Category Archives: Security

Security

Cloud: Superhighway for Cyber crime?

Leave a comment

A press release from a company that calls itself a “leader in real-time traffic analysis” lists ten of their cyber threat predictions for 2011 and beyond.

Way down on the list at number 8 is “Cloud computing concerns”. They do not go into much more detail. Just general concerns, like this:

The incredible cost savings and flexibility cloud computing affords also opens up a superhighway for cyber crime. As cloud use increases, so, too, will the number of opportunities for data infection or theft.

Less cost and more flexibility is like a superhighway, right? And just like more lanes means you have the opportunity for a faster drive time…


Just look at all the opportunities

Oops, well, you know what they mean. I bet they do analysis for a different kind of traffic. More is more, so more opportunity for data infection or theft means more data infection or theft?

Maybe not. What if I told you there are instances of cloud computing that reduce opportunities for data infection or theft? They grow faster and larger yet remain easier to secure than non-cloud; provisioning tools may be setup to deliver a new service or security patch more quickly, remotely and widely in the cloud.

Perhaps they should have used high-speed trains as an analogy instead, especially in reference to software as a service (SaaS). It seems more fitting as a service-mode of transportation that delivers scalable and managed throughput with lower risk.* Even infrastructure as a service (IaaS) providers are more buttoned-up than the typical personal car and highway transportation model.

I too, however, sometimes use driving as an analogy when I give presentations about security. In fact I think there’s a video of me now floating around somewhere talking about how Interstate traffic controls work. My point is that there is not much preventing you from driving the wrong way, for example, but how often does it happen?

As tempting as it may be to say that there will be greater opportunities to commit crimes (four lanes open on the other side instead of one) there are a set of security principles that suggest the cloud (or any large enterprise IT environment) is not predisposed to become a superhighway of Cyber crime. Take a look around the next time you drive on a highway (quickly, though, and keep your hands on the wheel) and you will probably see what I’m talking about.

* Deaths per billion passenger miles: Train 0.88 versus Car 11.7

Security

How Hunting Humans is Better Than Foxes

Leave a comment

Apparently the old game gets played better when you pit bloodhounds against man instead of foxes.

Hunting foxes can be a dangerous pastime, and not just for the fox. That’s because foxes show so little concern for the welfare of their pursuers: They’ll dart across major roads and leap over train tracks, with unwitting members of the pack following doggedly along behind. Sometimes to their doom.

Which is why some 30 years ago the veteran fox hunter and co-founder of the Coakham, Nigel Budd, decided to develop a sport that “would combine all the arts of venery together with a controllable quarry.” A human being.

Men, Budd argued, can be instructed to stay away from roads and railway tracks. They also avoid disturbing farmers’ livestock. And they can choose to lead the hounds and horsemen on a challenging chase over the highest hedges and the triangular wooden fences known as tiger traps.

Another risk to be avoided is getting shot by a fox.

A wounded fox shot its would be killer in Belarus by pulling the trigger on the hunter’s gun as the pair scuffled after the man tried to finish the animal off with the butt of the rifle, media said Thursday.

On second thought, there is risk that a human witness would tell a different story than a fox — a man accidentally shot himself in the leg and then made up a story about a scuffle to avoid embarrassment. In that case playing the game with humans might actually be worse.

History, Security

US Civil War and the South: 5 Myths

4 Comments

Vermont Professor James Loewen, author of “Lies My Teacher Told Me”, gives an interesting look at common myths regarding why the South seceded:

He says the South did not fight for states’ rights; they were opposed to them:

The South’s opposition to states’ rights is not surprising. Until the Civil War, Southern presidents and lawmakers had dominated the federal government. The people in power in Washington always oppose states’ rights. Doing so preserves their own.

He also says the South was not opposed to taxes:

Tariffs were not an issue in 1860, and Southern states said nothing about them. Why would they? Southerners had written the tariff of 1857, under which the nation was functioning. Its rates were lower than at any point since 1816.

He points out even whites who did not own slaves still supported slavery:

…belief in white supremacy provided a rationale for slavery. As the French political theorist Montesquieu observed wryly in 1748: “It is impossible for us to suppose these creatures [enslaved Africans] to be men; because allowing them to be men, a suspicion would follow that we ourselves are not Christians.” Given this belief, most white Southerners — and many Northerners, too — could not envision life in black-majority states such as South Carolina and Mississippi unless blacks were in chains.

He quotes Lincoln to show that the President went to war to save the Union, not to end slavery:

On Aug. 22, 1862, President Lincoln wrote a letter to the New York Tribune that included the following passage: “If I could save the Union without freeing any slave, I would do it; and if I could save it by freeing all the slaves, I would do it; and if I could save it by freeing some and leaving others alone, I would also do that. What I do about slavery and the colored race, I do because I believe it helps to save the Union; and what I forbear, I forbear because I do not believe it would help to save the Union.”

In conclusion, he says it is unlikely the US would have ended slavery if it had not been for the war:

To claim that slavery would have ended of its own accord by the mid-20th century is impossible to disprove but difficult to accept. In 1860, slavery was growing more entrenched in the South. Unpaid labor makes for big profits, and the Southern elite was growing ever richer.

In other words, it is fair to describe the South as pro-federalist and pro-tax as well as pro-slavery.

The reason for secession was slavery alone, as presented by the Southern states at the time. Take, for example, South Carolina’s Declaration of Causes of Secession, December 24, 1860:

Those States have assume the right of deciding upon the propriety of our domestic institutions; and have denied the rights of property established in fifteen of the States and recognized by the Constitution; they have denounced as sinful the institution of slavery; they have permitted open establishment among them of societies, whose avowed object is to disturb the peace and to eloign the property of the citizens of other States. They have encouraged and assisted thousands of our slaves to leave their homes; and those who remain, have been incited by emissaries, books and pictures to servile insurrection.

For twenty-five years this agitation has been steadily increasing, until it has now secured to its aid the power of the common Government.

In other words, anyone who did not support a definition of people as property was characterized by the South as an unacceptable threat to slavery practices. Everything from the failure to arrest and return escaped slaves to the “books and pictures” that did not support slavery were cited as forms of incitement to revolution and agitation. The Editor of the New York Evening Post wrote (Cincinnati Gazette, May 24, 1856; New York Evening Post, May 23, 1856, quoted. in “Battle cry of freedom: the Civil War era” by James McPherson, pg 150):

[The South] cannot tolerate free speech anywhere, and would stifle it in Washington with the bludgeon and the bowie-knife, as they are now trying to stifle it in Kansas by massacre, rapine, and murder.

Has it come to this, that we must speak with bated breath in the presence of our Southern masters? … Are we to be chastised as they chastise their slaves? Are we too, slaves, slaves for life, a target for their brutal blows, when we do not comport ourselves to please them?

The South declared themselves victims to justify armed dissent against their own country; they believed disintegration of the Union was their righteous path to maintain slavery. What they did not calculate was the new President’s resolve to keep the country in a Union. Had they not seceded they probably would have continued slavery in America, and continued Southern influence over federal rule, for many more years.

Security

EFF Condemns Tunisian Cyberwar Tactics

1 Comment

Is it still Cyberwar if the battles are between a government and its own citizens? Would it be Civil Cyberwar or Cyber Civilwar?

The EFF “calls for immediate action to defend activists”. Tunisian authorities are reported to have blocked HTTPS access to Facebook, Google and Yahoo! in order to attack or track down dissenters and compromise their on-line identities.

…last week the Tunisian government turned up the heat on bloggers, activists, and dissidents by launching a JavaScript injection attack that siphoned off the usernames and passwords of Tunsians logging in to Google, Yahoo, and Facebook. The Tunisian government has used these stolen credentials to log in to Tunisians’ email and Facebook accounts, presumably downloading their messages, emails, and social graphs for further analysis, and then deleting the accounts entirely.

The EFF gives the following recommendations, which are a good idea all the time and not just when in Tunisia:

* If HTTPS is available, use HTTPS to login to Facebook, Google, and Yahoo. If you are using Firefox, EFF’s HTTPS Everywhere plug-in will do this for you automatically.
* EFF has received reports that the Tunisian government is periodically blocking HTTPS access to Facebook, Google, and Yahoo. If that is the case and you must login over HTTP, install the following Greasemonkey script to strip out the JavaScript which the Tunisian government has inserted to steal your login credentials.
* If you have logged in to Facebook, Google, or Yahoo recently over HTTP, login using HTTPS and change your password.