Scott Wright’s Security Views

With the growth in both occasional and full-time telecommuting, businesses are cutting corners to save costs, according to a recent Ernst & Young study. But the benefits to the organization may be outweighed by the risks if a few simple precautions aren’t taken. Despite the fact that some security professionals feel this is an “old news story”, I think it deserves more attention. These are still very important findings, especially in the context of managers who have finally been convinced that telecommuting can save the company some overhead, and (in some cases) improve employee morale and productivity.

Allowing employees to use their private home computers introduces many of the same types of risks as opening up the corporate firewalls. There is the very real potential of opening up big holes in the enterprise network that attackers can find irresistable.

Here are five ways you can make your telecommuting program more secure: Continue Reading »

*** Techno-Geek Warning ***

The following lengthy article discusses technical details that may cause your head to explode. I take no responsibility for cleaning the walls after you read this.

************************

As promised, Steve Gibson has published his explanation of what Phorm Inc. is doing to enable “Behavioral Targeting” for its advertising network that leverages equipment it installs in ISP facilities for tracking and targeting ALL user web surfing.

Here are my three levels of interpretation, so you can choose to read further or not:

1. At the highest level, Phorm is enabling a more targeted marketing database that relies on analysis of your web requests, AND on the content of pages you view through a given ISP. The ISPs can make a lot of money from this model. Phorm claims that they do not store the information they see, and any profiling data about you is anonymized. If you trust them and your ISP, and don’t mind that they are doing this without your consent, you won’t see it as being much worse than what Double-Click does to profile you, except that they can see virtually EVERY site you visit, including the information going in and coming out. Continue Reading »

I’m not an alarmist, normally. But listening to Steve Gibson’s “Security Now Episode 149 - ISP Betrayal”  - describing a really disturbing new trend in ISP privacy violations - makes me think we are headed for a drive off a big cliff, privacy-wise, if we don’t take notice and act soon.

Full episode transcript - http://www.grc.com/sn/SN-149.htm

According to Steve, there are a number of companies offering to put equipment in ISP facilities - for free - to profile “all unencrypted content”, even to the point of tracking when dynamic IP addresses of clients change, so that they can “better target ads in their network” and share the profits with the ISPs. They even try to spin the marketing copy to imply that their anonymization technology actually “improves” customer privacy. Continue Reading »

Viral marketing is a broad term used to describe methods for spreading ideas and messages through the internet at blazing speeds. Methods range from online contest promotions for canned spaghetti to subtle, clever videos on Youtube with website subtitles from the sponsor, to social networking site tools for scouring your email address book looking for candidates to invite into your network.

Depending on how these tools are used, they can be very helpful in bringing people into a focused movement to improve the penetration of a product or service; or they can be a greedy, risky way to get what amounts to a free lottery ticket. Continue Reading »

Bruce Schneier’s recent explanation in a CIO article of psycho-economic experiments regarding how we handle simple security investment makes us all look pretty silly (click HERE). With images that bring to mind Jack Black playing the part of a doomed jungle animal or primitive “homo securosis” (in my mind’s eye, anyway), he recalls Kahneman and Tverseky’s 1979 theory and experiments. The conclusion is fairly simple, and makes some sense.

Consider the following two scenarios and how you would respond…

Continue Reading »

In the same vein as spammers who depend on your clicking on or replying to their messages to feed their voracious appetites for valid email addresses and traffic, you should be aware of a fast-growing, yet less obvious risk.

With the growth in small, low-cost, high capacity Mobile Storage Devices (e.g. USB Drives, MP3 Players, Cameras, PDAs), it is inevitable that the things will get lost. So, when you see one abandoned at a phone booth, on a bench or in a hallway, the scenario may seem harmless enough — a memory stick fell out of a pocket, or was left there by accident. But at the risk of sounding paranoid, don’t do the obvious. Continue Reading »

Sadly, some electronic voting machine manufacturers in the USA have been getting some bad press regarding their machines’ alleged accuracy issues. Martin McKeay put up this post with a mock news video about electronic voting machine risks the other day (click HERE).

This could be just the tip of the iceberg. Maybe we could all someday have the illusion of: Continue Reading »

Stephen J. Murdoch is a graduate student at Cambridge, and a prolific writer of papers regarding Internet security. He recently wrote article and article (click HERE) on censorship and shifting Internet borders. The piece reflects on how various jurisdictions have attempted to control or censor content deemed “offensive”, and how it has changed as the nature of the Internet has evolved. As with any conflict, each side adjusts to the other’s new tactics.

Continue Reading »