This is pretty much a solved problem.
* only grant execute access to stored procedures, no ad hoc or dynamic sql at all
* encrypt sensitive information so that backup tapes do not become a vulnerability
* don't store anything you don't actually need...there are credit card authorization firms that will give you a token to store, so you never store the credit card number at all, even for recurring payments
* segment particularly sensitive data entirely...the HR database should be a different instance on a different server etc.
* don't give IT folks access they don't actually need....this protects them from suspicion, too
* if you have especially sensitive stuff, use a data access intelligence product like rippletech to intercept database calls and stop suspect ones
* don't allow the data to float around in clear text before it hits the database....clear text credit cards in the apache logs obviate the benefit of strong encryption in the database, and if it moves over the network in the clear any employee that can download snort owns it
* use different vlans for sensitive information, or for inter-application communications that might be particularly rich with valuable information
* use strong authentication for access to sensitive servers...several layers worth for connecting from home
etc. etc. etc. all the normal security stuff.
The ISP isn't intercepting and modifying google....they are warning their user about hitting bandwidth overage charged. There is absolutely NO evidence presented that the ISP is paying any attention to which page they prepended their info to at all. And if they didn't go out of their way to warn users that they were approaching "you have to pay extra" territory, they would be excoriated for that.
The first time I was surprised by this was when they demanded that fast food no longer be wrapped in paper, in order to save the trees. Then of course a few years later they demanded the paper back, since the polystyrene containers were much nastier to the environment. They were right about the polystyrene of course, but McD's et al would never have changed from paper in the first place if they weren't forced to. And if memory serves it really was force, at least in Berkley laws were passed.
It must be frustrating for statist control freaks to pass law after law only to see them ignored on some scale, be it large or small. So this is the perfect law - nobody will ever break it. They should next pass laws against faster than light travel, going back in time, resurrection, speaking to the dead etc.
re. "Isn't the entire point of insurance to charge higher for higher risk people, and lower for lower risk people?"....well, no. That would be a state called "uninsured".
The entire point of insurance is to pool risk among many people who will not have a need, and pay for the people who do have the need. Thus homeowner's insurance would not work if only purchased for houses on fire.
The fact is that about 7% of the US population suffer from chronic illnesses, and consume around 70% of the health care dollars. So charging people an extra $10 for being overweight is pointless in terms of managing health costs, offensive on too many levels to count, and is live bait for employment law litigators to a greater extent than anything I can remember in recent history.
Rick.
Civil cases require only a "preponderance of evidence", so it would be even HARDER for anyone to win a civil suit in the face of receipts, boxes, cd keys etc.
I am a CIO right now, of a smallish company (about $50mm revenues projected for this year). I have been CIO of a mid-sized ($1bn revenue) company, and CEO of a small company ($20mm revenue) in the past.
A CEO, at least of a growth company, simply must be the company's number-one salesperson and cheerleader. He or she has to be quite comfortable with all of the risk and uncertainty of entering markets with bigger entrenched players, and the vicissitudes of everything from economic cycles drying up her capital to global competition changing her value proposition by an order of magnitude in ninety days. The CEO must understand all of these risks intellectually, but frankly a great CEO is at least emotionally oblivious to the risks....always believing in the positive outcome. I was told by my subordinates, that as CEO it was my job to absorb uncertainty.
It is my experience that most successful CIOs are master contingency planners -- striving to quantify and avoid or mitigate all risks. Further, they are usually serving internal users, rather than paying, external clients who are protected by contracts and able to fire them.
These two things, in combination, tend to attract people who are not of the cheer leading, external client focused, negotiation oriented, happy to accept rather significant risks everyday mindset that CEOs need.
I think I was a really good CEO. But if I were a VC investing in a company, except in a very few unusual circumstances, I would rather hire a sales & marketing oriented CEO than myself. There are thousands of companies with great products and services, and the difference between success or failure is PURELY in getting the market to accept and pay for their stuff.
Of course it is quite possible to play a game like World of Warcraft and not allow it to consume one's life. Just as it is possible for non-alcoholics to drink a glass or two of wine and not have it destroy their lives. I play world of warcraft for a few hours a week, and get a great deal of enjoyment out of it. And I still run a business and play with my son and pay attention to my wife and ride my bike three or four times a week etc. I don't really know why people would assume that anyone playing the game is automatically destroyed by it. For the Horde!
I would be intensely suspicious of anyone with a background that suggested they didn't have a problem stealing or harming strangers. Of course youthful indiscretions can be forgiven, but if someone has demonstrated, as an adult, that they don't know right from wrong (or care) I don't want them working for me. Oh yeah, I've been CTO of a couple of public companies etc.
Rick
Well, no it isn't practical to monitor all frequencies, as there are other things happening on them and following the thread of the signal in a spectrum full of many signals would be just as rough as following the hops. However if the technology is unsophisticated enough to follow a predictable pattern of hops, or to transmit the upcoming freq in a way easy to decrypt, well following the leader is easy enough. I am stunned to infer from this that the radios aren't all digital and encoded with something at least as robust as, to quote the example above, PGP. It would almost certainly be impractical to try to crack a 1024 bit PGP encrypted signal in real-time.
Nah... her behavior is obnoxious, and probably illegal, but her body count so far is zero. Between Stalin and Hitler you can pretty conservatively come up with 60,000,000 dead. She is a piker compared to them.
Slashdot Mirror
re. your comment "If guns kept people safer we'd be allowed to carry them on commercial flights."...well, they might not keep YOU safer.
yep
This is pretty much a solved problem. * only grant execute access to stored procedures, no ad hoc or dynamic sql at all * encrypt sensitive information so that backup tapes do not become a vulnerability * don't store anything you don't actually need...there are credit card authorization firms that will give you a token to store, so you never store the credit card number at all, even for recurring payments * segment particularly sensitive data entirely...the HR database should be a different instance on a different server etc. * don't give IT folks access they don't actually need....this protects them from suspicion, too * if you have especially sensitive stuff, use a data access intelligence product like rippletech to intercept database calls and stop suspect ones * don't allow the data to float around in clear text before it hits the database....clear text credit cards in the apache logs obviate the benefit of strong encryption in the database, and if it moves over the network in the clear any employee that can download snort owns it * use different vlans for sensitive information, or for inter-application communications that might be particularly rich with valuable information * use strong authentication for access to sensitive servers...several layers worth for connecting from home etc. etc. etc. all the normal security stuff.
The ISP isn't intercepting and modifying google....they are warning their user about hitting bandwidth overage charged. There is absolutely NO evidence presented that the ISP is paying any attention to which page they prepended their info to at all. And if they didn't go out of their way to warn users that they were approaching "you have to pay extra" territory, they would be excoriated for that.
The first time I was surprised by this was when they demanded that fast food no longer be wrapped in paper, in order to save the trees. Then of course a few years later they demanded the paper back, since the polystyrene containers were much nastier to the environment. They were right about the polystyrene of course, but McD's et al would never have changed from paper in the first place if they weren't forced to. And if memory serves it really was force, at least in Berkley laws were passed.
It must be frustrating for statist control freaks to pass law after law only to see them ignored on some scale, be it large or small. So this is the perfect law - nobody will ever break it. They should next pass laws against faster than light travel, going back in time, resurrection, speaking to the dead etc.
re. "Isn't the entire point of insurance to charge higher for higher risk people, and lower for lower risk people?"....well, no. That would be a state called "uninsured". The entire point of insurance is to pool risk among many people who will not have a need, and pay for the people who do have the need. Thus homeowner's insurance would not work if only purchased for houses on fire. The fact is that about 7% of the US population suffer from chronic illnesses, and consume around 70% of the health care dollars. So charging people an extra $10 for being overweight is pointless in terms of managing health costs, offensive on too many levels to count, and is live bait for employment law litigators to a greater extent than anything I can remember in recent history. Rick.
They sell special shampoo for getting rid of body thetans.
Thank you for this. "Less" vs. "Fewer" errors have become my bete noir (circumflex implied) lately.
Civil cases require only a "preponderance of evidence", so it would be even HARDER for anyone to win a civil suit in the face of receipts, boxes, cd keys etc.
I am a CIO right now, of a smallish company (about $50mm revenues projected for this year). I have been CIO of a mid-sized ($1bn revenue) company, and CEO of a small company ($20mm revenue) in the past.
A CEO, at least of a growth company, simply must be the company's number-one salesperson and cheerleader. He or she has to be quite comfortable with all of the risk and uncertainty of entering markets with bigger entrenched players, and the vicissitudes of everything from economic cycles drying up her capital to global competition changing her value proposition by an order of magnitude in ninety days. The CEO must understand all of these risks intellectually, but frankly a great CEO is at least emotionally oblivious to the risks....always believing in the positive outcome. I was told by my subordinates, that as CEO it was my job to absorb uncertainty.
It is my experience that most successful CIOs are master contingency planners -- striving to quantify and avoid or mitigate all risks. Further, they are usually serving internal users, rather than paying, external clients who are protected by contracts and able to fire them.
These two things, in combination, tend to attract people who are not of the cheer leading, external client focused, negotiation oriented, happy to accept rather significant risks everyday mindset that CEOs need.
I think I was a really good CEO. But if I were a VC investing in a company, except in a very few unusual circumstances, I would rather hire a sales & marketing oriented CEO than myself. There are thousands of companies with great products and services, and the difference between success or failure is PURELY in getting the market to accept and pay for their stuff.
Rick.
This is really interesting. Presumably one could put a bunch of these in layers and make a 3d display.
Of course it is quite possible to play a game like World of Warcraft and not allow it to consume one's life. Just as it is possible for non-alcoholics to drink a glass or two of wine and not have it destroy their lives. I play world of warcraft for a few hours a week, and get a great deal of enjoyment out of it. And I still run a business and play with my son and pay attention to my wife and ride my bike three or four times a week etc. I don't really know why people would assume that anyone playing the game is automatically destroyed by it. For the Horde!
I would be intensely suspicious of anyone with a background that suggested they didn't have a problem stealing or harming strangers. Of course youthful indiscretions can be forgiven, but if someone has demonstrated, as an adult, that they don't know right from wrong (or care) I don't want them working for me. Oh yeah, I've been CTO of a couple of public companies etc. Rick
Well, no it isn't practical to monitor all frequencies, as there are other things happening on them and following the thread of the signal in a spectrum full of many signals would be just as rough as following the hops. However if the technology is unsophisticated enough to follow a predictable pattern of hops, or to transmit the upcoming freq in a way easy to decrypt, well following the leader is easy enough. I am stunned to infer from this that the radios aren't all digital and encoded with something at least as robust as, to quote the example above, PGP. It would almost certainly be impractical to try to crack a 1024 bit PGP encrypted signal in real-time.
Nah... her behavior is obnoxious, and probably illegal, but her body count so far is zero. Between Stalin and Hitler you can pretty conservatively come up with 60,000,000 dead. She is a piker compared to them.