Satellite on a shoestring going strong 1 month later
OK, not really security related but fun to read anyway....

After a month in orbit, a satellite built by Naval Academy midshipmen with off-the-shelf parts from Radio Shack is exceeding all expectations, sending and receiving messages from ham radio users around the world.

Academy students and professors hoped the satellite would work for a month, given that many of the parts they used have no history of operating in space. But since the satellite was launched from Kodiak, Alaska, on Sept. 30, it has shown no signs of degrading, and the group is hoping the satellite will work at least another year and maybe another five.

Information Assurance
The Defense Security Service (DSS) Industrial Security Information Assurance Branch is comprised of computer security specialists and computer scientists who support existing Industrial Security programs.

New Dimensions International
Confronted by dramatic advances in technology and an historic shift in the Global Marketplace, security faces dynamic challenges. NDI services have grown to match the dynamic thresholds in technology and the new and changing World Order. Attacks emerge DAILY from global sources.

Attacks against the "Information Infrastructure" have reached unprecedented proportions with only more increases in sight.

NDI has advanced system security services, training, risk assessment and security designs since 1985. We have worked with government, Healthcare financial institutions, corporations, the public sector and telecommunications to ensure safe and sound security practices to help improve the understanding of the Intruder AND help develop policy, assess risks and prescribe remedies...SOLUTIONS.

gPIKT
gPIKT is a PIKT graphical user interface. It is written using Perl/Gtk. As of now, no other external modules are required.

gPIKT's basic philosophy is to present the user a tree of systems and their elements. All of them can be dragged to "publish list", and the list can then be published with a simple click. Each system and element have a context menu, where almost all command line piktc options are implemented.

PIKT
Sysadmins have long wrestled with the task of writing generalized scripts to monitor systems and deal with recurring problem situations. As conventionally practiced, this approach has numerous disadvantages: it is hard to account for diversity across machines and operating systems; operations are fragile and error-prone; scripts for handling simple tasks are difficult to code, or are hardly worth the effort to maintain; scheduling and managing scripts are time-consuming and repetitive; setup is inflexible; activity and error logging is rudimentary or nonexistent; and the whole mass of scripts and configuration files is nearly impossible to keep track of or even comprehend.

PIKT attempts to solve some of the problems observed in more traditional methods of monitor scripting and managing system configurations. PIKT is an embedded scripting language and accompanying script interpreter. PIKT is also a sophisticated script and system configuration file preprocessor for use with the Pikt scripting language or any other scripting language of your choice.
Finally, PIKT is a cross-platform, centrally run script scheduler (like cron), customizing installer (like rdist), command shell enhancement, and total script and configuration file management facility. PIKT's primary purpose is to monitor systems, report problems, and fix those problems whenever possible, but its flexibility lends itself to quite a few other uses as well.

MOUT
Military Operations on Urbanized Terrain (MOUT). In case you ever wondered what to do.....

Internet Journal of Rescue and Disaster Medicine
This on-line journal combines the contents of The Internet Journal of Aeromedical Transportation TM and The Internet Journal of Disaster Medicine TM.

Computer Security Group - Books & Journals
The Computer Security Group is an informal group of people with similar interests: mainly security, cryptology, and distributed systems.

We hold meetings, seminars, and workshops which are described in more detail in subsequent pages. Attendance is not restricted to members of the Computer Laboratory; we welcome visitors from other universities, companies, and other organisations.

Computer security has been among the laboratory's research interests for many years, along with related topics such as cryptology, formal methods, medical information security, electronic commerce, steganography and information hiding, and the robustness of distributed systems in general.

Here is a list of proceedings and journals which are edited by members of our group. It also has information on the "Computer & Communications Security Reviews".

Slashdot: Cryptography pages
The Slashdot articles on cryptography.

IBM 4758 PCI Cryptographic Coprocessor
The IBM PCI Cryptographic Coprocessor adds a high-security environment to your OS/2®, Windows NT®, Windows 2000®, AIX®, OS/400®, z/OS®, and OS/390® server systems for DES, RSA, and DSA cryptographic functions and sensitive custom applications. The PCI board incorporates specialized electronics to off-load your servers from time-consuming cryptographic functions while providing a tamper-responding, secure computing environment for the storage of keys and performing sensitive processing. Certification of the hardware under FIPS PUB 140-1 at levels 3 and 4 assures a high-integrity processing environment.

Extracting a 3DES key from an IBM 4758 The IBM 4758 is an extremely secure crytographic co-processor. It is used by banking systems and in other security conscious applications to hold keying material. It is designed to make it impossible to extract this keying material unless you have the correct permissions and can involve others in a conspiracy.

We are able, by a mixture of sleight-of-hand and raw processing power, to persuade an IBM 4758 running IBM's ATM (cash machine) support software called the "Common Cryptographic Architecture" (CCA) to export any and all its DES and 3DES keys to us.

Internet Security Systems, Inc.

AlertCON – Level 1:
AlertCon 1 reflects the malicious, determined, global, 24 x 7 attacks experienced by all networks
AlertCON – Level 2:
AlertCon 2 means increased vigilance/action required due to focused, patterned attacks.
AlertCON – Level 3:
AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, immediate action required.
AlertCON – Level 4:
AlertCon 4 reflects a catastrophic problem for a network or group of networks whose survival depends on immediate, decisive action.

The Packetfactory
The Packetfactory is a clearing house for cool-ass network and network security related endeavors. Here you’ll find all manner of useful security tools (firewalk, pandora), network tools (libnet, ngrep), etc... Feel free to peruse and download.

C4I.org - Computer Security and Intelligence
Links to interesting sites. Some sites will soon feature on this Weblog as well.

GeoTrust: TrustWatch
TrustWatch is an identity solution for business Web sites. Site association with a business is checked, and site owners are provided with an active digital icon for their Web site. Consumers, seeking to know and trust the Web domains they visit, will know from the icon if the Web site owner is a TrustWatch member. And, if the site belongs to a TrustWatch member, consumers will have access to business information about that enterprise. It's a way to show legitimate sites and make eCommerce safer.

Permanent link added
Besides the option to comment on a weblog entry, I've also included the 'permanent link' feature with a permanent link to the weblog entry. TIP: Bookmark the permanent link instead of the URL of the weblog, since it's contents change a lot (...).

F2F FOR PALM
The built-in security of most Palm Pilots is easy to break as has been demonstrated recently. Our free program, F2F for Palm, offers strong cryptography using the newly selected AES algorithm. It is intended for storage of items like pin codes and passwords only (although the program could easily be extended into a more general service). It offers a fixed storage space, a safe area, which is only decrypted when the program is active and the correct key is entered. Sensitive information may be stored in this area.

Comment opportunity added!
I've added the option to add comments to the entries I post to this weblog. Please, don't hesitate and give your opinion!

Clean Drive: Protect Yourself and Your Life
Every move you make on your computer is being logged. From the Internet sites you visit, to the documents you open... you are being tracked. Even if you attempt to delete these tracks, Windows retains secret log files. Deleting Internet Caches and searching for history files would take hours of work manually. Clean Drive deletes all these items from your computer... automatically, as often as you like!

Default disclaimer
Not a link to an external site but the default disclaimer I use on my PC and laptop. It is a disclaimer used by the DoD but I can't seem to find the link to it anywhere. Anyway, replace [COMPANY] with ofcourse, your company name!

This is a [COMPANY] computer system. This computer system, including all related equipment, networks and network devices (specifically including Internet access), are provided only for authorized [COMPANY] use. [COMPANY] computer systems may be monitored for all lawful purposes, including to ensure that their use is authorized, for management of the system, to facilitate protection against unauthorized access, and to verify security procedures, survivability and operational security. Monitoring includes active attacks by authorized [COMPANY] entities to test or verify the security of this system. During monitoring, information may be examined, recorded, copied and used for authorized purposes. All information, including personal information, placed on or sent over this system may be monitored. Use of this [COMPANY] computer system, authorized or unauthorized, constitutes consent to monitoring of this system. Unauthorized use may subject you to criminal prosecution. Evidence of unauthorized use collected during monitoring may be used for administrative, criminal or adverse action. Use of this system constitutes consent to monitoring for these purposes.

Protect your PDAs
When was the last time you left your PDA in the conference room or on your plane seat? Yesterday? Last month? Unless you plan to chain your PDA to your belt, the odds of losing your PDA are good. And if you're an IT manager, the whereabouts of corporate-supplied PDAs--and the sensitive information they contain--is now your problem.

According to Prakash Panjwani, senior vice president of business development for Certicom, which develops security software for PDAs, companies are now seeking the same level of security with PDAs that they once sought for laptops. "In the past," says Panjwani, "these were consumer devices that snuck into the enterprise. You got it as a gift, and then you started downloading corporate information and your IT managers didn't even know about it. Now that has changed because [companies] realize that the ultimate responsibility is the IT managers'."

Although the financial value of the hardware isn't devastating, the value of the information can be. The idea of a stranger having access to your personal data may be distressing, but the possibility that somebody could access presumably security corporate information is enough to give any CEO nightmares.