Comments for The Guerilla CISO

Comment on DDoS and Elections by Vlad the Impaler

Vlad the Impaler — Mon, 21 May 2012 16:06:36 +0000

BTW… welcome back…

Comment on DDoS and Elections by Vlad the Impaler

Vlad the Impaler — Mon, 21 May 2012 16:06:04 +0000

…you know it’s serious when my customer has Akamaized…. (finally!)

Comment on More on the Rybolov Information Security Management Model by Allen de Klerk

Allen de Klerk — Mon, 21 May 2012 13:02:19 +0000

Can you please send the correct properly sized diagram so I can have a look at it?
I am a security architect doing investigation into the different models applicable to security and your correlation seems rather interesting.

Comment on DHS is Looking for a CISO by Mini-me

Mini-me — Thu, 05 Jan 2012 21:50:26 +0000

Why don’t you take it?:)

Comment on The Guerilla CISO Rants: Don’t Write a System Security Plan by Tim Ruland

Tim Ruland — Thu, 22 Dec 2011 18:55:22 +0000

As part of our RMF transition we no longer do the traditional SSP. Ours are primarily in an Excel spreadsheet. This allows us to document components and controls at a more granular level and lets us produce diagrams and charts for our AOs, many of whom are not security oriented.

Comment on The “Off The Record” Track by LonerVamp

LonerVamp — Tue, 22 Nov 2011 19:05:37 +0000

1. I think they should always be called “Chatham House Rules” talks, so that we let everyone know what that means. There are still uninitiated who don’t know what that means when they attend something like that.

2. This is one thing I like about adhoc Defcon discussions and the like. Even if you don’t trust the rest of the attendees around you, chances are no one knows your name, you can decline recording, and you can frown upon photos. Being able to attend anonymously or under a pseudonym is still valuable. A little less so when everyone in the room is local and knows who you work for anyway.

3. For most orgs, I don’t see why you wouldn’t share information. Sure, actual breaches and incidents might be pushing the line, but even to talk about your implemented technology or weaknesses probably doesn’t open any doors for malicious attendees.

4. I don’t always need someone to say their name, who they work for, and why they’re qualified to talk on a topic. If their data/content will demonstrate that to me, I couldn’t care less. Tell me your pseudonym and go to town (and save those 2 minutes for more content!).

5. We really need orgs to be less gun shy about divulging things anyway.

Comment on The “Off The Record” Track by Network Security Blog » Open tabs 11/22/11

Network Security Blog » Open tabs 11/22/11 — Tue, 22 Nov 2011 14:35:57 +0000

[...] The “Off the Record” track – There’s really no such thing as “off the record”. But for some reason, I’ve noticed that people become more guarded and less likely to talk when they first [...]

Comment on The “Off The Record” Track by Ben

Ben — Tue, 22 Nov 2011 12:16:11 +0000

We’ve had “cone of silence” talks and tracks since the very first BSides event using these general rules. The first BSides Austin had a complete track dedicated for “cone of silence” talks/discussions.

Comment on DHS is Looking for a CISO by changingXs

changingXs — Wed, 09 Nov 2011 16:57:36 +0000

Slight correction, looking for a Director under the CISO’s office – Compliance and Technology.

Comment on DHS is Looking for a CISO by Darren Couch

Darren Couch — Sat, 05 Nov 2011 00:29:06 +0000

So, did you take HR some cookies yet?

Comment on Training for the Zombie Pandemic by MMO Tag

MMO Tag — Fri, 04 Nov 2011 02:30:09 +0000

The newest Zombie Apocalypse MMO is http://www.zombiedays.com which has just launched as Open Beta

Comment on Google Advanced Operators and Government Website Leakage by Generate Web Traffic

Generate Web Traffic — Tue, 13 Sep 2011 05:32:00 +0000

Google is really the boss. You can use its power for good purposes and also for bad purposes. We should know our limit that what we should or what not because every organizations have rights to secure their information. Thanks for the post..

Comment on The Rise of the Slow Denial of Service by Sam Bowne

Sam Bowne — Sat, 03 Sep 2011 01:37:52 +0000

There is a simple solution: CloudFlare.

Comment on Apache Killer Effects on Target by jg

jg — Tue, 30 Aug 2011 23:02:08 +0000

Nice. Have been following this issue and yours is the best write up I’ve seen so far.

I’m new to your blog and I read your comments guidelines. I’m glad to know that schmardt people are still taking jobs with/for our gov’t.

I’ll be reading more …

Comment on The Rise of the Slow Denial of Service by Apache Killer Effects on Target | The Guerilla CISO

Apache Killer Effects on Target | The Guerilla CISO — Tue, 30 Aug 2011 13:50:40 +0000

[...] Working on an Apache Killer blog post. Recent CommentsLonerVamp on The Rise of the Slow Denial of ServiceMr Burns on The Rise of the Slow Denial of ServiceMr Burns on The Rise of the Slow Denial of [...]

Comment on The Rise of the Slow Denial of Service by LonerVamp

LonerVamp — Sat, 27 Aug 2011 00:25:40 +0000

And by “suck” you mean, “really suck.” The defenses you list fly in the face of today’s web 2-point-whatever. No POSTs? Smaller requests? Less time? That’ll make me friends…

Still goes to show that the more complex (advanced?) things get…

Comment on The Rise of the Slow Denial of Service by Mr Burns

Mr Burns — Fri, 26 Aug 2011 03:26:37 +0000

And supporting article https://community.qualys.com/blogs/securitylabs/2011/08/25/new-open-source-tool-for-slow-http-attack-vulnerabilities

Comment on The Rise of the Slow Denial of Service by Mr Burns

Mr Burns — Fri, 26 Aug 2011 03:26:10 +0000

There is another slow HTTP attack test tool released. http://code.google.com/p/slowhttptest/

Comment on The Rise of the Slow Denial of Service by Network Security Blog » Network Security Podcast, Episode 252

Network Security Blog » Network Security Podcast, Episode 252 — Wed, 24 Aug 2011 00:09:09 +0000

[...] The Rise Of The Slow Denial Of Service [...]

Comment on The Rise of the Slow Denial of Service by Network Security Podcast » Blog Archive » Network Security Podcast, Episode 252

Network Security Podcast » Blog Archive » Network Security Podcast, Episode 252 — Wed, 24 Aug 2011 00:08:17 +0000

[...] The Rise Of The Slow Denial Of Service [...]

Comment on Stress-Test Apache with Intent to Tune: BSOFH Tip for the Software Masochist by The Rise of the Slow Denial of Service | The Guerilla CISO

The Rise of the Slow Denial of Service | The Guerilla CISO — Tue, 23 Aug 2011 13:49:59 +0000

[...] Go read my previous post on Apache tuning and stress testing for the background on server pool manag…. [...]

Comment on QR Code Temporary Tattoos Howto by Taking a Shot at Immunizations Online, Part 4 « Social Media Healthcare

Taking a Shot at Immunizations Online, Part 4 « Social Media Healthcare — Mon, 01 Aug 2011 11:02:49 +0000

[...] creative and decided to try to adapt the QR codes for temporary tattoos, as Mike Smith showcases here. That is when when we had bitten off more than we could chew. There were several glitches: they [...]

Comment on Data Security Lifecycle–Surprise, It’s C&A All Over Again by links for 2011-06-30 | Bare Identity

links for 2011-06-30 | Bare Identity — Fri, 01 Jul 2011 00:02:00 +0000

[...] Data Security Lifecycle–Surprise, It’s C&A All Over Again | The Guerilla CISO (tags: security infosec datasecurity lifecycle) [...]

Comment on QR Code Temporary Tattoos Howto by Scan Your Way to a New Job with QR Codes | Online Debt Relief

Scan Your Way to a New Job with QR Codes | Online Debt Relief — Tue, 28 Jun 2011 22:53:30 +0000

[...] of an audience, but don’t be afraid to get creative. I’ve seen people with temporary QR codes tattooed on themselves at conferences. I’ve also seen young executives wear neckties featuring QR codes. You have to find the [...]

Comment on QR Code Temporary Tattoos Howto by Jully Nascimento

Jully Nascimento — Mon, 23 May 2011 18:55:46 +0000

I have a original qr code tattoo one…
ask me in my page!!!

@mother_fuckerz