Aardvarks to Zorillas - Anything goes

It is crazy that a cash starved as well as food starved North Korea spends useful funds on Nuclear Armaments, Unfortunately, this is because of the overtures from US that make them belligerent.  US is a trigger happy country and want to act as the cop of the world. This is never an area where there is common world opinion. When countries are cornered by the US and put under pressure, they tend to do something on the contrary. Export of US ideas to other countries is considered a cultural invasion and is always resented upon. This is very similar to the US missionaries that push Christianize the world by economic incentives rather than as a philosophy and as a spiritual way to attain salvation.  Why does not the US take on the North Koreans they way they did with the IRAQIS. The economics of such intervention is never positive and even though North Koreas is much worse than IRAQ was under Saddam, still we do not see the US trying to destabilize North Korea and bring US brand of democrac...

Is PCI-DSS enough to ensure security of personnel data. Is it the minimum required to protect user information. But the way the standard has been prescribed, it looks more like a system designed to transfer the incidence from the card issuing organization to the organization handling information for the card issuers. If the controls are adequate, why are there breaches. Is the system designed to protect the end user sufficient and complete enough to warrant a certification. What does the certification achieve. If you look at the issues in hand, it is clear that the problem is not with the organization handling the data but the protection afforded by such systems to personnel information. Is it not that the card industry to protect itself have an publicly available standard that has gone through peer reviews and public scrutiny imposed on organizations which process credit/debit card information inadequate?  The balance between what is prescribed in the standard and what is requ...

Been hearing about this worm since November 2008. The researchers have found that it may have a payload that it may unleash today. Not sure how bad it could be, depending on all those un-patched machines out there in the wild. So what does it do.... It has a very interesting payload and we have already seen more than 4 variants. Interestingly it looks like they let version A and B to check on how the community is going to respond. The cabal to counter its domain generation algorithm got a new lease and a new algorithm in the C version and also contains a p2p communication mechanism. The other part is how a digital signatures can be used effectively to control the compromised host. This is important to protect other bot commanders to take over the already compromised Conficker bots. Network traces have not yielded much, but looks like it is a widely distributed system which has already started pushing the latest DLL updates across to the already compromised machines. Lets look at the ch...

Organizations fail as a consequence of decisions taken by the collective intellect of the powers at the board. They are successful because of the same powers that make effective, efficient decisions and manage risk. As an investor every individual looks at a number of parameters before investing. These rules of investing have over the years been honed and tuned to such a level that the health of an organization can be gleaned from the statistics and information available to the public. Do any of the organizations that have got funding from the Government eligible as good Investments or Investment Grade? None of them would pass the muster, they are bleeding organizations which should have been asked to die or scale down become more efficient. Well now that the funding has been secured, what is the guarantee that these funds are to be utilized properly and efficiently. Would the Government end up with another body to oversee governance of these Organizations. Are we ready and prime for ...

Humans have and will always be using techniques we now call Threat Modeling. The circumstances we are in and history is full of threat modeling techniques employed at and effectively used to counter an  adversary. The adversary has multitude of forms and attacks utilizes any vector for effectively neutralizing your efforts to counter the adversary. So what do we do when we say threat modeling. Is threat an adversary? There are tomes written on the approach towards an adversary. Here in this blog, I will term "Threat Modeling" as something akin to understanding the adversary in terms of the threat he brings to the table and the varied tools (Armaments) in his disposal, his ability to understand your weaknesses and exploit it. All this put together helps the incumbent to understand the posture he has taken viz the adversary and therefore understands the various actions and reactions thereof. The activity to list all the threats, countermeasures, weaknesses and appropriate actio...

Security Verification is a process through which Code can be analyzed. However, as prerequisite, it needs to be addressed with due consideration of What the application is and the business operation that it supports. The main reason for this is that it would be very difficult to prioritize and address the weaknesses. The threat modeling is an important tool and along with the threat model a security review would be an indispensable tool in identifying the root cause of vulnerabilities – CODE. Based on the prioritized functions and possible attack vectors – For example Protocol Errors may be a potential area for Input validation problems. Based on the preliminary build, it is possible for a preliminary scan of the code base. This should provide a base input that can again be cleaned up to remove unwanted areas to concentrate the efforts and to move to areas of potential weaknesses. The easiest way to achieve this is to use a Static Code Analyzer, a lot of tools are available both open s...

Software design is the important stage where the code is really put to work to deliver or build an business function and application. This is a stage where the SRS (Software Requirements Specifications) is finalized and signed off for design and development. The major difficult in software design is to incorporate the business requirements as well as do threat modeling to understand the attack surface of the applications. Many applications do not show up problems in regular normal use but show up funny ways of responding when provided with a different input or action not generally considered as part of the application design. The major areas that a threat model derived needs to address are – The Microsoft STRIDE model provides the following areas to be addressed as part of the design. 1. Spoofing 2. Tampering 3. Repudiation 4. Information Disclosure 5. Denial of Service 6. Elevation of Privilege 7. Integrity of Data Even though all aspects are not covered most of ...