Category Archives: Information Technology

Disruptive Age?

A quick read offers an agile perspective on resource management; shifting from plan-based to adaptive and focusing on finishing projects, instead of starting them.  http://www.slideshare.net/rallysoftware/c-connor-pmirockymtntalk

 

Tagged , , ,

ApplyLogic has been nominated for SECAF’s Government Contractor of the Year.

SECAF AwardGreat news! ApplyLogic has been nominated for SECAF’s Government Contractor of the Year. SECAF’s 6th Annual Award honors small and emerging government contractors. We are proud of the ApplyLogic Team and excited about the nomination and recognition for the hard work we provide: servicing and delivering quality solutions to our customers! Way to go ApplyLogic!

Tagged , , , , , , , , , ,

Surveillance versus Breach

GCN published an article on June 3, 2013 regarding the possible data breach of Customs and Border Protection (CBP) systems operated by third-parties for clearances. The information used to obtain clearances is not only personal identifiable information (PII), but also re-tells the past ten or more years of history of an individual. So the potential compromise of this information is a serious issue.

Now add the recent scandals regarding surveillance by the NSA and other government agencies adds to the concern. This is more than a privacy issue, but one of the capability to maintain data secure. DHS is meant to provide the “cybersecurity” component of the government in conjunction with the DoD, but if DHS and the DoD have issues with maintaining the security of their respective systems, what will the potential breach be with the new surveillance information. While granted, the information of the phone calls from the various telecoms is currently not maintaining the call content itself, the associated metadata could expose even greater risk to individuals than is being expressed. Most phones maintain GPS and cell tower information with a call. Add the additional cell phone number and owner information, it is now possible to track the patterns of the individual in addition to the various calls.

While the potential privacy issues around surveillance has its place, the ability for the government to protect the data is also equally important.

Tagged , , , , , , , , ,

40 Zettabytes with Meta Tags Please….

In an article by Computerworld, analysts are predicting that in the next 8 years digital data will exceed 40 zettabytes (1,099,511,627,776 gigabytes (GB) in a zettabyte) or about 5,200 GB per person on earth.  Emerging countries/markets will likely become the dominant data generators rising from 36% to 62%.   However, the research suggests that this data will mainly be produced by computers not humans.

More data, more storage, faster hardware, larger/faster networks, tighter security, “real” service-oriented architectures, “bring your own device” solutions, converged infrastructures and overall efficiencies needed for customers.  Meta tags will be the critical element in farming and correlating this data.  And, by 2020, while cloud spending is projected to rise from 5-40%, the cost of storage will likely plummet.     Interesting times ahead….

http://www.computerworld.com/s/article/9234563/By_2020_there_will_be_5_200_GB_of_data_for_every_person_on_Earth

Tagged , , , , , , ,

IPS Grows Up But IDS On Life Support?

In the November 2012 issue of SC Magazine (Pg 26-28) titled “IPS Grows Up”, an article by Fahmida Rashid discusses some of the changing landscape for intrusion protection systems with a variety of experts. There are a variety of interesting topics and statistics regarding IPS such as the following:

While IPS won’t be able to block attacks exploiting zero-day vulnerabilities or thwart skilled adversaries using sophisticated tactics, it should “prevent 99 percent of push-button or automated attacks, Al-Abdulla says.”

While many can agree with that statement, what probably would not receive a great deal of agreement was the following statement within the article:

Holden predicts IDS will “fall by the wayside” in the next three to five years.

While it is understood that IDS is not detective rather than reactive, but one of the things that many businesses and agencies have a hard time tuning IPS in a way that there will not be any issues with mission or business critical traffic. The thought that IDS will no longer be necessary seems very short-sighted and limited. Granted most IPS devices are also IDS, but if defense in-depth is still a valid concept and that risk is a business decision, then IDS will remain in use for the foreseeable future.

Tagged , , , , , , , , , ,

Windows 8 is Here and So Are is the Zero-Day…

Microsoft’s new flagship operating system Windows 8 was released at the end of October, but with its release, so has a new zero-day. In a recent article in SC Magazine, the article describes how the French security firm Vupen is offering the recently discovered zero-day for sale. In fact, a mere $50,000.00 could allow you to obtain the vulnerability that has been described as affecting the new Internet Explorer 10 browser.

According to the article:

Last week, Vupen CEO Chaouki Bekrar tweeted that “various” IE10 and Windows 8 vulnerabilities had been combined to circumvent exploit mitigation safeguards in Windows 8, which was released to the public on Oct. 26. The exploit was reportedly not disclosed to Microsoft, nor was its price made public. Vupen did reveal that the zero-day could allow a particularly skilled hacker to bypass embedded security measures, which include high-entropy address space layout randomization (HiASLR), anti-return oriented programming (AntiROP), data execution prevention (DEP) and protected-mode sandbox.

According to the article, Vupen only sells the vulnerability information to governments and business, but this is very concerning. The fact that they have not shared it with Microsoft, this could become a way to hold applications, business and governments hostage. Secure coding needs to be the priority of developers and the time to market needs to be properly married to insuring limited vulnerabilities.

Tagged , , , , , , , , , , , , , , , , , , ,

Seeing the Light of Security…

A recent article in DFI News discusses some interesting research. The article discusses research by physicists at Heriot-Watt Univ. and Univ. of Strathclyde. They are working with tiny particles of light to create a new way of verifying electronic messages and transactions as authentic, helping address the huge cost of e-crime and avoiding potentially catastrophic fraud, online hacking and theft of digital data.

According to the article discusses how the research shows how photons can be used to verify security and authenticity of any transaction or communication with a “digital signature.” The article specifically states it does the following:

Quantum-based secure signatures mean that an “eavesdropper” — a malevolent third party listening in — cannot fake a signed message which is being sent to multiple recipients.

  • The sender writes the signature with encoded light particles and sends it to the receiver
  • The receiver cannot yet read the signature. However, it can be sure it received an authentic signature
  • To confirm a message is authentic and to also read it, the receiver has to receive both the message (the “signature”) plus additional information required to decipher it
  • The multiple receivers confirm that they have received identical signatures – only then does the sender provide the additional information required to read the signature
  • This process takes place without the user (e.g. a shopper) being required to do anything differently to current security methods

When physicist begin looking at how they can impact and improve e-commerce, you know there is a big amount of money at stake. It will be interesting to see how this can be implemented in the real-world and also how it will be circumvented…

 

Tagged , , , , , , , , , , , , , ,

ApplyLogic Jobs…

ApplyLogic has a number of openings.

If you want to work with exceptional people in a variety of organizations and environments, go to the ApplyLogic Employment Page and complete the application form or send your resume to careers@applylogic.com.

Tagged , , , , , , , , , ,

South Carolinas’s Majority of Social Security Numbers Exposed…

In an article in Dark reading, South Carolina officials announced that more than three-quarters of the states social security numbers were exposed in a recent hack. The data included debit and credit card information for the states residents as well. The most concerning issue was that the database that was compromised was not encrypted. As a state agency, it should have been an example to follow rather than one to avoid. The state’s Department of Revenue should have been held to not only federal regulatory requirements, but also PCI. This type of failure is not acceptable.

While not everything has been released as to the cause other than the database was breached and not encrypted, the article states the following:

Although state officials referred to the hack as a “database” breach, they didn’t specify just what flaw was exposed. Security experts say it was most likely a SQL injection or other vulnerability in the Web-based application that ultimately led to the data breach.

Chris Eng, vice president of research for Veracode, says it sounds like a SQL injection attack against a Web application. “That’s the simplest way in,” he says.

It is easy to make conjecture about how the breach occurred, but it would seem that the necessary due diligence was not followed. Security should be more than a check-box. States and Federal governments should be setting the examples for the rest of business…Another instance where measure twice and cut once should have been put in place…

Tagged , , , , , , , , , , , , ,

Weather To Have Security or Not…

Millions of people are feeling the effects of Hurricane Sandy along the East Coast of the United States. Natural disasters occur all the time all of over the world, but many times some of the basic precautions do not get addressed in advance. Many will ask how this topic deals with technology or security, but the answer is simple…it just does. Most businesses will have a process or procedures if a server crashes or the phone system or Internet goes out for a couple of hours, but how many businesses address the longer term impacts of flooding or the fact that your cloud provider lost one or more of its data centers.

The reality is that business continuity planning and disaster recovery planning should include these types of scenarios. Scenarios and planning for short and long-term outages. Whether it is an earthquake, tornado/hurricane, or flooding, the planning needs to be there and how it could impact your business from a safety and financial stand point. If you take this recent storm as an example, many businesses lost power and will be flooded for days potentially having a strong negative impact for their customers. In fact, the NYSE closed for multiple days as a result of the storm and that has not occurred for weather related issues since the early 1900s.

The bottom line is to plan. Make business continuity and disaster recovery a part of your process and then also test those processes. The last thing your business needs during an outage is to go to a process that does not work or has never been tested. Now we know that security and business has to evaluate risk. If not being prepared is an acceptable risk, then that is the business decision you will need to make…

Tagged , , , , , , , , , , , , , , , ,
<span>%d</span> bloggers like this: