More servicesWindows Live
HomeHotmailSpacesOneCare
 
MSN
Sign in
 
 
Spaces home   Cryptography, Quantum P...ProfileFriendsBlogMore Tools Explore the Spaces community

Blog

October 19

Intelligent Redaction

Xerox Unveils Technology That Blocks Access to Sensitive Data in
Documents to Prevent Security Leaks
http://www.parc.com/about/pressroom/news/2007-10-15-redaction.html

The Innovation: The technology includes a detection software tool that
uses content analysis and an intelligent user interface to easily
protect sensitive information. It can encrypt only the sensitive
sections or paragraphs of a document, a capability previously not
available.

saqib
http://security-basics.blogspot.com/
June 20

TCG Storage Work Group Webinar - June 21, 2007

The Trusted Computing Group (TCG) Storage Work Group and industry
expert David Hill, Mesabi Group, will address storage security in a
free webinar on June 21, 2007.

For more information and to register, visit
http://www.techonline.com/learning/webinar/199703101

Attendees will learn:
* What is the problem of trust with mobile computing?
* Software vs hardware encryption
* Use cases that highlight the technical requirements being solved by
the formal specifications
* TCG's specification for secure and trusted storage including
relationships and cooperation with other industry storage standards
(eg, SCSI and ATA, SNIA)
* Adoption in the enterprise and next steps

Date and Time
Greenwich Mean Time: Thu., Jun 21, 2007 18:00
Eastern Daylight Time: Thu., Jun 21, 2007 02:00 PM
Pacific Daylight Time: Thu., Jun 21, 2007 11:00 AM


For more information and to register, visit
http://www.techonline.com/learning/webinar/199703101
June 18

FDE solutions selected for US Government use

If you haven't already heard, Data At Rest (DAR) Encryption Contract
Awardees were announced today. The Office of Management and Budget,
DoD and General Services Administration awarded multiple contracts
today for blanket purchase agreements (BPA) to protect sensitive,
unclassified data residing on government laptops, other mobile
computing devices and removable storage media devices.

The following vendors/resellers won the contracts:
1. CREDANT Technologies, Inc.
2. GuardianEdge Technologies, Inc.
3. Information Security Corporation
4. Mobile Armor, LLC
5. Safeboot Corp.
6. Safeboot Mobile Data Security
7. SafeNet, Inc.
8. SPYRUS, Inc. & WinMagic Inc.
9. WinMagic Inc.

More information at:
http://www.esi.mil/newsDetail.asp?iContentID=361

[New Tool] DirBuster - Web application file and directory brute forcer

Hi all

I am pleased to announce the public release of DirBuster. DirBuster
is a multi threaded java application designed to brute force
directories and files names on web/application servers. Often is the
case now of what looks like a web server in a state of default
installation is actually not, and has pages and applications hidden
within. DirBuster attempts to find these.

However tools of this nature are often as only good as the directory
and file list they come with. A different approach was taken to
generating this. The lists were generated from scratch, by crawling
the Internet and collecting the directory and files that are actually
used by developers.

DirBuster provides the following features:

+ Multi threaded has been recorded at over 2800 requests/sec
+ Works over both http and https
+ Scan for both directory and files
+ Will recursively scan deeper into directories it finds
+ Able to perform a list based or pure brute force scan
+ DirBuster can be started on any directory
+ Custom HTTP headers can be added
+ Proxy support
+ Auto switching between HEAD and GET requests
+ Content analysis mode when failed attempts come back as 200
+ Custom file extensions can be used
+ Performance can be adjusted while the program in running

More information and downloads can be found at
http://www.sittinglittleduck.com/DirBuster/

Flames, comments and suggestions are always welcome

sittinglittleduck
May 26

"Standards and Guidance for Encryption" document for John Hopkins University

Earlier this month John Hopkins released and approved their "Standards
and Guidance for Encryption":
http://www.it.jhu.edu/policies/StandardEncryptionApproved050607.pdf

It is a good read. However I would have titled it "Recommendations"
rather then Standards document. The does not set any standards as to
what software to use or what protocol to use. Just gives examples of
various tools that can be used to be encrypt data. A standard document
should list specific tools that must be used.

Still a good read.
May 19

Quotes on Capital Punishment

"If Capital Punishment is state sponsored murder, then any lesser punishment is a state sponsored murder of Justice." Saqib Ali

"It is Justice, not Laws that cures the society. And Capital Punishment is the only Justice that suits a murderer" Saqib Ali
May 17

The Evolution of Security by Dr. Dan Geer of MIT

What can nature tell us about how best to manage our risks?
http://geer.tinho.net/acm.geer.0704.pdf

Security people are never in charge unless an acute embarrassment has
occurred. Otherwise, their advice is tempered by "economic reality,"
which is to say that security is a means, not an end. This is as it
should be. Since means are about tradeoffs, security is about
trade-offs, but you knew all that.
.......
- Security is a set of trade-offs.
- The existence of tradeoffs is why security = risk management.
- In the real world, tradeoffs are measured in cost.
- Cleanup and prevention are both necessary but neither is sufficient.
.......
Readers of Queue hardly need to be reminded that mono-culture risk is
real, that diversity can make coherent systems management challenging,
or that risk management has to include tradeoffs around monoculture
risk. There's nothing unique about digital security in that sense:
farmers rotate their crops to do their kind of risk management. Big
manufacturers second-source every critical part to do their kind.
Simulation studies done at George Mason University demonstrated that
when about 40 percent of computers are alike, the risk of general
collapse takes a leap upward.What a surprise! (Not.)
.......



Read the entire article at:
http://geer.tinho.net/acm.geer.0704.pdf


saqib
http://www.full-disk-encryption.net
May 11

Public comments on the hash algorithm requirements and evaluation criteria posted online

FYI

Public comments on the hash algorithm requirements and evaluation criteria (see Federal Register Notice Vol. 72, No. 14, January 23,
2007) are now available for review at
http://www.csrc.nist.gov/pki/HashWorkshop/Public_Comments/2007_May.html .

For other information related to NIST's hash algorithm competition, please visit http://www.nist.gov/hash-function
.
saqib
http://www.full-disk-encryption.net

Fwd: IEEE International Conference on Intelligence and Security Informatics 2007

*********************************************************************
IEEE International Conference on Intelligence and Security Informatics 2007
May 23-24, 2007
Hyatt Hotel
New Brunswick, New Jersey

** DEADLINE FOR EARLY REGISTRATION IS ALMOST HERE **

Hosted by:
Rutgers, The State University of New Jersey
DIMACS-CAIT Laboratory for Port Security
Center for Discrete Mathematics and Theoretical Computer Science (DIMACS)
Center for Interdisciplinary Studies in Information Privacy and Security

Sponsored by:
Institute of Electrical and Electronics Engineers (IEEE)
IEEE Systems, Man, and Cybernetics Society
IEEE Intelligent Transportation Systems Society
National Science Foundation
Intelligence Technology Innovation Center
Department of Homeland Security

*********************************************************************
 Informatics research has emerged as a key scientific discipline and applications domain supporting counterterrorism and homeland security's missions of anticipation, interdiction, prevention, preparedness and response to terrorist acts. ISI 2007 provides a forum for discussions among these vital communities: academic researchers (in information technologies, computer science, public policy, and social studies), local, state, and federal law enforcement and intelligence experts, and information technology industry consultants and practitioners. Security informatics is a rapidly growing multidisciplinary area that crosscuts numerous disciplines, including computer science, information technology, engineering, public policy, medicine (medical informatics), biology (bioinformatics), social and behavioral sciences, political science, and modeling and analysis. The combination of intelligence and security informatics strives to integrate computational social science, advanced information technologies and algorithms to support counterterrorism and homeland security policies, organizations and operations (both domestically and internationally).  Because of the conference's location near major New York - New Jersey ports, one of its key themes is port security, where the term "port" is used here in its broad sense, namely, as a point of entry/exit for secure flows of people and cargo. Other themes cover the components of effective counterterrorism, dynamic data analysis, and critical-infrastructure protection technologies. This conference aims to foster the development and growth of a counterterrorism and homeland-security community by providing a forum and podium for diverse communities: academia, government (local, state, federal law enforcement, intelligence experts, etc.) and industry (consultants and practitioners etc.). We solicit contribution of long or short papers, and proposals for panel discussions on both the science and the practice of intelligence and security informatics. The conference proceedings will be published as an IEEE publication. Several satellite conferences will also be held before ISI-2007.

The upcoming IEEE International Conference on Intelligence and Security Informatics 2007 (ISI 2007) will be held May 23-24, 2007, in New Brunswick, New Jersey, at the Hyatt Hotel. There will also be two satellite conferences: The 2007 Conference on Interdisciplinary Studies in Information Privacy and Security. This conference will be held on May 22nd, 2007 from 9 a.m to 5 p.m. at the University Inn, Douglass Campus, Rutgers, New Brunswick. The second event is the NSF Workshop on Biosurveillance Systems and Case Studies, May 22, 2007, New Brunswick, New Jersey.

The two previous symposia on ISI (ISI-2003, ISI-2004) were held in Tucson, Arizona; the third (ISI-2005) in Atlanta, Georgia; the fourth (ISI-2006) in San Diego, California. These meetings provided a stimulating intellectual forum for discussions among previously disparate communities: academic researchers (in information technologies, computer science, public policy, and social and behavioral studies), local, state, and federal law enforcement and intelligence experts, and information technology industry consultants and practitioners. Proceedings of these past ISI meetings were published in Springer Lecture Notes in Computer Science (LNCS). 



*****************************************************
Registration Fees:

(Pre-registration deadline: May 15, 2007)

For complete registration information, please see:
http://dimacs.rutgers.edu/ISI2007/registration.htm

Your conference fee will entitle you to:
- Entrance to all conference presentations
- Breakfast on both conference days (May 23-24)
- Entrance to the Conference Reception, held in conjunction
with the Poster and Demonstration Session,
where ample food will be served (evening, May 23)
- The conference packet of materials including the conference papers

***********************************************************************

Information on the program, registration, accommodations, and travel
can be found at:

http://dimacs.rutgers.edu/ISI2007/

**PLEASE BE SURE TO PRE-REGISTER EARLY**
April 26

sudowin website updated

---------- Forwarded message ----------
From: Kutz, Schley Andrew

If you use sudowin and have an opportunity, please check out http://sudowin.sf.net. The website has undergone a drastic makeover
and I would like to know what you think. I am particularly trying to refine how the documentation section looks. I am not happy with it, but I am unsure yet how to make it better. Currently I am following the BackupPC style and simply pouring all of my thoughts onto one page in as cohesive manner as possible.

Thanks!

--
-a

"Condensing fact from the vapor of nuance."

ITS@The University of Texas at Austin

name: Schley Andrew Kutz, MCSD, GCWN, VCP-VI3
mail: a.kutz@its.utexas.edu
work: 512.475.9246

Please do not hesitate to call or e-mail me if you have any questions or
concerns!

open source disk crypto update

Marc Schiesser gave a tutorial at EuroBSDcon 2005 on encrypting the whole hard drive on your laptop using FreeBSD. He used the trick of booting from a USB drive. The notes from his tutorial are here:
http://events.ccc.de/congress/2005/fahrplan/attachments/586-paper_Complete_Hard_Disk_Encryption.pdf

saqib
http://www.full-disk-encryption.net

SecureZip 11 available for free for limited time

If you haven't already heard, PKWARE (the inventor of ZIP algorithm) is offering SecureZip 11 for free for limited time.
http://www.securezip.com/

It is a decent product for encrypting files / folders.

I think they are trying to use viral marketing to make their way into the large enterprises. But I don't mind that as the product offers
some great functions. It can interface with your PKI or LDAP based certificate store. It also lets you create self-extracting encrypted
executables that can be emailed etc.

saqib
http://www.full-disk-encryption.net