Watering hole attack prevention

Watering hole attack prevention

A watering hole attack is an indirect attack on a victim. Rather than directly attacking the victim’s network, the attacker attacks a web site that the victim’s employees are likely to visit. Then the attacker attacks the victim’s network, via its own workstations, from that web site. A former colleague asked me how you protect against watering hole attacks, and I thought this was a good exercise. So here are some strategies for watering hole attack prevention.

Read more

What I would have done to secure the Astros’ database

The now-infamous breached Houston Astros database sounds like a classic case of what security professionals call Shadow IT: a project that the business needs, done without adequate involvement from security and, most likely, from the IT department as well.

These kinds of things happen a lot. A go-getter implements it, cutting through red tape to get a useful project done in record time, and it’s great until something goes wrong.

In this case, “wrong” meant a competitor got into the database and stole trade secrets.

Read more

Hillary, hackers, threats, and national security

I got a point-blank question in the comments earlier this week: Did Hillary Clinton’s home-made mail server put national secrets at risk of being hacked by our enemies?

Depending on the enemies, maybe marginally. But not enough that any security professional that I know of is worried about it. Here’s why.

Read more

Random thoughts from the day after bin Laden died

It was 9:15. I was tired. I’d been reading, then I went to my computer to check baseball scores. I saw that the president had called a press conference for 9:30 CST, with no indication what it was about. 9:30 PM on a Sunday night isn’t when you usually call press conferences, and there’s usually some indication what the subject will be. I was curious enough to click around to see what was going on, but when I didn’t find anything right away, I went to bed.

This morning I woke up, went straight to the Kansas City Star’s baseball page to get an account of last night’s Royals-Twins game, and out of the corner of my eye, spotted the last headline I ever expected to read: “The Raid that Killed bin Laden.” What? Beneath it was a similar headline. I clicked, read the first two sentences to make sure I was reading the right thing, then raced into the bedroom, where my wife was getting our two sons dressed.

“They got bin Laden,” I said. And she did the same double-take that I did, and made me say it again.

Read more

The rock, or the hard place?

I have to confess I’m paying minimal attention to technology these last few days. I’ve been watching the goings-on in the Middle East. I saw the headlines that Intel’s newest chipset is buggy, but that won’t go down as the biggest news of 2011. A revolution in Egypt stands a chance. And it could have a domino effect.

Read more

No, Pat Robertson\’s comments aren\’t \"very Christian.\"

Venzuelan vice president Jose Vicente Rangel is now calling Pat Robertson a terrorist and saying his statement that the United States should assassinate neo-communist, neo-Mohammedan Venezuelan president Hugo Chavez is “very Christian.”

I’m not comfortable with the evangelical Christian label, but people frequently make me wear it. Statements like this are a big reason why I don’t like the label.

Most Christians will say they know Christianity when they see it. And this isn’t it.Hugo Chavez isn’t the reason gas costs $2.61. He’s part of the problem, but so is George Walker Bush. And it’s not right to kill someone just because he doesn’t want to lower his price on something you want. By that logic, it would be right to kill every store owner that isn’t Wal-Mart.

The problem is there’s something wrong with every major source of oil in the world right now. There’s instability in Saudi Arabia. The problems with Iraq should be self-explanatory. The rest of the Middle East is torqued off about Iraq. Russia is pumping the oil out as fast as it can. Our offshore operations have been pounded by the weather. Venezuela is mad because, well, Hugo Chavez looks at history and sees that the United States has a bad track record with Latin American countries. It also has a bad track record with oil-producing countries. Then he realized that Venezuela is both. If I were Hugo Chavez, I might be a little bit scared too.

Meanwhile, China is sucking down oil as quickly as it can because we outsourced all of our manufacturing there so we could pay 10 cents less for trinkets at Wal-Mart. It takes energy to make that stuff and ship it over here. The same energy we put into our gas guzzlers.

It’s not Chavez’s fault the entire Middle East hates us. Chavez didn’t cause the hurricanes, and Chavez didn’t sabotage the Russians. Chavez didn’t make us empty our factories and ship everything to China, and Chavez didn’t hold a gun to our heads and make us buy cars that get 9 miles to the gallon, and he doesn’t hold a gun to our heads and make us drive 15 miles per hour over the speed limit every day. We did (and do) those last three things on our own accord, and now we’re paying for it.

Most of these problems are beyond our control. We can’t control the war in Iraq. To a certain degree Bush can, but there’s little reason for him to do so. He wanted this war; he doesn’t have to buy his own gas, and he doesn’t have to worry about re-election. He has what he wants. Nobody can do anything about the weather, and while the war rages, nobody can do anything about the Middle East.

The only factor you and I can control is our fuel consumption. Sales of Toyota Corollas are at record highs, which is a step in the right direction. Not everyone can afford a hybrid, and not everyone who can afford one can get one. The next-best thing to do is to buy Toyota Corollas and Honda Civics.

The Bible very clearly says that killing outside of war is wrong. Pat Robertson needs to read Exodus and Deuteronomy a bit more carefully before he opens his mouth next time.

I’m not sure what the Venezuelan government wants us to do about Pat Robertson. Our laws allow him to say whatever he wants to say. So there isn’t a lot that we can do about him.

Except we can stop listening to him. And, come to think of it, that is an awful lot.

Cheap hardware won’t stop software piracy

Who’s to blame for rampant software piracy? According to Steve Ballmer, AMD and Intel. Oh, and Dell. Charge less for the computer, and there’ll be more money to pay for Windows and Office.

Steve Ballmer doesn’t know his history.

Read more

Pretentious Pontifications: R. Collins for President

R. Collins Farquhar IV, Aristocrat and Scientist.

To the directionless American people.

Greeting:

As my most recent endeavor received little appreciation, it is my great delectation to announce my decision to devote my considerable talents to solving the world’s problems.George W. Bush is in the back pocket of large corporations in a time when there are only two corporations, Intel and Microsoft, who are worthy of any trust. John Kerry is in the back pocket of labor unions and other leftist organizations.

Matters such as war and the economy are best left to the aristocracy, and not to amateurs such as these men. And, being an aristocrat, I have adequate means to support myself for eight years, so I can work without the distraction of trying to tread water above the poverty level on a meager $200,000 salary.

Therefore I am running for president.

John Kerry says he will reduce U.S. dependency on foreign oil but he does not say how. This is because this is a popular idea to which he has given no thought. Some political consultant told him this is what the rabble wants to hear. As even a simpleton like my brother David knows, the way one reduces dependency on oil flowing in from countries that hate you is by increasing your dependency on oil flowing in from countries that do not. Alaska has oil. Alaska is not even a foreign country. Venezuela has oil. We already buy oil from Venezuela. We should keep doing that. Russia has oil. We have money. We need oil. Russia needs money.

I will not state the rest of the obvious.

Now let us tackle the difficult matter of war. Being of rich Scottish heritage, and being descended from warriors who nearly succeeded in overthrowing the King of England except for a minor technicality of being betrayed by the French, I know a few things about war. I know more than a few things about winning a war.

I suppose only an aristocrat would notice such things, but it is very appropriate that our troops wear green camouflage, for many of them are not battle-tested. This is part of the reason why we are not winning the wars in Iraq and Afghanistan. It is painfully obvious to my aristocratic eyes that our troops need more seasoning before we send them off to fight in either of those two countries. Therefore, I propose we declare war on France in order to give our troops an opportunity to learn how to fight a war and gain confidence by absolutely trouncing an enemy. This trenchant and sonorous victory would give our troops confidence and rid us of a distraction. While routing the French army would not provide total preparation for facing the much better-trained guerrilla troops in Afghanistan and Iraq, it would certainly give them confidence, and confidence is 90% of everything.

The economy is easy to turn around. The aristocracy needs to spend more of its pin money. And when unemployment increases, the aristocracy needs to take on more manservants.

There remains but one problem, but hear me out, for I am going to turn that problem into a tremendous advantage: My age. The reports are true that I am but 29 years of age, which is well short of the 45-year requirement. However, I am in possession of an evil twin brother, who, incredibly, is also 29 years of age. Our combined age of 58 is well over the legal requirement. The advantage is that my brother, whom some consider more personable than myself, can take to matters that make presidents popular with the populace, such as jogging, drinking coffee at McDonald’s, looking at trains going around Christmas trees, signing books, making appearances at sporting events, dedicating libraries, granting interviews, and other such examples of woolgathering. He obviously will not know what is going on, but that is okay, because it will make this presidency appear peccant and naive, but such are the hallmarks of recent U.S. presidencies. Meanwhile, I can be tending to vade me*censored*presidential affairs, such as having my manservants bathe me, and then I can tend to a grueling 4-hour workday, whose tasks will include turning around the economy, bringing jobs back to the United States, and winning wars.

With an identical twin frolicking about the country acting as an aegis, it will be impossible at all times to know my whereabouts. So my misguided fans who like to give me fan letters soaked in alcohol and set on fire, or give me a 21-gun salute all by themselves, will not only have to get past the Secret Service, they first will have to figure out where I am. The additional Secret Service agents needed to protect two co-presidents will help the economy, offsetting some of the abstruce disadvantages of having such an ignoramus in such a prominent and redoubtable position.

My vice president, of course, will be none other than Jacques Pierre Cousteau Bouilliabaise le Raunche de la Stenche. He will, of course, be my main deipnosophist, and act as a fountain of yeasty jeremiads.

My time has come. My country needs me.

Not only do I appreciate your vote, I deserve it.

WordPress Appliance - Powered by TurnKey Linux