The Security Kitchen

This time the audit cold rocked ya
A box checked instead of a certificate
Nothin’ proper about ya firewall rule set
Fools follow rules when the set commands ya
Said it was blue
When the alert was red
That’s how ya got a request crossed through ya head

Crossed through ya head
Crossed through ya head

Happy 2010, be good !

So, here we go again … why do some people – obviously under pressure to get their brand ‘out there’ – have to stand up and proclaim themselves experts on whatever is hot at a certain point in time only to make utter fools out of themselves ?

Yes, I care about people, even if they turn themselves, knowingly, into a fucking parody of what they really are.

What ticked me off ? Two dudes, one Belgian, one Dutch, working for anti-malware (I can’t say virus anymore, right?) vendors. They probably spent numerous hours together to devise this list of 9 risks they see “in the cloud”. Oh yes, we’re back to the big, mushroomy, scary, cloud. Ugh.

You can find their list here. The article is in Dutch, but I’m sure you’ll find some (cloud?) translating service to find out what they’re trying to say.

what I find interesting is that these two … persons look at “the cloud” from a very naive point of view.  First off, they devise a list of 9 risks. A strange number in my humble opinion. If you look at the list, they put Identity and Access Management (IAM) on spot 9, but on spot 7 they talk about account hijacking, spot 2 is insider abuse and the golden medal is taken by what they call “Centralized abuse of and trust in Authentication, Authorization and Accounting”.  In my extremely humble opinion and with my (maybe limited) knowledge of IAM, THIS IS ALL IDENTITY AND ACCESS MANAGEMENT related. So, we remain with a list of 5 risks … whereof the other four are too silly to reiterate here as they mostly relate to what the writers know best, Anti-malware as a Service.

If you really want to inform your customers about what they should be concerned about when evaluating cloud services, maybe it would be good to point them to knowledgeable people on the subject instead of blowing your own horn and pushing their cart in the canyon.  Some starters could be this , this , this and this .

It doesn’t hurt you to admit you don’t know jack shit about a subject.  It hurts your customers if you try to convince them that your backroom amateur BS is the only truth out there. Let’s hope they are a little bit wary about your “advice” and don’t run into the wall face first.

I’ll say my prayers this Christmas …

In the name of all that is sacred, what have you done you moronic ministers of finance and justice of the European Union of we’ll kiss America’s ass until there’s no tomorrow ?

Every country in Europe has pretty strict privacy laws.  I’ve personally had my encounters with their inner workings here in Belgium a few years ago and up until now, I really thought they were there to protect me and my personal information.

Not any longer.

Today those assholes that we pay way to much for what they actually do have decided it is OK to share the information of ALL EUROPEAN CITIZENS with the United States and of course the war on terror is cited left, right and center as the reason to do this.  There goes the neighborhood.

Why this decision ?

SWIFT was contemplating to move their servers (that handle ALL international payments) out of the US and onto European soil. This would have cut off access for the US as the privacy laws in each individual country would prevent the release of any personal information whatsoever.

Why now ?

After way too much time, Europe is ratifying the Lisbon agreement.  Which would have given the European Parliament a voice in the decision. The lowlifes that quickly pushed this decision through knew that and probably wanted to make sure they can still travel to the US and be royally pampered while recovering from their demanding, energy-sucking, important job.

What can I do ?

Probably nothing much … or can I ? Article 8 of the European Treaty …

1. Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

Either that or we throw the whole treaty away ? At least it would allow us to waterboard suspected criminals again … fun should be had by all !

http://forskningsavd.se/2009/11/29/i-can-haz-moar-bout-teh-reid/

On saturday November 28th the Swedish Hackerspace Forskningsavdelningen was brutally raided by a few dozen police offers donning full riot gear and they confiscated a lot of hardware.  The reason that’s stated (illegal sale of alcohol) seems like a strange reason to go S.W.A.T. on a hackerspace in my humble opinion but hey, it’s the coppers, they must know hackers are the real dangers of society … AS IF !

Allthough I’m not personally involved in the local or global hackerspaces, I do have a place in my heart for them because they make the dream of sharing information and knowledge true on a daily basis.  Please click on the link above and see what you can do to help them out.
Thanks !