Category Archives: Security

Guidelines for Secure IPv6

The National Institute of Standards and Technology last week issued SP 800-119, Guidelines for the Secure Deployment of IPv6

Some things are said to be very different about it…

Router access control lists (ACLs), firewalls, and other security components must be carefully managed to retain ICMPv6 functionality. Any security measures on a network segment must allow IPv6 nodes to use ICMPv6 to accomplish Neighbor Discovery, PMTU discovery, and other essential tasks. If an IPv6 default router on a network segment is unable to receive and reply to legitimate RS messages, nodes sending those messages may experience a denial of service condition.

…while other things are said to stay the same.

The deployment of IPv6 reinforces the basic security lessons learned with IPv4. These security practices include defense in depth, diversity, patching, configuration management, access control, and system and network administrator best practices. Good security practices remain unchanged with the deployment of IPv6.

US Government Oversight – Up for Bid

A site called Issa Exposed says the new chair of the US House Oversight Committee has asked corporate lobbyists for guidance on what he should investigate.

They point out he is calling for an end to earmarks, while he takes earmarks.

In FY 2007, Issa requested a total of $260,738,955 in what he later called “tantamount to a bribe.” It dipped a bit in FY 2008 to $112,570,000, but he rebounded strongly for FY 2009 with earmark requests totalling $214,367,000.

And, while “his biggest backer since entering Congress has been the health care and pharmaceutical industry” he criticizes 9/11 first responders for asking for federal health care assistance.

And let’s remember that it was just a few weeks after submitting those FY2009 earmark requests that he was trying to block health care for 9/11 first responders, saying “I have to ask … why the firefighters who went there and everybody in the city of New York needs to come to the federal government for the dollars versus this being primarily a state consideration.”

That is the first time I have seen anyone call al Qaeda’s terrorist attack in New York “primarily a state consideration”.

A labor blog has written a scathing open letter to Mr. Issa, where they point out the irony in an “oversight” official asking corporations for a list of regulations to weaken. A comment attached to their letter also makes an interesting point:

California Congressman Darrell Issa made his fortune as CEO of Directed Electronics, maker of the Viper and Python car alarms. He may have spoken to you sternly if you too closely approached a Viper-protected vehicle, as it is Issa’s recorded voice that announces, “Protected by Viper. Stand back.” Ironically, he was twice arrested for auto theft himself in the 1970’s, but never charged.

That turns out to be true:

Issa, 49, became a multimillionaire manufacturer of electronic auto alarms, including the popular “Viper” anti-theft device. “When people ask me why I got into the car alarm business, I tell them the truth,” he said in a statement to The Chronicle. “It was because my brother was a car thief.”

Issa was accused by the police of giving misleading and inconsistent information about the stolen car and his brother. He, in response, panned the police efforts to solve the crime, calling them poor investigators:

Issa told The Chronicle that he believed police had targeted him because “they always thought I was not coming clean enough essentially to (help them) prosecute my brother.” He blamed his brother for the San Jose arrest. […] William Issa’s attorney contended that no crime had been committed because Darrell Issa had offered to buy the Mercedes back from the dealership for more than the amount it had paid.

Why would he offer them more?

Tahoe Resort Power Outages

The CEO of Squaw Valley has sent a letter explaining an interruption of services and loss of power at one of their busiest times of year.

On December 30 at about 12:00pm, the power lost one “leg” from the bottom of Headwall to the upper mountain. We immediately pursued contingency plans to activate backup power, and contacted the power company, NV Energy. A fuse located on a power pole operated by NV Energy near Granite Chief Road had failed. It took us 30 minutes to locate the fuse following the failure, at which point the power company was already en route. Upon arrival, the power company repair crew replaced the fuse, which they found had melted. We were advised, based on the state of the melted fuse, that failure was attributable to a defective fuse and was not related to the mountain’s infrastructure or operations.

Good example of a disaster recovery plan failure; the energy company was wrong in their assessment and the mountain infrastructure was the problem. Power failed at about the same time the next day, indicating it was caused by load.

The same fuse failed again on December 31 at 11:00am. Again, our team immediately mobilized backup power supplies and generators. NV Energy was on site within 30 minutes. A decision was made to replace the fuse with a larger set, which had to be sourced and delivered. The process took about 30 additional minutes.

The three legs of power thus had to be upgraded to the larger fuse. The CEO did not explain the cause of load or why the larger fuses were necessary. Squaw Valley has initiated an audit of their infrastructure and operations. It could also be related to how the power company was handling a wider set of power outages in the region.

A similar incident happened last year, when the Kirkwood infrastructure was overloaded and overheated. Kirkwood runs on power from six diesel generators, however, and so it caused an explosion and giant fuel fireball, covering the mountain and visitors with pollution for several days. The Kirkwood Senior Vice President said their plan has been to migrate the resort to power lines.

Ultimately, Cohee said, the resort would like to maintain the diesel generators for back-up purposes only. For the last few years, Kirkwood has sought to connect to Pacific Gas & Electric’s power grid in the region. The move, which would mean burying power lines in federally owned forest land, is under environmental review.

It is a wonder the resorts do not work on developing locally-sourced energy. They often have to close due to high-winds, which seems like an ideal time to run windmills and generate power. The days without high-winds produce abundant sunshine, which seems like an ideal time to collect solar energy. Innovation could also improve the efficiency of lifts and the resort, with sources more independent and redundant, so less load would have to be pulled from a grid. Guests would be less at risk of emergency conditions even with a main-power outage.

DNA link to hair color

Researchers say in the Journal of Human Genetics that they have found a link from DNA to hair color.

The study revealed a significant association between both variable sites and normal variation in hair colour. Only L374F remained significantly associated with hair colour when both SNPs were included in a logistic regression model. No association with other pigmentation traits was detected in this population sample. Our results indicate that the rare allele L374 significantly increases the possibility of having black hair colour (OR = 7.05) and thus may be considered as a future marker for black hair colour prediction.

That could help reduce the number of potential suspects in an investigation.