Hectic Eclectic

Like browsing? Thought you were annonymous?... Think again.

Really interesting article by Robert McMillan on just how private your private online sessions happen to be.  Well actually if you are paraniod it isn't perhaps even as bad as you might have thought but it isn't good.  Without stealing Robert's thunder it would be fair to say that on average it is 94% bad (i.e., they can ID your browser - through some combo of browser, fonts, time zones, plug-ins etc... ) which would mean there is room for improvement...

I certainly would start applying some randomness to all those variables if I were some naughty Serbian or other sort about to embark on the cyber-naughtiness (I'm alluding to fraud rather than filth here).  Move, counter, counter to the counter and so the game goes on: Cops and robbers... cops and robbers!

Anyway - check out Robert's article here. 

Don't be evil...?? Cyber attack on Google hit password system, says insider - 20/04/2010 - Computer Weekly

Cyber attack on Google hit password system, says insider - 20/04/2010 - Computer Weekly.

Bummer - looks like the old gmail account needs a password refresh!  And not 3 months too soon...

Don't be evil ... might that include full and open disclosure on information breech?  Thank goodness failure to disclose will most likely carry a fine in the UK from April 2011... but what if the server isn't UK hosted (like most of google tax avoiding UK business) will they be subject to the legislature...

#verymessycloudness

£500k Data loss fines come into Law

Hi, I mentioned earlier that some fines were likely to come in to law - well they just have.  So if you haven't got your house in order you probably should be thinking about it.

Whether you are governed by PCI, FSA or anything else this is the catchall - so make sure you are on top of it. 

Oh, and it lok like a few guys

Zurich Insurance

(who lost 46,000 unencrypted records)

Royal London

(who had over 2,000 stolen)

just missed out on being the first big fine... good old post ex-facto...  ;-(

Watch out all you data protection guys...  call us if you need a hand...

IBM wins Best Security Company in 2010 SC Awards

IBM scooped the Best Security Company at Secure Computing 2010 Awards.  Click these here links for a full list of finalists and winners.   IMHO this is cos IBM has been going all aquisitive on us and snapped up, it would appear strategically (well done guys), all sorts of niche solutions over the past four or five years.  Noteably for those of us at Seric Towers are of course Watchfire (2007) and Ounce Labs (2009) and we do see a fair bit of ISS (2006) out there in cyberville.  Throw these bad boys into the already reasonably juicy mix and rub some GBS on it and IBM have a good story to tell those enterprise boys.  Good enough to win the Security Company of the Year from SC at the largest awards in the Security Industry Calendar.

Here are some of the factoids about what IBM is doing to get just such an accolade

• 7,000,000,000+ security events managed daily
• 48,000+ vulnerabilities tracked in the IBM X-Force research and development database
• 15,000 researchers, developers and subject matter experts on security initiatives
• 4,000+ customers managed in security operations centres around the world
• 3,000+ security & risk management patents
• 40+ years of proven success with security and virtualisation

Why am I telling you this - well this would be the shameless plug section of the blog, we do this stuff!  We supply and support the IBM's Rational AppScan Suite - covering black and whitebox application scanning.  If you want secure code out there that won't leave you with egg (a fine) on your face (balance sheet) get in touch!  Look, I even have a snazzy graphic for this stuff on my blog - yes, I spotted it should read PROTECTED

There are are 10 different siblings in the AppScan Family.  You can compare the members of the AppScan clan here - though it is a particularly bad page as the row headings don't change with teh product changes and products look devoid of features when they are in fact irrelevant.  Anyway - pick three and compare like-for-like, find what you like and then call us 0141 561 1161  - we'd like that  ;-)

Web Applications Security Issues Make up almost half of all Successful Attacks in 2009

http://www.scmagazineus.com/ibm-report-vulnerabilities-fell-in-09-attacks-rose/article/164547/.

Web Application Security - The time of the carrot and stick has come

As I mentioned earlier the information commissioner's office has announced big fines (~£500k) for folks not getting their data security sorted out - web application or otherwise.  I'd not be surprised to see at least 10 people get a big fine in the next 12 months and can imagine just what action will be taken with the CIO in charge of these outfits.

I hear from people on the grapevine that the banks are already starting to look downstream on their supply chain to ensure they don't have any dirty little secrets hanging around in there.  Do you supply any of the big banks?  My money would be on you being a target for a juicy fine.

Seen a great article at www.mcpmag.com which covers a lot of the drivers for Standards (CWE/SANS OWASP) and Legislation (US Fed/UK/NY State etc) currently out there.