Friday 23 September 2011

I say


GCHQ appoints cyber skills consortium
http://www.publicservice.co.uk/news_story.asp?id=17523
"Good news that Royal Holloway is giving some intellectual credibility to the whole thing. I was rather concerned that it might end up as a CISSP show boat. Shame that GCHQ can't offer decent salaries, but you know the people who want to work at Google might just not get the DV .. chin chin infosecchap"
Data centre security: how safe is your data?
Relentless Intrusion Detection? That's a new term to me. But it sounds (a) effective; and (b) expensive. I've never yet found a cheap solution to IDS, log reviewing or protective monitoring (as required in the UK by GPG 13). I'd be really interested in how the service model works, especially what the incident response is. For generic hosting it's going to be hard to do anything other than alert-on-a-port-scan and you get that all the time. chin chin InfosecChap 
Boot up: iPads in journalism, teach kids to code, celeb phone hacking and more
HTML5 standard may neglect important security issues eh? well that's par for the course. I don't think that the RFCs really take a holistic view of security. But then why would they? It's only one aspect and to be fair, it's probably not the most important one. What is important? Getting your standard approved! Call me an old cynic, but most people don't "get" security so, it's not surprising when it fails to materialise. They have other things to worry about and, let's face it, IA is an ever evolving beast and quite simply hard to get right. chin chin @InfosecChap
SIEM: Dead or alive?
Good lord, another one dies? SIEM is an expensive solution, expensive in terms of people and potentially expensive in terms of technology. Though one can do SIEM with notepad and Excel (thought the proper IA wonks amongst us would only use Vi), a nice aggregation tool really helps. The issue is the investigation, the remediation, the incident handling. On an estate of anything above a couple of hosts, it's a nightmare to do properly. Of course most solution providers will say that they have a jolly old SOC, but one has to peer behind the curtain to see exactly what's going on there. This is exactly why GPG13 is so hard to get right, that and the fact that the IA community keep changing their minds. It does have its place, so rumours of its death are, I think, exaggerated. For now, until the next killer solution comes along. chin chin infosecchap 
Defence Firm Probably Hit By Spear-Phishing Attack 
Well, what do you know? A defence company attacked! Look Over There, you know China is on the no fly zone for UK HMG employees. it's there for a reason. We see this again and again. State sponsored hackety-cracketty. You really would think that a defence company would have its defences in place. There are standards for this, penetration testing, audting, yadda yadda. Makes you wonder what is happening that no one has found out yet. chin chin @infosecchap
Graduates sign in at PwC
Ah, bless 'em. little itty bitty young consultants. Now they are in for a shock. it's not all shaking tins on the high street. no, it's all about what you can get on expenses. In a couple of years they'll be on the CLAS scheme and probably be my boss ... chin chin @infosecchap
(ISC)2 launches awareness foundation and member chapters  
Ah, bless 'em. I do like my CISSP, but I often wonder why I need to keep "in good standing". If they really want to "move the profession forward" then they should stop acting like a trade and be professional, unfortunately there are other organisations willing to be the professional arbiters: BCS (CITP); IISP; IEEE to name but a few. So, where's the beer then? chin chin @InfosecChap
Government invests €8.6m in an eLearning Solution
Good lord 8.6 million for on line training. has the emperor no clothes? call me old fashioned, but Aristotle managed perfectly well in his academy without a browser. 8m will buy a whole lot of books. "even learning outside school time" as if. give 'em hacking exposed and let 'em get on with it. I can't understand where the 8m is going. chin chin @InfosecChap

No comments:

Post a Comment