A few weeks ago, I was asked to contribute to fudsec.com.
Fudsec's goal is stated as "Showcasing Fear, Uncertainty and Doubt from the Information Security Industry"
I was happy to contribute and feel honored that I was asked. There is a lot of really good content published and I look forward to what's to come.
You can see my contribution here: I'm Not Secure and You Can't Make Me
Thanks Craig for allowing me to participate.
-Kevin
Good afternoon everybody! I hope your day is going well.
Here are today's Interesting Information Security Bits from around the web.
- Exception, variance, these words are the bane of the information security professional. We all have to deal with them. Jarrod offers some thoughts on the topic. You will benefit from reading them.
/dev/null - ramblings of an infosec professional: Security Exemptions
Tags: ( policy )
- Ben shares his method for writing along with some thoughts on writing in general. It's a good read and I bet you can find some things in there that can be applied to your own writing.
The Writing Funnel (The Falcon's View)
Tags: ( general writing )
- A bit ago, a forensic contest was opened with the winner getting a free SANS course. That contest is now over. Here is the cool part, they took the finalist's answers and made a website out of them for the rest of us to learn from. Check it out.
Network Forensics Puzzle Contest
Tags: ( forensics contest answer )
- This boggles the mind. A judge has ordered that Google deactivate an account because the account holder received an email not intended for them. I seriously hope this gets challenged. Otherwise, we are in for a very rocky time.
Judge Orders Gmail Account Deactivated After Bank Screws Up | Threat Level | Wired.com
Tags: ( cloud privacy )
- Hoff has penned a post that, along with the attending comments, is something that you should read. Seriously, go read it.
Incomplete Thought: Virtual Machines Are the Problem, Not the Solution... | Rational Survivability
Tags: ( virtualization )
- Shrdlu offers some guidance on how to implement new policies. I have used this same method in the past.
The policy bootstrapping problem.
Tags: ( policy )
- Next month is Cyber Security Awareness month. The Internet Storm Center handler's diary will again be making deep dives into various security issues during the month. If you aren't a subscriber now, I suggest you rectify that lapse.
Cyber Security Awareness Month
Tags: ( awareness )
- Wade talks about the difference between Management Science methods of making decisions and engineering methods. He then ask the question "..how does your company make 'Should we do X, Y, or Z?' decisions?" (slightly paraphrased) He offers a few he has seen. Stop by and offer your input.
Verizon Business Security Blog >> Blog Archive >> Security Decisions - How do you make them?
Tags: ( risk-management )
That's it for today. Have fun!
Subscribe to my RSS Feed if you enjoy these daily Interesting Bits posts.
Kevin
Hard to believe that RSA Europe 2009 and the Security Bloggers Meetup is just around the corner. We have officially passed the less than one month mark.
On the news front, we have secured a venue. We have the second floor of a pub reserved for us so we can talk about securing that and breaking this as loud as we want 
Invitations have been sent out to the Security Bloggers Network. If you did not get one and want to attend, send an email to bloggermeetup@infosecramlbings.com and we will get the details to you.
-Kevin, Dale and Benny
Network Access Control (NAC) was touted to be the end-all be-all technology that would answer all the our prayers for a way to ensure that only authorized devices can access our networks. Several years later, NAC is still around, but not as prevalent as you would think it would be.
Jennifer Jabbusch, the author of Security Uncorked, has released a white paper that explains why and then goes on to offer some suggestions to the vendors of these products that might help them moving forward.
I was lucky enough to get to read the paper when it was in draft form. I strongly recommend you give it a look. It is well written and contains a lot of really good information.
Catching the Unicorn: A technical exploration of why NAC is failing
-Kevin
Catching the Unicorn:
A technical exploration of why NAC is failing
![Reblog this post [with Zemanta]](http://img.zemanta.com/reblog_e.png?x-id=f8590ee3-66a1-4783-aeeb-08622a8d85d6)