Just a quick plug for a friend's new blog focused on Desktop Management, Microsoft Operating Systems and all things System Center.

Check it out!

Foundstone (who produce a bunch of great free tools) have released VDigger; a new VMWare hardening tool. I haven't had a chance to check it out yet.

Tripwire also have a free product called ConfigCheck that has been out for quite a while now, which I have used and can recommend.

I previously mentioned the VMWare hardening guide here.

An aussie hacker who was arrested back in July for infecting @2500 computers with a virus to steal banking and credit card information has plead guilty but asked for a reduced sentence as his actions wee 'youthful curiosity' and he 'was interested in becoming an internet security consultant'.

Are there any hackers who got arrested who didn't pledge to go straight and become an IT Security consultant? Now there's not alot of detail in the news articles about exacly what he did (did he write his own code, is he a script kiddie running something like Zeus, etc), but regardless, asking for a more lenient sentence after you commited a crime so you can become a security consultant - is that not something like being arrested for stealing cars because you want to be a mechanic or robbing a bank because you wanted to be a security guard?


I know there is a great precedent of those who were on the wrong side of the law, who reformed and have become security consutlants or security celebrities (eg: Kevin Mitnick, Kevin Poulsen), and it is a subject that has been well debated before. Would you hire a 'reformed' blackhat? Does it always "take a thief to catch a thief"? I'm not so sure...

The interesting thing about this case from an Australian point of view is that:

"The judge was told there had been no similar cases across Australia to guide him when imposing a penalty."

It will be worth watching closely to see what kind of sentence is handed out, and to compare it against  other parts of the world where these types of prosecutions have been more common.

I attended the AISA national seminar day earlier this week (which was a great day), and one of the panel discussions touched on whether there was a need for greater regulation or government intervention in IT Security. The prevailing view was that over-regulation would stifle innovation and government mandated minimum requirements would lead to businesses doing the bare minimum and no more.

I don't disagree with those points, but I do believe that Australia is stll behind the US/Europe in understanding Information Risk in the boardroom and one of the ways to make sure it gets on the radar and stays there is mandatory breach notification.

My view was somewhat echoed in a recent itnews story that made the good point that individual data breaches may be too small for authorities to really investigate but the implementation of a IC3-style centralized reporting body could assist in aggregating many small breaches into a large one and show a pattern of behaviour or negligence by an organization.

On a similar note I (re)discovered a link to a useful document that I had used in a Uni assignment last year that compares Data Breach Notification Laws around the world [pdf]. Although a little out-of-date (2009), it's still a great little summary.

On data breaches, there is of course Wikileaks. Wow. Infosec Island has a nice piece on how the forthcoming "megaleak" from a major US bank will be 'Enron-esque' in the fallout (if you haven't seen it, I recommend Enron:The Smartest Guys in the Room).

If it is as big as promised, it will be interesting to see the effect on corporate security (and is probably a great time to be a salesman with a good DLP solution...)

Now this [pdf] is cool. Data encoded into DNA in bacteria by a team from Hong Kong University - according to their slides they could encode 900TB of data in 1 gram (wet weight) of E.Coli bacteria! It even proposes an encryption scheme by shuffling DNA (a genetic caesar cipher?).

The ACMA are warning us that 30,000 Australian PCs infected every day. I wonder, are they unique infections? If so then if 78% of households have a computer and there are 7,600,000 households (roughly - 2006 figure) then every household should have one infected PC by 5th August 2011! (oops forgot to minus the 80,000 pre-infected machines, so that would actually be 2nd August 2011).

Are we really all that doomed?

This is interesting. While I can understand the US Government feels the need to 'do something' (a feeling common to politicians of all nationalities and sides), I'm not sure if a Government-mandated set of compliance rules is the best solution. Companies that have spend millions on SOX and PCI-DSS compliance have proven far from invulnerable to cyberattack or data breach. It not like the DHS can keep their own house in order as it is (although they have apparently been improving).

Of course if this does pass into law in the US, it will only be a matter of time before it being discussed here in Australia...