Category Archives: Security

Poetry, Security

Another Mispresentation of new DoE Cybersecurity Model

Leave a comment

Earlier I pointed out some misrepresentations of the new DoE Model.

I read the DoE report, called “Electricity Subsector Cybersecurity Capability Maturity Model, Version 1.0,” and I did not find very strong language about a senior executive. In fact, the term CISO (or CSO) does not appear anywhere in the document. […] Likewise the term vice president is only mentioned as a side-bar within the 92 page document.

I can imagine why someone might try to treat the side-bar example as a call for executive leadership in security but that’s not really a fair represenation of the document. It’s a minor and passive point compared with everything else put forward in nearly 100 pages.

But I just found the misrepresentation happening again, this time on Law.com in “Cybersecurity Becoming No. 1 Concern for GCs and Directors”

…the Department of Energy is encouraging electric-power companies to adopt a separate board altogether that’s just devoted to cyber-risk governance, as Network World reports. Under the recommendation, outlined in new guidance [PDF], a “cybersecurity governance board” would “develop a cybersecurity strategy for the utility and recruit a new vice president of cybersecurity to implement a program based on the strategy.”

The quote used by Law.com is from a side-bar to the document clearly labelled “example”. While it may illustrate a model it is neither a requirement a recommendation or encouragement. The actual statement of the model is this:

A cybersecurity program may be implemented at either the organization or the function level, but a higher-level implementation and enterprise viewpoint may benefit the organization by integrating activities and leveraging resource investments across the entire enterprise.

I rank the phrase “may benefit” somewhere below encouragement and definitely below recommendation.

The DoE obviously has left open the possibility that implementation of the program with an enterprise viewpoint also may not benefit the organization…

I don’t necessarily agree with the DoE’s language, but I also don’t want to misrepresent it and overshadow the rest of the document.

History, Security

This Day in History: 1863 Quantrill Raid on Lawrence

Leave a comment
Painting of William Clarke Quantrill’s 1863 “offensive defense” raid from Missouri on Lawrence, Kansas that targeted civilians. Some called it warfare tactics that targeted anti-slavery/abolitionist Jayhawkers. Source: LJworld

General Thomas Ewing, commander of the District of the Border, issued General Order No. 11 after Quantrill’s raid, which sent soldiers into four counties of western Missouri to impose order on the population and destroy the “bushwhacker” network (support for militant rebels, either for or against slavery).

Quantrill was known for surprise attacks, fraud, disregard for authority and targeting civilians. He led men like Jesse James on ruthless campaigns in Texas and “Bleeding” Kansas until Confederate forces had no choice but to try and detain him. He escaped arrest through corruption and sympathy. Eventually he was shot by Union special forces in 1865 while threatening to kill the President and died in hospital. I’ll post more details later this year.

History, Security

Android is Winning (Still)

2 Comments

First, in terms of disclosure, let me just get out of the way that I don’t prefer Android or iOS. They’re both too centrally managed for my taste. Call me a deviant hacking anti-communist if you must but I’m a fan of Linux on my handset, which is why I keep buying the awesome Nokia N9 and building/flashing it on my own.

Going to South Korea? Well pop a local South Korean telcom firmware on your N9 and look like a native with all those cool feature “defaults”. When you get home replace it with a Northern European vanilla firmware that’s as clean and clear as the icy waters of Trondheim. That’s the N9. Unlocked as unlocked can be, by default.

The closest thing on Android is the Cyanogenmod. A while ago I made a small business out of buying and reselling Android phones that wiped, replaced the firmware and opened up. It wasn’t for the money but rather for the liberation of the phones and their users (for comparison I also used to pull bicycles out of dumpsters, refurbish them and then leave them on the street to get more people riding). The Motorola Defy was my favorite to set free but even Cyanogenmod didn’t feel big and open enough compared to straight Linux.

At least Cyanogenmod exists. Liberating an Apple phone has been a sordid and messy game that has little upside other than showmanship and to refute Jobs. The Apple icon shifted from admitting to being a fan of stealing ideas to viciously threatening anyone who tried to “steal” his. It’s odd, especially when you consider that his highly-successful OSX is a BSD variant.

That being said, it wasn’t hard for me to predict that Android would eat Apple in the market. Earlier this year I mentioned “iOS struggles against Linux phones” but here’s what I said in October of 2010 when it looked clear that Google would rocket past Apple

iPhone losing OS fight

Today, here’s what TC says the real experts think.

The latest numbers are in: Android is on top, followed by iOS in a distant second.

This word comes from Gartner, a top research firm for these sorts of things. Overall, within the last quarter, Android outsold iOS devices nearly three to one while capturing 64% of the worldwide market share. Samsung was the top dog accounting for 90M handset sales.

There is no denying Android’s dominance anymore. There is no way even the most rabid Apple fanboy can deny that iOS is in second place now. Android is winning.

While so many others were talking about how iOS made them “feel” special the platform was just too proprietary to be a long-term bet. People may as well been telling me that the iSeries and OS400 were going to take over the world. Microsoft Windows and all that. Battle impact? Yes, of course. QSECOFR was a great thing. Long-term war victory? No.

The fact is that economics and politics in history indicate the majority of people eventually choose freedom over specific functionality. As much as some apologize for and say this or that “brilliant” dictatorship could have kept going (e.g. Mussolini made the trains run on time)…information likes to be free and Android at least allows for commodity hardware, which is far more free than iOS. And yes, RIP RIM.

Kirby Ferguson explains better than I ever have (or probably ever will) some of the dynamics behind why Android is winning…

Updated to add Aug 15, 2012: Even though Apple’s iOS lags in the market behind Android, Imperva reports that it is far more discussed by attackers (as reported in The Reg).

Hacker Growth

Updated to add Oct 25, 2015: Current phone Unix install base by version shows this blog wasn’t far off in its prediction of Android dominance.

Mobile Phone Unix Install Base

A side consideration here is that China committed to a universal accessory standard for phones to tamper down landfill growth (e.g. charger upgrade because different connector). That would obviously sway them towards open because better for the environment. Now ask me why Tesla opened all their patents when China was looking for electric vehicle platforms (e.g. chargers) for the world’s largest fleets.

Security

IBM Opens African “Smart City” Research Center

Leave a comment

This description is found in the IBM press release, on PR Newswire:

The single biggest challenge facing African cities is improving access to and quality of city services such as water and transportation. IBM, in collaboration with government, industry and academia, plans to develop Intelligent Operation Centers for African cities — integrated command centers — that can encompass social and mobile computing, geo-spatial and visual analytics, and information models to enable smarter ways of managing city services. The initial focus will be on smarter water systems and traffic management solutions for the region.

It sounds like a bold statement and move by IBM. Usually the top challenges in Africa are said to be internecine conflict, corruption and bureaucracy, which tend to keep businesses away.

If infrastructure development now has manageable risks then the stage could finally be set for explosive growth by business investment in areas without legacy systems to get in the way. That seems somewhat optimistic, though, given Kenya’s ongoing corruption problems.

Another possible explanation for IBM’s confidence in this venture is related to rising U.S. State Department interest in strategic influence over communication and information systems of Africa (Kenya ranks 3rd on the Net Index).

It will be interesting to see how Kenya handles the risks and liabilities that come from a foreign entity building big data repositories for them and a “smarter” critical infrastructure. The U.S. military has made it pretty clear they tend to want to predict movements of certain people on the Horn of Africa, especially when FBI are on the ground in Somalia. Military, intel and business objectives have an obvious overlap in the IBM proposal to build “command centers” and “traffic management solutions for the region”.