Read more at http://www.phpclasses.org/package/7504-PHP-Take-screenshots-of-Web-pages-using-GrabzIt.html
16452 items (10780 unread) in 27 feeds
ComputerTechnology
(5303 unread)
RantsandRamblings
(4202 unread)
ComputerTechnology (65 unread)
Two weeks ago Vago Muradian from This Week in Defense News interviewed Army Lt Gen Michael Barbero, commander of the Joint IED Defeat Organization. I was struck by the similarities between the problems his command handles regarding improvised explosive devices (IEDs) and those involving digital security professionals. In fact, you may be aware that papers and approaches like Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains by Eric M. Hutchins, Michael J. Cloppert, and Rohan M. Amin, Ph.D. were inspired by the desire to move "left of boom" regarding IEDs.
In this post I will highlight elements from the interview which will likely resonate with those working digital security problems.
If you'd like to see examples of the IEDs encountered in the field and some US countermeasures, check out the first segment.
TweetCopyright 2003-2012 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
In November I wrote SEC Guidance Emphasizes Materiality for Cyber Incidents, my thoughts after reading an article by Senator Jay Rockefeller and former DHS Secretary Michael Chertoff. They explained why the CF Disclosure Guidance: Topic No. 2, Cybersecurity issued by the SEC in October is a big deal. Since then I attended a conference on Director's and Officer's insurance in Connecticut, and spoke on a panel about that SEC guidance. During the conference I learned that the SEC guidance isn't a big deal -- it's a really big deal. We're talking a game changer, potentially on three fronts. Here's what I heard at the conference.
Clients bombarded insurance firms asking what language they should use in their SEC disclosure documents. They asked "what are other companies saying? What should we say?" The firms noted similar boiler plate shared among clients, most of which insufficiently met the SEC's requirements.
One lawyer I spoke with said she expects the SEC to give publicly traded firms a "one year pass" before bringing enforcement actions against them for insufficiently outlining digital risk, pre- and post-breach.
Although it doesn't appear that this new office has paid any whisteblowers yet, it is apparently gearing up to do so. Imagine a case where security staff believes that management is not treating a breach as the staff thinks it should be treated, and decides to report the incident to the SEC -- with the possibility of a payout waiting!
At least a half-dozen major U.S. companies whose computers have been infiltrated by cyber criminals or international spies have not admitted to the incidents despite new guidance from securities regulators urging such disclosures.
Top U.S. cybersecurity officials believe corporate hacking is widespread, and the Securities and Exchange Commission issued a lengthy "guidance" document on October 13 outlining how and when publicly traded companies should report hacking incidents and cybersecurity risk.
But with one full quarter having elapsed since the SEC request, some major companies that are known to have had significant digital security breaches have said nothing about the incidents in their regulatory filings.
Now Senator Rockefeller is taking a closer look as reported by Jennifer Martinez of Politico this week:
Senate Commerce Chairman Jay Rockefeller thinks the SEC needs to ensure hacked companies are adequately informing their investors about when they suffer a security breach or cybersecurity risk that could jeopardize their financial standing.
The West Virginia Democrat wants the full commission to issue guidance for companies — right now they only have staff-level instructions — on when they have to report cyber breaches or threats and what steps they’re taking to minimize the risks.
“It’s crucial that companies are disclosing to investors how cybersecurity risks affect their bottom lines, and what they are doing to address those risks,” Rockefeller said in a statement to POLITICO.
Rockefeller will soon introduce an amendment that calls on the SEC to issue interpretive guidance on when companies must disclose cybersecurity risks and intrusions. Staffers for the Commerce Committee are finalizing the amendment and aim to introduce it before Sen. Joe Lieberman’s (I-Conn.) cybersecurity bill goes to the floor.
This is the sort of activity that I think is going to mark a sea change in digital security over the coming years. I don't expect engineering or technical developments to have anywhere near the same level of impact as issues that involve legislators, lawyers, insurers, and financiers. Stay tuned!
TweetCopyright 2003-2012 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Package:
Form Build
Summary:
Compose and output HTML forms
Groups:
HTML, PHP 5
Author:
srihari
Description:
This class can be used to compose and output HTML forms...
Package:
Protect Image
Summary:
Put transparent watermark text on images
Groups:
Graphics, PHP 5
Author:
Karl Holz
Description:
This class can put transparent watermark text on images...
Package:
Protect Image
Summary:
Put transparent watermark text on images
Groups:
Graphics, PHP 5
Author:
Karl Holz
Description:
This class can put transparent watermark text on images...
Package:
ApPHP Data Validator
Summary:
Validate sets of values in different ways
Groups:
PHP 5, Validation
Author:
Chara Miteo
Description:
This package can validate sets of values in different ways...
Package:
Random Secure Password
Summary:
Generate a random text from lists of characters
Groups:
Security
Author:
Hossam Suliman
Description:
This class can generate a random text from lists of characters...
If you've been reading this blog for a while, you know I don't think very highly of mathematical valuations of "risk." I think even less highly of the clowns in the financial sector who call security professionals "stupid" because we can't match their "five digit accuracy" for risk valuation. We all know how well those "five digit" models worked out. (And as you see from the last link, I was calling their bluff in 2007 before the markets imploded.) Catching up on last week's Economist this morning I found another example of financial buffoonery that boggles the mind. The article is online: Inter-bank interest rates; Cleaning up LIBOR -- A benchmark which matters to everyone needs fixing:
It is among the most important prices in finance. So allegations that LIBOR (the London inter-bank offered rate) has been manipulated are a serious worry.
LIBOR is meant to be a measure of banks’ own borrowing costs, and is used as the foundation for a host of other interest rates. Everyone is affected by LIBOR: it influences the payments made on mortgages and personal loans, and those received on investments and pensions.
Given its importance, the way LIBOR is calculated is astonishingly flimsy. LIBOR rates are needed, every day, for 15 different borrowing maturities in ten different currencies. But hard data on banks’ borrowing costs are not available every day, and this is the root of the LIBOR problem.
The British Bankers’ Association (BBA), responsible for LIBOR, gets around it by asking banks, each day, what they feel they should pay to borrow.
So LIBOR rates—and the returns on $360 trillion of financial contracts related to them, five times global GDP—are based on best guesses rather than hard data.
Let that sink in and forget about what you learned in business school or economics classes. LIBOR isn't based on actual rates; it's based on feelings!
The next part of the article talks about suspicions that banks manipulate this broken process to the advantage of the financial sector.
The remainder offers recommendations for improvement:
[T]he BBA should revamp LIBOR to ensure it is simple, transparent and accountable. These principles suggest LIBOR should be based on actual inter-bank lending, with any gaps filled in with the help of statistical techniques. Banks’ own guesses should be used as a last resort, not the first.
And regulators should collect data that could help spot LIBOR cheats: banks should be required to submit information on other banks’ borrowing costs, as well as their own. Regulators could cross-check submissions against hard data on banking-sector risk, and publicly report LIBOR abusers.
Keep this system in mind the next time a so-called "master of the universe" offers a lecture on measuring risk in digital security.
TweetCopyright 2003-2012 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)
Package:
TrialPay Dynamic Products Generator
Summary:
Create buttons to pay for products using TrialPay
Groups:
E-Commerce, HTML, PHP 5
Author:
Steven
Description:
This class can create buttons to pay for products using TrialPay...
Package:
Verify User
Summary:
Validate user with a record in a MySQL table
Groups:
Databases, PHP 5, User Management
Author:
Renato Menezes Portugal
Description:
This is a simple class can validate user with a record in a MySQL table...
Package:
FormGenerator
Summary:
Generate and validate Web forms
Groups:
HTML, PHP 5, Validation
Author:
Kacper Rowinski
Description:
This class can generate and validate Web forms...