Jon Udell: Security

Homeland Insecurity

8/2/2002; 5:58:44 PM

The September issue of the Atlantic Monthly has a remarkable special report called Homeland Insecurity (not yet excerpted online). It features none other than Bruce Schneier. I am delighted to see Schneier's philosophical transformation -- from crypto-infatuated fortress builder to pragmatic watchguard -- detailed in a mainstream magazine. People who would never have read Secrets and Lies will read this excellent article, and I hope will ponder Schneier's message: ...

OASIS and WS-Security

7/23/2002; 10:43:41 AM

Under the OASIS umbrella, more folks are linking arms to support WS-Security: ...

Web services security and XML pixie dust

7/2/2002; 11:14:48 AM

It's an article of faith right now in the web services realm that security is the major roadblock. We're all sitting around drumming our fingers on the table, the story line goes, just waiting for consensus to emerge from that cloud of dust the standards-makers are kicking up. ...

Triangulating on k-logging for homeland security

6/18/2002; 12:57:27 PM

Hey, this was top news in my own magazine. Cool! ...

Blogging and homeland security: connecting the dots

6/12/2002; 8:19:47 AM

Sunday's New York Times featured a disturbing story on the IT culture clash between Google and the FBI: ...

Managing credentials with Counterpane's Password Safe

5/18/2002; 3:50:56 PM

...

Security, insurance, and hard realities

5/15/2002; 8:23:52 PM

Here are some notes from Bruce Schneier's talk. Hard, cold realities. Microsoft and its peers don't care about security, he argues, because it's not rational for them to do so. As businesses, they shouldn't, because they're not liable for their practices. Schneier is running out of options, he says, and what he's left with is a two-pronged strategy. One, require businesses to use insurance to manage risk, just like businesses use it to manage all other risks. Two, beef up prosecution of computer crime. ...

PKI: no silver bullet, but not worthless either

5/15/2002; 2:35:08 AM

John Robb's comment -- certification isn't worth doody -- overstates the case. Despite exploitable flaws in the PKI/SSL infrastructure, I would rather transact business with a company that has identified itself to some third party than with a company that hasn't. ...

PKI and SSL: house of cards?

5/14/2002; 8:15:12 PM

Richard Forno, chief security officer for ShadowLogic, takes a dim view of the PKI industry. "Digital trust is a slick marketing tool put out by the PKI industry. DoD wants smartcards with certs by 2004. What's the value of that? I don't know. They don't know." ...

SOAP security and external underwear

4/9/2002; 11:01:32 PM

I'm sure Paul Kulchenko will soon fix the SOAP::Lite vulnerability that was just noticed. This episode got me to wondering, though, about the original rationale for the SOAPaction HTTP header, and what can or should be done to make filtering SOAP traffic workable. Several years ago, one of the original SOAP FAQs, from DevelopMentor, said: ...

myNetWatchman: neighborhood watch for the Internet

4/8/2002; 3:22:15 PM

Thinking about trust and social capital, in online communities, reminds me of the work of Lawrence Baldwin, the creator of myNetWatchman.com. As I mentioned in a column on broadband security, Lawrence takes issue with the attitude of personal firewalls toward the steady stream of malicious probes that they repel. That attitude can be summed up as: "Don't worry, this is just the background noise of the Internet, and we're shielding you from it." ...

2/2/2002; 2:26:07 PM

Hackers Hit Global Leaders' Summit. An invisible cyber assault has cut off access for the second day running to the Web site of the World Economic Forum, organizers of the gathering confirmed. [The New York Times: Technology] ...

1/22/2002; 7:22:14 PM

...

1/18/2002; 7:42:52 PM

...

1/18/2002; 5:44:01 PM

...