More inspiration on scenario thinking. I picked up another Michael Connelly thriller. I've read about 20 of his thrillers and almost al of them are hard boiled thrillers often with serial killers. In about 15 of his books Harry Bosch a LAPD detective is the main character. Harry doesn't know anything about computers and the way the books are written it is described as if it should be like that. In the other 5 books two of them the lawyer is the main character, one a journalist, one an ex-cop with a new hart, the brilliant Blood works and one a ex-con. In some of the books the different main characters meet, making feel like one sees different parts of the puzzle of crime.
In none of them computers or internet played a big role. But the books are a great read with a lot of pace and reasonable scenario's with a dark edge.
I was more than pleasantly surprised when I picked up "The scarecrow" and it starts with Due Diligence visit of CIO of a data hosting centre. Ok the Due Diligence check doesn't go as it should go, but the way it is described with a visit to a girly bar to settle the deal it might go the way it goes with some CIO's. At least that is my security officer view of it. But in the mainstream book with millions of readers, SAS 70 reports, SOX and Hipaa are mentioned too.
In the book a serial killer is running around and choosing his victims from the internet. He also uses the internet, social websites, public self service interfaces of credit card companies and company e-mail systems, to isolate the journalist that is chasing him. All threats that currently exist and could with some skill indeed be used. The journalist is the one that was in a earlier Connelly book the Poet. He just got fired from the job, because newspapers need to cut back on costs, very real life too.
What makes this book very useful for scenario descriptions for a board meeting is the fact that the security officer of the data center turns out to be a serial killer . (I'm not ruining your join of reading, this is clear from the start of the book.). Ok according to the book the guy is called CTO, Chief Thread Officer, a title I’ve never heard off, but this could also be used in some presentations. And the name of the book is related to the way CTO scares away hackers of the data center, a name I’ve also never heard in this relation.
Still that a main character of a mainstream thriller is a security officer must mean the profession still has future even though is a vicious killer. Wasn’t the main character in American psycho a stock broker, just before that profession became a Master of the universe ?
Showing posts with label scenario thinking. Show all posts
Showing posts with label scenario thinking. Show all posts
Saturday, 6 March 2010
Tuesday, 2 March 2010
Scenario thinking
To explain IT security risks to the business or customers it is good to tell a story. The story should take the listener into the story to explain why an IT solution has certain risks. The story shouldn't start with the "bigbang accident" that could to the system, but gradually taking the listener along its path.
*
Scenario thinking is part of architecture books like Software System Architecture - working with stakeholders using viewpoints and perspectives. The method of scenario thing is described, but one would need inspiration too. Popular literature could give this inspiration.
*
Lately a number of good samples were published as regular thriller stories. Daemon by Daniel Suarez is sold in Amsterdam bookstores in the Science Fiction section, but in fact it uses mainly of existing technology.
Core in the book is the use of VOIP systems that are activated by a daemon process, that scans the Internet news sites for certain news facts. When a certain news fact happens the Daemon using VOIP calls people and using voice recognitions lets them generate new news facts. So on and so forth. This part is the best part of the book. Existing technology "miss used" to break the system of society. The security specialists in the book use standard security technology to find where a daemon or Trojan is running. Off course the book also has its standard I don't understand and don't want to understand IT character, but allot of people in the book take it serious and are not putting IT security in the Geek corner.
The story further develops into a "Hollywood" Armageddon style in which "Autonomous Vehicles" and "Laser-Induced Plasma Channel Weapons". This is also based on existing technology, but for a simple IT person, just a bit too much. I like it better when it is not right away that the whole world is collapsing, but just the world of a few people. e.g. this part of the book would have been better if this was Hitchcock style instead of Bruce Willis. That is the way the first 200 pages develop.
But all in all the book to read for IT and specifically IT security people.
I'm not going to tell you how it ends, because I don't know. The IT consultant that wrote the book, was at page 1200 when he decided that two books might be better for sales.
The second part called Freedom, I still need to read. Hopefully this will give some inspiration for more scenario thinking too.
The fact that IT security is not just a "front runner thing: anymore. It is on its way into the mainstream. Hopefully IT business will follow on its path ......
*
Scenario thinking is part of architecture books like Software System Architecture - working with stakeholders using viewpoints and perspectives. The method of scenario thing is described, but one would need inspiration too. Popular literature could give this inspiration.
*
Lately a number of good samples were published as regular thriller stories. Daemon by Daniel Suarez is sold in Amsterdam bookstores in the Science Fiction section, but in fact it uses mainly of existing technology.
Core in the book is the use of VOIP systems that are activated by a daemon process, that scans the Internet news sites for certain news facts. When a certain news fact happens the Daemon using VOIP calls people and using voice recognitions lets them generate new news facts. So on and so forth. This part is the best part of the book. Existing technology "miss used" to break the system of society. The security specialists in the book use standard security technology to find where a daemon or Trojan is running. Off course the book also has its standard I don't understand and don't want to understand IT character, but allot of people in the book take it serious and are not putting IT security in the Geek corner.
The story further develops into a "Hollywood" Armageddon style in which "Autonomous Vehicles" and "Laser-Induced Plasma Channel Weapons". This is also based on existing technology, but for a simple IT person, just a bit too much. I like it better when it is not right away that the whole world is collapsing, but just the world of a few people. e.g. this part of the book would have been better if this was Hitchcock style instead of Bruce Willis. That is the way the first 200 pages develop.
But all in all the book to read for IT and specifically IT security people.
I'm not going to tell you how it ends, because I don't know. The IT consultant that wrote the book, was at page 1200 when he decided that two books might be better for sales.
The second part called Freedom, I still need to read. Hopefully this will give some inspiration for more scenario thinking too.
The fact that IT security is not just a "front runner thing: anymore. It is on its way into the mainstream. Hopefully IT business will follow on its path ......
Saturday, 6 December 2008
Application Separation Of Duty
Separation of Duty (SOD) is often enforced per application. Within a ERP application like JD Edwards, SAP or Oracle E-Business Suite the roles are checked against a list of roles that can't be shared.
The roles that can't be shared are defined by business standards for the specific market, laws like Sarbanes Oxley and company specific.
Because the SOD enforcement wasn't build in the core of the systems the SOD checks are post role assignment. On a regular basis the roles assignments to the persons, groups or department are checked against the SOD list.
Then these SOD need to be resolved. This can work but will mean extra work since the roles assignments are checked after the fact. When an SOD is found these need to be resolved by assigning the role to another person or group of persons.
Off course when the roles were defined they needed to be checked that they only have SOD conflicts within the role.
The roles that can't be shared are defined by business standards for the specific market, laws like Sarbanes Oxley and company specific.
Because the SOD enforcement wasn't build in the core of the systems the SOD checks are post role assignment. On a regular basis the roles assignments to the persons, groups or department are checked against the SOD list.
Then these SOD need to be resolved. This can work but will mean extra work since the roles assignments are checked after the fact. When an SOD is found these need to be resolved by assigning the role to another person or group of persons.
Off course when the roles were defined they needed to be checked that they only have SOD conflicts within the role.
Tuesday, 7 October 2008
Security Roadmap
In the entries of the first of October we showed the single account usages between Oracle Enterprise Linux Operating (OEL) system accounts and Oracle database accounts. One would say why not go for Single Sign On (SSO) using kerberos rightaway. Indeed that would simplify the usages of the accounts.
There are a number of technical and license reasons I'll get to later, but it is also a social reason.
One of the reasons is the SSO would be based on Kerberos in combination with MS Active Directory (AD) . For many companies the AD is doing the domain authentication.
For the OEL machines to be able to use keberos authentication they would have to be added to the windows domains as machines. Before large enterprises to go for this kinds of integration they need to get used to the idea. Alot of evangilizing is necessary before that can be achieved.
Using single account between OS and database is a step in getting used to that idea.
Management will start asking for SSO soon afterwards. Cross "IT Ecosphere" integration is than easier too.
Other reasons for not quickly implementing OEL Kerberos authentication:
1) Kerberized clients, like kerberized Putty for SSH, need to be used. To role these out in large Enterprise takes a lot of explaining and time.
2) MIT Kerberos for Windows DLL's needs to be implemented to integrate the Kerberos with OEL. To role this out in thousands of clients takes a lot of time and explaining.
These extra installations could be prevented when the Oracle Database administrators for whom we are implementing this solution would use the sqlplus client form the windows client prompt. Since the windows client is already authenticated to the windows domain. This windows run client could then be used for Kerberos authentication to the Oracle database. Skipping the authentication to the OEL OS.
But the Oracle DBA's are very used to there Unix prompt and can also only slowly change there attitude. Here again that will need some time.
To implemented kerberos Authentication for the oracle database is fairly simple and following the steps in the Oracle manual will get you there.But to be able to use kerberos for windows one needs to have the Advanced Security Option licensed from Oracle.
This extra costs is not always within the budget of even large Enterprises.
Al in al the roadmap to security should be taken in small steps, so to get all stakeholders used to the little bit of technical solutions to take them onto the path of the next level.
There are a number of technical and license reasons I'll get to later, but it is also a social reason.
One of the reasons is the SSO would be based on Kerberos in combination with MS Active Directory (AD) . For many companies the AD is doing the domain authentication.
For the OEL machines to be able to use keberos authentication they would have to be added to the windows domains as machines. Before large enterprises to go for this kinds of integration they need to get used to the idea. Alot of evangilizing is necessary before that can be achieved.
Using single account between OS and database is a step in getting used to that idea.
Management will start asking for SSO soon afterwards. Cross "IT Ecosphere" integration is than easier too.
Other reasons for not quickly implementing OEL Kerberos authentication:
1) Kerberized clients, like kerberized Putty for SSH, need to be used. To role these out in large Enterprise takes a lot of explaining and time.
2) MIT Kerberos for Windows DLL's needs to be implemented to integrate the Kerberos with OEL. To role this out in thousands of clients takes a lot of time and explaining.
These extra installations could be prevented when the Oracle Database administrators for whom we are implementing this solution would use the sqlplus client form the windows client prompt. Since the windows client is already authenticated to the windows domain. This windows run client could then be used for Kerberos authentication to the Oracle database. Skipping the authentication to the OEL OS.
But the Oracle DBA's are very used to there Unix prompt and can also only slowly change there attitude. Here again that will need some time.
To implemented kerberos Authentication for the oracle database is fairly simple and following the steps in the Oracle manual will get you there.But to be able to use kerberos for windows one needs to have the Advanced Security Option licensed from Oracle.
This extra costs is not always within the budget of even large Enterprises.
Al in al the roadmap to security should be taken in small steps, so to get all stakeholders used to the little bit of technical solutions to take them onto the path of the next level.
Subscribe to:
Posts (Atom)