Scott Wright’s Security Views

*** Techno-Geek Warning ***

The following lengthy article discusses technical details that may cause your head to explode. I take no responsibility for cleaning the walls after you read this.

************************

As promised, Steve Gibson has published his explanation of what Phorm Inc. is doing to enable “Behavioral Targeting” for its advertising network that leverages equipment it installs in ISP facilities for tracking and targeting ALL user web surfing.

Here are my three levels of interpretation, so you can choose to read further or not:

1. At the highest level, Phorm is enabling a more targeted marketing database that relies on analysis of your web requests, AND on the content of pages you view through a given ISP. The ISPs can make a lot of money from this model. Phorm claims that they do not store the information they see, and any profiling data about you is anonymized. If you trust them and your ISP, and don’t mind that they are doing this without your consent, you won’t see it as being much worse than what Double-Click does to profile you, except that they can see virtually EVERY site you visit, including the information going in and coming out. Continue Reading »

Viral marketing is a broad term used to describe methods for spreading ideas and messages through the internet at blazing speeds. Methods range from online contest promotions for canned spaghetti to subtle, clever videos on Youtube with website subtitles from the sponsor, to social networking site tools for scouring your email address book looking for candidates to invite into your network.

Depending on how these tools are used, they can be very helpful in bringing people into a focused movement to improve the penetration of a product or service; or they can be a greedy, risky way to get what amounts to a free lottery ticket. Continue Reading »

Here’s a scenario that could happen to anybody in any organization. But with the staggering number of information security breaches occurring at colleges and universities recently, this scenario is perhaps more common in within educational institutions.

A university professor receives an email from another colleague working in the university. The subject line says, “Here’s a good way to stop students from cheating on assignments and exams…” When the email is opened, there is a forwarded message that has a pitch for a free teleseminar on iron-clad techniques that discourages student sharing of assignments. This sounds like a panacea in a world where students are getting too street-wise for professors to maintain control over their evaluation system. So, the prof clicks on the link.

Continue Reading »

One thing sailors usually learn before they become “old sailors” is the value of keeping things neat. When you are at the mercy of wind and water - and with nobody around - a good sailor makes recovery from incidents look easy. They know exactly where the lines, tools and emergency equipment are stowed. They also explain the safety features to new crew members and passengers before they are needed.

If you see ropes strewn across the deck, you may not think of them as being dangerous; but imagine having a weather or mechanical crisis going on, and having to keep looking down to see what’s under your feet as you scurry about the deck to keep from tripping and falling overboard.

Continue Reading »

Bandaids are supposed to be used for first aid, not preventative maintenance. Here’s a good example of why you need to make security a priority early in the system design cycle.

Today I spent 45 minutes on my handsfree cell-phone while driving (and another 20 minutes on my home phone), helping a friend configure his new laptop PC to work with his wireless network. In the end, I don’t think Vista was actually the root of the connection problem, but it certainly didn’t help. I still don’t know why Vista can’t just recognize the wireless card, recognize the network and ask for the encryption key; then make the connection. It shouldn’t take more than a minute. As Bulldog Briscoe would say on the old “Frasier” sitcom, “This is crap! This is total BS!” Then he would thwak Bill Gates in the forehead with his knuckles… Continue Reading »

I think we all agree that powerful tools must be handled with care.

A nail gun is an invaluable tool for building houses, but would you let your kids, or even your office staff play with them? Definitely not, unless they have a reason to use nailguns (other than “for fun”), can demonstrate that they know how to use them without nailing themselves to the floor, and have at least read the handy reference manual, “Nailguns for Dummies”.

Michael Geist wrote about the power of Facebook (click HERE) and social networking sites in his self-described modest attempt to protest the Canadian government’s intent to pass reforms to federal copyright legislation this past month. Within a period of two weeks from starting it he watched his modest initiative snowball into a movement comprising 25,000 members on Facebook. This, together with independent efforts by others, apparently led the federal Industry Minister Jim Prentice to announce a delay in the proposed legislation.

Michael Geist must have felt something like Dr. Peter Venkman from Ghostbusters did after the first time the team tried to use their Proton Pack Beam to catch a ghost. So, how can such a great tool be dangerous? …Remember, “Important safety tip: Don’t cross the beams.” Continue Reading »

With the UK Government’s logic on personal internet security and data breach laws (click HERE), it seems that they might as well be deregulating their drinking water distribution systems. A set of recommendations from a House of Lords Science and Technology Committee study was almost completely discounted by the government.

What would happen if a city’s drinking water distribution system developed a major leak, or had significant breaches? Or what if a major contamination entered the supply? Continue Reading »

I was recently on the Security Catalyst Forums (HERE), where I was reminded of this quote from the lyrics of the song “Free Will” by the Canadian rock group, Rush (HERE):

“If you choose not to decide, you still have made a choice.”

This statement can be applied to a lot of different situations and philosophies. However, I think it is particularly relevant in the world of Risk Management.

Continue Reading »

Canada’s Privacy Commissioner recently issued a statement about the TJX breach of Personally Identifiable Information for millions of credit card holders. Click HERE for the news release. Continue Reading »

The Security Roundtable’s September, 2007 podcast (HERE) has a great discussion on several different aspects of privacy. Michael, Rebecca, Martin, Andrew, Dan and Anton raise some really interesting questions, and even educate each other.

Continue Reading »