Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
Near my parent’s house there is a small home that has a metal workshop and he’s there every day even if there’s nothing to do. Honestly I don’t know what his real name is though his nickname is Paquico and everyone knows him by that name.
As a personal project I decided to take a couple of photos of his workshop because I find it quite interesting and the workshop has all of these dark spots that really come out well with the industrial and gritty side that it comes with the working on metal side.
I decided to go with B&W for this project as it would pull that same feeling I get when I go in there and because of this I went with Ilford HP5+ on my Kiev 88CM medium format camera and because this film isn’t found locally I had to order it online.
Continue reading the rest of Paquico’s shop
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
by Robert Menes (noreply@blogger.com) at August 24, 2010 03:15 PM
by Robert Menes (noreply@blogger.com) at August 24, 2010 02:58 PM
...No, although I have heard rumors that it might be a good idea too, I am not talking about the kind of exercise that involves push-ups or running a mile before breakfast. I am talking about exercising emergency plans before they are actually needed.
Today I was able to get the entire IT management team together to run through a tabletop exercise of the IT business continuity plan. The exercise was received very well and I think the participants not only had fun going through the scenario that I set out for them, I also think it boosted their confidence, worked towards increasing team spirit, and (of course) identified some areas in which we need to improve our processes.
Those of us who have played tabletop role playing games such as Dungeons and Dragons (go ahead, admit it!) will feel right at home in a tabletop business continuity exercise. The goal of a tabletop is to practice policies and procedures without having to break out the big guns, pull staff from their normal routine, or disrupt production processes. As a result, tabletops can be a relatively cheap, but still effective way to go over a scenario.
The chain of events was fairly simple. I set the story to emulate a small fire in a main server room to take out a core switch, which took with it remote connectivity and some telephone services. The fire was small and contained relatively fast, but it was not possible to do a full damage assessment as a result of a Fire Marshall declaring the site off-limits for investigation.
For myself, I had set the following training goals:
- Train the participants to recognize when 'events' turn into something bigger and some form of emergency operations need to be activated.
- Train the participants in the decision-making process that leads up to formally declaring an incident.
- Train the participants in designating emergency roles and responsibilities
- Train the participants to communicate fully, clearly, and unambiguously, not only within the technology team, but also with the user community at large.
Because many of us in IT are so used to dealing with end-user emergencies all day long, it often takes time to recognize that something bigger is going on and that a response must be escalated. As always, that turned out to be the case here too, but lessons were definitely learned and I am confident that we will do much better next time.
All-in-all, I think we had a good exercise and, once again, we are better prepared for when events really take place.
DRBD stands for Distributed Replicated Block Device and allows block
devices to be replicated over a network in a RAID-1 fashion. Since Linux
Kernel 2.6.33, DRBD has been accepted into mainline and with its ever
growing user base defines itself as the de facto Linux data replication
solution. DRBD acts as a block device and can be transparently inserted
underneath virtually any Linux application. Alone, DRBD’s replication
can be leveraged as a robust disaster recovery solution ensuring data is
kept geographically diverse between nodes, data centers or continents.
Coupled with other Linux clustering technologies (Pacemaker, Heartbeat,
RHCS, etc.), DRBD’s shared-disk semantics become the foundation of a
free, open-source high availability (HA) clustering stack used to
provide complete hardware and service level fault tolerance. From
databases to virtualization to centralized storage, DRBD and Pacemaker
provide a completely free, open-source availability and redundancy
solution using commodity, off-the-shelf hardware.
This talk will first provide an introduction to DRBD: what it does, how
it works, and some live demonstrations of replication-in-action. Basic
HA concepts will be covered as well as an overview of Pacemaker and the
Linux HA cluster stack as it relates to DRBD. To give a sense of its
flexibility, common and interesting use cases will be presented ranging
from simple, locally deployed HA clusters to geographically dispersed,
cross-site disaster recovery installations. Finally, attendees will see
how the current Open Cluster Framework (OCF) standards provide users
with a generic and easy way of integrating their own custom applications
into a highly-available environment using freely available open-source
software.
Attendees are expected to have some system administration experience
related to storage and networking. Knowledge of the Linux kernel and
other shared storage technologies is helpful, but not necessary.
More information:
About the speaker:
Adam is an expert in open-source clustering and high availability.
Originally from New England, Adam lives in Portland, OR where he has
been working at LINBIT, developers of DRBD and maintainers of Heartbeat.
Aside from providing top-level Linux High-Availability and Disaster
Recovery consulting for customers in the Americas, he also leads LINBIT
training courses in the US, doubles as a technical writer and regularly
contributes to related open-source projects. Adam enjoys his R&D work
creating new and exciting methods for DRBD integration into the fastest
growing arenas; cloud, virtualization, HPC and distributed computing
environments.
After the meeting … Join us around 8:30 PM or so at
TGI Friday’s
After the meeting … You may wish to join up with other NYLUGgers
for drinks and pub food. This month we’ll be over at TGI Friday’s
(677 Lexington Avenue & 56th Street, second floor, northeast corner), but we are also evaluating
other options for the future and welcome your suggestions.
I was the leader for Costa Rica in the Scott Kelby’s World Wide Photowalk that happened on July 24th and I planned for this instance to visit the “Plaza de la Cultura” in San Jose. This boulevard is pretty much the heart of San Jose as it’s the one that sees the most people walking by any given day.
During the weekends and holidays there are street performers and clowns entertaining people as they walk by and daily you see a lot of people selling from cheap toys to pirated DVDs to leather belts and wallets to original audio CDs to paintings, most of which are done right there on the boulevard, and these are people that usually come from other countries to make a living out of selling these things because they can’t find other jobs.
The photo above was taken around the Melico Salazar theater and it’s the area where the most street performers gather.
Continue reading the rest of La Plaza de la Cultura
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
Markets are quite common in come areas of the world whereas others are just something you hear once in a while. In Costa Rica, for example, it’s quite common to have a market in every major city and they don’t just sell fruits and vegetables they also sell pots and pans, toys, meat, spices and a lot of other things.
Back in the old days people would visit these places a lot more often than nowadays because a lot of the things found in the markets can be easily found in the supermarkets and people would rather go there than to a dark and dirty market. Recently I paid a visit to the market that’s located in Heredia and even though I don’t really like eating there, I’ve done this once, I like to visit it and walk around because there are a lot of different smells and sounds coming out of every corner.
A barber shop can be found in one of the many entrances that this market has and right next to a fruits and vegetables stand.
Continue reading the rest of The market in Heredia
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
Service announcement:
If you plan on bringing a computer to Defcon and/or Black Hat, think twice about plugging it into the conference network or connecting to the conference wireless networks.
If you do insist on bringing a machine to the conference floor, you had better take a pristine image without any form of even remotely sensitive data on it.
Do not communicate any authentication information at all, unless you are POSITIVE that it is protected.
If you rely on a VPN-like connection to tunnel your traffic, make sure that you authenticate BOTH SIDES of the tunnel.
Do not forget to turn off the WiFi and the Bluetooth settings on your mobile devices. Leave that iPad at home or in the room.
I am not too worried about using the hotel's network at Ceasar's, but don't even consider plugging it in if you stay in the Riv.
by Robert Menes (noreply@blogger.com) at July 20, 2010 08:45 PM
NY Public Library, Hudson Park Branch
66 Leroy St.
New York, NY 10014
Calendar & Directions
Coding Workshops/Hacking Society: This is a group of people that wants to learn about and work on coding in Python, Smalltalk, C++, and other languages, and hack on code. Sometimes they go out to eat afterward. Bring something to show off and discuss! The workshops meet every other Tuesday, at the NY Public Library, Hudson Park Branch. 66 Leroy St. NY NY from 6:00 PM – 8:00 PM
Professor Coleman will tell us about Debconf 10 which will be held August 1st through 7th right here in New York City. This will be the first time the conference is being held in America, so it is a great opportunity for us to participate and learn. She will cover some of Debconf’s history and update us on the schedule of events and talks. This will also be a chance to volunteer to fulfill some remaining roles that could help make the conference even better for our guests.
On July 29, Rakudo* (pronounced “rakudo star”), the first user-friendly
distribution built around an implementation of the Perl 6 programming language, will be released. In this talk, James Keenan will provide a brief introduction to Rakudo*:
Fedora has some great new performance analysis features that can help you obtain the best performance from your hardware possible. Jon Stanley will introduce us to some of these tools such as perf, latencytop, and systemmap in a hands on demo. He will also make an overview of Fedora 13 features.
More information:
About the speakers:
Trained as an anthropologist, Gabriella (Biella) Coleman examines the
ethics of online collaboration/institutions as well as the role of the
law and digital media in sustaining various forms of political
activism. Between 2001-2003 she conducted ethnographic research on
computer hackers primarily in San Francisco, the Netherlands, as well as
those hackers who work on the largest free software project, Debian. She
is completing a book manuscript “Coding Freedom: Hacker Pleasure and the
Ethics of Free and Open Source Software” (under contract with Princeton
University Press). She is the recipient of numerous grants and awards,
including ones from the National Science Foundation, the Woodrow Wilson
Foundation, the Ford Foundation, and the Social Science Research
Council. She is on leave during the 2010-2011 academic year at the
Institute for Advanced Study in Princeton, NJ.
James E Keenan has been hacking Perl since 2000. He is the author or maintainer of 15 distributions on the Comprehensive Perl Archive Network (CPAN). He has co-led Perl Seminar New York since its founding ten years ago and has spoken or led workshops at numerous Perl conferences and user groups in the United States and Canada. He is active, principally in testing, in the
Parrot virtual machine project, one of the underpinnings of Rakudo Perl. Jim first attended NYLUG in 2000 and spoke at NYLUG in October 2006. He is a senior software developer at a leading email services and campaign management provider in New York City.
Jon Stanley is a longtime Fedora contributor and is currently a member of the Fedora Board. He has previously presented at NYLUG. He is currently most aligned with the Fedora Infrastructure team, where he keeps the servers that make Fedora possible running 24/7. He can be found on IRC as jds2001 in various Fedora channels and #nylug on Freenode.
After the meeting … Join us around 8:30 PM or so at
TGI Friday’s
After the meeting … You may wish to join up with other NYLUGgers
for drinks and pub food. This month we’ll be over at TGI Friday’s
(677 Lexington Avenue & 56th Street, second floor, northeast corner), but we are also evaluating
other options for the future and welcome your suggestions.
I have recently been invited to teach my introductory computer and network security class in the Spring semester. The class is a "high 300"-class, and I'm looking forward to refreshing my material.
For as many years as I have been active in this field, I have observed a serious disconnect between technical information security practitioners and the material that is taught at colleges and universities.
As it happens to be, I will be
heading out to Las Vegas at the end of this month (July) to attend the Black Hat Briefings and some of Defcon 18. At the risk of launching is understatement of the year, I am fairly sure that it should not be too hard to find security practitioners with an opinion at those venues,
So, consider this post as a call to action.
If you want to help me out by sharing your thoughts on what a full-semester 3 credit undergraduate class on computer and network security should look like, please hit me up and tell me exactly how you feel. The class is targeting a mix of computer science majors and management of information systems majors.
You can reach me via the feedback option at the bottom of each page on this site, but using the comments fields, or by contacting me on Twitter. My handle is @leune. I look forward to hearing anything from technical skills that should be taught, reading materials that I should review, or even conferences that I should send people to. Any feedback is good feedback!
I’ve been terrible at blogging lately and have yet to blog 2 sessions I did during the month of June; but just as a preview of those sessions I’ll post these photos which were taken on film. These photos are black and white because they were shot with Ilford Delta and HP5 film.
The photo above is from the Bet-Shalom concert that took place in San Jose and you can read more about it here. I took the chance to shoot a couple of frames from their concert on my trusty Nikon FM10 using the excellent Ilford HP5 film, which I must say that it’s my favorite film to shoot with and I’ll be definitely using it a lot more.
Continue reading the rest of Film photos from previous sessions
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
NY Public Library, Hudson Park Branch
66 Leroy St.
New York, NY 10014
Calendar & Directions
Coding Workshops/Hacking Society: This is a group of people that wants to learn about and work on coding in Python, Smalltalk, C++, and other languages, and hack on code. Sometimes they go out to eat afterward. Bring something to show off and discuss! The workshops meet every other Tuesday, at the NY Public Library, Hudson Park Branch. 66 Leroy St. NY NY from 6:00 PM – 8:00 PM
Recently I had the opportunity to meet up with Bet-Shalom, which is a Costa Rican reggae roots band, and attend one of their concerts that took place in San Jose, the capital of Costa Rica, as part of the “Fiesta de la Musica” that was organized and included several concerts throughout the big cities in Costa Rica.
Earlier that day we had a portrait session for the whole group and I also took the chance to take photos of them during the concert they had that day. Despite the great amount of rain that fell that afternoon there was quite a crowd that came to the concert.
Continue reading the rest of Reggae Roots Band Bet-Shalom
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
On one of my recent trips back from New York City to my office, I had to spend some time on Penn Station to wait for my train to arrive. Invariably, whenever that happens, I end up in a book store. Although, I usually do not end up buying anything, this time I picked up a copy of Atul Gawande's The Checklist Manifesto. In the book, Gawande presents example after example to explain why just about any procedure can be improved by using checklists.
Checklists provide the minimal steps required to execute a procedure successfully. They do not have to always be written in full, and should not go into extreme details describing every step to take, but they should focus on certain key steps that should always be followed. Arguably, the most well-known form of checklists are the ones used by pilots. These checklists cover routine circumstances, but specific exception checklists also exist. The checklists typically do not focus on how to do things, they do provide a form of reflection to whomever uses them to ensure that the what has been done.
Information security practices may also benefit from checklists. Keep in mind the lesson from the book: checklists should be simple to understand, focus on critical steps, describe what needs to be done and not how to do it, and most importantly, be used consistently.
In my security practice, I often use very simple checklists. Common items include:
☐ Notify CIO
☐ Inform Helpdesk
☐ Create tracking ticket
☐ Activate CSIRT
These checklist items are simple to understand, do not assign specific responsibility for who should execute the steps, and do not provide any guidance about how they should be executed. Yet, they are unambiguous, and when steps are omitted from them, it may come back to haunt you.
Some of the common objections against using checklists raised by critics are:
by Robert Menes (noreply@blogger.com) at June 08, 2010 07:52 PM
The living room remains the final frontier of open source
software. With wide adoption from home office to enterprise, from
datacenter to dining rooms, consumers all over the world rely on OSS
daily to run their lives. However, the third screen that has
dominated eyeballs for the past sixty years has been the exclusive
dominion of proprietary, monolithic black boxes. With the average
American consuming eight full hours of television per day, one New
York startup aims to change this paradigm of closed software in the
single room in the house where most waking time is spent.
Boxee’s free, open source, downloadable media center software is
changing the way consumers experience media. Lead Apps Developer and
Community Evangelist Rob Spectre will discuss Boxee’s open source
heritage, hacker culture, and open API as well as answer your
questions and unload T-shirts a-plenty.
About Boxee:
Boxee is changing the way people experience home entertainment by
bringing TV shows, movies, videos, and music from the Internet to the
TV. Boxee's free software can be easily downloaded to any computer or
embedded into TVs, Blu-Ray players, game consoles, and set top boxes.
Boxee has quickly established itself as the best way to bring
entertainment from different sources into one place – anything from a
local collection of movies, TV shows, music, and photos, to streaming
content from websites like Netflix, MLB.TV, Pandora, Last.fm, and
flickr. Users can also discover new entertainment from their friends
and share recommendations with social networks like Facebook and
Twitter. More than a million people use Boxee to enjoy their
entertainment. Learn how you can join them at www.boxee.tv.
About Rob Spectre:
Rob is the Lead Apps Developer and Community Evangelist for Boxee
with the worst haircut in open source software. An eleven year Linux
user, he serves the Boxee family as the passionate advocate for the
open source community armed with over a decade of experience in OSS
and a hefty supply of hairspray. In what little spare time he has,
Rob likes to go to punk rock shows, speedcube and maintain his
unInternet service laughotron.com.
More Information:
After the meeting … Join us around 8:30 PM or so at
TGI Friday’s
After the meeting … You may wish to join up with other NYLUGgers
for drinks and pub food. This month we’ll be over at TGI Friday’s
(677 Lexington Avenue & 56th Street, second floor, northeast corner), but we are also evaluating
other options for the future and welcome your suggestions.
A couple years ago, I setup my first gigabit Ethernet network. I wanted to test just how fast it could go with the equipment I gave it (that is, the NICs, cabling, and switches it operated on). Gigabit Ethernet, theoretically, can operate at 1000 Mbit/sec. This translates to 119.209 MiB/sec, units your OS typically displays when doing downloads (1000 Mbit/sec / 8 / 2^20). How close is your network setup to that maximum? Copying files between PCs, while being a very “real world” test, will be limited by how fast your disks can read or write. A specialized tool is needed.
While many system benchmark suites include network testing tools, most are not easily separate from their suites, and are not easy to install and use.
Enter NetStrain. It’s a very simple C application for Linux and MacOS X designed to stress network connections. Unfortunately, it’s not included in most Linux distributions or MacOS X, so you need to download and compile it yourself.
After compiling, use is simple. One machine acts as a server, and another machine acts as a client. Start the server first with:
netstraind -4 9999This starts a server using IPv4 networking on port 9999 (use a different port if you know this is in use; remember to pick one above 1024 if you’re not running as root). On your client machine, start the client connect to the server (assumed to be running on IP 192.168.1.2 and port 9999):
netstrain -4 192.168.1.2 9999 sendNetStrain will then try to send as much over your network connection as it can as long as the client is running. NetStrain is very spartan, so there are not a lot of options. In addition to sending, you may want to test receiving, as well simultaneously sending and receiving. Check NetStrain’s README for details.
Most likely, you will not get anything near 119.209 MiB/sec—but hopefully, you’ll get better speeds than a normal 100 Mbit connection to make everything worthwhile.
What if you want to make things faster (without buying newer, better hardware)? There are many parameters you can tune on your operating system’s networking stack. However, in most modern operating systems, most of them are already set, or are automatically configured (e.g. TCP window scaling). The one major tunable is something called MTU (Maximum Transmission Unit).
Data is transferred over Ethernet in packets; the MTU defines the size of those packets. A larger packet size means fewer packets are needed to send the same amount of data, reducing the amount of processing that needs to be done by your computer, switches, and routers. Your computer’s NIC, switches, and routers need to support large-size MTUs, a feature often advertised as “Ethernet jumbo frames.” Jeff Atwood wrote an article on the promise and perils of jumbo frames that you may want to read if you’re interested.
by Robert O'Connor (robby.oconnor@gmail.com) at June 01, 2010 12:41 AM
def shn_user_represent(id):
if id:
user = db(db.auth_user.id==id).select()
if user:
user = user[0]
name = user.first_name
if user.last_name:
name = "%s %s" % (name, user.last_name)
return name
return None
table.started_by.requires = IS_NULL_OR(IS_IN_DB(db,db.auth_user.id,lambda id : shn_user_represent(db.auth_user.id)))
table.finished_by.requires = IS_NULL_OR(IS_IN_DB(db,db.auth_user.id,lambda id : shn_user_represent(db.auth_user.id)))
by Robert O'Connor (robby.oconnor@gmail.com) at May 21, 2010 03:09 AM
The Sahana Free and Open Source Disaster Management System was conceived during the 2004 Sri Lanka tsunami. The system was developed to help manage the disaster and was deployed by the Sri Lankan government's Center of National Operations (CNO), which included the Center of Humanitarian Agencies (CHA). A second round of funding was provided by the Swedish International Development Agency (SIDA). The project has now grown to become globally recognized, with deployments in many other disasters such as the Asian Quake in Pakistan (2005), Southern Leyte Mudslide Disaster in Philippines (2006) and the Jogjarkata Earthquake in Indonesia (2006).
by Robert O'Connor (robby.oconnor@gmail.com) at May 21, 2010 02:59 AM
by Robert Menes (noreply@blogger.com) at May 16, 2010 01:34 AM
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
I have recently gotten into taking photographs using film, despite popular believe film is not dead, and I wanted to get a great camera. After quite a bit of investigation and talking with fellow photographers in the film area I fell in love with the Kiev 88CM. I bought one off of eBay in a brand new state with upgrades applied. This is a photo of the camera itself
This camera looks old, like it had been built back in the 60′s or something but it was actually built somewhere between 1999 and 2004 in Kiev, Ukraine. The company Arsenal, who mostly specialized in the creation of weapons and was funded by the Ukraine government, got into the business of creating film cameras and this is one of their last models, or so my research has said, and it’s an update to the Kiev 88 model. The design of the Kiev 88 and Kiev 88CM was based off of the Hasselblad 1000 and 1600 models.
Continue reading the rest of Kiev 88CM
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
In the 12 years since its initial release by IBM, the open source
Postfix mail system has become part of the email infrastructure.
The system has proven itself on personal systems and on ISP
infrastructures with 10s of millions of mailboxes. After Postfix
reached completion by 2006, the focus of development has moved from
building new functionality towards making the system more extensible
and more survivable in the face of changing threats and requirements.
In this presentation Wietse will review lessons learned, current
developments, and some speculation about the future.
More Information:
About Wietse Venema:
Wietse Venema is known for his software such as the TCP Wrapper
and the POSTFIX mail system. He co-authored the SATAN network
scanner and the Coroner’s Toolkit (TCT) for forensic analysis, as
well as a book on Forensic Discovery. Wietse received awards from
the Free Software Foundation, the System Administrator’s Guild
(SAGE), the Netherlands UNIX User Group (NLUUG), as well as a
Sendmail innovation award. He served a two-year term as chair of
the international Forum of Incident Response and Security Teams
(FIRST). Wietse currently is a research staff member at the IBM T.
J. Watson research center. After completing his Ph.D. in physics
he changed career to computer science and never looked back. In his spare time he enjoys hiking and cycling with his wife, Annita.
After the meeting … Join us around 8:30 PM or so at
TGI Friday’s
After the meeting … You may wish to join up with other NYLUGgers
for drinks and pub food. This month we’ll be over at TGI Friday’s
(677 Lexington Avenue & 56th Street, second floor, northeast corner), but we are also evaluating
other options for the future and welcome your suggestions.
The crew over at Offensive Security has taken the time to produce and publish a 17 minute technical video describing a summarized version of an actual penetration test. While several mistakes were clearly made by the target network, none of the errors were unheard of, even in well-managed corporate environments.
This is probably one of the best examples of penetration testing that I have seen in quite a while. The story is told by "muts" from Offensive Security, which is a training and consultancy company that I highly respect.
Offensive Security's training offerings are high quality for a low price, and definitely something that I highly recommend to look into (Disclaimer: I hold the Offensive Security Certified Professional Certification).
While the course content may not be 100% state-of-the-art, the attacks and exploits in it are still highly applicable in many organizations. Furthermore, the way-of-thinking that is introduced by this class is unparalleled.
After viewing the video, I think you'll have a whole new perspective on these things.
The month of April was a month in which I had three public speaking appearances. It started out on April 16 when I addressed the New York Higher Education Technology Forum at Hofstra University. The talk tried to drill home the point that all this Cloud stuff is all nice and fluffy, but that we, as cloud consumers, must make sure that our vendors deliver better service for less money. If we fail to do that, we are not making any progress, and Cloud will just be another concept that is doomed to fail.
The second talk was on April 20 at SOURCE Boston, where I was in the fortunate position to mentor a panel about career development, and especially about the role that mentors in that process.
In the third and final talk, on April 29, I addressed a gathering of non-technology people about the risks of social networking, and how to mitigate the risk for themselves. The most important point that I tried to make in that presentation was that on social networks, people may actually read what you write.
Both presentations are available for download, although they might not do you much good without the narrative.
SOURCE Boston has been over for almost a week. Looking back at the event, I can only come to the conclusion that, once again, the level of the presentations exceeded my expectations. While the conference is fairly small, with only between 250 and 300 persons in attendance, the talks were of high quality and the people who attended just about all mattered. Despite the fact that several speakers were stuck in Europe as a result of the volcanic eruptions in Iceland, it was still very worth while to attend.
As the talks are posted online in a few weeks, I'll let you form your own thoughts about them and I'll make sure to publish a reminder when the do become available.
This year, I was in the fortunate position to host a panel session on Wednesday night. The panel discussion revolved around the usefulness (or lack thereof) of mentors in furthering careers in the information security field. Some very interesting comments were made during the session, and we are going to try spinning something up again next year.
by Robert Menes (noreply@blogger.com) at April 22, 2010 01:26 AM
Two things you never want to hear (especially on the same day):
* From an IT director to the CISO: "There is no need to involve your group in the project yet-- we have not even decided on the product!"
* (overheard) Admin: "Do you think we should tell the security officer about this?" Manager: "no, he did not get in."
Now, I could do a full writeup about how important it is to include information security officers from before the planning stage of every project, and how even the slightest sign of unusual behavior should be brought to the attention of a security person, but I will not do that. These two quotes should speak for themselves.
Follow us on twitter | Find us on Facebook | Follow us on Tumblr | Contact Us
© lmurillo for Code|Beta Photography, 2010.
by Robert Menes (noreply@blogger.com) at April 20, 2010 08:07 AM
Today, I will present "Information Security In The Cloud" at the New York Higher Education Technology Forum. The presentation will deliver a high-level overflow of some things to keep in mind when moving to a cloud-based infrastructure.
The one point that I hope to get across is that, in order to create real value, CIOs must hold cloud service providers to at least the same levels of expectation as they hold their internal IT organization. In other words, when a CIO expects an uptime from 99.99% from the internal IT group, a cloud offering should be able to deliver the same. If a CIO expect to run an infrastructure component for $25,000 (all-inclusive), the cloud offering should be at most the same price. If the CIO expects regulatory compliance and performance monitoring from the internal groups, he should do the same from a cloud offering.
Too often, business are willing to accept a lower level of quality from cloud offering. For example, some of the cloud providers that I have worked with directly typically do NOT promise an minimum uptime, or when they do, it is at most 99.9%. Taking such of offering would often reduce the quality of the end-user service offerings.
The presentation outline is as follows:
- Introduction
- Assumptions
- Traditional information security
- Cloud Considerations
- Top Threats (based on the Cloud Security Alliance report of March, 2010)
- Recommendations
- Conclusions
After I have done the presentation, I'll post the slide deck and I may even record an on-demand version for those who are interested. Don't expect a technical talk, or one that goes in great depths: that would be unsuitable for the audience, and I only have 45 minutes (including discussion).
Code|Beta Photography
Fyndo's musings
Information Security Strategy
Josh Zeidner
MadRhetoric
More Blogs About Technology and Food
NYLUGblog
Natan's News
Random Thoughts of Jon
Rob's Musings
Vitaliy
preed's blah-blah-blahg
Last updated:
September 02, 2010 07:00 PM
All times are UTC.
Powered by:
