and again over the centuries. If this is what ultimately occurs, Republicans who fail to stand by their principles from this point forward will carry that responsibility and that burden.

Republicans: Please, please proceed with caution and think long term...we've all got too much to lose.

Read More

Supererogation helps infosec

I saw a great Word of the Day from Merriam-Webster over the Christmas break: Supererogation

It means "the act of performing more than is required by duty, obligation, or need". Said another way it's going the extra mile above and beyond to make things happen.

If there's any one underlying component of being successful in everything you do it's doing all the other things that need to be done in security (or wherever in your life) after you've completed what's generally expected.

Read More

Security complacency & leadership - focus on both in 2011

Happy New Year! Here are a couple of recent pieces I wrote for Security Technology Executive magazine I thought would be good to get things rolling for 2011:

Don't lose sight of what's important

Four traits of successful information security leaders

My wishes to you and yours for a healthy and prosperous year ahead!

Read More

Quick step-through of Metasploit Express

I've been raving about the penetration testing tool Metasploit for a while. With the release of Metasploit Express earlier this year I'm even more pleased with all the efforts HD Moore and his team have put forth. Metasploit Express is a commercial product you'll have to pay for but to me it's well worth the investment. It's easier to use, it has nice reporting and more. All the things we need in today's world of junk security tools that just don't deliver.

In the event you haven't tried it out, here's a brief walk-through of some of the nice features and capabilities of Metasploit Express.

<-- The main interface for a "project" provides access to hosts, sessions, reports, modules and tasks - the main sections of the app.










<-- If your vulnerability scanner has found a specific vulnerability you can search for it in Metasploit Express to confirm there's an exploit module as shown here.








<-- You can then manually launch the exploit on your target host.














<-- Once a vulnerability has been exploited and the payload delivered, you can gather evidence as shown here.












<-- Or, you just can just obtain a remote command prompt showing that you've compromised the host.














<-- When all's said and done, you can kill your session, clean up the remnants and be done with it.

































There are numerous other features within Metasploit Express that allow you to automate host discovery, the exploitation process and so on...just a bit much to cover in one blog post. Perhaps I'll cover that in detail in my next edition of Hacking For Dummies. :)

All in all, Metasploit Express is a security testing tool you shouldn't be without. It's a great way to "prove" those security vulnerabilities you discover are indeed a business problem.

Read More

Tips and tricks on e-discovery, forensics, and managing esi

Here are a few pieces I wrote and recorded for SearchCompliance.com on managing all that electronic data on your network that you're constantly drowning in...

Leaning on records management can take the angst out of e-discovery

Why you need to create an ESI strategy (webcast)

Why you need to create an ESI strategy (podcast)

What is computer forensics technology? Does it help compliance?

Read More

Possible bomb at Newark, ratchet up security!!??

I heard a news story this morning about the possible bomb that was found at Newark Airport. The reporter went on to say that TSA is "ratcheting up security" and searching bags with more scrutiny in the event the threat is real.

What I want to know is (and can't seem to find the answer to): why is it we "ratchet up security" when a such threat is detected rather than putting controls and processes in place that allow us to remain vigilant at all times?

So, we see a threat, we scurry to lock things down, and a few minutes or weeks later (or years in the case of the 9/11 attacks) we get back into our old complacent ways. I wrote about this phenomenon earlier this year in this piece for Security Technology Executive magazine:

Don't lose sight of what's important

...I just don't get it.

Read More