<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>The InfoSec Blog</title>
	
	<link>http://infosecblog.antonaylward.com</link>
	<description>System Integrity: Without Integrity you don't have Security</description>
	<pubDate>Mon, 30 Aug 2010 14:08:02 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6</generator>
	<language>en</language>
			<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" type="application/rss+xml" href="http://feeds.feedburner.com/SystemIntegrity" /><feedburner:info uri="systemintegrity" /><atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="hub" href="http://pubsubhubbub.appspot.com/" /><feedburner:browserFriendly></feedburner:browserFriendly><item>
		<title>IAM - Basics - Policy</title>
		<link>http://infosecblog.antonaylward.com/2010/07/14/iam-basics-policy/</link>
		<comments>http://infosecblog.antonaylward.com/2010/07/14/iam-basics-policy/#comments</comments>
		<pubDate>Wed, 14 Jul 2010 22:16:43 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Policy]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Access control]]></category>

		<category><![CDATA[Policies and procedures]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Standard operating procedure]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=621</guid>
		<description><![CDATA[If there&#8217;s one thing that upsets me when I see articles and posting to forums about policy, its mention of a &#8220;Password Policy&#8221;.  I have to step away from the keyboard, go outside and take some deep breaths to calm down.
I get upset because policy is important and developing &#8212; and more importantly communicating [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/07/14/iam-basics-policy/feed/</wfw:commentRss>
		</item>
		<item>
		<title>You don’t need a Firewall Security Policy</title>
		<link>http://infosecblog.antonaylward.com/2010/06/29/you-dont-need-a-firewall-security-policy/</link>
		<comments>http://infosecblog.antonaylward.com/2010/06/29/you-dont-need-a-firewall-security-policy/#comments</comments>
		<pubDate>Tue, 29 Jun 2010 12:34:37 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Policy]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Standards]]></category>

		<category><![CDATA[Access control]]></category>

		<category><![CDATA[Firewall]]></category>

		<category><![CDATA[Network address translation]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=615</guid>
		<description><![CDATA[A member of a discussion list I subscribe asked for a Firewall Policy template.
A usual, I was alarmed enough by this to want to comment and drag it back to the discussion on &#8220;assets&#8221;.
I don&#8217;t think you should have a &#8220;Firewall Security policy&#8221;.
This is why.
A great book on firewalls once described the firewall as
The network&#8217;s [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/06/29/you-dont-need-a-firewall-security-policy/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Google Phasing out Windows</title>
		<link>http://infosecblog.antonaylward.com/2010/06/04/google-phasing-out-windows/</link>
		<comments>http://infosecblog.antonaylward.com/2010/06/04/google-phasing-out-windows/#comments</comments>
		<pubDate>Fri, 04 Jun 2010 12:03:32 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Linux]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Standards]]></category>

		<category><![CDATA[Android]]></category>

		<category><![CDATA[Financial Times]]></category>

		<category><![CDATA[Google]]></category>

		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=587</guid>
		<description><![CDATA[http://www.h-online.com/security/news/item/Report-Google-phasing-out-internal-use-of-Microsoft-Windows-1012679.html
&#8220;According to a report  in the Financial Times, Google are phasing
out the use of Microsoft&#8217;s Windows within the company because of
security concerns. Citing several Google employees, the FT report
reports that new hires are offered the option of using Apple Mac
systems or PCs running Linux. The move is believed to be related to a
directive issued [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/06/04/google-phasing-out-windows/feed/</wfw:commentRss>
		</item>
		<item>
		<title>“Impact” is not a Metric</title>
		<link>http://infosecblog.antonaylward.com/2010/05/28/impact-is-not-a-metric/</link>
		<comments>http://infosecblog.antonaylward.com/2010/05/28/impact-is-not-a-metric/#comments</comments>
		<pubDate>Fri, 28 May 2010 15:43:00 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA["the unthinkable"]]></category>

		<category><![CDATA[controls]]></category>

		<category><![CDATA[death]]></category>

		<category><![CDATA[Mortality rate]]></category>

		<category><![CDATA[Risk analysis]]></category>

		<category><![CDATA[Risk Management]]></category>

		<category><![CDATA[statistics]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=526</guid>
		<description><![CDATA[I never like to see the term &#8216;impact&#8217;.
Its not a metric.
I discuss how length, temperature, weight, are metrics whereas speed, acceleration, entropy are derived values.  In the same sense, &#8216;impact&#8217; is a derived value - &#8220;the cost of the harm to an asset&#8221;.  The value of an asset can be treated as a [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/05/28/impact-is-not-a-metric/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Risk Analysis Makes No Sense … does it?</title>
		<link>http://infosecblog.antonaylward.com/2010/05/22/risk-analysis-makes-no-sense-does-it/</link>
		<comments>http://infosecblog.antonaylward.com/2010/05/22/risk-analysis-makes-no-sense-does-it/#comments</comments>
		<pubDate>Sat, 22 May 2010 13:04:01 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=523</guid>
		<description><![CDATA[



Image via Wikipedia



Take a look at this article.
 http://www.zdnet.com/blog/security/security-engineering-broken-promises/6503
You&#8217;re back?  What did you think of it?
OK, now look again, scroll down the section titled &#8220;Risk Management&#8220;
It picks up on a number of themes I&#8217;ve discussed and has this interesting observation:
Prioritization of security efforts is a prudent step, naturally. The
problem is that when risk management is [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/05/22/risk-analysis-makes-no-sense-does-it/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Risk is Not a Primary Metric</title>
		<link>http://infosecblog.antonaylward.com/2010/05/19/risk-is-not-a-primary-metric/</link>
		<comments>http://infosecblog.antonaylward.com/2010/05/19/risk-is-not-a-primary-metric/#comments</comments>
		<pubDate>Wed, 19 May 2010 13:40:52 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=522</guid>
		<description><![CDATA[&#8220;Risk&#8221; is not a primary metric.
What do I mean by that?
Primary metrics you can measure easily.
In physics they are things like length, weight, temperature, time-duration.
Secondary metrics most people can understand: rate of change that we call speed (length as distance and elapsed time).
Some secondary and many tertiary we can understand intellectually, but they have to [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/05/19/risk-is-not-a-primary-metric/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The Classical Risk Equation</title>
		<link>http://infosecblog.antonaylward.com/2010/05/19/the-classical-risk-equation/</link>
		<comments>http://infosecblog.antonaylward.com/2010/05/19/the-classical-risk-equation/#comments</comments>
		<pubDate>Wed, 19 May 2010 12:23:33 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[How-to]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Standards]]></category>

		<category><![CDATA[Business]]></category>

		<category><![CDATA[Internal audit]]></category>

		<category><![CDATA[Risk analysis]]></category>

		<category><![CDATA[Risk Management]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=521</guid>
		<description><![CDATA[What we had drilled into us when I worked in Internal Audit and when I
was preparing for the CISA exam was the following

RISK is the
&#160;&#160;&#160;&#160;PROBABILITY that a
&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;THREAT will exploit a
&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VULNERABILITY to cause harm to an
&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ASSET
R = f(T, V, A)
Why do you think they are called &#8220;TVAs&#8220;?
More sensibly the risk is the sum over all the [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/05/19/the-classical-risk-equation/feed/</wfw:commentRss>
		</item>
		<item>
		<title>A Security Policy needs to be abstract not specific</title>
		<link>http://infosecblog.antonaylward.com/2010/03/26/re-iso-27001-security-information-security-policy-document/</link>
		<comments>http://infosecblog.antonaylward.com/2010/03/26/re-iso-27001-security-information-security-policy-document/#comments</comments>
		<pubDate>Fri, 26 Mar 2010 14:38:25 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Policy]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Standards]]></category>

		<category><![CDATA[Access control]]></category>

		<category><![CDATA[Authentication]]></category>

		<category><![CDATA[Information security]]></category>

		<category><![CDATA[Remote access]]></category>

		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=494</guid>
		<description><![CDATA[



Image via Wikipedia



There&#8217;s much I don&#8217;t like about many of the published security policies an the ones I see in use at many sites I visit and audit.   But lets pick on ones that deal with passwords.
Firstly, the concept of passwords are limiting.
Are you going to add a &#8220;pass-card policy&#8221; and a &#8220;iris scan [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/03/26/re-iso-27001-security-information-security-policy-document/feed/</wfw:commentRss>
		</item>
		<item>
		<title>More on how to win friends and influence management</title>
		<link>http://infosecblog.antonaylward.com/2010/03/22/more-on-how-to-win-friends-and-influence-management/</link>
		<comments>http://infosecblog.antonaylward.com/2010/03/22/more-on-how-to-win-friends-and-influence-management/#comments</comments>
		<pubDate>Mon, 22 Mar 2010 15:04:14 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Chicxulub crater]]></category>

		<category><![CDATA[COBIT]]></category>

		<category><![CDATA[Project management]]></category>

		<category><![CDATA[psychology of risk]]></category>

		<category><![CDATA[Risk analysis]]></category>

		<category><![CDATA[Risk Management]]></category>

		<category><![CDATA[Warfare and Conflict]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=493</guid>
		<description><![CDATA[Take a look at
Forget ROI and Risk. Consider Competitive Advantage
by Richard Bejtlich
I note the line that so many of us in the InfoSec business have encountered and complained about &#8230;
As we&#8217;ve seen during the last few years, &#8220;risk&#8221; has turned out to be a dead end too. The numbers mean nothing. Even if you could [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/03/22/more-on-how-to-win-friends-and-influence-management/feed/</wfw:commentRss>
		</item>
		<item>
		<title>On the one hand …</title>
		<link>http://infosecblog.antonaylward.com/2010/03/13/on-the-one-hand/</link>
		<comments>http://infosecblog.antonaylward.com/2010/03/13/on-the-one-hand/#comments</comments>
		<pubDate>Sat, 13 Mar 2010 21:58:52 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Law]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Privay]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Child pornography]]></category>

		<category><![CDATA[Golden Shield Project]]></category>

		<category><![CDATA[John Stuart Mill]]></category>

		<category><![CDATA[Politics of Sexuality]]></category>

		<category><![CDATA[Pornography]]></category>

		<category><![CDATA[Sexual abuse]]></category>

		<category><![CDATA[Sexuality]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=492</guid>
		<description><![CDATA[On the one hand there this:
http://www.theregister.co.uk/2008/06/10/new_york_isp_crackdown/
and on the other, when it comes down to practice, there&#8217;s this
http://www.theregister.co.uk/2008/02/20/australian_adult_content_filter_failure/
Now please don&#8217;t think I support p0rn.
But surely &#8230;
One of the principles of good home economics is to pay down your most expensive (usually credit card) debts first.  Surely there&#8217;s an analogue here about applying censorial leverage where [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/03/13/on-the-one-hand/feed/</wfw:commentRss>
		</item>
		<item>
		<title>White House Cyber Czar: ‘There Is No Cyberwar’</title>
		<link>http://infosecblog.antonaylward.com/2010/03/05/white-house-cyber-czar-there-is-no-cyberwar/</link>
		<comments>http://infosecblog.antonaylward.com/2010/03/05/white-house-cyber-czar-there-is-no-cyberwar/#comments</comments>
		<pubDate>Fri, 05 Mar 2010 12:29:59 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Crime]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Howard Schmidt]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=491</guid>
		<description><![CDATA[Thank you Howard!  This has long needed to be said by someone in authority!

Yes, crime and espionage will cripple us all economically.
We won&#8217;t see enemy troops occupying our land.
(We might see the same result from &#8216;enhanced homeland security&#8217;: troops and law enforcement on every corner checking papers, breaking down your front door at 3am [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/03/05/white-house-cyber-czar-there-is-no-cyberwar/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The FBI risk equation</title>
		<link>http://infosecblog.antonaylward.com/2010/02/28/fbi-risk-equation/</link>
		<comments>http://infosecblog.antonaylward.com/2010/02/28/fbi-risk-equation/#comments</comments>
		<pubDate>Mon, 01 Mar 2010 01:35:40 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Crime]]></category>

		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Humour]]></category>

		<category><![CDATA[Law]]></category>

		<category><![CDATA[Politics &amp; Economics]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Standards]]></category>

		<category><![CDATA[Business]]></category>

		<category><![CDATA[FBI]]></category>

		<category><![CDATA[Federal Bureau of Investigation]]></category>

		<category><![CDATA[Government]]></category>

		<category><![CDATA[infosec]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Vulnerability]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=490</guid>
		<description><![CDATA[It seems that to make better cybersecurity-related decisions a senior FBI official recommends considering a simple algebraic equation:
risk = threat x vulnerability x consequence
rather than solely focusing on threat vectors and actors.
To be honest, I sometimes wonder why people obsess about threat vectors in the first place.  There seems to be a beleive that the [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/02/28/fbi-risk-equation/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The checklist revolution works</title>
		<link>http://infosecblog.antonaylward.com/2010/02/05/the-checklist-revolution-works/</link>
		<comments>http://infosecblog.antonaylward.com/2010/02/05/the-checklist-revolution-works/#comments</comments>
		<pubDate>Fri, 05 Feb 2010 17:07:45 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[How-to]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Standards]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=489</guid>
		<description><![CDATA[http://www.smartplanet.com/technology/blog/rethinking-healthcare/the-checklist-revolution-works/838/
I can see the reasoning behind why doctors would object to check-lists, but it makes me wonder why so many corporate IT departments, sysadmins, programmers and so on resist &#8220;security check-lists&#8221;.
I always used check-lists as a programmers, sysadmin, and in most of my managerial roles where it was appropriate.  Yes I got laughed at [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/02/05/the-checklist-revolution-works/feed/</wfw:commentRss>
		</item>
		<item>
		<title>About Social Networking policy</title>
		<link>http://infosecblog.antonaylward.com/2010/01/25/about-social-networking-policy/</link>
		<comments>http://infosecblog.antonaylward.com/2010/01/25/about-social-networking-policy/#comments</comments>
		<pubDate>Mon, 25 Jan 2010 16:23:37 +0000</pubDate>
		<dc:creator>antonaylward</dc:creator>
		
		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Policy]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[best practices]]></category>

		<category><![CDATA[context is everything]]></category>

		<category><![CDATA[EBay]]></category>

		<category><![CDATA[Facebook]]></category>

		<category><![CDATA[Internet access]]></category>

		<category><![CDATA[MySpace]]></category>

		<category><![CDATA[Online Communities]]></category>

		<category><![CDATA[Social network]]></category>

		<category><![CDATA[Twitter]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=469</guid>
		<description><![CDATA[




Policy development is one of my areas of practice, so when a colleague on a mailing list asked about how to phrase policy to deal with the social networks (Facebook, Twitter, Myspace, etc.) and what the &#8220;best practices&#8221; are, I came out of my shell to reply.
(We&#8217;ll skip over the oxymoron &#8220;best practices&#8221; since &#8220;Context [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/01/25/about-social-networking-policy/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Text vs HTML: what is more secure?</title>
		<link>http://infosecblog.antonaylward.com/2010/01/25/text-vs-html-whats-more-secure/</link>
		<comments>http://infosecblog.antonaylward.com/2010/01/25/text-vs-html-whats-more-secure/#comments</comments>
		<pubDate>Mon, 25 Jan 2010 13:59:55 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[context is everything]]></category>

		<category><![CDATA[E-mail filtering]]></category>

		<category><![CDATA[Firefox]]></category>

		<category><![CDATA[HTML]]></category>

		<category><![CDATA[HTML e-mail]]></category>

		<category><![CDATA[Linux]]></category>

		<category><![CDATA[plan text]]></category>

		<category><![CDATA[sanitizers]]></category>

		<category><![CDATA[social engineering]]></category>

		<category><![CDATA[spam filters]]></category>

		<category><![CDATA[Thunderbird]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=468</guid>
		<description><![CDATA[There are &#8220;good&#8221; mailing lists and &#8220;not so good&#8221; mailing lists from the point of view of security.
Try posting HTML mail to a &#8220;good&#8221; and one of two things will happen.

If you have a mailer that includes the plain text then the list
software will discard that, forward the plain text to the list
with a message [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/01/25/text-vs-html-whats-more-secure/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Arrogant?  Who? Us?</title>
		<link>http://infosecblog.antonaylward.com/2010/01/15/arrogant-who-us/</link>
		<comments>http://infosecblog.antonaylward.com/2010/01/15/arrogant-who-us/#comments</comments>
		<pubDate>Fri, 15 Jan 2010 13:12:01 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[11th Domain]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Cascading Style Sheets]]></category>

		<category><![CDATA[Communication]]></category>

		<category><![CDATA[Marketing]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=438</guid>
		<description><![CDATA[http://blogs.csoonline.com/problem_3_for_security_professionals_not_enough_humble_pie?source=CSONLE_nlt_update_2010-01-12
Talk about difficult to read!   I hate sites like this, only slightly more than ones that use a completely black background.




Image via Wikipedia



A large part of my &#8220;11th Domain&#8221; bleating is about communication - thinking in terms of the other person, their needs and views and how the &#8216;message&#8217; you&#8217;re sending will be received [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/01/15/arrogant-who-us/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The Need to Understand Culture</title>
		<link>http://infosecblog.antonaylward.com/2010/01/06/need-to-understand-culture/</link>
		<comments>http://infosecblog.antonaylward.com/2010/01/06/need-to-understand-culture/#comments</comments>
		<pubDate>Wed, 06 Jan 2010 17:13:54 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[11th Domain]]></category>

		<category><![CDATA[How-to]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[How to Win Friends &amp; Influence People]]></category>

		<category><![CDATA[Public Speaking]]></category>

		<category><![CDATA[Win Friends &amp; Influence People]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=404</guid>
		<description><![CDATA[Some references for &#8220;The 11th Domain&#8221;
I&#8217;m going to respond to this as broadly as possible.
This is not a subject like &#8220;access control&#8221; that is hard and bound.
First, there&#8217;s Human Communication.
Probably the best source for this is to take the Dale Carnegie course on
Public Speaking.  No, really.  I&#8217;m quite serious.
There are a number of [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2010/01/06/need-to-understand-culture/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Throwing in the towel</title>
		<link>http://infosecblog.antonaylward.com/2009/12/27/re-cisspforum-throwing-in-the-towel/</link>
		<comments>http://infosecblog.antonaylward.com/2009/12/27/re-cisspforum-throwing-in-the-towel/#comments</comments>
		<pubDate>Sun, 27 Dec 2009 19:18:18 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[11th Domain]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Business]]></category>

		<category><![CDATA[Certified Information Systems Security Professional]]></category>

		<category><![CDATA[CISA]]></category>

		<category><![CDATA[CISSP]]></category>

		<category><![CDATA[Consultants]]></category>

		<category><![CDATA[Donn Parker]]></category>

		<category><![CDATA[Information security]]></category>

		<category><![CDATA[ISO/IEC 27001]]></category>

		<category><![CDATA[Security]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=403</guid>
		<description><![CDATA[I was saddened to hear of an InfoSec colleague who met with overwhelming frustration at work:
After two years of dealing with such nonsense, I was forced to resign
within two months of discovering a serious security issue which possibly
jeopardized overseas operations.  I have since found out that they are
selling the company and didn&#8217;t want any [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2009/12/27/re-cisspforum-throwing-in-the-towel/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The wedge gets thicker</title>
		<link>http://infosecblog.antonaylward.com/2009/12/01/the-wedge-gets-thicker/</link>
		<comments>http://infosecblog.antonaylward.com/2009/12/01/the-wedge-gets-thicker/#comments</comments>
		<pubDate>Tue, 01 Dec 2009 18:28:03 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Crime]]></category>

		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Law]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Business and Economy]]></category>

		<category><![CDATA[Copyright]]></category>

		<category><![CDATA[Digital Economy Bill]]></category>

		<category><![CDATA[Internet service provider]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=394</guid>
		<description><![CDATA[http://news.cnet.com/8301-1009_3-10405824-83.html
http://news.zdnet.co.uk/communications/0,1000000085,39909136,00.htm
http://community.zdnet.co.uk/blog/0,1000000567,10014530o-2000331761b,00.htm
The thin edge of the wedge was when pubs were fined or letting patrons get drunk, drunk enough that they shouldn&#8217;t drive.
Now that wedge is being driven further.

Like so many laws it seemed reasonable.
Gone are the days before personal automotive transport when a drunk patron would have to walk home, possibly stumbling into a ditch [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2009/12/01/the-wedge-gets-thicker/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Why don’t companies apply more risk analysis - Part 2</title>
		<link>http://infosecblog.antonaylward.com/2009/11/25/why-dont-companies-apply-more-risk-analysis-to/</link>
		<comments>http://infosecblog.antonaylward.com/2009/11/25/why-dont-companies-apply-more-risk-analysis-to/#comments</comments>
		<pubDate>Wed, 25 Nov 2009 19:18:11 +0000</pubDate>
		<dc:creator>Anton Aylward</dc:creator>
		
		<category><![CDATA[Failures]]></category>

		<category><![CDATA[Human Factors]]></category>

		<category><![CDATA[Rants and Raves]]></category>

		<category><![CDATA[Risk]]></category>

		<category><![CDATA[Security]]></category>

		<category><![CDATA[Social]]></category>

		<category><![CDATA[Business and Economy]]></category>

		<category><![CDATA[Greater Toronto]]></category>

		<category><![CDATA[Intellectual property]]></category>

		<category><![CDATA[Ontario]]></category>

		<category><![CDATA[Technology]]></category>

		<category><![CDATA[Toronto]]></category>

		<guid isPermaLink="false">http://infosecblog.antonaylward.com/?p=392</guid>
		<description><![CDATA[And while on that subject &#8230;
&#8220;Consult Human Resources when making disaster recovery plans&#8221;
Every DR plan I&#8217;ve seen has failed to take into account human factors.
The most basic of which is that if there is any one of a large number of disaster scenarios, how are staff going to get in to the DR site?




Image via [...]]]></description>
		<wfw:commentRss>http://infosecblog.antonaylward.com/2009/11/25/why-dont-companies-apply-more-risk-analysis-to/feed/</wfw:commentRss>
		</item>
	</channel>
</rss>
