The Issue With Cloud Computing

I really like the way The Hoff puts things sometimes:

We’re told we shouldn’t have to worry about the underlying infrastructure with Cloud, that it’s abstracted and someone else’s problem to manage…until it’s not.

I think that sums up in one line the problem with Cloud Computing. You are essentially making your job easier by dumping the responsibility for Security (and Availability) onto someone else's plate. Which is fine until they post a note saying "Sorry" and you are left with no service.

Or worse - data that has gone off somewhere that you don't want it going!

The Conficker Eye Chart - Really!

This Conficker Eye Chart is brilliant!

Information Security can get a bit drab and boring. Especially when the auditors start poking around and you are arguing about the minutiae of your security policy. And especially when you look at the designers with their Apples and the programmers pumping out new Web 2.0 frontiers.

But sometimes, someone out there comes up with something so silly but effective that it just has to be blogged about.

The Conficker Eye Chart is simple - it tries to download images from Sites that Conficker blocks. If you can't see them then it could be that you are infected.

But you really have to see it. I wish I had come up with that one!

Isn't Open Source Wonderful?

[Nokia releases Open Source Symbian and it is installed on a toaster]

There is a news story about a toaster running Symbian (the platform that newer Nokia phones run).

It does this so it can provide extra services like measuring the heat of your toast etc.

Full set of features:

• BreadSense mode that uses internal sensors to figure out the ideal heat setting and time for the bread you have inserted.
• The large touchscreen UI also allows you to tweak the settings to suit your personal taste.
• Toast settings can be saved and assigned to individuals. A finger-print sensor on the side identifies the user and automatically displays their personal presets.
• Additional presets and sandwich serving suggestions can be downloaded from the internet using the built-in WiFi connection.
• Users can share their own presets and recipes online too.
• Can connect to your phone via Bluetooth and upload reminders to buy more bread when you run out.
• The screen can display useful online information such as news headlines, weather forecasts and video feeds to keep you entertained and informed in the kitchen.
• Firmware updates are automatically downloaded and applied over the air to make sure you always have the latest features.

By the way, happy April Fools Day. Still, some April Fools Jokes come true...

Note: click through to see the image of this toaster, I want one. And I'm not sure why!

Scareware

My mother-in-law runs a small craft shop (with lovely craft products, sold very cheaply and with good friendly advice ;) and her business relies a lot on the Internet. Queries come in via email, she has an online store and a website.

Yesterday she got sent an email telling her that due to some unsavory use of the Internet, she would be disconnected. The email had an attachment which was (pretending to be) some sort of log of her activities.

Now, the more savvy of us may think - scam. But she is not "the more savvy of us" and this email freaked her out. She imagined her Internet presence being shut down. And, of course, she was always careful about her browsing.

Fortunately for her, her ISP's antivirus recognised the attachment as being a trojan and deleted it. But she may have been stressed into opening the attachment to see what the accusations were.

I have written this post to tell people about this type of trickery and to just remind those out there that are maybe not so Internet savvy - NEVER open attachments that you are not expecting. If you are concerned about your Internet connectivity being taken away then contact your ISP directly.

And always have an up-to-date antivirus.

The Victorian Police Have Issues (Ironic Post)

[The irony in this article is so lovely, it has to be shared]

The Age newspaper reports that a leaked memo from inside the Victorian Police (Australia) department says that their IT systems are risky.

The article lists a whole bunch of "Availability" risks such as backups failing and the like. It doesn't really go into details about how information security can be compromised although it does list the kind of information that the police have on hand which is very confidential.

The wonderful part is that the article says: 'A police spokeswoman said the force believed its IT applications were secure and there was a "full back-up regime across all our services as well as disaster recovery for core applications".'

My question is ... if the Victorian Police are secure, as they claim to be, how did a highly confidential memo with the ability to cause massive amounts of embarrassment to the department get leaked to the press?

More Fame... Where is the Fortune?!

[The Highly Esteemed Author Presents At ITWeb Conference]

I applied and my presentation was accepted to be presented at the ITWeb Security Conference.

If you have read my Blog posts then there will be very little new information in the presentation. However, I do tie my thoughts together in one big "this is where you should be going" session. It will be on the management track so I should be expecting some high level thinkers and, yes, the presentation is very high level.

Even though I am now involved, I highly recommend this conference for all that can make it. I missed out in 2007 but the twice that I attended (2006, 2008), I certainly came out with some mind blowing insights.

I also highly recommend that management don't have the mindset: "we need to think about this security stuff" and then send their IT Guy but rather that they make the effort to send someone who can make business decisions. Even better - send both. That is why there is a management stream and a technical stream.

The reason I promote this event (and I really don't get commission) is that it is the only major event in South Africa with an Information Security focus. I believe that management at any company should make an effort to stay in touch with what is happening in Information Security.

Unless you don't use information or none of your information is private.

Fame! I'm gonna live forever!

[The esteemed writer of Security Thoughts Gets a Mention in Two of His Favourite Blogs]

Yes, not only did I get a mention on The Hoff's Rational Survivability.

But I also got a mention on Securosis.

Life is good.