Security

Ask something
Discussion Locked

Computer Security Education

0 helpful
37 replies

by al macintyre

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Learning how to do a competent job with Computer Security requires continuing education because as technology evolves and our enterprises acquire applications we were previously inexperienced with, the risks also change.

I have amassed many URLs to an abundance of resources to help in this challenge, but I do not like posts by other people that give URLs without much of an explanation of their function, so what I seek by this discussion thread is mini-reviews of the pros & cons of one site over another ? here?s a good place for X ? here?s a better place, and I am hoping that once I have posted some examples, other enthusiasts will add to my collection.

Initially, I plan to structure my posts like the Disaster Avoidance Discussion http://www.TechRepublic.com/forumdiscuss/thread_detail.jhtml?thread_id=17159 although the questions that inspired me to start this discussion were most recently passed to me via the Discussion on Computer Protection Adequacy, whose URL I do not have handy right now ? I plan to do a section later on relevant cross-posts where other TR resources are relevant to this discussion.

37 replies

by al macintyre

This is my name for resources that should be known to anyone who claims to be a Security Professional. What does not fit on this list & what?s missing?

CERT http://www.cert.org
DOJ http://www.usdoj.gov/criminal/cybercrime/index.html = US Gov Department of Justice Cyber Crime Site
EPIC http://www.epic.org = Electronic Privacy Information Center
ETA? http://www.law.upenn.edu/bll/ulc/ulc_frame.htm Electronic Transaction Legalities adopted by a majority of USA states.
E-sign rules http://www.cybersign.com/news_news.htm#top = Summary of US Gov Federal Electronic Signatures in Global & National Commerce Act
FBI http://www.ifccfbi.gov = US Gov Computer Fraud Complaint Site
FEMA
FTC http://www.ftc.gov/ = US Gov Federal Trade Commission home page
GSA http://www.itpolicy.gsa.gov/ = US Gov IT issues on-ramp
INTERPOL
ITAA http://www.itaa.org

I do not have all the web sites of these places. ? nail down the URLs, understand their function or role. Which is the first place we should go for help for what kind of scenario?

I plan to do individual posts answering these type rhetorical questions, and going into some more detail on the sites cited above, and more in this general category of what I think we who claim to be Security Professionals really ought to be cognizant of.

by al macintyre

Contrary to widespread computer press reporting that no computer can be truly secure, there is such an animal as a computer system that has met high standards of security set by the US Gov Dod, although some action is needed by the buyer of a systemto adhere to those standards. Take a look at

http://www.radium.ncsc.mil/tpep/epl/epl-by-vendor.html

This is a directory, by vendor, of computer systems that have been evaluated by the Trusted Product Evaluation Program (TPEP) & passed certainstandards within the past 3 years rating maintenance cycle. The security criteria these systems met are listed in "Common Criteria for Information Technology Evaluation" (CCITSE) jointly developed by the USA, UK, Germany, France, Canada, and the Netherlands.

26 computer vendors are listed on this directory by vendor, with links at top of list to evaluations indexed by rating class or by product - a little over 60 passed the tests.

This includes such well known combinations as
DEC VAX
IBM AS/400
MS NT
Netware 4+

Many familiar brand names are also conspicuous by their absense.

According to the FAQ on evaluated products, many of the reports are available for downloading & a CD Rom copy of the collection is available from the National Security Agency ... address given in the FAQ.

You might like to go here & see if the computer infrastructure used by your enterprise is listed, then if it is, look at the detail evaluation to see what is needed to make your system truely secure, then engage in a discussion in your business as to whether or not this is something desired by the enterprise.

by al macintyre

One of the FAQ questions, at the Department of Defense site I cite at

http://www.radium.ncsc.mil/tpep/epl/epl-by-vendor.html

is about "hacker proof" systems.

Basically there are certain well understood threats & some systems have effective assured counter measures, so that the product is vulnerable to less risk than one with no such assurances & the rating system reflects the degree to which a system is protected.

The FAQ goes on to discuss general types of threats such as the "social engineering" of many hackers trying to con personnel into believing that they are authorized users, in which naive users need education to evade insider-related threats.

by al macintyre

The Internet Fraud Complaint Center (IFCC) is a partnership between the Federal Bureau of Investigation (FBI) and the National White Collar Crime Center (NW3C). Complaints posted here are referred to whichever law enforcement or regulartory agency has jurisdiction over our complaint ? we do not have to be figuring out whether the right place to contact is the Better Business Bureau, SEC, our local police, Interpol, or some place in between.

http://www.ifccfbi.gov

This team effort offers massive services to individual crime fighting agencies. Just like we can subscribe to a discussion on TR & learn of a hit by someone else where we are interested, the cyber cops can subscribe to notification of any new hits related to folks under investigation.

by al macintyre

The National Infrastructure Protection Center (NIPC) serves as a national critical infrastructure threat assessment, warning,
vulnerability, and law enforcement investigation and response entity. The NIPC provides timely warnings of international
threats, comprehensive analysis and law enforcement investigation and response.

http://www.nipc.gov/

by al macintyre

http://www.icsa.net/html/labs/ certifies firewalls, has a list of those
certified, and a buyer's guide with security tips & advice for selecting
firewalls. Their lab has approx 40 different firewalls continuously setup,
against which they test the latest security alert risks as they are
discovered. Their web site lists the approx 40 products that they have
certified, by vendor & by product - you can click on details of their
Firewall Lab Reports for whichever product you interested in & you can download for free a buyer's guide to firewalls.

They also publish Information Security Magazine, have TrueSecure software &
services, run NTBugtraq, and are involved in a bunch of computer security
consortiums described on theirweb site.

by al macintyre

CERT is a center of Internet Security Expertise located at the Software Engineering Institute, a US government funded research and development center operated by Carnegie Mellon University. They provide incident response services to sites that havebeen victims of attack, publish a variety of security alerts, do research & education to help companies improve their computer security.

Their home page has a section with the latest security advisories, there is also a section with most current activity risks, and each quarter they issue a summary to draw attention to recent frequency of different types.

Past summaries are available from www.cert.org/summaries/

by al macintyre

These are the general computer support places for beginners to the challenges of computer security issues, be they small business or consumers. Here are some xamples of what I am referring to & I plan to so individual posts reviewing these type places & I invite other folks to add to this collection.

http://www.askme.com = TR style Q+A for non-technical topics.

http://ciac.llnl.gov/ciac/CIACChainLetters.html = explanations of the most prevalent Chain Letters circulating the internet

http://www.cybercrime.com/ = Click on Message Boards ? this is a wide ranging discussion hosted by ZD Net, many of whose participants are below the tech level we often expect to see on TR.

http://www.smartcomputing.com = One of the better publications for computing beginners I think. They may not include all products in their reviews, but they explain concepts for people new to anything.

http://www.urbanlegends.com - stuff that far too many people are taken in by.

by al macintyre

An International Treaty on Cyber Crime seems close to signing by Euripean Union, USA, Canada, Japan, and other nations. It is needed because of the high volume of activities via the internet that are illegal in one nation but legal in another, so the relevant laws need to be harmonized so nations can do a better job fighting pornography, hacking, fraud, identify theft, viruses & other problems.

Information on this treaty can be found at

http://www.usatoday.com/life/cyber/zd/zd7.htmand

www.SecurityFocus.com

The latter site also has news of other events of security interest.

Opposition to the treaty may get the phraseology adjusted to satisfy various concerns.

Initial phraseology seems to ban some tools that now areessential to security experts verifying adequacy of security, because they are popular in the hands of intruders, rather than defining hacking into a site without permission of the site as being the banned activity.

There is concern that languagetelling ISPs to copy traffic, so that law enforcement can study what is now considered by some people to be private communications to help resolve issues of pornography, spam, Denial of Service attacks, viruses & so forth, means that ISPs will have to buy more hard disk to satisfy this new legal requirement.

In some cases the treaty will mean that stuff that is illegal in our country will now also be illegal in others, while in some cases it will mean that stuff that was legal here, will nowbe illegal. Likewise the powers of the police will change. Some people are concerned that this will adversely impact traditional constitutional checks & balances. This concern is shared by people in the USA & Britain.

by al macintyre

Thanks to a link in the Gadwall Group Cynical CIO newsletter http://www.gadwall.com/publishing/subjectindices.html
I found out about a great article on CNET about the state-of-art of Malicious e-Mail
http://enterprise.cnet.com/enterprise/0-9567-7-3780311.html

This is an excellent overview of problems associated
with viruses and email. It opens with some
statistics and a general discussion, then
focuses on viruses transmitted via .exe and .vbs
attachments, HTML email messages, and rogue HTML links.

by al macintyre

Key lessons from the article are:
Keep your overall backups up-to-date, so if you get hit, you have a recent backup;
Keep your anti-virus protection up-to-date & if your company has some network, use enterprise software to identify the weak link ?the co-worker who is not keeping anit-virus up-to-date on their PC, because if they get hit, that can infect every other connected PC, bypassing the e-mail system;
There is no such thing as a trusted friend when that person can get infected & unknowingly forward this garbage to you;
There is no such thing as an e-mail system that is free of this stuff ? if you run away from Outlook to some other system you may reduce your risk but not eliminate it;
ATTACHMENTS to e-mail are a common risk butnot the only e-mail way to get infected ?Opening an e-mail that has HTML can launch a cookie that uses OS Script & you are done for, so if possible you should block e-mail that has HTML until your anti-virus can have a go at it.

Much of the discussion centers around the problems with
Outlook and its tight integration with other Microsoft and
third-party products. In the final section, the author offers 10
tips for avoiding problems and discusses anti-virus
solutions and other services.

After digesting this wonderful article, go up a level from Security / Malicious E-Mail to other Security articles & Links at this C-Net site for other very useful data.

by al macintyre

Security Measures for a particular operating system may be inappropriate to others ... think

Stand alone single user PC vs. some kind of network.

Windows
Linux
Unix
OS/400

by al macintyre

Many people buy or download anti-virus & have trouble with the documentation, can?t get it to work right, don?t de-install first effort, try to install some other brand name, don?t understand mess of multiple AV in conflict. Others get a new PC with some AV pre-installed & don?t realize that getting latest VDs is a continuing requirement. I have some e-correspondents who have a hard time articulating what AV they have & what kinds of settings it is running with, so I steer them to web sites that test their PC for whatever condition it is in & tell them if anything is wrong with that condition.

http://grc.com/default.htm Shields Up then Test - do both
tests, then check FAQ at that site for the risks that your PC was tested for
http://security2.norton.com/sa/1033/sym/sym_intro.asp?j=3D1&bhcd2=3D95794931=9
this test is more comprehensive than Shields Up, but the
FAQ is more difficult to navigate - if you are able to do
so, note that you can sign up for a monthly e-newsletter
on what the current greatest virus threats are

Other sites with similar offerings - I have not visited
them individually so I cannot vouch for how good they are
http://www.hackerwhacker.com
http://www.secure-me.net
http://www.antionline.com
http://www.webtrends.net

I will talk about Cookies in a separate post later.

by qdid7of9

Al you must drink a lot of coffee? I read thru your thread and find that if seems to concentrate on what the government lists as their version of security. If one wants to follow truly what vulnerabilities exist at any given time one must follow some of the hacking/cracking news sites and even get scripts that are available as you say from the governments view should be illegal. These many scripts that can cause loss of data and downtime on any network are needed to be studied how they act and how they can be stopped. If you are really really interested in this you should persue the CCIE certification only 5000 in the world and get your hands on a lot of Cisco Equipment. Also learn scripting in Perl and learn IP and UDP etc really really really well. Access lists. Try www.cyberarmy.com might be a good place to start, I can only get their thru a proxy server first as perhaps my ISP doesn't want me to get there.
www.L0pht.com is a site worth visiting. An excellent group of true hackers that find flaws in every type of OS to exploit. Authors of L0phtcrack that checks for NT password security at the Server. They were bought up by a Security Company that perhaps makes them seem more legit. Read the fairly recent article in Eweek formerly PCweek a free publication of how their own site got hacked that was set up for this purpose.
They ask yearly to have it hacked. www.eweek.com book Maximum Security ? Haven't read it myself. Some like it others say its outta date. 2nd version out now.

by al macintyre

Virus Hacker Cracker Phreaker Embezzlement Klutz

Identity-Theft
Industrial-Espionage
Denial-of-Service

Different types of threats call for different types of preventative measures

by al macintyre

A fragile computer world is what we have, with all these problems occurring to what we think is modern technology, but the mass of users watt systems that will do good stuff without a lot of our time spent protecting ourselves from the artifacts of e-crimimals.

I believe the responsibility of someone who finds a vulnerability is:
1. Notify the vendor of the hardware or software that has the bug.
2. Document your notification & ask the vendor what they doing about it.
3. Only if the vendoris non-cooperative do you then share discovery with other users of the product that has the bug.
4. Attempt to suggest constructive ways that the problem can be fixed.
This is the way we found out about the Pentium mathematical bug.
Intel was notified & said no big deal, not worth our trouble to fix.
Only then was the bug publicized.

But the common reality that we see instead
1. Share discovery of the weakness with a bunch of adolescents who have nothing better to do with their time than throw digital rocks at civilization & claim that they are doing us a favor by displaying some product that is defenseless against this attack. In the real world people who throw rocks through windows are considered to be low life mentally deficient rejects from society.
2. Participate in promoting hacking, virus creation, e-destruction crime spree.
3. A huge industry grows up to protect the consumers from this, that is simply massive in comparison to what is needed in the real world to protect us against criminals & incompetents.
4. I guess this is further evidence of break down of society that future politicians will use to argue some solution to get them elected.

by alex

While it is true that some exploits pass thru the hands of malicious hackers before they get to the vendors for a fix, that is not the way the majority goes. There are alot of exploits that the vendors either will not bother to fix or drag their feet for months or years. Vendors should be held more responsible for security instead of just rushing to get their product on the shelf so they can start making the $$$$. Well yes then the exploit goes out to the world of underground evil doers. Oh yeathen the vendor starts crying when people stop buying their miracle product or at least start complaining about it. Then of course their are all the lazy or misinformed people that won't even bother to install the fix even if they know about it, still leaving their doors open.
To sum up, your comparison is pretty much a stereo type. If you were to actually research the security world and exploits you will see that more often then not the vendor is notified well before the exploit is released.Most peoples only knowledge of security and exploits are the news articles that are released after someone is cracked with the exploit. Well next time do a search for that exploit , find out who released it and then find the advisory. I can almost guarantee one of the first lines in the advisory will be "Vendor Contacted: " then a "They responded no big deal" or something to that effect. Or even email me with the name of the exploit and I will get you the advisory.

by al macintyre

CERT has had a policy change on this topic.

Now when a security exploit is discovered, they will notify the vendor of the precise details, then 45 days later inform the general public of the problem in general terms but not to the degree needed for a hacker to actually do it.

See details of this

http://vnunet.com/News/1112167

"Clock ticking to fix security holes"

by al macintyre

The world we live in is a dangerous place & computer security is really a small part of a bigger picture. For information about this larger picture, check out

http://www.stratfor.com

This place focuses on intelligence rather than news, about various hot spots around the world. What the heck caused the latest explosion of violence in the Middle East? What will be the probable economic effects of the rising oil prices? Why can?t those African countries be peaceful neighbors to one another? What?s causing the increase in the Ozone hole & what is it going to mean for nations down under? Pipe-Lines & Railroads impact on Asian economies. Regional conflicts that could escalate into a Nuclear War. China?s changing policies on Yugoslavia. India & the next superpowers. US trouble with Canada?

You can subscribe to a 4 days a week daily behind the headlines update explaining current world hot spots & a weekly analysis. Check out stories indexed by nations, regions, US interests in various hot spots, political forecasts, situation reports, country profiles, lots more.

by al macintyre

I pick up every freebie I can hopefully absorb.

There's stuff out there costing $$$ to buy / subscribe ... if we could budget some reasonable sum for books & classes on Computer Security issues ... where would our investment get biggest bang for the buck?

by donq

I develop database business software (Access abd SQL-Server) and think of "Workgroups", "Groups", "Users", "User ID"s, and passwords when I see the word "Security".

I logged on to find out what my bretheren were doing and found this detailed discussion that should have been titled "Virus Protection Products" ?

Am I wright or am I missing something here?

by al macintyre

"Security" is different topics to different people in different areas of an enterprise.

I just been learning a lot from
http://www.radium.ncsc.mil/tpep/epl/epl-by-vendor.html
which is a list of computer systems that have passed DoD standards for security.

However, for many people the reality is that we have received responsibilities to manage a computer system that has problems with security & other areas.

As far as I am concerned, security has to do with the integrity of our data in our data bases & the reliability of that data.

It can be compromised many ways & viruses are one way that it can be compromised if we are using a system that is vulnerable to viruses.

But computer security is a much bigger subject. Various aspects of computer security have come up in various TR discussions, with a recurring theme of where do we go to get at education on this subject, so I thought it would be constuctive to start a thread that shared URLs to address such issues, then later perhaps do some book reviews.

by pjpatiky

Al - It is good of you to take the time to offer data on computer security. I have read many of your Posts and I have been taken back to when I was in a Computer Security Course.
The Course was for Senior Managers, where a Computer Dept. was but one of the Manager's many Dept's. All Instructors had MS or PhD credentials. All the Instructors talked well above the level of the class, used a lot of dazzle and rhetoric. By the third day the Instructors had lost the interest of the class, a learnedand successful Government Group that had assembled in Wash DC from all over the U.S.
I am suggesting you capsule your data in a format that is continually interesting. So far you have put up 29 Posts. Can you reduce it to intersting size. And yes, I am interested, and this is a positive contribution as opposed to adversarial.

by al macintyre

User-ids & passwords can be totally bypassed on some systems. I work in a reality in which security used to be practical via user-ids & passwords & hierarchies of what these folks could get into, but evolving technology for FTP & other protocols for transferring data between different computer systems has made it possible for people to get into our data without going through the process of signing on with a user-id & a password.

This might not be a risk on all platforms, but generally even when it is a known risk, upper management is so enamoured with whatever the high-risk offerings do for an enterprise, that we end up having to sacrifice formerly good security to satisfy whatever it is that the end users are clamoring for.

User ids & passwords are a starting point, but not an end to good security, in my opinion.

You might also want to check out at the bottom of the Discussions, under the group for Security ... last time I checked, there were a dozen threads on various aspects of Security. You can then see where a spectrum of other folks feel constitutes major the challenges of Computer Security.

by al macintyre

I also develop data base software - I write in RPG on AS/400 for a manufacturing company, but I recognize that our profession will not always exist, since the data base itself can contain business rules enforced without software ... if you interested in that concept ... check out http://www.erros.co.uk/ ... this can be a bit difficult to grasp at first so you might want to check a reviewer on the subject such as http://www.400times.co.uk/Documents/ERROS1.htm but of course this is part of DATA BASE theory, separate from an interest in Computer Security.

by al macintyre

Other Security Discussion Forums exist.

TR has many resources for discussing Security issues, as do other places & here I want to share links to any promising places we might encounter.

by al macintyre

Information Security has become a topic of growing concern to many Computer Managers because Security risks are often much greater on the internet than traditional computing, and because many enterprises seem to feel that connecting to the internet is so urgent that traditional safeguards need to be circumvented.

http://www.egroups.com/group/e-com-sec is the web site where I signed up for
the European e-com-sec discussion group of such issues & where there is a synopsis of what it is all about, and visual statistical portrayal of the historical volume of traffic. It is structured similar to Yahoo clubs except greater flexibility in how you can get the content.

Joining e-Groups involves a registration process at the web site, then they send you an e-mail to which you reply to for confirmation this is really you. There are a number of things you can subscribe to which have very rapid confirmation, but the e-com-sec is human moderated. It took 24 hours for my sign-up to be approved, which I think is pretty fast considering across the Atlantic different working hours, a weekend, volunteer organizer no doubt, etc. Some similar type groups within USA have taken me 2-5 days to get in the door. I visited the archives to get a sense of the traffic then launched my first post "Weakest Link" in which I touched on a panoply of risks & threatened to add to my collection in later posts.

In recent months the monthly volume of traffic in this moderated security discussion group of just over 500 people has been 50-120 posts per month.

by al macintyre

[e-com-sec] security tools notification
From: (Talisker)

Here is notification of a new security resource that I got from the e-com-sec list described in a separate post here.

Hi

I have started a security tools notification service to complement my web
site.

http://www.egroups.com/subscribe/security-tools

The website details every known commercial Intrusion Detection System and
vulnerability scanner and some of the better freeware alternatives, I am
currently extending it to include firewalls, I intend to extend it further
to include anti virus and counter eavesdropping tools. I cannot see it
extending beyond this, as I maintain it in my spare time (I don't have much)
The notification service will very low volume 2-4mails per month, detailing
new and updated products and vulnerabilities in existing products.

Andy
http://www.networkintrusion.co.uk Talisker's comprehensive IDS & Scanner
List
'''
(0 0)
----oOO----(_)----------
| The geek shall |
| Inherit the earth |
-----------------oOO----
|__|__|
|| ||
ooO Ooo

by al macintyre

Thanks, it was not evident to me if this was a White hat Hacker outfit or a Black hat Hacker area, but now I suspect they are Grey, because I read a post on "Hacker Help" which I found in the TR Hot Discussions, saying that they hack companies, do not DO anything there, then send an e-mail teling them about the vulnerabilities.

Black Hats are those that DO adverse things.
White Hats are INVITED to test security & do a thorough risk analysis.
Grey Hats are UNINVITED.

I like the comment by someone on the Hacker Help discussion ... would you feel greatful if you found a note on your kitchen table from someone who broke into your home for the purpose of leaving a note that it could be broken into?

by netw3

The SANS Institute (www.sans.org) is an *excellent* security resource. They also offer certification training. Most of it is hands-on, but some of it is web-based. All the passing practicals for the different areas are posted to the website, under the certification traning area. You can read practicals from firewall analysts (including mine, under my name Curt Wilson), practicals from Intrusion Detection Analysts, incident handlers, security essentials, and more.

I found my SANS training tobe something that I continue to grow into and the benefits keep coming. http://www.sans.org/giactc.htm

There are a million other great sites out there but SANS is one of my favorites. A few others would be www.insecure.org, razor.bindview.com, www.hack.co.za (a great place for fresh exploit code, mostly unix based but some other OS's), www.antionline.com, www.freelsd.com (select ADM for their security exploits and tools), securityfocus.com, hackernews.com, www.enteract.com/~lspitz, www.monkey.org/dugsong, packetfactory.net, rhino9.org, and of course, Bugtraq, NT bugtraq, and other mailing lists. My SANS paper lists a lot of resources, check it out at http://www.sans.org/giactc/gcfw.htm and click on "Curt Wilson" to view the practical (MS Word format).

Curt Wilson
netw3.com consulting
www.netw3.com

by al macintyre

Thanks, I found the SANS Institute (Security Administration, Networking, and Security) to have a massive volume of high quality links to still more sites with current news of e-security topics. The SANS Institute offers in-depth e-security education, tools in support of e-security, weekly e-security alerts for popular platforms, and a significant number of specialized documents. I see e-security protection guidance here for Win NT & 2k, Unix, Linux, and other platforms.

Another great site, that I found in the SANS archives, is http://www.vnunet.com which is chock full of e-security news stories. I expect I will be revisiting both http://www.sans.org & vnunet to explore more of this. Thanks again for the links.

by al macintyre

I may be misinterpreting what you are saying, but some of what you are saying strikes me as hacker enthusiasm.

There are fragile platforms in which it seems like there is a constant war between security specialists and hackers. The hackers find & exploit a loop hole. End users are grievously inconvenienced by the disruption to business service by mischievous hackers. The professionals close the hole. End users are grievously inconvenienced by the disruption to business service by all thehassle involved in implementing some security upgrade that may have some bugs & negative consequences such as blocking access to some capabilities, that the users have been depending on, for security reasons, so now they have to choose between the capabilities & the security, they cannot have both. The hackers find another hole. The war continues.

There are other platforms in which the computer vendors started with good engineering design & stuck with standards of quality, which means thatthey are not as cheap to buy & not as popular. These platforms rarely have disruptions for reasons of hacking, viruses, applications conflicting with resources, etc. One of my purposes here is to communicate the fact that such platforms exist, butthere is a responsibility for their administrators when connecting them to the fragile platforms, not to invite in the kind of trouble that is systemic in the reality that you describe.

Thanks for the URLs. I wanted a Discussion Area that collectively contains a bunch of URLs with explanations of the significance of each to understanding Computer Security trade-offs & you certainly have supplied some useful connections.

by al macintyre

I concede that much of what I have posted so far are reviews of Gov sites on Computer Security issues.

I had a vision for a topic, and tackled it top down, in which I visited web sites to verify I still had a good URL, and an accurate picture of their function, before doing a review. It so happened that my Gov links had not been visited by me since before Y2K crisis, so I picked them first for validation.

I have a ton of additional links that I intend to add here with mini-reviews, at some time in the future.

Most of my links are aimed at general business & consumer users, while I do have some that are extremely technical on very narrow platform specific concerns.

by al macintyre

I suspect patterns of behavior are related to the corporate culture of the computer vendor. Some need public outcry, like Intel needed to fix the Pentium math problem, Some will never change, such as Apple refusing to fix math to work the way mathteachers are demanding, because school administrators are in charge of buying, not the math teachers.

While IBM fixed their security problem within one week of notification after various discoverers of exploits REFUSED to tell IBM what the problem was, but published it on the internet. What was interesting to me is that IBM also fixed it on ancient OS that had not been supported or marketed by IBM for decades ie. they fixed everything they had ever put on the market & made it available for free to people using legacy systems that were no longer customers of IBM but using IBM equipment.

Some vendors stand behind their security standards & for others it is vapor ware.

by al macintyre

The structure of what can be posted to Tech Republic means that we have to work with small posts, unless the speaker (me) is extremely gifted at saying everything I want to say in only one of them.

I could e-mail you a paper I am working on "Computer Security Myths & Common Sense" to submit to a conference on Computer Infrastructure, but you might consider it to likewise be like a collection of posts. You could also check out the link to "Computer Security Myths" in my post to the e-commerce group in which I think I managed to cram my main points into something a bit longer than a Tech Republic post.

IE Links

I am using AOL 5.0 which uses a variation on MS IE for web browsing. When my time permits I plan to try out technique described at http://www.smartcomputing.com message board Q+A for exporting book marked Favorite Places to a printable document to help review how to reorganize what I think is becoming unmanageable & in serious need of reorganization. This has the added benefit of one person being able to e-mail to another person their collection of Security or other links. If you are interested in learning the technique to print your Favorite Places for reference ? when you get to the smart computing Q+A section, check out the message threads 59314 and 54883.

by al macintyre

Perhaps for the topics that you find the most interesting & relevant, I CAN do something that is of a size you find manageable. I am not particularly good at being concise.

I originally started this thread from a sense of frustration in many discussions where I found repeating variations of I wanted to say the same thing, so here I try to say - what is it that we ought to know if we consider outselves to be knowlegable about computer security & more responsible than the mentality that the only way to ensure good security is to be tearing things down all the time.

There was a time that security was seen as a tool to help the end users, to make their job uncomplicated, to shield them from a level of complications & problems, but we seem to have moved away from that to giving everyone fragile systems under constant bombardment, in which everyone HAS TO BE AN EXPERT to use computers.

As we have seen from the Florida vote mess, there are a lot of people out there who are not comfortable with technology or with what seems to be simple standard instructions. As a profession, we computer people need to be doing a better job of serving all users, across a spectrum of levels of understanding.

This discussion is closed to new replies.