You are currently browsing the Hayes On Security weblog archives for October, 2009.
23 October 2009 by Jeff Hayes.
Yesterday, U.S. communications regulators voted unanimously to support an open Internet rule that would prevent telecom network operators from barring or blocking content based on the revenue it generates.
“I am pleased that there is broad agreement inside the commission that we should move forward with a healthy and transparent process on an open Internet,” FCC Chairman Julius Genachowski said.
The vote came despite a flurry of lobbying against the net neutrality rule by telecommunications service providers like AT&T, Verizon and Qwest which say it would strip them of the ability to manage their networks effectively and would stifle innovation and competition.
[The rule] allows for “reasonable” network management to unclog congestion, clear viruses and spam, and block unlawful content like child pornography or the transfer of pirated content.
The challenge is how much favor is oriented toward the end consumer versus how much to control the free market. How much freedom should an ISP have in deciding how to manage traffic on their networks? What should be done to make sure one ISP does not play favorites by slowing traffic to their competitors?
From the looks of if, the FCC is leaning towards preventing service providers from discriminating what services and content they will carry over their networks and under what circumstances.
What if I am in a one-horse town and I only have one reasonable option for high-speed Internet and my ISP decides it does not like specific sites like the Drudge Report, Fox News, CNN or categories of sites like hate, gambling, drugs, adult (not talking child porn here), or all sites in Arabic?
One the other hand, what if I decide that I want an ISP that supports my moral values and I elect that company to provide me my Internet service?
What if my ISP elects to throttle-down P2P traffic? Is that bad? It is bad for the P2P user but is it bad for everyone else? So should the ISP be given free reign or should there be some regulation?
I support the principle behind net neutrality in that all Internet traffic should be treated equally. As rule, I don’t like the idea of my ISP screening, interrupting or filtering Internet content without court order. Any fragmentation of services or control over specific protocols should be the exception and not the rule.
Posted in Web Security, Privacy | Print | No Comments »
11 October 2009 by Jeff Hayes.
I just completed the five-week FBI Citizens’ Academy. We meet once a week in the evening for 3 hours at the FBI offices (mine was in Salt Lake City) and on one Saturday at the firing range (mine was with the Salt Lake County). The best training experience I have ever had.
The curriculum consists of
The Special Agent in Charge (SAC) and the Assistant Special Agent in Charge (ASAC) lead the training; the actual Special Agents are the instructors. We covered white collar crime, violent crime, cyber crime, counterintelligence, domestic terrorism, undercover ops, victims, investigations, technology & tools, and careers. We got enter and see the gun vault (including a 1929 Thompson submachine gun) and play in Firearms Training System (FATS simulator).
On Saturday, we saw a sniper demo. We were told roughly were he was concealed; he made 4 precise shots from 100 yards. None of us could spot him until he stood up. We saw an explosive demo; amazing what a little C4 can do. We shot four FBI guns – two handguns and two semi/full automatic guns. We even got to shoot the .45 Tommy gun. We participated in a SWAT team hostage training session (we were the hostages).
There is no doubt that the men and women we met — Special Agents and support staff — are second to none. They are very professional and personable. They are dedicated to their jobs. I was more than impressed.
If you are interested in law enforcement, information security, investigations, forensics, homeland security, this is a must. It was a great experience for all of us. I want to thanks those that participated in the 12th Citizens’ Academy in the Utah Division. I wish them the best, including the SAC who is transferring to the SE USA.
Posted in Homeland Security | Print | 1 Comment »
8 October 2009 by Jeff Hayes.
As an adjunct instructor at ITT Technical Institute for the past four years, I enjoy introducing a new topic to the newer students and then to see them a year or two later and see how far they have come.
For most, the concept of policy and more specifically, security policy, is foreign. I think they must get tired of hearing me answer: “it all depends” or “what is the policy and why does it exist that way?”
Joan Goodchild, Senior Editor of CSO magazine, wrote a recent article, The Seven Deadly Sins of Security Policy. Here are her security policy deadly sins:
It is my experience that the biggest issue is lack of buy in from the top. Without top level buy in, why should any one read, follow or believe the policies are enforceable?
For many organizations, security is viewed as the “business prevention department.” The challenge security professionals have the world over is justifying the associated expenses. Security is an expense but for many organizations, it might be absolutely necessary, even an item that be be used to differentiate it from its competition, attract employees, and have a positive impact the bottom line.
There are many deadly sins with respect to security, and the worst is something many organizations are guilty of (not being one of the seven): they have no formal security policies.
Posted in Security Policy | Print | No Comments »
6 October 2009 by Jeff Hayes.
The U.S. Department of Homeland Security, as part of its National Cyber Security Awareness Month, has created a list of fourteen things home users can do to bolster cyber security.
Good list? Yes.
What about business? The best checklist I have found for good cyber security for the average business is from the Payment Card Industry within its Data Security Standard:
Simple? No. But is a great list to build a security plan upon.
Posted in Security Policy, Personal Security, Homeland Security | Print | No Comments »
2 October 2009 by Jeff Hayes.
October is National Cyber Security Awareness Month, as proclaimed by the U.S. DHS. The premise behind this is good: create awareness for cyber security. The DHS’s campaign will seek to:
Security professionals the world over need all the help they can get to create awareness of their craft. For the most part, security measures, be they physical or cyber, are business expenses. The challenge security professionals have is to justify those expenses in a manner that helps improve the overall business appeal from the prospectives of the customers, partners, employees and investors.
For most of us working in the cyber security profession, we are viewed a smart but our value is questioned. “We pay this guy how much for doing what exactly?” “If we did not do ‘this’, what would be the impact?” “Do we really need to jump through all of these hoops?” “Do we really need to buy all of these security tools, applications and appliances?” “Wasn’t our security policy just updated?”
Some things are just hard. Cyber security is one of those hard things. It is tough to see, quantify and qualify. The better we are at creating reasonable awareness of the issues confronting or business and industry, the better and more effective we will all be at performing our security jobs.
Posted in Security Policy, Homeland Security | Print | No Comments »