![]() |
|
Spaces home Cryptography, Quantum P...ProfileFriendsBlogMore ![]() | ![]() |
|
|
October 19 Intelligent RedactionXerox Unveils Technology That Blocks Access to Sensitive Data in Documents to Prevent Security Leaks http://www.parc.com/about/pressroom/news/2007-10-15-redaction.html The Innovation: The technology includes a detection software tool that uses content analysis and an intelligent user interface to easily protect sensitive information. It can encrypt only the sensitive sections or paragraphs of a document, a capability previously not available. saqib http://security-basics.blogspot.com/ June 20 TCG Storage Work Group Webinar - June 21, 2007The Trusted Computing Group (TCG) Storage Work Group and industry expert David Hill, Mesabi Group, will address storage security in a free webinar on June 21, 2007. For more information and to register, visit http://www.techonline.com/learning/webinar/199703101 Attendees will learn: * What is the problem of trust with mobile computing? * Software vs hardware encryption * Use cases that highlight the technical requirements being solved by the formal specifications * TCG's specification for secure and trusted storage including relationships and cooperation with other industry storage standards (eg, SCSI and ATA, SNIA) * Adoption in the enterprise and next steps Date and Time Greenwich Mean Time: Thu., Jun 21, 2007 18:00 Eastern Daylight Time: Thu., Jun 21, 2007 02:00 PM Pacific Daylight Time: Thu., Jun 21, 2007 11:00 AM For more information and to register, visit http://www.techonline.com/learning/webinar/199703101 June 18 FDE solutions selected for US Government useIf you haven't already heard, Data At Rest (DAR) Encryption Contract Awardees were announced today. The Office of Management and Budget, DoD and General Services Administration awarded multiple contracts today for blanket purchase agreements (BPA) to protect sensitive, unclassified data residing on government laptops, other mobile computing devices and removable storage media devices. The following vendors/resellers won the contracts: 1. CREDANT Technologies, Inc. 2. GuardianEdge Technologies, Inc. 3. Information Security Corporation 4. Mobile Armor, LLC 5. Safeboot Corp. 6. Safeboot Mobile Data Security 7. SafeNet, Inc. 8. SPYRUS, Inc. & WinMagic Inc. 9. WinMagic Inc. More information at: http://www.esi.mil/newsDetail.asp?iContentID=361 [New Tool] DirBuster - Web application file and directory brute forcerHi all I am pleased to announce the public release of DirBuster. DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation is actually not, and has pages and applications hidden within. DirBuster attempts to find these. However tools of this nature are often as only good as the directory and file list they come with. A different approach was taken to generating this. The lists were generated from scratch, by crawling the Internet and collecting the directory and files that are actually used by developers. DirBuster provides the following features: + Multi threaded has been recorded at over 2800 requests/sec + Works over both http and https + Scan for both directory and files + Will recursively scan deeper into directories it finds + Able to perform a list based or pure brute force scan + DirBuster can be started on any directory + Custom HTTP headers can be added + Proxy support + Auto switching between HEAD and GET requests + Content analysis mode when failed attempts come back as 200 + Custom file extensions can be used + Performance can be adjusted while the program in running More information and downloads can be found at http://www.sittinglittleduck.com/DirBuster/ Flames, comments and suggestions are always welcome sittinglittleduck May 26 "Standards and Guidance for Encryption" document for John Hopkins UniversityEarlier this month John Hopkins released and approved their "Standards and Guidance for Encryption": http://www.it.jhu.edu/policies/StandardEncryptionApproved050607.pdf It is a good read. However I would have titled it "Recommendations" rather then Standards document. The does not set any standards as to what software to use or what protocol to use. Just gives examples of various tools that can be used to be encrypt data. A standard document should list specific tools that must be used. Still a good read. May 19 Quotes on Capital Punishment"If Capital Punishment is state sponsored murder, then any lesser punishment is a state sponsored murder of Justice." Saqib Ali "It is Justice, not Laws that cures the society. And Capital Punishment is the only Justice that suits a murderer" Saqib Ali May 17 The Evolution of Security by Dr. Dan Geer of MITWhat can nature tell us about how best to manage our risks? http://geer.tinho.net/acm.geer.0704.pdf Security people are never in charge unless an acute embarrassment has occurred. Otherwise, their advice is tempered by "economic reality," which is to say that security is a means, not an end. This is as it should be. Since means are about tradeoffs, security is about trade-offs, but you knew all that. ....... - Security is a set of trade-offs. - The existence of tradeoffs is why security = risk management. - In the real world, tradeoffs are measured in cost. - Cleanup and prevention are both necessary but neither is sufficient. ....... Readers of Queue hardly need to be reminded that mono-culture risk is real, that diversity can make coherent systems management challenging, or that risk management has to include tradeoffs around monoculture risk. There's nothing unique about digital security in that sense: farmers rotate their crops to do their kind of risk management. Big manufacturers second-source every critical part to do their kind. Simulation studies done at George Mason University demonstrated that when about 40 percent of computers are alike, the risk of general collapse takes a leap upward.What a surprise! (Not.) ....... Read the entire article at: http://geer.tinho.net/acm.geer.0704.pdf saqib http://www.full-disk-encryption.net May 11 Public comments on the hash algorithm requirements and evaluation criteria posted onlineFYI Public comments on the hash algorithm requirements and evaluation criteria (see Federal Register Notice Vol. 72, No. 14, January 23, 2007) are now available for review at http://www.csrc.nist.gov/pki/HashWorkshop/Public_Comments/2007_May.html . For other information related to NIST's hash algorithm competition, please visit http://www.nist.gov/hash-function . saqib http://www.full-disk-encryption.net Fwd: IEEE International Conference on Intelligence and Security Informatics 2007********************************************************************* IEEE International Conference on Intelligence and Security Informatics 2007 May 23-24, 2007 Hyatt Hotel New Brunswick, New Jersey ** DEADLINE FOR EARLY REGISTRATION IS ALMOST HERE ** Hosted by: Rutgers, The State University of New Jersey DIMACS-CAIT Laboratory for Port Security Center for Discrete Mathematics and Theoretical Computer Science (DIMACS) Center for Interdisciplinary Studies in Information Privacy and Security Sponsored by: Institute of Electrical and Electronics Engineers (IEEE) IEEE Systems, Man, and Cybernetics Society IEEE Intelligent Transportation Systems Society National Science Foundation Intelligence Technology Innovation Center Department of Homeland Security ********************************************************************* Informatics research has emerged as a key scientific discipline and applications domain supporting counterterrorism and homeland security's missions of anticipation, interdiction, prevention, preparedness and response to terrorist acts. ISI 2007 provides a forum for discussions among these vital communities: academic researchers (in information technologies, computer science, public policy, and social studies), local, state, and federal law enforcement and intelligence experts, and information technology industry consultants and practitioners. Security informatics is a rapidly growing multidisciplinary area that crosscuts numerous disciplines, including computer science, information technology, engineering, public policy, medicine (medical informatics), biology (bioinformatics), social and behavioral sciences, political science, and modeling and analysis. The combination of intelligence and security informatics strives to integrate computational social science, advanced information technologies and algorithms to support counterterrorism and homeland security policies, organizations and operations (both domestically and internationally). Because of the conference's location near major New York - New Jersey ports, one of its key themes is port security, where the term "port" is used here in its broad sense, namely, as a point of entry/exit for secure flows of people and cargo. Other themes cover the components of effective counterterrorism, dynamic data analysis, and critical-infrastructure protection technologies. This conference aims to foster the development and growth of a counterterrorism and homeland-security community by providing a forum and podium for diverse communities: academia, government (local, state, federal law enforcement, intelligence experts, etc.) and industry (consultants and practitioners etc.). We solicit contribution of long or short papers, and proposals for panel discussions on both the science and the practice of intelligence and security informatics. The conference proceedings will be published as an IEEE publication. Several satellite conferences will also be held before ISI-2007. The upcoming IEEE International Conference on Intelligence and Security Informatics 2007 (ISI 2007) will be held May 23-24, 2007, in New Brunswick, New Jersey, at the Hyatt Hotel. There will also be two satellite conferences: The 2007 Conference on Interdisciplinary Studies in Information Privacy and Security. This conference will be held on May 22nd, 2007 from 9 a.m to 5 p.m. at the University Inn, Douglass Campus, Rutgers, New Brunswick. The second event is the NSF Workshop on Biosurveillance Systems and Case Studies, May 22, 2007, New Brunswick, New Jersey. The two previous symposia on ISI (ISI-2003, ISI-2004) were held in Tucson, Arizona; the third (ISI-2005) in Atlanta, Georgia; the fourth (ISI-2006) in San Diego, California. These meetings provided a stimulating intellectual forum for discussions among previously disparate communities: academic researchers (in information technologies, computer science, public policy, and social and behavioral studies), local, state, and federal law enforcement and intelligence experts, and information technology industry consultants and practitioners. Proceedings of these past ISI meetings were published in Springer Lecture Notes in Computer Science (LNCS). ***************************************************** Registration Fees: (Pre-registration deadline: May 15, 2007) For complete registration information, please see: http://dimacs.rutgers.edu/ISI2007/registration.htm Your conference fee will entitle you to: - Entrance to all conference presentations - Breakfast on both conference days (May 23-24) - Entrance to the Conference Reception, held in conjunction with the Poster and Demonstration Session, where ample food will be served (evening, May 23) - The conference packet of materials including the conference papers *********************************************************************** Information on the program, registration, accommodations, and travel can be found at: http://dimacs.rutgers.edu/ISI2007/ **PLEASE BE SURE TO PRE-REGISTER EARLY** April 26 sudowin website updated---------- Forwarded message ---------- From: Kutz, Schley Andrew If you use sudowin and have an opportunity, please check out http://sudowin.sf.net. The website has undergone a drastic makeover and I would like to know what you think. I am particularly trying to refine how the documentation section looks. I am not happy with it, but I am unsure yet how to make it better. Currently I am following the BackupPC style and simply pouring all of my thoughts onto one page in as cohesive manner as possible. Thanks! -- -a "Condensing fact from the vapor of nuance." ITS@The University of Texas at Austin name: Schley Andrew Kutz, MCSD, GCWN, VCP-VI3 mail: a.kutz@its.utexas.edu work: 512.475.9246 Please do not hesitate to call or e-mail me if you have any questions or concerns! open source disk crypto updateMarc Schiesser gave a tutorial at EuroBSDcon 2005 on encrypting the whole hard drive on your laptop using FreeBSD. He used the trick of booting from a USB drive. The notes from his tutorial are here: http://events.ccc.de/congress/2005/fahrplan/attachments/586-paper_Complete_Hard_Disk_Encryption.pdf saqib http://www.full-disk-encryption.net SecureZip 11 available for free for limited timeIf you haven't already heard, PKWARE (the inventor of ZIP algorithm) is offering SecureZip 11 for free for limited time. http://www.securezip.com/ It is a decent product for encrypting files / folders. I think they are trying to use viral marketing to make their way into the large enterprises. But I don't mind that as the product offers some great functions. It can interface with your PKI or LDAP based certificate store. It also lets you create self-extracting encrypted executables that can be emailed etc. saqib http://www.full-disk-encryption.net |
|
|