Category Archives: Security

New site design

Every so many years flyingpenguin gets a new look. I finally had some time (mostly to automate site maintenance) so you are looking at my latest design. Feedback welcome.

Incidentally, if you’re running Firefox 3, I recommend enabling color management. (First type “about:config” in the address bar, then click the “I’ll be careful, I promise!” button, and then type “gfx.color_management.enabled” in the Filter bar. Double-click to set the color management value to true)

Free scans for sensitive data

Shoestring budget or not, Dark Reading has published an edu security guide to finding your data. It is basically a shortlist of software:

It’s possible to get a jump-start on discovering sensitive data using freely available and open source tools — provided that you understand what your company needs to identify and protect. The tools range in functionality from simple searching of files on desktops and laptops to spidering and searching Website content.

I would be more impressed if he had gone to the trouble of explaining how to script and then automate the tools into a SIEM.

75 mpg 1989 Geo Metro

A very nice site that explains a simple way to increase the gallons per mile of a Geo Metro, simply by reducing drag:

This car, originally, was a joint venture between General Motors and Suzuki, which delivered as much as 58 miles per gallon. 49 hp is all it takes to get a person to work safely and comfortable. I reworked this car to get even better mileage. It was getting 75 mpg during the 2 years I drove it. The bottom line is, with a 3-cylinder engine 12 valve variable cam, a small streamlined tandem-style could get even better mileage.

What, no roof-rack? I guess the real down-side is that when you cut away half of a Geo Metro, you are still left with half a Geo Metro. But seriously, the problem I see is that the footprint on this thing is still four wheels and now just has a lot of wasted space. That would not appeal to someone looking for a smaller vehicle, and it lacks the storage for someone who needs a larger vehicle. High marks on drag efficiency and gallons per mile, but who would find it useful beyond these advantages?

Another day, another stolen laptop with identity information

The redOrbit story shows a continuing trend in breach notification — it is all about encryption:

A laptop containing confidential information about 11,000 patients has been stolen from a Midland GP’s home.

Contrary to Department of Health guidelines, the information was not encrypted, which would have made it unreadable without a special code to unscramble it.

Shame, shame. Will we have to start monitoring for data written to a non-encrypted space? Wait a minute, why is there any non-encrypted space on a GP’s laptop? Does not compute.

The laptop was among items stolen in a recent burglary at the home of the unnamed doctor, who works at the Castlecroft Medical Practice in Wolverhampton.

I am certain the authorities will not release his name because that would be like giving away his identity information. At least they are careful about that, but what if they had a policy where they did the opposite and subjected people who lost information to similar treatment…? Too malicious? Cruel? Yes, I know. Monty Python comes to mind.

The information on the computer, which belongs to the practice, included patients’ names, dates of birth, addresses, contact details and confidential medical records. The practice has written to all of its 11,000 patients to inform them that information about them was on the stolen computer.

Dr Peter Wagstaff, senior partner at the practice, said: “The practice is treating this issue very seriously and we are extremely sorry for any distress or concern that it may cause our patients.

“Though not encrypted, the confidential information on the laptop was protected by a complex password system, which only a person with specialist computer knowledge would be able to crack.”

Wonder why the practice did not notice the gap in encryption. Complex password or a complex system? I have a strange feeling that the system might be complex, but the password was not.