The Ashimmy Blog

Wombat Continues To Make Learning About Security Fun

I last wrote about Wombat a few months back.They are a company that was spun out of Carnegie-Mellon University and based on some work done under a US Government grant. Based on game theory, they had developed some really fun games that would teach people the do and don’ts of phishing. Now they have expanded beyond phishing to cover other areas of security. The games have also matured and are more contagious then ever.

After seeing Wombat’s phishing Phil and Phyllis last time I checked in with them, I introduced my 12 year old son Landon to them. He did a science project based on phishing and educating his classmates (and their parents) about phishing and wound  up with a 3rd place county wide finish in his project.

I spoke to Joe Ferrara, CEO of Wombat about their new offerings. Moving beyond phishing the team now has training on smart phone use, social media and creating strong passwords and password security.  Of course they still have phishing and email security as well.  Also Joe and his expanded team have moved beyond some of the cartoon figures in phishing Phil to a bit more sophisticated look and feel.  You can sign up for free demos of the products on their web site.

Best of all for Joe and Wombat, the market is warming up to their" “making security training fun” approach. They recently announced that food giant Del Monte had chose Wombat for their security training program for employees. Joe is growing the team pretty quickly at Wombat. Between ramping up the sales team, as well as adding new modules and areas of training, Wombat is hopping right now.

It is good to see a security start up doing so well. Will keep watch on Wombat’s progress, but if you are in need of security training for your organization, you should give them a look.

Wombat, Putting the Fun in Security Education

I am always on the look out for new security companies that are doing things a little differently.  I came across a good one a few weeks back courtesy of my friend Liz Safran. The name of the company is Wombat and they are based in Pittsburgh, home of the Steelers.

Wombat specializes in information security education and training.  They are a spinoff from Carnegie Mellon’s renowned School of Computer Science. They have been funded by the US Army and the National Science Foundation. The cool thing about them is they make learning security fun.

Remember not everyone is so enamored with computer security.  Sure no one wants to be breached, but for most employees cyber security training ranks just ahead of a trip to the dentist.

Wombat takes a different tack. They make security training a game, literally.  Right now there training is concentrated on anti-phishing. The paradigm is a “Phish Guru” with anti-phishing Phil and Phyllis.  Yes it can be a little campy.  But the fact is if people learn while playing, it is a good all around.

That is exactly what Wombat is all about. Using games to educate.  They are already talking about branching out beyond the anti-Phishing education they do now. I can’t wait to see more.

There are plenty of companies that do security education and with most it is a question of giving out a security handbook that quickly gets buried under a pile of other stuff.  Wombat is making security education fun.  You should check them out!

Help A Student With Her MMIS In Infosec

A local student here in South Florida needs some help. Renata Bergman needs some C-level, preferably CISOs to fill out a survey about what constitutes a “worthwhile security compliance program”.

Renata is seeking:

C-level executive’s viewpoint:

· Their “take” on what security governance is.

· Recommended reporting structure for best success

· Ideal governance model(s) recommended

· Challenges and constraints in evolving a functional security governance program

· Best practices to assure organizational security culture

· What works best for governing security?

· Components of “model” program, budget recommendations, etc.

· Experience with what works best

· Measuring the success of security governance in an organization

· What are the key elements of security governance?

You can download the questionnaire here. All information will be kept confidential.  Renata is a great person and really needs the help. So if you can please lend a hand!

What Classes Are Actually Required For A BS in Network and Security Administration?

When I wrote last week about Champlain College sponsoring the SBN to help promote their Network and Security Admin program a few people wrote me and wanted to get an idea of what type of classes would be in such a program and what classes would be in the certificate program for security. I’d think some of these classes would be standard on an online IT degree program.

I asked Bob Green, the Assistant Dean at Champlain about it and he gave me the following suggested courses for the both the BS degree and certificate courses:

For the BS Degree:

Curriculum

 

	Code	Course Title	Credits
Information Technology Courses
	CIT 130	Introduction to Networking and Security	3
	CIT 135	Introduction to Computer Theory	3
	FOR 270	Anti-Forensics & Network Forensics	3
	FOR-240	Computer Forensics I	3
	NET 140	Operating Systems	3
	NET 215	TCP/IP	3
	NET 230	Telecommunications	3
	NET 250	Windows Server	3
	NET 260	Linux/Unix System Administration I	3
	NET 330	Network Design	3
	NET 350	Windows Server System Administration	3
	NET 360	Linux/Unix Systems Administration II	3
	NET 415	Wireless Networking	3
	NET 450	Senior Thesis Project	3
	SEC 250	Computer and Network Security	3
	SEC 335	Software and Web Site Security	3
	SEC 350	Securing Enterprise Network	3
	SEC 420	The Business of Information Security	3
	WEB 125	Web Development I	3
	---	Technical Elective	9
		Subtotal	66
General Education Courses
	COM 130	Interpersonal Communication	3
	COM 270	Intercultural Communication	3
	ECN 205 or ECN 210	Micro or Macroeconomics	3
	ENG 111	Critical Reading & Expository Reading (CREW) I	3
	ENG 112	Critical Reading & Expository Reading (CREW) II	3
	ENG 315	Writing in the Workplace	3
	MGT 260	Project Management & Team Leadership	3
	WRT 231	Technical Writing	3
	MTH 180	Statistics	3
	PHI 340	Ethics in the Professions	3
	PSY-100 or SOC-110	Intro to Psych or Intro to Soc	3
	---	Literature Elective	3
	---	General Elective	2
	---	Fine Arts Elective	3
	---	History Elective	3
	---	Social Science Elective	3
	ACC-130 or MGT-2XX	Fin. Acctg or Fin. Sys for Mgmt	3
	---	Lab Science	4
		Subtotal	54
		Total	120

 

Technical Elective Options for the Networking and Security Administration Program

 

Technical Elective Options
	NET 490	Internship	3
	EBC 460	Internet Issues and Strategies	3
		Networking Options
	NET 460	Linux Scripting	3
	NET 335	Routers (Summer or Inter-session on-campus offering)	3
	NET 340	Network Operating Systems (Summer or Inter-session on-campus offering)	3
		Web Options
	WEB 225	Web Development II	3
	WEB 265	Implementing Web Media	3
	WEB 325	Client Side Scripting	3
	WEB 320	Server-Side Scripting	3
	SWE 200	Relational Database	3
	MMG 210	Digital Interactive Design	3
	WEB 200	Relational Database/Web Applications	3
		Computer & Digital Forensic Options
	FOR 340	Computer Forensics II	3
	FOR 350	White-Collar Crime	3
	FOR 360	Cybercrime	3
	CRJ 120	Criminal Law	3
	CRJ 121	Criminal Procedure	3

 

Information Security Certificate

 

Code	Title	Cr
FOR 240	Intro. to Digital Forensics	3
FOR 270 or SEC 350	Anti-Forensics & Network Forensics Securing Enterprise Network	3
NET 215	TCP/IP	3
SEC 250	Computer and Network Security	3
SEC 335	Software and Web Site Security	3
SEC 420	The Business of Information Security	3
	Total	18

 

Related articles

• Champlain Colleges Network and Security Administration Program (ashimmy.com)

Champlain College’s Network and Security Administration Program

I am happy to report that Champlain College is teaming with the Security Bloggers Network to bring their Network and Security Administration Program to everyone. You can take these courses either on campus or via Champlain’s online virtual program.

The College has been designated a National Center of Educational Excellence in Information Assurance Education by the DHS and the NSA. The program takes advantage of new technologies (e.g. virtualization and cloud computing) to make it possible for students to complete the degree online while having access to high quality server and network systems which they will be able to control in a way that is similar or better than what they would find in a typical lab environment. Students are able to connect to virtual labs located in the Champlain College Data Center where they will gain hands-on experience configuring networked virtual machines within a closed network environment. Students use a secure connection from their home computer to access the virtual lab, thus making it possible for them to safely practice network configuration and administration tasks without putting their home computer at risk.

In addition to the BS Degree program, Champlain also offers a certificate program in several areas including Information Security, Linux Administration, Security and Support and Computer Forensics and Digital Investigations.

This is a great program for anyone looking to get some formal training and education under their belt.

You can check out more details at http://online.champlain.edu/network-security-administration

Related articles

• SBN News (ashimmy.com)

A reluctant post on 9/11

NOTE: This is a repost of an article I wrote about 9/11 several years ago. I don't have anything else to add.

Unlike so many of my blogging friends (here, here and here, for a few examples), I was not planning on commenting on the 5th anniversary of that horrific day (and the weeks that followed). Unlike many of them, 9/11 hit too close to home in my case.  My wife's sister, Myrna Yaskulka worked in the trade centers for Fred Alger Funds.  She was a vibrant, fun loving, nourishing person, a mother of 3 sons, caretaker for her own mother and most of all a genuinely innocent spirit.  On that beautiful fall morning, we were still living in Long Island and I was working in Purchase, NY for Interliant.  I was about to leave for work, when I saw the news of the first plane and was just getting on the Long Island Expressway, when Bonnie called to tell me of a second plane and said I should come home.  I returned home and saw F-18 fighter jets buzzing our house.  I remember thinking they looked like angry hornets, loaded with missiles.

Though Bonnie was immediately concerned for her sister, I thought the law of averages would protect us and she would be fine.  By that evening we received word that no one from her sisters office had been heard from.  By then the roads into and out of the city were closed and Bonnie's mom was alone on Staten Island.  I actually "borrowed" my friends police badge and drove from Long Island to Staten Island to bring Bonnie's mom to our house as I expected the worse.  The roads were empty, except for other police officers and emergency workers heading into the city to help with the rescue.  I took the Verazano Bridge from Brooklyn into Staten Island and stopped midway through, looking into NY Harbor.  I don't remember seeing the lights on at the Statue of Liberty ( all the better, she was probably crying anyway), but I remember a clear view into a smoke-filled lower Manhattan.  It was eerie and angry and chillingly dark, except for the bright spot lights focused on where the towers had stood.  The fires were still burning and the smell was intense.  I remember stopping and thinking, Alan, take a good look and never forget what you see, smell and feel.  I got to her mom's place, took her and headed back out to Long Island, flashing my master shield whenever questioned (it occurred to me that terrorists could have done that too), we made it home and tuned into the TV like everyone else.

So started a 10 day period of mourning, mixed with hope and then finally despair and realization, that we would never see Myrna again.  We organized a memorial service that was attended by thousands, but was missing the guest of honor.  We never heard anything or found out anything more about how Myrna reached heaven.  Needless to say, 9/11 is always an ordeal in our house.  A scab that is ripped off a never healed wound.  I know the rest of the country shares our grief, but it just cuts so close to the bone for us.

So here we are 5 years later and we still have not delivered the fatal response I thought our country would to those responsible, (I don't think they live in Iraq).  We hear about rescue workers continuing to suffer from their efforts and we have tried to go on with our lives.  My youngest son is named for Myrna and whenever he dances or sings, he reminds us of how much she used to love to do those things.  We moved from NY to Florida to be nearer Bonnie's other sisters. Today they will gather together to remember their missing sister.  I am so touched by the many people who called and wrote, telling us we were in their thoughts and prayers today. I don't know what to say other than, thank you. I look forward to the new building to rise up on the trade center site. To the memorial to its victims and hope it will finally bring a little closure to this dark chapter.  They say history is written by the winners, if so I hope history recalls that 9/11 was the beginning of the end for terrorism, the beginning of the end of Islamic extremism and the beginning of the end for enemies of democracy and freedom everywhere.  Thank you all for your thoughts and prayers, God bless you for caring, God Bless my sister-in-law Myrna and the other victims of 9/11 and God Bless America!

AppSec USA 2010, September 7 to 10 at the University of California at Irvine

My friend Richard Greenberg of the Los Angeles County Department of Public Health and co-chair of the organizing committee for AppSec USA 2010 has asked me to pass along the following info:

Open Web Application Security Project (OWASP) announces AppSec USA 2010, the premiere web application security conference in North America

Los Angeles, California - July 9, 2010 - Open Web Application Security Project (OWASP) announces AppSec USA, which will be held from September 7 to 10 at the University of California at Irvine.

The conference consists of two days of in-depth training classes on September 7 and 8, followed by two days of plenary sessions on September 9 and 10. BOF (Birds of Feathers) sessions and panel discussions round out the conference offerings.

Jeff Williams, keynote speaker and Chairman of the OWASP Foundation notes, "Software is simultaneously getting radically more critical, complex, and interconnected. This creates a perfect storm for attackers, who are having a field day with our systems. We will never hack our way secure. Instead, we need to change the way we think about software, build software, and buy software. OWASP's audacious goal is to reach all developers everywhere and help them build rugged code - because our future depends on it".

Williams continues, "I've attended many OWASP AppSec Conferences, and they truly bring together the leading researchers, innovators, and community leaders to focus on application security in a free and open noncommercial forum. There's a fantastic sense of community and shared purpose. We encourage anyone interested in secure code to come and find out what application security is all about. Our 501(c)(3) not-for-profit status allows us to keep prices extremely low".

Another keynote speaker, Bill Cheswick, is a well known security researcher with AT&T Research; his very popular book Firewalls and Internet Security has influenced many security practitioners.

The third keynote speaker, David Rice, is an internationally recognized information security professional. Mr. Rice , author of the highly acclaimed book, Geekonomics, which promotes awareness of the true cost of insecure software, made significant contributions to advance the security of our nation's critical infrastructure.

HD Moore, the final keynote speaker, is widely acclaimed for his creativity and technical skills, and brings a distinct perspective to AppSec. Mr. Moore's best known contribution to the security community is the Metasploit Project, an open-source project which can be used to find vulnerabilities in computer systems in order to protect or exploit them.

Irvine, located in Southern California, is beautiful year-round and the UC Irvine campus offers famous architecture, a large park, art, and modern facilities in a pleasant environment. Irvine is situated in the heart of Orange County and is next door to Los Angeles, San Diego, and many other attractions.

Richard Greenberg, Co-Chair of Conference Organizing Committee, says, "If you can only get away from the office for one conference, this is it. We all are aware of the insidious exploits taking advantage of all types of application security vulnerabilities".

Greenberg continues, "We need to learn from the experts in order to counter the attacks - to build solid and secure applications. The knowledge we pride ourselves of amassing is insufficient to meet the new evolving threats. Only by sharing our collective wisdom and experiences can we realistically expect to protect our assets".

The conference is still soliciting sponsors of different levels.

For more information on sponsorship, or to register, please visit http://www.AppSecUSA.org or contact Kate Hartmann at kate.hartmann@owasp.org.

Sounds like a great conference. If you can make it, you should check it out!

The road to perdition is paved with good intentions

So Captain Privacy, my friend Martin McKeay has reacted with the expected outrage over the disclosure that a school district in Pennsylvania had installed “spying” software (not spyware mind you, spying software) on some school issued laptops. I won’t bore us all with a recap of what the Lower Merion School District did. You can read the summaries of it here and here, if you  have not already heard the facts.

Let me start off by saying using the spying software for any thing other than the legitimate use of tracking down a stolen or lost laptop is wrong! If anyone were to do that, especially without notice to an innocent party, let alone a minor, they are guilty of abuse of power.

But before we go off and castrate the school officials involved and as Martin says those “. . . who instigated and ran this program need to lose their jobs; they obviously don’t have enough of a moral compass to understand the difference between right and wrong and have no right to be working with children and teaching the next generation.”

The people who thought of installing this software may not even be the people who used it. It was a perfectly reasonable assumption they made in any event. In case the laptops were stolen or lost, wouldn’t it be great to be able to find out where they are. 

The idea of “spying” on kids when the laptops weren’t stolen was probably just not given a lot of thought. As one of the first school districts to give out laptops to all the children, there was no “book” for them to follow. They were kind of making it up as they went.

Yes this program left open the possibility of abuse in the wrong hands. We would think that school officials would be sensitive to the rights and privacy of minors. We also trust police officers not to violate the rights of the criminals. We trust soldiers not to torture POWs. Sometimes that trust is misplaced. Sometimes people disappoint us when we have trusted them.

The thing about this case though is that much of Martin’s hand wringing is over what could have happened. Only one incident of what did happen. Do we now live in the world of the “Minority Report”, where the thought police are going to prosecute people over their thoughts or worse yet over “what could have happened”.

As much as I don’t want to give up my privacy, I don’t want any thought police or prosecutions over what could have been.  Martin and the mob has jumped to worst case scenarios without knowing who these people are, what safeguards may have been in place or anything else.

At the end of the day, anti-theft measures for school owned property is a good thing. This program did not seem to have the proper checks and balances in place to prevent any potential abuse which might have, but did not necessarily occur.

Other school districts should learn from it, but should not be dissuaded from handing out laptops to kids or installing anti-theft technology. I am glad Martin’s kids don’t need to take any computers home. But I assure you that there are millions of kids in the country who do!

Related articles by Zemanta

• Spying defies belief (computerworld.com)
• Laptop-Spying School District Superintendent Covers Ass By Claiming Security Feature [Privacy] (gizmodo.com)
• School backs off on laptop spying policy in wake of lawsuit (arstechnica.com)
• School: Webcams used only on missing laptops (msnbc.msn.com)
• School Watches Kids on WebCams (momblognetwork.com)
• Pa. School: Webcams Used Only on Missing Laptops (abcnews.go.com)
• School district: Spy Webcams activated 42 times (news.cnet.com)
• US school accused of web spying (news.bbc.co.uk)
• The Pennsylvania School Spycam Story Grows More Complicated (abovethelaw.com)
• FBI said to be probing Pa. webcam case (msnbc.msn.com)
• School allegedly uses students' laptop webcam for espionage, lawsuit ensues (engadget.com)
• Hey Teachers, Leave Them Kids Alone! (trueslant.com)
• Pa. school: Webcams used only on missing laptops (seattletimes.nwsource.com)

InfoSec Institute buys Intense School assets

This blog has become something of a clearinghouse regarding Vigilar’s going out of business and the Intense School tragedy.  I am happy to report some good news today.

Jack Koziol of the InfoSec Institute wrote me to report that InfoSec Institute has purchased the assets of the Intense School. A notice on the Vigilar site is up confirming this as well.

Jack assures me and the notice on site verifies that most of the Intense School teachers have been retained as well as the courseware and other methods, assets and IP of the Intense School.

This is certainly a happy ending to a crappy story for many of the students and teachers at Intense School.  InfoSec Institute has a great reputation.  Here is wishing them luck in continuing some of the great training that Intense School provided.

I would be interested to hear from students of the old/new program as to what their experience is.

Related articles by Zemanta

• Message from Barry on Intense School (ashimmy.com)
• Are the Vigilar / Intense School instructors getting paid? (ashimmy.com)
• Looks like Vigilar is toast (ashimmy.com)
• Even more on Vigilar and Intense School (ashimmy.com)

Rogue software support from Software-HQ certified by Trustwave

In a recent podcast with Mitchell, he and I were bemoaning the fact that it is just so hard for non-technical users to not get gamed or scammed on line. One of the type of scams I hate the most is the rogue AV and rogue security software scam. What a kick in the butt. Using fake security software to infect a computer.

Tonight I came across another type of rogue software I want to call out. What made this one worse is that Trustwave is certifying these folks. What these people are doing is wrong, Trustwave giving them a seal of approval is worse though. Did anyone at Trustwave even check this out? Come on now, I would expect more from Trustwave!

It all started when I realized that my Windows 7 install did not have Windows Media Player. I did a search for Windows Media Player in Bing (BTW, Google didn’t have this link, I checked later). The first link in Bing, which is I guess a paid link was for a site that advertises Windows Media Player 11. The blurb says download Windows Media Player 11 – 100% guaranteed. I clicked the link and went to a domain at http://mediaplayer.11-now.com/. It had a very Microsoft look and feel, though it did have a disclaimer down at the bottom. There are two big click to download buttons and I did. Instead of download though I was taken to a page for an order sign up.

Turns out they want me to pay 19.95 for the year or 12.95 a year for 3 years. For this they are going to give me:

Technical Support When You Need It

Awesome "Up to date" Flash Tutorials

Unlimited Software Downloads

Complete Downloads

Never Pay a Download Fee

Instant Access After You Sign-up

Access to the Hottest Software

This service is run by a company called Software-HQ and their domain is http://www.software-hq.net.  They claim to have all of the hottest software for you to download. Programs like Winzip, Paintshop Pro, Ifran and more. All shareware programs that you can download anywhere on the net. If you buy these programs and register them, the makers of the program offer you support. So what exactly is software-hq giving? Ice cubes in winter that’s what! They are going to let me have unlimted software downloads, that are complete and the latest versions? Right after I pay them they will give me instant access to these hard to find programs? Stop! Stop! Stop! This is ridiculous.

Think of some of your relatives who might be duped by this and turn over the 20 bucks. Do you think they are getting value? I don’t think so, I think it is just another rat hole on the Internet that needs the light of day shined on it.

Trustwave what are you doing certifying this? Would you certify a ham sandwich? Where is the quality control here? You are a security company supposedly, you should know better!