The Travelin' Librarian

Testing a new blogging app on the iPod. Thanks for ignoring this post.

Click here to view a printable version of this eCard.

Click here to send your own eCard.

Nancy sushes a Krillitane (1)
Originally uploaded by Travelin’ Librarian

Just showing off the Blog This feature in Flickr.

Reiner van Heerden , CSIR Pretoria, South Africa

• passwords are part of everyday life
• password model
• crack passwords
• measure strength
• suggested rules
• upper & lower case
• numerals
• 8 character minimum
• no dictionary words
• no names
• easy to remember
• People keep using a single password for everything
• Asdf1234
• follows those rukes
• possible patterns
• start w/ cap
• follow w/ keyboard sequences
• end w/ numerals
• tradeoff between security & memory
• avg length 7-8 char
• advice usually ignored
• dictionary words & numbers are popular
• special char use limited
• memory is the key factor of choice
• Markov model
• sequence of events for which… just see the photos
• Results (see photo, actually very interesting)
• Uses
• defensively as a password strength evaluator
• offensively as a tool to enhance password guessing

Persistence, Ambiance, and New Maps
Brian Lopez, Lawrence Livermore Laboratories
(Led security for Utah winter Olympics)

• 1200 comp sci folks @ LLL
• LLL has world’s largest laser & world’s fastest supercomputer
• Vulnerability and Risk Assessment Program founder
• field assessment
• threat
• vulnerability
• consequences
• actionable findings
• 1996 Presidents Commission on Critical Infrastructure Protection (PCCIP)
• 1998 Presidential Decision Directive 63: Policy on Critical Infrastructure Protection (CIP)
• Moved to DHS in 2003
• DHS seeme to be “perpetually reorganized” (audience snickers)
• Energy infrastructures
• electric power
• oil
• natural gass
• Most owned by private corporations
• Assessment activities completed in 30 states
• Look for isomorphisms
• Red Hat, Black Ice exercises
• US Computer Emergency Readiness Team
• training annalists on protocols & systems
• Classified work
• Intel, VAs/Red Teaming, SNM,DBT
• Methodology Development
• Emerging vulnerabliities
• 802.11i & Zigbee
• Smart border initiative
• attacks in canada & mexico can affect CI here in the US
• “Critical Infrastructure is the one place where the computers touch the physical world”
• Terrorist simulations folks use OpenSource tools
• dumpster diving too
• Philosophy
• combine strong security and domain expertise
• field experience and capabiities
• multi-diciplnaty teams
• work at three levels
• strategic
• tatical
• technical
• approach – listen, learn, teach, collaborate
• actionable findings
• customers make all decisions
• continuous support
• Broke into state power grid in 20 minutes. Board’s response was “great, who do we fire”
• “Information” warfare, not computer science warfare
• Three themes
• Ambiance – what’s ambient that we can leverage
• New Maps – seeing though new lenses
• Persistence – tools to make those maps
• Beware of photocopiers, especially those with network connections and hard drives
• Has the mic on the videoconferencing system on even when they’re not using the room for a video conference?
• “OpenSource reconnaissance” / Social Engineering
• “How to initiate a fire drill other than the obvious starting a fire?” (laughs) “Hey, the terrorists aren’t beyond starting fires.”
• “The electric power grid runs on water.” so blow up the water main two blocks away from. (Second order effect)
• The Problem with Persistence
• photo of a theatre
• single exposure of a whole film
• Too much information creates no information
• “The sum of everything is nothing”
• “Honey Nets”
• Replicate a system to attract the bad guys
• “instrument the heck out of it” / “instrumented to beat the band”
• learn from what they try to do to it
• Now they’re building the map for you
• Research ideas for the attendees
• Ambiance
• expand field of vision of the target
• expand the avenues of attack
• cascading failure – infrastructure interdependence
• cascading support – leverage the dark fiber when other standard connections fail
• auto-characterizing environments tools
• ex-filtration
• what can you inject to induce signatures?
• New Maps
• “Good maps help win the war”
• map of the air – value cocaine from measuring the air
• maps of sound – IEDs & “what the locals know” – when the marketplace goes more quiet than normal
• biometrics – gait analysis, veins in the face, “we need BIG biometrics map”
• “maps used to represent the data, everything you know. now a map is a viewpoint, not everythng you know”
• establish new baselines & establish tools to organize that data
• mapping the physical to the cyber – where are the people in the virtual world located in the real world?
• Persistence
• More complex sensors
• More signal sensors
• We need tools to peer into all that data & pull out actionable items
• bioengineer plants to react to certain elements
• All this is dual-use i.e. commercial and governmental
• CS graduates are down 50%
• this is a crisis for the country
• There are tons of CS jobs available right now
• encourage Americans to go into science, esp CS

According to Boing Boing "The State of Oregon is sending out cease and desist letters to sites like Justia and Public.Resource.Org that have been posting copies of Oregon laws, known as the Oregon Revised Statutes."

Want to read them online? Check them out on TravelinLibrarian.info! I wonder if they’ll send me a letter.

I had an account and I didn’t even remember that I did. Good thing that my browser remembered for me…

Anyway, I’ve been using Google Docs lately due to my recent acquisition of a Cloudbook. This tiny computer does have a hard drive and USB ports but I figured it would just be easier to do my work online and be able to pick it up from any other computer. Trouble is, I’m jus tnot all that impressed with Google Docs’ lack of features.

Now, this Zoho Writer thing, which I’musing to write this post, is, at first glance, impressing me a whole heck of a lot. I see lots of formatting buttons and even a Collaborators feature allowing me to bring in others to edit documents along with me. (Not having anyone to test that with at the moment I’m unclear on how well it works. For example Google Docs allows multiple people to work on the same document at the same time (sort of) so I wonder if Zoho Writer allows that same level of fucntionality.

Hmmm, maybe I’ll have to try Zoho Writer next time while on the Cloudbook or on my office laptop during a department meeting.

All that being said, let’s see how easy it is to publish from her to my blog. If you’re reading this you can assume it went off without a hitch.

Check out the details here. (Sorry, I’m just to excited to blog details at this point.)