Smart Business Interview

Here is an interview I recently did with Smart Business.

Shackleford and InfoSec IDGAF

Speak softly and carry a big stick rarely applies to Shackleford, as his opinions are almost always as blunt and in your face as the American Gladiator style weapon he uses as his stick is big. And in his latest blog post he does not disappoint, introducing the concept of IDGAF security and designing for this lowest common denominator. Great stuff. Application whitelisting and NAC are two of my own favorite big sticks (check out Cisco ISE, identity at the packet layer, mmmmmmm) but my only bone to pick is the lack of definition of the term "traditional" in his statement "Traditional security awareness programs are useless. Give them up. Do it now." My assumption is that "traditional" means the existence of a weak security awareness program simply to satisfy the compliance checkbox and that has no teeth. To which I would absolutely agree. But when you have the technologies with teeth meant to enforce policies, those policies must first off exist and secondly they must be communicated throughout the business. And this should be done through "non-traditional" security awareness programs.

Oh, who am I kidding? IDGAF.

InsecurID? RSA/Lockheed - Another example of media jumping on blog speculation

A client and associate of mine were talking further about the risks to our organization in the wake of the latest RSA associated news wave with Lockheed Martin. I'm not saying that the accounts blogged by Cringely on his recent post aren't the events that actually occurred. They might be. But it does appear to be one of the first posts about the Lockheed Martin incident. And it does contain a number of words/phrases such as "probably", "seems likely". And it is being referenced as a source in other media reports on the events. Now this is absolutely not a knock at Cringely's cyber-sleuthing skills. It absolutely is a blast on verifying data, using blog speculation as news sources and creating news "facts" that may or may not be accurate.

Note my use of the phase "may or may not be". That might be reported tomorrow by Reuters as true.

Facebook introduces 1-1/2 factor authentication

And collects more of your PII in the meantime by requiring your phone number. I hope Google authenticator gets an API and becomes widely adopted. Facebook post here

Real world costs of APT to American Taxpayers

Bejtlich's analysis of a new report on the costs of the new USAF bomber and how much of those costs have increased due to China's APT program ($8B). That's just for this one project that falls under the Special Access Program. Tip of the iceberg, anyone?