Information Assurance as a Service and Abstracting Complexity "Away"

The State of the Internet Operating System

We are once again approaching the point at which the Faustian bargain will be made: simply use our facilities, and the complexity will go away. And much as happened during the 1980s, there is more than one company making that promise. We're entering a modern version of "the Great Game", the rivalry to control the narrow passes to the promised future of computing.

In the world of Information Assurance, there is a strong desire from application and service developers to "abstract away" the complexities of security. Think of this in terms of Security-as-a-Service or an Information Assurance Framework in the cloud. This can be accomplished for difficult security functions, such as handling X.509 certificates using Server-based Certificate Validation Protocol (SCVP) and PKI Resource Query Protocol (PRQP). The complexity is "removed" from the relying party to the trusted Validation Authority. Given the difficulty and risk associated with different certificate validation implementations by relying parties (some implemented more securely than others), this abstraction of complexity "away" from relying parties to a trusted Validation Authority run by an "expert" has advantages. The security experts create and control the security context in which applications will work.

It also means that the relying parties have made a "Faustian bargain" with the security experts that take "on the pain of managing complexity" and end up "with a powerful lock-in."

Mayhem on Mufsidoon ...

Blogs target jihadis online

Mr. Weisburd said in a recent report to U.S. intelligence agencies and private companies that the August surge "severely degraded" a stable network of nearly two dozen Web sites and that jihadi efforts to rebuild have had only limited success.

Adding to the complaints bringing down the Web sites, one jihadi Webmaster was arrested and another killed while fighting alongside Islamists in northern Lebanon.

Excellent!!

Previous: Worldwide Web War on Mufsidoon

Worldwide Web War on Mufsidoon

via SWJ

While we have a few Americans who take similar action against mufsidoon (evildoers) web sites, why don’t we encourage Americans/western “geeks” to go after these websites? Exploit them, disrupt them, shut them down, post false information, and create distrust. This will not be a government controlled or directed effort. Essentially, I am suggesting a leaderless effort that allows Americans to use their creativity, technological skills, and the rabid dedication some people will apply to such a project. The mufsidoon are coming after all American citizens; this is a way some Americans can fight back.

NBC Dateline Reporter flees Defcon 15

Another Tricare Data Compromise?

There's really no excuse for this.

Some TRICARE Beneficiary Data Put At Risk

Data for nearly 600,000 households enrolled in TRICARE stored on a government-contractor's unprotected computer server could have been exposed to hackers, defense officials announced Friday.

What can I do to protect myself against identity theft?

There is a wealth of information available about identity theft for you and your household members at the consumer protection web sites of the Federal Trade Commission (FTC), Department of Defense (DOD), and TRICARE:

• FTC: Fighting Back Against Identity Theft
• FTC & DoD: Military Sentinel
• TRICARE: ID Theft Resources

These sites provide valuable information regarding identity theft prevention and steps that individuals can take should problems develop.

Monitor your credit
Common advice includes routinely monitoring your financial accounts and billing statements for suspicious activity. Credit reports contain information about you, including what accounts you have and how you pay your bills. The law requires each of the major nationwide consumer reporting agencies to provide you with a free copy of your credit report, at your request, once every 12 months. Best practice recommends requesting a credit report every four months, rotating through the three nationwide consumer credit reporting companies with each request.

To order your free annual report from one or all the national consumer reporting companies:

• Visit www.AnnualCreditReport.com
• Call toll-free 877-322-8228 or
• Complete the Annual Credit Report Request Form (40k PDF file*) (FTC web site) and mail it to:

Annual Credit Report Request Service
P.O. Box 105281
Atlanta, GA 30348-5281

Related:

Pentagon Hacker Compromises Personal Data (April 29, 2006)

An intruder gained access to a Defense Department computer server and compromised confidential health care insurance information for more than 14,000 people, the department said Friday.

Reward offered in theft of medical records (January 2, 2003)

Computer hard drives containing the medical records of more than 500,000 military members were stolen last month from TriWest Health Care Alliance Corp., which administers the military's Tricare health plan in 16 midwestern and western states. The files, which contain sensitive information including patients' claims histories and Social Security numbers, disappeared from the Tricare Central Region health contractor's Phoenix offices on Dec. 14.

When self-preservation is no deterrent ...

2007 National Security Strategy Essay Contest

The Army G-3 and the Combating Terrorism Center at West Point are sponsoring the 2007 National Security Strategy Essay Contest in order to solicit new ways of thinking about deterrence in today’s post-9/11 world. We invite submissions of article-length (7,500 – 10,000 words), publication-quality essays addressing the following question:

How can the U.S. credibly and ethically deter adherents of extremist religious ideologies from engaging in terrorist activity?

Essays will be judged on scholarly rigor, creativity and innovation. Authors are encouraged to be interdisciplinary in their thinking. The author of the essay judged by the CTC Faculty and Senior Fellows to be the best will receive a $5,000 research grant.

Entries should be postmarked no later than 1 September 2007 and mailed in hard-copy format with a copy of the author’s curriculum vitae to:

Combating Terrorism Center
National Security Strategy Essay Contest
Lincoln Hall
United States Military Academy
West Point, NY 10996

Malware meets Robot Genius

via c|net News:

[Robot Genius] claims that Spyberus has a 99 percent success rate in reversing spyware, adware, rootkits, and other forms of malicious software. Free trial versions of RGcrawler Data and Spyberus are available now on Robot Genius' Web site; RGguard is "coming soon."

Little Fish

Hacking, Homebrew, History and Hype

So, I'm cruising around and "stumble upon" a post by M.Simon at Classical Values about hacking. It's a great video (~50 mins.) from Discovery's The Learning Channel about the history of hacking.



A few thoughts struck me right away. First - 50 minutes!! We've gotten to the point where you can upload - for free - an hour of video onto the 'net? Who does that?

Google Video, of course.

The second is, what a great show! What great history! What great educational value! Is this available on Discovery.com?

Uh, no! I was able to find an active page with a link to it at TLC, but the link is 404. The Way Back Machine has the page archived from July 2001 through April 2006, but then it just drops off the 'net.

Third thought: the masses are keeping interesting history alive via free public archives like Google Video and The Way Back Machine. It's truly a public library in what is being archived and checked out, isn't it? This is a good thing, right?

Anyway, the hacking video leads me to the DigiBarn Homebrew Computer Club 30 Year Retrospective and a must see CBC series Computer Invasion: A History of Automation in Canada which has this historical gem from their CBC Prime Time News show, A network called 'Internet'.

Which leads to another thought: Why did Discovery's TLC remove their content from the web and how long before CBC's content (from Feb. 2007) is gone? And then, how long before someone brings it back via a free public archive?

Maybe I'm just being nostalgic, or a naïve geek, about what's being stored, recovered and brought together by hyperlink ... but I thought you might enjoy it.

------------------

Completely unrelated sidenote:

I really like the "Cite" feature on CBC's webpage. It's a nice pop-up javascript window with a formatted citation. The code looks like this:

javascript:nw('/includes/citerPage.asp?IDLan=1&titre=Computer Invasion: A History of Automation in Canada&date=2/27/2007 10:59:40 AM&url=|IDD-1-75-710|science_technology|computers|','citation',
'width=600,height=180,menubar=no,status=no,toolbar=no,scrollbars=yes,
resizable=yes,titlebar=no')

Click here for the resulting citation.

 

Vorpal Bunny Script-Kiddies

IT Pro Briefing: How To Secure Desktop PCs With Personal Firewalls

The top performer of the latest round of tests is the Jetico personal firewall, one that seems to stop just about anything, at least according to Firewall Leak Tester's results.
...

Personal firewalls aren't a luxury anymore. As more users roam with their laptops in and out of corporate networks, it's easy for their devices to become infected. This has prompted companies to look for ways to shield them from the continual attacks raging across the Internet.

Yes, continual attacks. A recent study from the University of Maryland Clark School's Center for Risk and Reliability and Institute for Systems Research finds that attackers attempted to breach the average Internet-connected computer every 39 seconds. "Our data provide quantifiable evidence that attacks are happening all the time to computers with Internet connections," says Michel Cukier, the author of the study and an engineering professor at the school. The computers in Cukier's study were attacked, on average, 2,244 times a day.

UM Study: Hackers Attack Computers Every 39 Seconds

Cukier and two of his graduate students, Daniel Ramsbrock and Robin Berthier, set up weak security on four Linux computers with Internet access, then recorded what happened as the individual machines were attacked. They discovered the vast majority of attacks came from relatively unsophisticated hackers using "dictionary scripts," a type of software that runs through lists of common usernames and passwords attempting to break into a computer.

Jetico Firewall (stable, beta)
Firewall Leak Tester