Security: Risk and Reward

By Andreas M. Antonopoulos

When insiders attack: How recessions make good people do bad things

11/12/08

Whom can you trust? In security, many of us nurture a healthy sense of paranoia and tend to be distrustful. But as human beings, as social beings, we form bonds of trust with those around us.

How to sustain security on a tight budget

10/28/08

Whether you believe we are in or about to enter a recession, IT budgets are certainly tightening up for 2009.

The process and culture of security

10/15/08

I'm always amazed at the tenacity and inventiveness of my fellow Greeks. They actually manage to get things done in a system that makes it look impossible to achieve much at all.

Can you keep users from importing their own applications?

09/30/08

Shadow IT is all the IT that was neither planned nor approved by anyone but gets chosen, deployed and used by end users. Some see this as grass-roots deployment of cool technologies; some see it as weeds growing from any crack in the IT plan. If you don't build it, they will go find it elsewhere. And even if you build it, if it isn't adequate, comprehensive, flexible and easy to use, they will go find it elsewhere.

Privacy, security issues darken cloud computing plans

09/16/08

Enterprises are increasingly interested in cloud computing as a potential solution to capacity challenges. The idea is that if you have a virtualized data center, the cloud could potentially be an “overflow” data center where you expand capacity during periods of high demand. If the cloud can extend your data center, then you don’t need to build another one or increase the capacity of the one you have just to handle intermitted spikes in computing demand.

The challenge of securing virtualization operations

09/02/08

I have been very interested in virtualization security since early 2004 and it now seems like it has become a mainstream topic. Most of the focus however is on securing the technology of virtualization (the hypervisor) and providing virtualized security (usually as virtual appliances). My focus nowadays is more on the operational impact of virtualized infrastructure and by extension the impact on security operations. After all, security controls (technology) are essential but without operational controls (people) they are not sufficient. So what is the operational impact of virtualization?

Georgia cyberwar overblown

08/19/08

Last week Russian tanks rolled into South Ossetia while Russian bombers were taking out critical communications infrastructure. But even before the first tank rolled across the disputed borders, another war was brewing in cyberspace.

What you don't know about security can hurt you

08/05/08

In reading an early release of an information-security survey conducted by the RSA Conference, two findings caught my attention.

No excuses -- encrypt all laptops

07/22/08

No more excuses: If you're not encrypting laptops, you are not applying due diligence.

Security tribulations breed guilt by association

07/08/08

The headline read “Google loses employee data.” It caught my attention as I thought of all the implications this has for all the other data Google stores. A headline like that hits a nerve, I take it personally, because like most of us I immediately think of my search history from the last 10 years.

Communal security?

06/24/08

I’ve visited quite a few countries in Asia over the last two years. In the various airports I passed through I often saw people wearing surgical masks. I also saw “fever checkpoints” in most major airports. These checkpoints have infrared cameras that show a thermal false color picture of passengers as they are funneled through immigration. The signs surrounding the checkpoints indicated that the purpose was to identify people with a fever so as to screen for various types of flu (avian or other). This is classic perimeter control, network access control even, applied in the real world.

A question of trust and identity

06/10/08

What is the right balance between security and privacy? This is a common starting point in many policy discussions, especially in government. It’s a trick question because it presets the conversation as a balancing act between two values as if they are antithetical – they are not. In practical terms, privacy is security.

Less is more (secure)

05/27/08

Complexity is the enemy of security. Simple systems are inherently more secure than complex solutions.

Which IT security skills are most important?

05/13/08

I often hear from IT executives that it is hard to recruit and retain 'good security people.' Many lament the shortage of skills in this area and cannot reconcile the skills offered with the positions that need to be filled. Is there really a shortage of good security people? Or just a mismatch in the skills and the jobs?

Security preparedness instead of threat prediction

04/29/08

In the last column I talked about the challenge of trying to predict attacks, and how that approach leads to "anti-X" security strategies that are rapidly made obsolete by each new wave of threats.

Attackers are thinking outside the box

04/16/08

Security expert Andreas Antonopoulos explores the challenge of figuring out what the next big security attack will look.

Security in a bubble

03/18/08

Sometimes small, incremental changes add up in a way that isn't noticed until a change in degree becomes a change in kind.

Virtualized security: the next frontier

03/11/08

Companies are adopting virtualization technologies at a faster and faster rate. They are virtualizing servers, desktops, storage, networks. But one aspect of infrastructure has been lagging – very few companies address the growing demand for virtualized security.

Privacy and the coming backlash

02/27/08

Network World security columnist Andreas Antonopoulos discusses the growth of identity theft and the need in the United States for stronger privacy protection.

Network threats develop 'antibiotic' resistance

02/12/08

The scientific field of biology has provided many useful metaphors, such as "virus" and "infection," for the study of malware. Many researchers have used biology and evolution science to create innovative defenses against malware, in many ways simulating the functions of biological immunity systems. I find that biological sciences and especially evolution provide some great insights into the behavior of malware, malware creators and malware defenses over longer periods of time. I also see a lot of parallels between the evolution of malware and the evolution of darknets (stealthy P2P networks).

When it comes to security, chaos may be your friend

01/29/08

Viruses and other malware are getting better at evading antimalware systems despite the sophisticated behavioral-analysis systems that are used to detect them. This week a rogue trader in France was able to hide a growing loss until it reached $7 billion and was impossible to hide. What do these two events have in common? Both exploit the predictability of defenses to evade detection.

Floating data offers unique security challenges

01/15/08

You've probably already read the news of a company planning to use container ships as floating data centers. The plan is similar to the modular shipping container data centers. Only instead of parking them in your back lot, you moor them to a nearby pier. The company, International Data Security, is planning to deploy the first such data-ship next to Pier 50 in San Francisco.

Security: What will be hot in 2008?

12/19/07

There are two ways to predict the future with 100% accuracy. You either have the power to shape the future to your predictions (the God method) or you make your predictions vague enough so that they fit most conceivable outcomes (the Nostradamus method). For those of us without omnipotence and with a desire to write something meaningful, that leaves the alternative: extrapolate from in-depth research, solid statistics and current trends and hope for minimum volatility (disruptive innovation or externalities) in the outcome.

Convenient credit = security threat

12/05/07

There were more than 20 major data compromises in the last three months that went almost completely unreported. Eventually we all become resigned to the fact of identity theft/loss. But I’m not giving up so easily.

Re-assessing risk (The crown jewels are almost worthless)

11/19/07

A popular expression in security circles is to equate critical company intellectual property with the crown jewels. The crown jewels are protected by many layers of security, but the truth is that they make very poor targets for theft because they are far too distinctive to fence. To sell such items, a thief would have to take great risks and heavy discounts. Yet, in most information security risk-assessment methodologies we measure the loss impact for the company and ignore the gain potential for the thief.

More