DCS Security

Perhaps this can be a music blog

2009-06-11T19:26:00.000-05:00

Po Folks

2009-05-20T20:40:00.001-05:00

Wife reminds me it is bed time.

Night all

Gotta be Sombody

2009-05-20T20:27:00.001-05:00

No I haven't been hijacked

2009-05-20T19:54:00.000-05:00

Just a music night

I got you dancing

2009-05-20T19:53:00.000-05:00

Drown in the Now

2009-05-20T19:52:00.000-05:00

Hand of God

2009-04-06T19:27:00.003-05:00

No it isn't a Marvel Iron Man Reactor

2009-03-20T19:03:00.002-05:00

It is real.

http://www.sandia.gov/media/z290.htm

Ubuntu Rules

2008-09-24T19:48:00.003-05:00

1. No I haven't abandoned the blog.
2. Yes I am going to finish the FMEA stuff.
3. Ubuntu is quite nice.

Oh Snap

Mortgage - Doddgate = more homeless

2008-06-28T07:31:00.005-05:00

Look if we remove the risk and impact on mortgage companies of defaulted loans the result will be more defaults and therefore foreclosures. The result of congress bailing out the mortgage companies will be more foreclosures not less because they will have less incentive to negotiate with borrowers who are on the line.

This holds especially true in variable rate loans where the borrower is able to make initial payments but the increased payments are out of reach. In these cases neither the borrower or the lender should have made the agreement in the first place but if you remove the downside of the default from the vendor why would they ever entertain the idea of negotiating with someone who was making payments earlier.

This article misses the point in the end but I agree with the bailout point. Government involvement is exacerbating the problem and it isn't a solution.

This makes Doddgate even worse. Dodd's FOA status might lead directly to more people getting kicked out of their houses.

We need to make it clear to Congress and the Senate that they need to be very careful about how they walk when it comes to solutions that take away one side of the bargaining position. In this case our side.

FMEA Step 1

2008-06-18T08:53:00.005-05:00

Develop the Ratings table/index

The ratings table consists of 3 columns.

Severity Rating

Occurrence Rating

And Detectability Rating

You typically have a scale from 1 to 5, 7 or 10 depending on the level of granularity that is needed in your organization

Anyone who has done a real BIA would get the Severity section almost immediately.

In short the trick here is to tie each escalating level of severity to some specific series of business impacts.

Brand/Reputation - TJX, Hannaford ... what else needs be said
Direct Financial Loss - Fraud, Equipment Damage, Theft, Embezzlement, Lost Sales ...
Indirect Financial Loss - Cost of Data Recreation, Lost FTO time, Lost future sales, Project Delays
Legal Liability - often part of direct and indirect but also includes, Legal costs, Fines, Cost of increased regulatory oversight ...
Compliance - The costs associated with failed compliance

Many more ... when you develop the ranking table do it with the business leads and let them define their concerns

Occurrence, and Detection Continued later

I will stress this one more time this is not a risk assessment it is a risk priority ranking. The risk guru's will definitely get the distinction right away but if you don't get it and you are doing this you will eventually run into the all powerful cost justification argument. It is powerful when dealing with audit and those pesky internal budget decisions.

Because it focuses primarily on priority it is faster, easier and more agile. Think 10 meetings vice 100 with 20 people instead of 200. (obviously adjust those for company size)

FMEA

2008-06-17T07:37:00.004-05:00

Failure Mode Effects Analysis

I mentioned it a few weeks ago.

In a nutshell it is a relatively fast and dirty way of weighting and assessing relatively relative priority of risks. It is not a risk assessment and certainly not a ALE but if you combine it with a good series of BIA's linked empirically to the Failure Effects that are assessed against it can close a lot of gaps with not much work. If I were a consultant looking for a quick way to add risk prioritization value to a client I would certainly look into it. If the ratings table is properly developed it also significantly reduces the controversy of the rankings quite a bit.

More later

Musical Religious Jux

2008-06-11T20:16:00.006-05:00

I might be a bit schizo

Though if you listen one is the promise the other the fear.

another one that has no video is here http://music.yahoo.com/track/16308352

Sometimes a soul is perfect before birth and God decides it is time

2008-05-15T11:34:00.002-05:00

Nathan Green Cupps
Born May 14 2008
Died May 14 2008

Tough Week

Two words FMEA and FTA

2008-04-16T10:14:00.000-05:00

Well acronyms really

SCADA Topic - Source

2008-03-03T09:55:00.003-05:00

Looks like an interesting conference.

http://www.sourceboston.com/

Write to me if you are interested in going.

An for all of you other bloggers that I haven't been engaging with as well as I should please forgive me and link to either this post or the conference for me.

Evolution

2008-02-18T11:48:00.002-05:00

In the next few generations our peripheral vision is going to improve several fold.

Call it the blackberry selection factor.

Year of SoD

2008-02-14T08:40:00.001-05:00

From a security perspective

If '00 and '01 were years of the worm;

'02 through '04 the years of SoX, Compliance, and executive oversight

'05 through '07 the years of organized crime and Identity theft

Then

In the Security Realm these will be the years of Segregation of Duty.

Why?

7 Billion Dollars
Wall Street Journal
http://online.wsj.com/article/SB120168827173528415.html?mod=googlenews_wsj
CNN
http://www.cnn.com/2008/WORLD/europe/01/30/french.bank.ap/
Reuters
http://www.reuters.com/article/businessNews/idUSWEB304120080124
Bloomberg
http://www.bloomberg.com/apps/news?pid=20601085&sid=aSy8ZDtkdcow&refer=europe

On the Sub-Prime Side
Guardian
http://www.guardian.co.uk/business/2008/jan/30/subprimecrisis.creditcrunch?gusrc=rss&feed=networkfront
Financial News
http://www.financialnews-us.com/?page=ushome&contentid=2449684760

Information Security has a unique role that it can play in protecting a company from these issues. That role is due to the convergence of information. The information security team is the only location that all of the data exists that can be used to properly control for these types of complex issues.

Addressing them requires the proper combination of ID management, Roles Based Controls, and Analytic Business intelligence. (the latter is the primary reason I championed the Analytic Environment standards over a year ago).

This is an area that Info Security can not only serve as a minimum barrier to prevent downtime or confidentiality loss but can also add legitimate value to the business in the form of information, reports and preventative controls to enable increased trust to the actual people performing the real day to day work without the risk of a massive failure.

On the opposite end SoD control failures are massive and systemic. Not only do they result in dramatic items like the ones mentioned above but also ubiquitous often unintentional losses. From system down time to improperly placed orders or paid claims the incremental small losses exist in every organization.

The real question now is can we position ourselves so that we are ready as these waves break?

GLB

2008-02-11T11:13:00.000-05:00

Anyone want to chime in on what their take is on this quote from GLB?

"was, or is reasonably believed to have been, acquired by an unauthorized person"

What is reasonable?

Any case law people can link to?

How about other State Laws.

Oh yea a good table to have if you are a CISO, Director of Security or a Compliance lead. Not sure how up to date it is. But the current was November of '07.

Fatal Meme's

2008-01-29T08:31:00.001-05:00

“There is, a thought that stops thought. That is the only thought that ought to be stopped.” - Chesterton

Buckaroo Banzai

2008-01-24T14:18:00.001-05:00

They are comming to take me away

Ha ha

He he

ho ho

10 Reasons

Wicked Cool but can you Hack it?

2007-12-20T15:33:00.000-05:00

200KW self regulating Mini Reactor with 40 year lifespan

Update:

I want to know if it is a true fission reactor or just a decay based one.

More here don't think it is the same thing though this one looks more like an RTG.

and Here

And here Homeland Security angle

This one talks about the 4S mentioned above

Not a Huff Fan - But write for free anyway

2007-12-14T09:42:00.000-05:00

Found this via Instapundit (If you haven't noticed he is a daily read for me).

I am certainly not a Huff fan Pretty much the opposite (I am not a moron Huffington Pseudo Int zombie political hack) but it is hard to criticize the model. After all I write for Google via Blogger for pretty much free.

Almost all of us do.

Hell I don't even write for the hit count fix anymore.

"the market can stay irrational longer than you can stay solvent".

2007-12-12T09:58:00.001-05:00

Goes for dodging Security bullets as well.

TNR Beauchamp - NEI ?

2007-10-29T08:01:00.000-05:00

I have been following the Beauchamp TNR storry for a while and while it disgusts me I haven't had much to say that many others are not already saying more effectively.

This morning I read this post at that I found via instapundit.

I was quite surprised to see the NEI as one of their advertisers.

I have cross linked with the NEI blog a number of times and am a regular reader of TNR online. Believe me when I say that it is unlikely that ardent readers of TNR are unlikely to support NEI's goals of increasing the acceptance of nuclear power. It seems their advertising budget would be better spent in less hostile venues.

Do I have a fundamental misunderstanding of either of the organizations? Or could this be a case of the Yankee picking algorithm planted adds and equating them with direct advertisement? An understandable mistake but still possibly a mistake. If so we might want to be judicious in approaching the advertisers or laying blame.

Was this in the paper publication or did it only appear on their site?

In any case I agree with the general need to press TNR to stop presenting lies targeting the military.