The Ashimmy Blog

The Sleazy Dark Side of Product Reviews

Yesterday I wrote in response to Bill Brenner’s Salted Hash post about the Google-funded, Accuvant conducted browser security study which found (surprise) Chrome on top.

In my post yesterday I mentioned that one company that I thought is doing product  reviews right was NSS Labs.  Well Rick Moy of NSS Labs wrote me last night, having read my post.  The NSS Labs folks have had a look at what was publicly available.

Vik Phatak, CTO of NSS Labs has a blog post up on the subject here. More importantly Vik and team have put out a more complete analysis of problems they see with the way this study was conducted and some issues in Google’s behavior. You can read the analysis here.

It is a very interesting read and you should take a look for sure.  It certainly raises some questions about what went on with this browser study and calls into question some very questionable practices by Google. 

It just proves that product reviews are a dirty business and why any reader has to look at and weigh all factors in deciding how much faith to put in them.

Related articles

• The Death of Product Reviews (ashimmy.com)
• What's the Most Secure Web Browser? [Security] (lifehacker.com)
• Chrome sandboxing makes it the most secure browser, vendor study claims (arstechnica.com)
• NSS Labs claims its new tool can detect all Duqu drivers (infoworld.com)
• NSS Labs Claims Its New Tool Can Detect All Duqu Drivers (pcworld.com)

The Death of Product Reviews

Image via Wikipedia

My friend Bill Brenner has a post up on his Salted Hash blog today about a recent browser security study done by Accuvant LABS. The study shows that Google Chrome was the safest browser tested. Like Bill, I use Chrome too and agree with the Accuvant study.

The problem for Bill is that the study was sponsored by Google, the makers of Chrome. The fact that they paid for this study in Bill’s mind and in many other people’s minds calls the legitimacy of the entire study into question. Even if it is correct, it just doesn’t sit well with Bill.

Frankly I have the same problems with most product reviews, bake offs, analysis reports, etc. I have written about this before as well. In my mind it is a big reason why no one seems to pay attention to product reviews anymore.

It doesn’t make a difference if it is an “independent lab” doing the testing, a magazine’s testing department, industry awards or an analyst firm analyzing the market, the first thing I look at is who is paying for it. Sometimes finding out who is paying for it is not so easy or transparent either.

To be fair, some firms like Securosis for instance will say upfront that some research they are doing is being financed by a paying customer. Such was the case when Mike, Rich and Adrian did a dive on “fact based security security metrics”. The boys said upfront and at the bottom of the page that they thanked Red Seal for sponsoring the research.

Now does that mean that everything they wrote was for the benefit of Red Seal? I know Rich, Mike and Adrian too well to believe that. But it does give me pause when I read the report to remember that fact.

But I will say that over time I have come to soften my attitude on this issue (I must be getting old). For me it is a case of forewarned is forearmed and I take that disclosure in terms of evaluating how much weight to give the research. The same way a juror has to weigh the testimony of a witness depending on their believability.

In the case of Bill’s browser study, same thing. The chances that Google had a heavy hand in the study by Accuvant is pretty low, but it is something to consider. That is just the way it is.

But for Bill and the other doubting Thomas’s out there, what is the alternative?

One alternative is what Rick Moy and the guys at NSS Labs are doing. They have turned this equation on its head. They make their money from the end user, so the vendors being tested have little to no influence.

As Bill says just because Google paid for it doesn’t mean the study is wrong, but it does give you something else to consider. But since no one wants to do these tests or studies for free, someone has to pay and that is the truth of it.

Related articles

• What's the Most Secure Web Browser? [Security] (lifehacker.com)
• Accuvant Labs: "Chrome is the most secured browser" (miguelalmeida.net)
• Chrome sandboxing makes it the most secure browser, vendor study claims (arstechnica.com)
• Which Browser Is Most Secure? A New Study Reports A Surprise (ostatic.com)
• Google-Funded Study Knocks Firefox Security (news.slashdot.org)
• Chrome Is Most Secure of the Top Three Browsers, Study Finds (pcworld.com)
• New study claims that Chrome is the most secure browser (zdnet.com)

Blogging is a Conversation

For those of you who may be wondering, yes there will be a killer Security Bloggers Meet up at RSA this year. There will also be another Social Security Blogger Awards with some new categories as well. More on those in another blog. But the reason I write today is something Rich Mogull said on our blogger meet up organizing committee call.

Rich said “lets face it, the security blogger’s community isn’t what it used to be”. While I don’t disagree with Rich, I went back and looked at some of the numbers and some of the security blogs. While Rich is right, we don’t see as many as blog posts from the community as we used to, I think we all agree that Twitter probably plays a significant role in that. In fact the Tripwire 25 most influential people in security list seems pretty skewed towards twittter users. But that being said, there are still plenty of security blog posts being posted. The SBN feed is still fresh with lots of new posts every day.

One thing I do see is many of the posts come from corporate security blogs rather than individuals. Many of the corporate blogs don’t develop the personality that a good personal blog does. More importantly what has changed is another thing Rich brought up. We don’t comment anymore. We don’t blog back anymore.

People are blogging and putting their 2 cents into the conversation, but no one is repsonding. Oh, maybe they respond on twitter, on but it doesn’t make it into the blog. Blogging has always been and will always be a two way street. A blog should be a multi-party conversation with the blogger putting forth his ideas and others responding. They can agree, disagree, or concur, but they put their thoughts into the conversation.

One of the great things about reading a hot blog post was following the thread of comments, that was where the real action took place. Whether it was a Rothman post on Security Incite/Securosis or Tom Pcatek on Matasano, a good threat with 50 comments kept you reading for more.

Now maybe Twitter is where blog comments have gone and some of the discussion. Can we have a plug in that captures the real time of twitter comments and discussions back to the original blog post? Doesn’t sound too hard.

How about writing a blog post in response to another blog post? That is part of carrying on the conversation as well. Need something good to blog about? Go look at what your community is writing and join in.

Adam Shostack over on Emergent Chaos has a post up about Threat Modeling as a result of a conversation he had with Wendy Nather, who has her own good blog post about “what your analyst wishes you knew” (and she is not talking about your psychoanalyst either).

I am going over to both of those blogs and adding my voice to the conversation. I already tweeted Wendy’s post, but I realize that is not enough. If we are going to keep the Security blogging community strong and vibrant we have to add our voice on blogs.

What about you? Are you ready to rejoin the conversation?  If so, head over to your favorite security blog and join in.  Or better yet, write a blog in response to someone else’s blog.  It starts with you and you and you.

Related articles

• Reasons to Blog: Guest Post! (lexisjen.wordpress.com)
• Email chaos: How to reach Adam Shostack (emergentchaos.com)

Steve Jobs: It can happen to you

Image via Wikipedia

First of all let me wish my condolences and sympathies to the family, friends and colleagues of Steve Jobs.  To say he was a visionary with a profound effect on the technology world for years to come, somehow comes up short to truly describe the genius of the man.

While I was never a big Apple fan, you have to admire what he accomplished in two different stints at the company. You also have to admire his vision in buying Pixar from George Lucas and turning into yet another multi-billion dollar property.

While there are no shortage of tributes and homages to Jobs being written tonight. I wanted to go on a slightly different path. That path is to challenge the next Steve Jobs out there to go out and grab greatness.

That is right, there might be more than one next Steve Jobs out there, there are even a few not Steve Jobs out there. But take the lessons of Job’s life and his advice, go out and make it happen.

This country, this world, humanity needs more Steve Jobs. We need them to imagine, create and give us ideas and products which will make the world better. To advance the human experience in ways that make us all better.

With all of the heartfelt sympathy pouring out about Steve Jobs now, I hope it does inspire others to be the next Steve Jobs.

There is also another lesson in this all to early death of Steve Jobs. That is at the end of the day, death is the great equalizer. It makes no difference how much money you have, how much of a genius you are or even how much good you did for your fellow man.  We are all here at the grace of God. When he decides it is time to go, we have no say, we obey. That is at the end of the day the ultimate human condition that not even Steve Jobs could avoid.

Related articles

• Rest in Peace Steve Jobs (shopify.com)
• Steve Job Passed On (it-sideways.com)
• Pixar Issues Statement on Steve Jobs' Passing (pixartimes.com)
• Celebs React to Steve Jobs' Death (justjared.buzznet.com)
• Steve Jobs Passed Away: Lessons Learned (dailyblogtips.com)
• Steve Jobs Dies At 56 (justjared.buzznet.com)
• Steve Jobs of Apple dies at 56 (workplacepsychology.net)
• Live Blog: Steve Jobs, 1955-2011: Share Your Thoughts (fool.com)
• Disney CEO: "Jobs Was Such an Original" (mashable.com)

How About A Schmear With Lo(x)cks

Having gone to my share of security conferences over the years, I have seen more than my share of the “uniqueness” of the security industry.  I passed through the stage of the large multi-color Mohawks, the piercings that set off the metal detectors at TSA stations in a 75 mile radius and yes even the attraction to wearing a good, old kilt to let things “air out” a bit.

Over the years I have always liked to watch at BlackHat/Defcon all of the lock picking stuff.  I wasn’t quite sure if it made sense for HackKid Con, but hey who am I to judge if people want their kids to learn to pick locks.

However, I just don’t see why we are seeing such large crowds around the lock picking table at the recent security shows I have attended.  I mean really. Is that what we as an industry should be putting our time and focus into?  At the same time we run around as Chicken Little about how hard and insurmountable our jobs are, we devote hours picking deadbolts and other locks?

Figuring that I am just an old crab (not a security curmudgeon mind you, that is reserved for old guys with long beards) I thought I would ask some folks what is with the locks? The variety of answers confirmed my thoughts.  Security people play with locks for the same reasons dogs lick themselves, that is because they can.

Here is a sample of some of the answers I heard:

1. Lock picking is sort of like security. It is about keeping people out from what you are trying to protect, so it is adjacent.

2. It keeps my kids interested in security and that is a good thing.  My kids need to know how these things work.

3. It is a great family fun activity

4. Security people love a good puzzle and picking locks is sort of like a good puzzle. It keeps us sharp

5. We fail so miserably at protecting our networks and data, it feels good to get a “win” when we pick a lock.

6. It is just a fetish and really has nothing to do with security at all (I respect the honesty)

So, as you can see the answers were a bit all over the map. This leads me to believe we are grasping at straws to justify our behavior.  So lets just say picking locks does not help us manage risk on our networks. But it feels good.

OK, now that we have that out of the way, why stop at locks?  Andrew Storm would like a Makers Fair at his security shows.  Misha Govshteyn would like a “foodie” table. Security shows are what we make of them.

Related articles

• VIDEO: Picking locks for sport (bbc.co.uk)
• Analogue hacking (bbc.co.uk)
• Picking Locks and Hacking Servers at Defcon (bits.blogs.nytimes.com)

If AT&T Really Gave A Crap About Customers

Image via Wikipedia

I had yet another eye opening experience today dealing with AT&T. It showed me once again why at the end of the day AT&T could care less about their customers and just want to grab as much money as they can.

Over the last year I have fired them from being my internet provider at home, my local and long distance phone company and even bundling my satellite TV through them. The only thing I am stuck with them with is our family cell service because we have iPhones from way back.

My son though doesn’t have an iPhone. I bought him an Android HTC phone a few months ago. Today his phone was stolen out of his backpack at school. We will dive more into that later on, but for now let me tell you about AT&T.

I called the 611 number and pressed the option to report a lost or stolen phone. Of course I couldn’t get a live person with that option. The only I could do was deal with the automated service to shut off the phone number.  I did that but it wasn’t good enough for me. I called back and didn’t fall into the automated trap. I got a live person on the phone and asked what we could do.

The rep told me that I could have signed up for a 10 dollar a month phone location service, but since I didn’t there was nothing they could do. I would have to pay data and phone charges on the account for the rest of the term of the contract.

I then asked what if someone brought my son’s phone into an AT&T store. Would they check and see the serial number was stolen? Like trying to register a stolen car. The rep said what a great idea, but no they wouldn’t do that. If someone wants to open an AT&T account they don’t care what phone they use. Can you imagine? They condone people using stolen phones.

Think about it. If they would have a stolen phone registry that was checked when phones were turned on, that would take the bottom out of the stolen phone business. But AT&T doesn’t care, so they won’t.

As it turns out the Android Market has a great free app called Plan B.  It installs over the air and locates your phone for you.  How cool was that.  Do you think the AT&T rep might tell someone reporting a phone lost or stolen about it? Nah, no money it for them.

As it turns out my son’s phone wasn’t stolen. It was hidden in the bottom of his book bag.  But that is not the point. AT&T should be better than this.

10 Years After, Anger

I was going to rerun the 9/11 post I wrote 5 years ago to commemorate the 10th anniversary of that terrible terrorist attack that took my wife’s beautiful older sister from her family. But I am not going to post that, you can read it here if you like.

Instead I want to write about a change of my world view with the passing of 10 years since that attack on our country and our way of life. Watching all of the 10 year anniversary stuff these past few days had a cumulative effect on me.  With each passing story of someone’s tragedy on 9/11, I grew more dark, more angry, more resentful.

On top of this I look around our world and realize that after 10 years of more families losing loved ones as they fight far from our own shores, what do we have to show for it? Yes we killed OBL.  We have even killed a decent amount of the leaders of the terrorists. But what have we really accomplished?

The system that spawned these monsters still exists. We have seen an “Arab Spring” overthrowing dictators in several Arab states. But what are they replaced with? We delude ourselves if we think pro-Western regimes are springing up in the MidEast.  Even Iraq where we have spent trillions of dollars and thousands of lives, is not a stable democracy.  As soon as we leave there, Iran will exert even more influence.  Egypt, that takes billions of dollars in aid from us every year is ruled by mobs that rape female journalists. Saudi Arabia, “our friend” in the Arab world buys off their people with the oil money they suck from our veins, but the kings of Arabia have a short horizon and are themselves radically out of line with our world view.

Afghanistan will be as twisted as it ever was on the day we finally leave there.  The fact is we have few if any friends in that part of the world. Lets stop spending our money trying to change an unchangeable fact. Lets not spill any more of our blood trying to make them “safe for democracy”.  We are going to be fighting a war against these anti-American, anti-Western foes for a long time. 

The Hamas, Hezbollah and the rest are not going to be made over, they are what they are.  We need to treat them as such. They are our enemies and we need to destroy our enemies. 

Let them build the next memorials to their dead and grieve for loved ones. I don’t want any more sacred memorials to our innocent dead here.

Is that harsh? Is that just? Frankly I don’t care, it is what we need to do.

Related articles

• Why They Hate Us (lewrockwell.com)
• Saudi Arabia's 9/11 legacy (salon.com)

Help A Student With Her MMIS In Infosec

A local student here in South Florida needs some help. Renata Bergman needs some C-level, preferably CISOs to fill out a survey about what constitutes a “worthwhile security compliance program”.

Renata is seeking:

C-level executive’s viewpoint:

· Their “take” on what security governance is.

· Recommended reporting structure for best success

· Ideal governance model(s) recommended

· Challenges and constraints in evolving a functional security governance program

· Best practices to assure organizational security culture

· What works best for governing security?

· Components of “model” program, budget recommendations, etc.

· Experience with what works best

· Measuring the success of security governance in an organization

· What are the key elements of security governance?

You can download the questionnaire here. All information will be kept confidential.  Renata is a great person and really needs the help. So if you can please lend a hand!

Marketing 2007 Security in 2011 or LCD Security Marketing

I was reading an interview with an executive from a nameless security vendor the other day and the point he was making was that their security products are necessary because “hacking is now a for profit enterprise”. How absolutely 2007.

Most of the examples of hacking incidents he brought up were attributed to LulzSec or Anonymous. Those are not examples of “for profit enterprises”. They were exactly the malicious and “to show we can” type of attacks that he said disappeared 15 years ago. Not to mention that while cyber-war, cyber-terror and cyber-espionage all have a “profit” in mind, it is not exactly the same “for profit" as the Albert Gonzalez gang stealing credit card data.

In fact recent attacks if anything show that we may in fact be entering a new era of hacking and security that calls the whole responsible disclosure and “ethical hacking” issues into a new light. So why talk about security drivers circa 2007 halfway through 2011?

At first I chalked it up to having people who really don’t have any security background and not living security being put in a position where they are forced to talk about it. But then I thought about it some more. It is more than just another empty suit talking about security, it is a chronic problem in the security industry.

I have heard it from other security executives too. When speaking to customers and the public they don’t think the audience is sophisticated enough to really “get it”. So instead of giving it to them straight, lets give them what they can understand. It is LCD (least common denominator) security marketing. Give them something simple enough that they can put their mind around it, that has examples that have already been established in the public consciousness. This way we don’t have to explain too much and we don’t have to open the kimono about our solutions being perhaps only an inch deep. KISS, keep it simple stupid. If only the world really worked like that though.

But why should we be surprised with least common denominator security marketing when too many security companies sell least common denominator security solutions. You know, the check box security that allows people to say they have complied, but leaves them defenseless when LulzSec and the like put them in their sites.

I think the whole thing is an outgrowth of the old enterprise security vendor approach of watering and “dumbing down” their solutions for the mid-market.  It didn’t work then and LCD security and LCD security marketing doesn’t work now. 

Yes, you may fool some people for some of the time, but you can’t fool all the people all the time and sooner or later it catches up with you.  The people and organizations relying on the security industry deserve better and we as an industry should be better than that!

Related articles

• Ethical Hacking for Lulz? (brighthub.com)
• AntiSec movement ENDED or begins NOW...! (rakhikankane.wordpress.com)
• LulzSec & Anonymous Step Up Cyber War (bigthink.com)
• Cyber Doctrine: Competitiveness is the Key to Resilience (policeledintelligence.com)
• LulzSec...a new era of hacktivism? (eheheheh.wordpress.com)

Should Your Clergyman Need a Disclaimer? Do They Speak For You?

Not security related at all but wasn’t sure where else to post this one.

I was at a very interesting meeting yesterday from the local synagogue I belong to.  The meeting was called by our Rabbi in regard to some controversy over an appearance he made on a local news show here in South Florida. He spoke about President Obama’s recent announcements regarding restarting the Middle East peace process. Our Rabbi, Richard Agler then followed up his TV appearance with a post on his own blog further explaining his position.

The fact that he actually supported President Obama’s view (in its entirety, not the sound bite) is really neither here nor there for purposes of this post. The point was that more than several people in our congregation were upset that he went “public” with his views and it was not clear that he was not speaking for the congregation, but instead expressing his own opinions.

The Rabbi convened the meeting in response.  My feeling is that speaking out from the pulpit whether it be Jewish, Christian, Muslim or other religion is a long held tradition. I think not only is it a right of a clergyman to speak out on issues important to his “flock”, but it is his obligation. 

Of course others do not agree. They wanted the Rabbi to put a disclaimer in before speaking to the media, much the way we bloggers do when writing that it does not necessarily represent the view of our employers. 

I think in the case of the clergy this is not practical and not the fact. The clergy no matter the disclaimer is of course going to be viewed as speaking for the congregation. In fact that is part of the job. Also do you expect them to preface every statement with a “I am only speaking for myself”?

This is certainly no a Jewish only problem. I think the same thing can be said when Catholic clergy speak out against abortion, birth control, etc.  In fact anytime a clergyman speaks on political issues it probably comes up.

One couple said they were thinking of leaving the congregation because they don’t agree with the Rabbi’s political views. It is certainly their right to do so and they should feel comfortable in their religious community. But should they really leave over this?

What about you? Do you think your clergyman speaks for you? Would you stay a member if you disagreed with them?

Related articles

• In Conversation: Rabbi Steven Chester (midlifebatmitzvah.wordpress.com)
• As Israel debates rage, Jewish professionals face employment repercussions (jta.org)