TaoSecurity Blog

I just finished listening to a Webcast offered by Tripwire titled Security Compliance: Revving Up for Regs with a Unified Strategy . To be honest, I don't think the presenters used their time appropriately, and I think the material was not conveyed very well. I listened, however, because I have learned of a book by Tripwire co-founder Gene Kim called Visible Ops . Visible Ops is a four-step methodology to implement the IT Infrastructure Library (ITIL). Tripwire describes ITIL as a framework "for assuring effective, verifiable, repeatable IT change and system configuration management processes." The Visible Ops four step process is: Electrify the fence and modify first response. Catch & release and find fragile artifacts. Establish repeatable builds. Establish a repeatable build library. This Computerworld rticle from last year provides a good explanation and introduction to these ideas. The Visible Ops authors donated the results of their research to the Info...

Whenever I fly I use the time to read ;login: magazine from USENIX . Chad Verbowksi 's article The Secret Lives of Computers Exposed: Flight Data Recorder for Windows in the April 2007 issue was fascinating. (Nonmembers can't access it until next year -- sorry.) Chad describes FDR: Flight Data Recorder (FDR) collects events with virtually no system impact, achieves 350:1 compression (0.7 bytes per event), and analyzes a machine day of events in 3 seconds (10 million events per second) without a database. How is this possible, you ask? It turns out that computers tend to do highly repetitive tasks, which means that our event logs (along with nearly all other logs from Web servers, mail servers, and application traces) consist of highly repetitive activities. This is a comforting fact, because if they were truly doing 28 million distinct things every day it would be impossible for us to manage them. Ok, that's cool by itself. However, the insights gained from these lo...

I realized I never published my notes from the July ISSA-NoVA meeting. This was another managerial-type talk, by James Golden, Manager of IT Governance at the USPS . The USPS is huge -- 153,000 desktops, 22,000 servers, 18,000 laptops, 7,000 offices, 175,000 internal email users, and 2,000 external users. Their Web site gets over one million visitors per day. Mr. Golden said security is like Y2K -- "If everything fails, critics say you spent too little money. If everything works, critics say you spent too much money." He defined "IT governance" as "doing the right things right." I had never heard of IT governance, let alone the IT Governance Institute . He said the USPS is not covered by FISMA -- "Thank goodness!" -- and that SOX is "the biggest waste of money we spend in IT." By now you could imagine me liking Mr. Golden's style. Since this was an ISSA meeting, Mr. Golden did discuss aligning COBIT , ITIL , and ISO 17799...

Courtesy of SANS NewsBites (link will work shortly) I learned of a router or switch crash that shut down the San Francisco Bay Area Rapid Transit District (BART). According to the article: BART officials promised Thursday to thoroughly investigate why technicians risked working on computers that control trains while the transit system was running, work that crashed BART's main computer, stalled 50 to 60 trains, and stranded 35,000 passengers for more than an hour at the peak of the Wednesday evening commute. "The bottom line is we shouldn't have worked on it (during service hours)," BART spokesman Linton Johnson said. No kidding. They're lucky the trains stopped running rather than keep running -- into each other. "The network switch was not supposed to get overloaded,'' Johnson said. "It is not supposed to crash. But we shouldn't have been working on (the computer system) while trains were running." Johnson described the technicians...

Yes, you are reading that title correctly. After about ten weeks of no reading and reviewing, I have finally finished and reviewed a new book. It's The Visible Ops Handbook , and I gave it four stars. Amazon.com just posted my review : "I read The Visible Ops Handbook because a friend told me his company was considering integrating the booklet's ideas into their product line. I had not heard much about the Information Technology Infrastructure Library (ITIL), but I was familiar with the problems caused by poor administration. I perform network incident response (IR), so I am often asked to solve problems in three days that clients have been confronting for three months or years. After reading Visible Ops, I will recommend it to every IR client who asks me to remediate intrusions."