Even if users print out a paper copy, how can we know if it was intercepted and tampered with before it went to the printer?
The ONLY solution to this that has any security whatsoever is a ZTIC-like device that unlocks with a PIN, and hooks up to the user's computer. This way, the user votes and confirms on the ZTIC, and the only thing the computer sees is the encryption transaction passing through.
In the days where there was one sysadmin running a herd of machines, just logging in as root was A-OK, so logging in and su-ing to root would slow things down.
Times have changed though. Accountability logs, even ones that are gotten around by using sudo -i or sudo -s are a must have in a lot of corporate environments to please the auditors. Client or regulatory requirements might require separate accounts for admins, so a box that only has just a root user is not allowed in a lot of places; it has to have the user's admin ID and the root user at the minimum.
Personally, I feel better using sudo. It may not be "manly", but it does minimize the amount of time a "#" prompt is on the screen, which in the overall picture of both footshooting and security, is a good thing. Having a proper audit trail is also a good thing when it comes to CYA ability.
The only place I expect to see this is the sudoers file of my iPhone, because I have an obnoxiously long (>64 characters) root and mobile password on my device.
So true. For example, if the app servers pop up before the database servers or the network fabric, it might be that the apps will need restarting manually, or at worst, the apps will eat themselves, requiring a restore.
This is why I like having machines stay off it a power failure happens. This way, I can get the network fabric up, then the main services (DHCP, DNS, ACE, AD), then the databases up (and their containers checked for errors). Then the application servers (WebSphere, custom stuff, SAP). Finally the external Web servers.
I'm sure there are some. There are still some Novell 3.11 and 3.12 boxes still out there, so finding a 486 running Jolitz's 386BSD as a gateway might not be out of the question.
I have seen dicey stuff in production systems as well. The problem is when people confuse "it works" with "it works at a production level". For example, Exchange running on a cast-off $300 machine bought from Wal-Mart might be suitable for a home network, but if it is needed for business production use, one needs a lot more hardware.
Disclaimer: Not all school districts are like this. However, a lot are.
It is more like a vicious circle. Parents with justified issues are completely ignored by the school board muckety-mucks until they start having to get "loud" enough to be heard by having to threaten litigation, or actually start hauling school officials into court.
Schools retaliate by adding more and more paperwork to cover their derrieres, and start adding more levels of bureaucratic crap, to try to make themselves more deaf to parents and students.
So, it ends up that having to retain counsel becomes second nature with the thick-headed school districts as opposed to actually being able to voice concerns and have some action taken in the first place.
Of course, there are the idiot parents as mentioned above who have their kids beat people up, and then said parents get mad because their little darling is in the in school suspension room. However, school districts don't address either type of parent (the bad ones, nor the ones that have legitimate issues), and try to bury themselves in paperwork.
The best thing for the US education system? Well, funding comes to mind first of all [1]. It might be nice for something other than football stadiums to receive grants [2]. It is absolutely laughable how pathetic the school system here is compared to almost any other developed country. It can be debated, but probably one of three options is needed:
1: Go with a system similar to Germany, let each state have its own schooling ability, overseen by the Federal government.
2: Go with a voucher based system similar to France, and let schools compete for students, assuming the schools are accredited.
3: Try to fix the existing school district system here in the US without throwing the baby out with the bathwater, and not doing brain-dead things like No Child Left Behind either.
[1]: Funding to college level. An American has to get $50,000+ in debt to finance four years of college unless they are lucky to have savings, or a fat trust fund. Their competitor coming from Chile, Venezuela, China, or India? Their entire education was financed by their government, so they have no worries about finances once they get their diploma.
[2]: Where I live, high school football stadiums are starting to have skyboxes. Districts which barely can keep their vital services running ask for bond money so they can rebuild their 5 year old stadium with a bigger Jumbotron so they can be on par with the small town down the road.
Sometimes one wants the drive to erase ASAP, and they might not have time to pop a jumper.
Instead, perhaps a compromise system, where the drive can be set in a multiple security modes:
Mode 1: Password + master one. Good enough for most users, and if the user loses their PW, they can call support with a serial number, and with enough proof, get a one time unlock code.
Mode 2: Erase data after x amount of bad password attempts. The drive controller would zap the key it uses, generate another one, and start again.
Mode 3 is what the PP suggests. Have a fuse and a routine on each flash controller that blows, blocking read/write access to the cells, and the controller would just sit there writing alternate 1s and 0s (or whatever pattern) until depowered. Alternatively, have the memory that stores the encryption key be blown out via fuses first. This way, it would take uncapping with a chip fab to even have a chance at getting to the data.
The problem is that the ATA commands are there, except there are no utilities available or maintained today that can use them. There used to be a tool called HDDErase, but it requires MS-DOS and a floppy drive for use.
What would be nice is to have the ATA erase command standardized, so this can be easily done.
Command gets handed to the drive controller, controller does the erasing the right way, where on a hard drive, it zeroes out sectors, even the ones on the bad sector relocation table, and sectors marked as bad. On a SSD, it zeroes out everything regardless of the status with regards to wear leveling.
Even better would be having the drive controller encrypt all data, storing the key as a value in NVRAM. Then when it gets handed an erase command, it replaces the key stored with one randomly generated.
Even better would be to have the drive controller to have its own free space bitmap. After being zeroed, if a sector is read without being written to, the controller returns just zeroes, regardless of the actual data present. If the sector was written to, the controller marks it as used in the bitmap and then returns the sector's data on subsequent writes. This way, an erase command can be almost immediate (flagging everything in the bitmap as free), and outside of yanking the controller and looking at the platters/cells, there is no way to retrieve the data that was erased. Bonus points if the controller zeroed out data in the background.
Ideally, Java should come as a.MSI or.MSP file. I don't like how it tries to foist a third party program on you when updating. Nor do I like having to deal with third party installers which means another program that has to have admin level privs on a system.
Plus, MSI/MSP files mean it is easily pushed out centrally.
I'll take the repos where the Web browser can scan both default and user specified repositories for updates over having every single program, plugin, and code chunkie having a separate update mechanism.
With so many update mechanisms, there are so many links that can become weak links in a security chain that program security becomes unwieldy. If a blackhat manages to compromise some browser addon's update mechanism, and the addon can get user (or even admin) context, it means the blackhat just obtained themselves a multi-million PC botnet with users unable to do anything about it.
The only thing that should update applications should be the OS, other than application data (levels in games, zones for a MMO, etc.) Why have every single program reinvent the wheel, as opposed to having a hardened OS mechanism do the dirty work.
This is the nice thing about repos, Apple's App Store, and Windows 8's store. If I want to tell a user to download an app, they just type it in on the store search, and download it. No website compromise, no Trojanized executables. It also increases the "hmm, I shouldn't really do this" barrier with websites asking a user to install dubious applications manually, as opposed to through a repo/store.
So, repos keep the chance of getting Trojans down, which is one of the bigger vectors of compromise. Leave the application updates to the OS.
Correction: Kudos to Google for using OS controls for additional security.
Yes, using OS specific security constructs makes a Web browser less portable across platforms, but it might be that some OS security mechanism may be the only thing standing in the way of browser compromise turning into complete machine pwnage.
On a larger scale, it might be time for OS makers to have some standardized security mechanisms, where a program can take advantage of them regardless if it runs on Windows, OS X, AIX, or OpenVMS.
The more browsers use the operating system security abilities, be it WIC, jail(), AppArmor, SELinux, or any other mechanism that reduces the privs a Web browser under, the better.
The battle for control of most PCs is going to be fought at the browser and browser add-on level. This is one front that really needs defense in depth, from browser add-ons being in a separate context from other objects, to a browser tab or window not being able to access other windows, to a browser not being able to get normal user (or even worse, root/sysadmin/QSECOFR context.)
Kudos to Chrome for working on advances with keeping things separated/sandboxed. A Flash or other scripted app that can record keystrokes only can record those typed in its window of the Web browser, and can't record anything if the user is using another window or another program.
With clued people, there may not be convincing evidence.
However, in a jury trial with the DA throwing the book at you for a lot of computer trespass charges, convincing a jury of that is a lot harder.
We all have dealt with the Joe Sixpack archetype. He calls you on the phone demanding you "fix" his computer. Because he is either a friend of someone you care about, or otherwise can't tell him where to stick it, you go over. You make it past the baying mangy hound menagerie, avoid the cans of Bud Light on the front porch, hold your breath as you round the TV area that is permanently turned onto Fox News, and narrowly dodge the gun cleaner oil perched precariously on a table.
Finally you get to his computer. The copy of AV software has expired (or never been activated.) You see the hard disk light constantly on even though the box is idle. Further prodding finds that a reinstall is a must because iexplorer.exe and explorer.exe got corrupted and replaced by something. The recovery partition? Completely corrupted.
You ask Joe for the install media. He never made the install CDs (if he bought the box from most PC companies), or he lost the media (if he bought a Dell). You ask him about backups. He tells you that if he backs his pickup up any more, it will smash into the wall. You ask him about saved images of Windows. He wonders why you want pictures of stuff found in a Pella or Andersen catalog.
End result is that you tell him to buy some install media. He ends up stopping by Best Buy and just buying another computer. You help him get the new machine set up and browsing the NSFW stuff (the computer's primary use), and almost certainly, the cycle will begin again in a few months.
Now picture twelve of these types of people who have zero clue about computers. They are deciding your fate, and they have possibly the rest of your life in their pork-rind stained hands. The DA will tell them in the opening/closing statement that you trespassed electronically, and the jury will just rubber stamp that verdict and the sentence time asked, because they don't know better. They will dismiss the defense as greasy nerds with "ass-burgers syndrome" who are trying to spout meaningless technobabble in order to get a disgruntled employee off the hook.
It just pays not to log in at all, whatsoever to an ex-employer without permission. It also pays to use a strong password, so you are not kept up at night wondering if a cracker would get in and get you blamed for it.
This. If you are good at the IT job, your work is invisible. However, one needs to make sure they are not invisible, mainly by proactively checking with other cow-orkers and departments to see how things are running, anything possible they can get, etc. This way, you have a presence.
I have seen companies fire their IT guys who have extreme clues because they thought that they could get someone cheaper to run things, then their whole infrastructure collapses with the guys they hired on to replace the veteran IT people barely able to do firefighting duties. Said companies end up with two choices, either finding another veteran IT person that they likely will end up paying far more, re-hiring the guy they fired (assuming he or she would ever bother to come back), or re-hiring the fired person as a consultant for a lot of cash.
Here is the ironic thing: The PHB who has the MBA goes through courses like ITIL/ITSM concepts where they have to pass concepts like this. So, the concept assuming that the IT infrastructure would work perfectly by jettisoning veterans was taught to them that it won't work.
An intrusion attempt is an intrusion attempt, be it by a dedicated tiger team doing a pen test, some guy living in Elbonia testing his skillz, an enemy country with their intel arm probing for weaknesses, a criminal organization looking for organizations with their fly open to use as staging points for botnet C&C servers.
An attack is an attack, and an exploit check is an exploit check. Who is doing it matters less than handling it, be it someone checking if the ssh daemon is buggy, or someone calling the front desk pretending to be the CEO and demanding a password.
Ideally, people need to not focus on *who* is doing the attacks as the primary concern, but the attacks themselves.
Since there is no good definition of a cyberwar, if one defines it as a country's military or intel forces attacking another site to find a way in, it can be said that there are plenty of cyberwars going on around the globe with almost every country going against everyone else.
The cable people want their subscribers to use their broadcasting whenever they can. It brings them money, it doesn't use their Internet pipes, and ensures them TV ad revenues. For every show someone watches on Hulu and not as a prime time or pay-per-view special, the cable companies don't get a good chunk of revenue.
This is why cable companies drag their feet and wring their hands in front of Congress when their evil subscribers demand things like expanding their core/edge Internet structure to handle demands of current applications, or adding bandwidth and not additional fees or tiers.
Or ISPs amend their TOS stating that those boxes are "a clear and present danger to their infrastructure", and automatically ban accounts running them. Detecting them would be a cat and mouse game, but generally in a game of cat and mouse, the cat wins.
Partisianism aside, this is a good thing. Security initiatives are not going to be coming from the business sector because security has no ROI [1]. So, the only real origin of more robust tools to keep the blackhats out are going to have to come from governments.
Of course, my fear is that this security initiative (meant to keep data safe from being exposed, or worse, tampered with), may turn into funding for nastier DRM. Mainly because DRM does seem to have a ROI attached to it while security in general doesn't.
[1]: Of course, security saves money, but to a PHB, they don't really know or care that expanded security means that trade secrets keeping a competitive edge are safe. Couple this with the attitude of a lot of SMBs that "gee, if I get hacked, I can call Geek Squad 24/7 and they can fend off the hackers", and it is just shameful for a lot of the private sector. Not all, there are a few companies who actually keep their flies zipped up, but unless a regulation forces a company to keep data secure, it just won't be done.
Ideally, the networks should be on a backbone which can piggyback over Internet connections, but by using half-routers that already know each other and use preshared symmetric keys (so even if RSA is broken, the communication going across the pipe is still secure unless someone hacks the endpoint.)
The US government has learned this (NIPRNet and SIPRnet), maybe businesses need their own backbone that is separate from the Internet.
Apple makes money because of the ecosystem involved. It is in their financial interest to keep older devices updated, because it means customers continue to buy from their App Store.
It is in Google's interest to keep providing updates as well for the same reason. However, the real sticks in the mud are the cellphone makers and the carriers. They hate the thought of upgrades because they don't make money from app stores, only from handset turnover.
This isn't really Google's fault. I'm sure that most of the devices out on the market that hardware wise could easily support 2.4 will never receive an official update to it, other than Google's, and at best, the ROM makers will have to kexec in the new functionality, assuming there isn't a mechanism that prevents that from happening.
It is sad these days, but the only Android phones worth buying are the ones from Google due to signed kernels, e-fuses, and other crap.
The problem with WP7 is that it "too little, too late". Instead, Microsoft should have seen about virtual machine technology so people could run most WP6.5 and earlier programs (technically not apps because they have been present before the word "apps" came into use), and direct access for XNA and Silverlight programs.
With the ability to use older programs in a VM, or perhaps different VMs, Microsoft would have the best of two worlds: An installed base that dates over a decade, and a new platform with good security present.
Ideally, MS should have required some GPU power in the devices and get some Xbox developers to ship some eye-popping games for that platform. For the enterprise, MS should have shipped the device with Exchange support and documents running in its own encrypted VM, security that would run rings around RIM's offerings.
WP7 has a lot of promise, but because it didn't ship with things that would get the enterprise to move to it from Blackberries, nor get people out of the iOS walled garden, it sort of fell in the cracks.
I beg to differ. The iPhone at launch had a lot of good items, but it didn't have in iOS 1.0:
1: Cut and paste. This didn't come until 3.x. (IIRC) 2: Third party apps. 3: Device encryption. 4: More than token Exchange support.
Android came with a bunch of things, and the improvements were more incremental than anything else. Of course, Android did not have Exchange support, but third party companies (NitroDesk and DataViz come to mind) promptly addressed that.
Neither phone OS was shipped perfect. Both are adding features and useful things as time goes along.
What is funny is that the Exchange security has been addressed by a solid Android app: Touchdown. This app encrypts all data, even files present on the SD card, supports remote wipe, enforces Exchange's permissions, and does what enterprises need for enforcing security.
There is only one item missing from Android, and that is device encryption, and encrypting data (not just the.apk stuff) on the SD card.
Google can easily address this -- LUKS or EncFS for the SD card, store the key in/etc, perms 066.
Slashdot Mirror
Even if users print out a paper copy, how can we know if it was intercepted and tampered with before it went to the printer?
The ONLY solution to this that has any security whatsoever is a ZTIC-like device that unlocks with a PIN, and hooks up to the user's computer. This way, the user votes and confirms on the ZTIC, and the only thing the computer sees is the encryption transaction passing through.
In the days where there was one sysadmin running a herd of machines, just logging in as root was A-OK, so logging in and su-ing to root would slow things down.
Times have changed though. Accountability logs, even ones that are gotten around by using sudo -i or sudo -s are a must have in a lot of corporate environments to please the auditors. Client or regulatory requirements might require separate accounts for admins, so a box that only has just a root user is not allowed in a lot of places; it has to have the user's admin ID and the root user at the minimum.
Personally, I feel better using sudo. It may not be "manly", but it does minimize the amount of time a "#" prompt is on the screen, which in the overall picture of both footshooting and security, is a good thing. Having a proper audit trail is also a good thing when it comes to CYA ability.
Even worse:
ALL: NOPASSWD:ALL
The only place I expect to see this is the sudoers file of my iPhone, because I have an obnoxiously long (>64 characters) root and mobile password on my device.
So true. For example, if the app servers pop up before the database servers or the network fabric, it might be that the apps will need restarting manually, or at worst, the apps will eat themselves, requiring a restore.
This is why I like having machines stay off it a power failure happens. This way, I can get the network fabric up, then the main services (DHCP, DNS, ACE, AD), then the databases up (and their containers checked for errors). Then the application servers (WebSphere, custom stuff, SAP). Finally the external Web servers.
I'm sure there are some. There are still some Novell 3.11 and 3.12 boxes still out there, so finding a 486 running Jolitz's 386BSD as a gateway might not be out of the question.
I have seen dicey stuff in production systems as well. The problem is when people confuse "it works" with "it works at a production level". For example, Exchange running on a cast-off $300 machine bought from Wal-Mart might be suitable for a home network, but if it is needed for business production use, one needs a lot more hardware.
Disclaimer: Not all school districts are like this. However, a lot are.
It is more like a vicious circle. Parents with justified issues are completely ignored by the school board muckety-mucks until they start having to get "loud" enough to be heard by having to threaten litigation, or actually start hauling school officials into court.
Schools retaliate by adding more and more paperwork to cover their derrieres, and start adding more levels of bureaucratic crap, to try to make themselves more deaf to parents and students.
So, it ends up that having to retain counsel becomes second nature with the thick-headed school districts as opposed to actually being able to voice concerns and have some action taken in the first place.
Of course, there are the idiot parents as mentioned above who have their kids beat people up, and then said parents get mad because their little darling is in the in school suspension room. However, school districts don't address either type of parent (the bad ones, nor the ones that have legitimate issues), and try to bury themselves in paperwork.
The best thing for the US education system? Well, funding comes to mind first of all [1]. It might be nice for something other than football stadiums to receive grants [2]. It is absolutely laughable how pathetic the school system here is compared to almost any other developed country. It can be debated, but probably one of three options is needed:
1: Go with a system similar to Germany, let each state have its own schooling ability, overseen by the Federal government.
2: Go with a voucher based system similar to France, and let schools compete for students, assuming the schools are accredited.
3: Try to fix the existing school district system here in the US without throwing the baby out with the bathwater, and not doing brain-dead things like No Child Left Behind either.
[1]: Funding to college level. An American has to get $50,000+ in debt to finance four years of college unless they are lucky to have savings, or a fat trust fund. Their competitor coming from Chile, Venezuela, China, or India? Their entire education was financed by their government, so they have no worries about finances once they get their diploma.
[2]: Where I live, high school football stadiums are starting to have skyboxes. Districts which barely can keep their vital services running ask for bond money so they can rebuild their 5 year old stadium with a bigger Jumbotron so they can be on par with the small town down the road.
Sometimes one wants the drive to erase ASAP, and they might not have time to pop a jumper.
Instead, perhaps a compromise system, where the drive can be set in a multiple security modes:
Mode 1: Password + master one. Good enough for most users, and if the user loses their PW, they can call support with a serial number, and with enough proof, get a one time unlock code.
Mode 2: Erase data after x amount of bad password attempts. The drive controller would zap the key it uses, generate another one, and start again.
Mode 3 is what the PP suggests. Have a fuse and a routine on each flash controller that blows, blocking read/write access to the cells, and the controller would just sit there writing alternate 1s and 0s (or whatever pattern) until depowered. Alternatively, have the memory that stores the encryption key be blown out via fuses first. This way, it would take uncapping with a chip fab to even have a chance at getting to the data.
The problem is that the ATA commands are there, except there are no utilities available or maintained today that can use them. There used to be a tool called HDDErase, but it requires MS-DOS and a floppy drive for use.
What would be nice is to have the ATA erase command standardized, so this can be easily done.
Command gets handed to the drive controller, controller does the erasing the right way, where on a hard drive, it zeroes out sectors, even the ones on the bad sector relocation table, and sectors marked as bad. On a SSD, it zeroes out everything regardless of the status with regards to wear leveling.
Even better would be having the drive controller encrypt all data, storing the key as a value in NVRAM. Then when it gets handed an erase command, it replaces the key stored with one randomly generated.
Even better would be to have the drive controller to have its own free space bitmap. After being zeroed, if a sector is read without being written to, the controller returns just zeroes, regardless of the actual data present. If the sector was written to, the controller marks it as used in the bitmap and then returns the sector's data on subsequent writes. This way, an erase command can be almost immediate (flagging everything in the bitmap as free), and outside of yanking the controller and looking at the platters/cells, there is no way to retrieve the data that was erased. Bonus points if the controller zeroed out data in the background.
Ideally, Java should come as a .MSI or .MSP file. I don't like how it tries to foist a third party program on you when updating. Nor do I like having to deal with third party installers which means another program that has to have admin level privs on a system.
Plus, MSI/MSP files mean it is easily pushed out centrally.
I'll take the repos where the Web browser can scan both default and user specified repositories for updates over having every single program, plugin, and code chunkie having a separate update mechanism.
With so many update mechanisms, there are so many links that can become weak links in a security chain that program security becomes unwieldy. If a blackhat manages to compromise some browser addon's update mechanism, and the addon can get user (or even admin) context, it means the blackhat just obtained themselves a multi-million PC botnet with users unable to do anything about it.
The only thing that should update applications should be the OS, other than application data (levels in games, zones for a MMO, etc.) Why have every single program reinvent the wheel, as opposed to having a hardened OS mechanism do the dirty work.
This is the nice thing about repos, Apple's App Store, and Windows 8's store. If I want to tell a user to download an app, they just type it in on the store search, and download it. No website compromise, no Trojanized executables. It also increases the "hmm, I shouldn't really do this" barrier with websites asking a user to install dubious applications manually, as opposed to through a repo/store.
So, repos keep the chance of getting Trojans down, which is one of the bigger vectors of compromise. Leave the application updates to the OS.
Correction: Kudos to Google for using OS controls for additional security.
Yes, using OS specific security constructs makes a Web browser less portable across platforms, but it might be that some OS security mechanism may be the only thing standing in the way of browser compromise turning into complete machine pwnage.
On a larger scale, it might be time for OS makers to have some standardized security mechanisms, where a program can take advantage of them regardless if it runs on Windows, OS X, AIX, or OpenVMS.
The more browsers use the operating system security abilities, be it WIC, jail(), AppArmor, SELinux, or any other mechanism that reduces the privs a Web browser under, the better.
The battle for control of most PCs is going to be fought at the browser and browser add-on level. This is one front that really needs defense in depth, from browser add-ons being in a separate context from other objects, to a browser tab or window not being able to access other windows, to a browser not being able to get normal user (or even worse, root/sysadmin/QSECOFR context.)
Kudos to Chrome for working on advances with keeping things separated/sandboxed. A Flash or other scripted app that can record keystrokes only can record those typed in its window of the Web browser, and can't record anything if the user is using another window or another program.
With clued people, there may not be convincing evidence.
However, in a jury trial with the DA throwing the book at you for a lot of computer trespass charges, convincing a jury of that is a lot harder.
We all have dealt with the Joe Sixpack archetype. He calls you on the phone demanding you "fix" his computer. Because he is either a friend of someone you care about, or otherwise can't tell him where to stick it, you go over. You make it past the baying mangy hound menagerie, avoid the cans of Bud Light on the front porch, hold your breath as you round the TV area that is permanently turned onto Fox News, and narrowly dodge the gun cleaner oil perched precariously on a table.
Finally you get to his computer. The copy of AV software has expired (or never been activated.) You see the hard disk light constantly on even though the box is idle. Further prodding finds that a reinstall is a must because iexplorer.exe and explorer.exe got corrupted and replaced by something. The recovery partition? Completely corrupted.
You ask Joe for the install media. He never made the install CDs (if he bought the box from most PC companies), or he lost the media (if he bought a Dell). You ask him about backups. He tells you that if he backs his pickup up any more, it will smash into the wall. You ask him about saved images of Windows. He wonders why you want pictures of stuff found in a Pella or Andersen catalog.
End result is that you tell him to buy some install media. He ends up stopping by Best Buy and just buying another computer. You help him get the new machine set up and browsing the NSFW stuff (the computer's primary use), and almost certainly, the cycle will begin again in a few months.
Now picture twelve of these types of people who have zero clue about computers. They are deciding your fate, and they have possibly the rest of your life in their pork-rind stained hands. The DA will tell them in the opening/closing statement that you trespassed electronically, and the jury will just rubber stamp that verdict and the sentence time asked, because they don't know better. They will dismiss the defense as greasy nerds with "ass-burgers syndrome" who are trying to spout meaningless technobabble in order to get a disgruntled employee off the hook.
It just pays not to log in at all, whatsoever to an ex-employer without permission. It also pays to use a strong password, so you are not kept up at night wondering if a cracker would get in and get you blamed for it.
This. If you are good at the IT job, your work is invisible. However, one needs to make sure they are not invisible, mainly by proactively checking with other cow-orkers and departments to see how things are running, anything possible they can get, etc. This way, you have a presence.
I have seen companies fire their IT guys who have extreme clues because they thought that they could get someone cheaper to run things, then their whole infrastructure collapses with the guys they hired on to replace the veteran IT people barely able to do firefighting duties. Said companies end up with two choices, either finding another veteran IT person that they likely will end up paying far more, re-hiring the guy they fired (assuming he or she would ever bother to come back), or re-hiring the fired person as a consultant for a lot of cash.
Here is the ironic thing: The PHB who has the MBA goes through courses like ITIL/ITSM concepts where they have to pass concepts like this. So, the concept assuming that the IT infrastructure would work perfectly by jettisoning veterans was taught to them that it won't work.
An intrusion attempt is an intrusion attempt, be it by a dedicated tiger team doing a pen test, some guy living in Elbonia testing his skillz, an enemy country with their intel arm probing for weaknesses, a criminal organization looking for organizations with their fly open to use as staging points for botnet C&C servers.
An attack is an attack, and an exploit check is an exploit check. Who is doing it matters less than handling it, be it someone checking if the ssh daemon is buggy, or someone calling the front desk pretending to be the CEO and demanding a password.
Ideally, people need to not focus on *who* is doing the attacks as the primary concern, but the attacks themselves.
Since there is no good definition of a cyberwar, if one defines it as a country's military or intel forces attacking another site to find a way in, it can be said that there are plenty of cyberwars going on around the globe with almost every country going against everyone else.
Agnostic?
The cable people want their subscribers to use their broadcasting whenever they can. It brings them money, it doesn't use their Internet pipes, and ensures them TV ad revenues. For every show someone watches on Hulu and not as a prime time or pay-per-view special, the cable companies don't get a good chunk of revenue.
This is why cable companies drag their feet and wring their hands in front of Congress when their evil subscribers demand things like expanding their core/edge Internet structure to handle demands of current applications, or adding bandwidth and not additional fees or tiers.
Or ISPs amend their TOS stating that those boxes are "a clear and present danger to their infrastructure", and automatically ban accounts running them. Detecting them would be a cat and mouse game, but generally in a game of cat and mouse, the cat wins.
Partisianism aside, this is a good thing. Security initiatives are not going to be coming from the business sector because security has no ROI [1]. So, the only real origin of more robust tools to keep the blackhats out are going to have to come from governments.
Of course, my fear is that this security initiative (meant to keep data safe from being exposed, or worse, tampered with), may turn into funding for nastier DRM. Mainly because DRM does seem to have a ROI attached to it while security in general doesn't.
[1]: Of course, security saves money, but to a PHB, they don't really know or care that expanded security means that trade secrets keeping a competitive edge are safe. Couple this with the attitude of a lot of SMBs that "gee, if I get hacked, I can call Geek Squad 24/7 and they can fend off the hackers", and it is just shameful for a lot of the private sector. Not all, there are a few companies who actually keep their flies zipped up, but unless a regulation forces a company to keep data secure, it just won't be done.
Ideally, the networks should be on a backbone which can piggyback over Internet connections, but by using half-routers that already know each other and use preshared symmetric keys (so even if RSA is broken, the communication going across the pipe is still secure unless someone hacks the endpoint.)
The US government has learned this (NIPRNet and SIPRnet), maybe businesses need their own backbone that is separate from the Internet.
Apple makes money because of the ecosystem involved. It is in their financial interest to keep older devices updated, because it means customers continue to buy from their App Store.
It is in Google's interest to keep providing updates as well for the same reason. However, the real sticks in the mud are the cellphone makers and the carriers. They hate the thought of upgrades because they don't make money from app stores, only from handset turnover.
This isn't really Google's fault. I'm sure that most of the devices out on the market that hardware wise could easily support 2.4 will never receive an official update to it, other than Google's, and at best, the ROM makers will have to kexec in the new functionality, assuming there isn't a mechanism that prevents that from happening.
It is sad these days, but the only Android phones worth buying are the ones from Google due to signed kernels, e-fuses, and other crap.
The problem with WP7 is that it "too little, too late". Instead, Microsoft should have seen about virtual machine technology so people could run most WP6.5 and earlier programs (technically not apps because they have been present before the word "apps" came into use), and direct access for XNA and Silverlight programs.
With the ability to use older programs in a VM, or perhaps different VMs, Microsoft would have the best of two worlds: An installed base that dates over a decade, and a new platform with good security present.
Ideally, MS should have required some GPU power in the devices and get some Xbox developers to ship some eye-popping games for that platform. For the enterprise, MS should have shipped the device with Exchange support and documents running in its own encrypted VM, security that would run rings around RIM's offerings.
WP7 has a lot of promise, but because it didn't ship with things that would get the enterprise to move to it from Blackberries, nor get people out of the iOS walled garden, it sort of fell in the cracks.
I beg to differ. The iPhone at launch had a lot of good items, but it didn't have in iOS 1.0:
1: Cut and paste. This didn't come until 3.x. (IIRC)
2: Third party apps.
3: Device encryption.
4: More than token Exchange support.
Android came with a bunch of things, and the improvements were more incremental than anything else. Of course, Android did not have Exchange support, but third party companies (NitroDesk and DataViz come to mind) promptly addressed that.
Neither phone OS was shipped perfect. Both are adding features and useful things as time goes along.
What is funny is that the Exchange security has been addressed by a solid Android app: Touchdown. This app encrypts all data, even files present on the SD card, supports remote wipe, enforces Exchange's permissions, and does what enterprises need for enforcing security.
There is only one item missing from Android, and that is device encryption, and encrypting data (not just the .apk stuff) on the SD card.
Google can easily address this -- LUKS or EncFS for the SD card, store the key in /etc, perms 066.