When I started this blog a couple of years ago, I was living and working in Barcelona, Spain. It was a glorious place and a glorious time. I genuinely loved living there, my wife and I have some very happy memories. We're about to have our first child, a boy, in just under 2 months - we haven't got a name yet, but it could have so easily been Pedro...
Sadly, circumstances conspired against us. Sad family circumstances which still echo through our lives on a daily basis - nothing else could have dragged me away from such a beautiful place, such amazing weather and such interesting people, architecture and culture. However, that doesn't stop me from taking the piss.
Catalan is just one dialect of Spanish, spoken widely in Barcelona. Catalans can be quite patriotic about Catalonia, if not dogmatic. Sometimes they are fiercely anti-Castillian, i.e. the rest of Spain. When my mother visited us one week in May, there was a big Catalan rally in town, the idea being that Catalonia was for the Catalans, and the rest of Spain could sod off, or that's the essence of it at least. I'm sure there were high politics involved along the way.
Mrs. N Senior stood and watched the hordes of squat hairy men gruffly shiffling down the main strip, understanding nothing on the signs - Catalan is unpronouncable and untranslatable at the best of times - but wanted to convey support. "Viva L'Espana!" she shouted, something she'd read on a T-shirt or something I guess... the somewhat secular crowd were not impressed. I bundled her into a taxi and we made a swift exit.
Later in the evening, we went to a tapas restaurant, "Tapes Gaudi" on the Avinguda de Gaudi, just near the incredible Sagrada Familia - if you don't know it, look it up, book a ticket to Barcelona and go, it's amazing, and worth the trip alone. Tapes Gaudi is not. The service was poor, the food expensive, and a general let down to the area and the people. A cynical attempt to rip off tourists who could get that at the KFC just down the street. (Yes, the most beautiful cathedral in the world has a KFC and a Burger King within 20 yards).
What Tapes Gaudi IS worth going for is the menu. No, not the taste, but the translation. It is in Castillian, Catalan and English-ish. I stole a copy, I was so impressed, and it still reduces me to tears on occasion. My favourite has to be "Boquerones en Vinagre" - nothing wrong with that in Spanish, the English "Vinegar big holes" leaves a little more to be desired, or maybe less.
So, wondering exactly what Boquerones en Vinagre actually were, we went back to the flat and used Babelfish to look it up. Babelfish dutifully replied that they were in fact "Vinegar big holes". Hmmm... I wonder how they translated that menu. I genuinely hope they never sort the problem out, I rather like it.
[Boquerones are anchovies by the way, and no, I never did try it, I'm pleased to say.]
Monday, 13 July 2009
Friday, 10 July 2009
What risk isn't
Writing blogs and having an opinion are fairly easy things to do, creating and selling a product is not. I've done both, at the same time, in fact that's why this blog exists - a marketing tool for a product I am no longer involved with, but a past-time I enjoy so I carried it on.
Sadly my opinions are still fairly strong on many subjects, and security is one of those. I believe security should be pragmatic, but that doesn't just mean trying 'as hard as you can', making 'best efforts', but getting the best result that can possibly be achieved. A subtle difference, semantic even, but one which I strongly believe in.
The 'bad guys' don't wait around until everyone's on a level playing field, they deliberately make it work in their favour. They are constantly on the attack. So when someone tells me that a product isn't the most secure, but the easiest to use, I want to grab them like a bad puppy and rub their nose in the mess they are leaving behind. I have heard this more times than you may think, and even fairly recently in response to a critical post.
So, I agree that risk is a vital part of security, making the best choice possible based on the cost of available tools, to mitigate the expense of possible attacks that exist without them. What I don't agree with is that when there is an equal cost involved, you should go for the product which is easier to install, understand or operate at the cost of security. This is often dressed up as TCO or some such rubbish. That's what security administrators are for, and actually, it's not that difficult. If you DO choose to do this, you are putting your network, your applications, your users and your data at risk. This is not acceptable for most organisations.
I've worked with some of the most complex encryption technologies out there, and all they take is a little training. Key management is only difficult when people are involved in remembering things, technology was invented for this kind of problem. The best solutions are the ones which offer a trade off where the non-intuitive decisions are made by humans and the repetitive tasks done by the technology.
What more is there to understand?
Sadly my opinions are still fairly strong on many subjects, and security is one of those. I believe security should be pragmatic, but that doesn't just mean trying 'as hard as you can', making 'best efforts', but getting the best result that can possibly be achieved. A subtle difference, semantic even, but one which I strongly believe in.
The 'bad guys' don't wait around until everyone's on a level playing field, they deliberately make it work in their favour. They are constantly on the attack. So when someone tells me that a product isn't the most secure, but the easiest to use, I want to grab them like a bad puppy and rub their nose in the mess they are leaving behind. I have heard this more times than you may think, and even fairly recently in response to a critical post.
So, I agree that risk is a vital part of security, making the best choice possible based on the cost of available tools, to mitigate the expense of possible attacks that exist without them. What I don't agree with is that when there is an equal cost involved, you should go for the product which is easier to install, understand or operate at the cost of security. This is often dressed up as TCO or some such rubbish. That's what security administrators are for, and actually, it's not that difficult. If you DO choose to do this, you are putting your network, your applications, your users and your data at risk. This is not acceptable for most organisations.
I've worked with some of the most complex encryption technologies out there, and all they take is a little training. Key management is only difficult when people are involved in remembering things, technology was invented for this kind of problem. The best solutions are the ones which offer a trade off where the non-intuitive decisions are made by humans and the repetitive tasks done by the technology.
What more is there to understand?
Saturday, 4 July 2009
IBE and PGP
Identity-based encryption (IBE) was first proposed by Adi Shamir over 25 years ago, developed by Dan Boneh and Matt Franklin in one scheme, and Clifford Cocks in another. If these names don't mean much to you, Adi Shamir is the S in RSA (Rivest and Adleman being the R and A). Dan Boneh founded Ingrian Networks and Voltage Security, as well as advising for many other important crypto companies on the West Coast. Clifford Cocks is a Brit who invented the RSA algorithm before Rivest, Shamir and Adleman at GCHQ in the UK, but wasn't allowed to divulge anything about it because it was owned by the government. In short, they are the biggest names you can get in cryptography.
So, you'd think that IBE was a bloody good idea then. Well, yes, it's a cracking idea... and as an idea, it will remain cracking. As a practical implementation of encryption, it's nothing short of impossible however. Trust me, I've tried. There are 2 products you can do this with currently, Voltage and Trend Micro.
I've been assured that Voltage's approach to database encryption is a good one (by Voltage), and from what I know about IBE, I can imagine that it might work, but they don't push much on email (or didn't when we last spoke - I see they are talking about ING Canada on their website now). Trend Micro of course bought Identum, the email encryption company out of Bristol University. Basically a student project which ended up being bought by a company which thought they were getting a cutting edge, fully developed product.
I spent a long time trying to install this product, and never got it working how I wanted it to. There are just too many mandatory requirements for it to be practical. You may think I'm saying this because I'm more interested in PGP, but actually, this is the reason WHY I'm backing PGP.
Until I came across Trend I had kind of ignored email encryption - email is an inherently insecure method of sending information, why encrypt it? Choose another method if you want to exchange or send information. However, I've always had faith in people's ability to learn new things, and apparently that is misplaced. People in finance and law are too busy or too helpless to use anything other than email apparently. The smartest and richest people in our country are simply too stupid to learn how an FTP server works, so secure mail we must.
That was basically how Trend presented it, and it apparently started to get some traction, so much so that I got to work on a secure email project recently in one of these places. It didn't work, and I've heard of others where it didn't. I never heard of one which did. At this point I took matters into my own hands and found PGP through some friends of mine.
Why isn't PGP bigger? Why isn't it everywhere already? Well, simply because they haven't pushed it onto everyone, but let people pick it up as they need it. I'd love to show it to everyone in the financial industry in the UK and let them see just how good it is for encrypting mail. Many of them have it already, for Whole Disk or File Encryption, some already have a Universal Server holding their keys, and a policy server holding policies. Adding mail encryption is barely any work, or cost, in these environments.
So, you'd think that IBE was a bloody good idea then. Well, yes, it's a cracking idea... and as an idea, it will remain cracking. As a practical implementation of encryption, it's nothing short of impossible however. Trust me, I've tried. There are 2 products you can do this with currently, Voltage and Trend Micro.
I've been assured that Voltage's approach to database encryption is a good one (by Voltage), and from what I know about IBE, I can imagine that it might work, but they don't push much on email (or didn't when we last spoke - I see they are talking about ING Canada on their website now). Trend Micro of course bought Identum, the email encryption company out of Bristol University. Basically a student project which ended up being bought by a company which thought they were getting a cutting edge, fully developed product.
I spent a long time trying to install this product, and never got it working how I wanted it to. There are just too many mandatory requirements for it to be practical. You may think I'm saying this because I'm more interested in PGP, but actually, this is the reason WHY I'm backing PGP.
Until I came across Trend I had kind of ignored email encryption - email is an inherently insecure method of sending information, why encrypt it? Choose another method if you want to exchange or send information. However, I've always had faith in people's ability to learn new things, and apparently that is misplaced. People in finance and law are too busy or too helpless to use anything other than email apparently. The smartest and richest people in our country are simply too stupid to learn how an FTP server works, so secure mail we must.
That was basically how Trend presented it, and it apparently started to get some traction, so much so that I got to work on a secure email project recently in one of these places. It didn't work, and I've heard of others where it didn't. I never heard of one which did. At this point I took matters into my own hands and found PGP through some friends of mine.
Why isn't PGP bigger? Why isn't it everywhere already? Well, simply because they haven't pushed it onto everyone, but let people pick it up as they need it. I'd love to show it to everyone in the financial industry in the UK and let them see just how good it is for encrypting mail. Many of them have it already, for Whole Disk or File Encryption, some already have a Universal Server holding their keys, and a policy server holding policies. Adding mail encryption is barely any work, or cost, in these environments.
Friday, 3 July 2009
Cheap as chips, safe as... chips.
I'm constantly amazed at how little strategy there is in most organisations. It doesn't matter how big or how small, I have rarely come across an organisation that has a fully joined up security strategy, which makes sense.
If you think you are one of these people, please set me straight, invite me in. I might stay.
I have been speaking to some people recently who have a large say in standards throughout financial services. I'm not going to name them as it would be embarrassing for them. They have created products in the past which are poor to say the least. Now they are backing an even poorer choice. I wonder how much of this is based on a friendship between directors, or a financial reward already spent.
Sadly there is still far too much of this going on in security. When will people learn that the cheapest solution WILL LET YOU DOWN. There are project processes like Prince, RUP, etc. for a reason. You NEED to know requirements before you install a product. Just because you get the licenses for a pound, doesn't mean it's the best solution to your problem.
I'm shaking my head whilst I write this, because that looks even more ridiculous when I write it down, and yet that's exactly what Safeboot did to the NHS. The NHS was using PGP for Whole Disk, now they are using Safeboot because it was £1 a license. Of course the support budget next year will make up for the massive losses they made, when they jack the prices back up again + the extra for license costs.
The sad thing - the NHS now needs secure email, which would have cost them just another £10 per seat with PGP, and they're stuck having to go back through the whole process again, back to tender, and will come out with another product, probably one which is the cheapest, and it won't do exactly what they want.
OK, I know it's easy to point out mistakes after the event, but is there really any excuse for this sort of behaviour from so-called security companies? Is this really the way to encourage "strategy"? Wake up people... the government of this country is already a laughing stock, don't feed them ammunition.
If you think you are one of these people, please set me straight, invite me in. I might stay.
I have been speaking to some people recently who have a large say in standards throughout financial services. I'm not going to name them as it would be embarrassing for them. They have created products in the past which are poor to say the least. Now they are backing an even poorer choice. I wonder how much of this is based on a friendship between directors, or a financial reward already spent.
Sadly there is still far too much of this going on in security. When will people learn that the cheapest solution WILL LET YOU DOWN. There are project processes like Prince, RUP, etc. for a reason. You NEED to know requirements before you install a product. Just because you get the licenses for a pound, doesn't mean it's the best solution to your problem.
I'm shaking my head whilst I write this, because that looks even more ridiculous when I write it down, and yet that's exactly what Safeboot did to the NHS. The NHS was using PGP for Whole Disk, now they are using Safeboot because it was £1 a license. Of course the support budget next year will make up for the massive losses they made, when they jack the prices back up again + the extra for license costs.
The sad thing - the NHS now needs secure email, which would have cost them just another £10 per seat with PGP, and they're stuck having to go back through the whole process again, back to tender, and will come out with another product, probably one which is the cheapest, and it won't do exactly what they want.
OK, I know it's easy to point out mistakes after the event, but is there really any excuse for this sort of behaviour from so-called security companies? Is this really the way to encourage "strategy"? Wake up people... the government of this country is already a laughing stock, don't feed them ammunition.
Subscribe to:
Posts (Atom)