Measuring Overall Effectiveness of Data Security

Comments

Post a Comment

Popular posts from this blog

Unsolicited Electronic Messages Bill

Image
Hong Kong after months of public consultations is proposing an Unsolicited Electronic Messages Bill. This proposed bill has the following major features: 1. Enforce Opt-out (One needs to check before sending) 2. Technology Neutral (cover SMS, FAX and Email) 3. Prohibit address harvesting Generally, HK Government's effort is appreciated and the bill is comprehensive. There is not loophole the drafted bill does not quite get it. Under this bill, government propose to empower the Telecommunications Authority (TA) to set up "do-not-call registers", "which would be to facilitate recipients to opt out from receiving further commercial electronic messages from all electronic marketers and for senders of commercial electronic messages to ascertain the electronic addresses to which they should not send further commercial electronic messages unless they have specific consents. "This kind of register is very likely to be abused by malicious person to validate email address...
Read more

Blackhole for network security

There is a few paper on the net discuss how to divert and mitigate the damages caused by network attacks, in particular DDOS. Both papers describe a means to create a “black hole” on the network. One is on the network layer and one is on the web server layer Cisco Black Hole Filtering Cisco's paper explain a specifically built infrastructure can help ISP to route malicious packets to a null interface(blackhole filtering). Microsoft Beat Hackers At Their Own Game With A Hackerbasher Site Utilizing the principle that all vistors must know my name. This method divert incoming traffic using IP address not hostname. These papers give a good illustration that security can be achieved by thoughtful design. All the tools and technology is available to everyone or what they call built-in. By good designing, we increase the effectiveness of our security investment.
Read more

Windows Online Crash Analsysis (OCA) Security

Image
Today when I was using MS word to edit a document, I encountered an error which hangs my application. By forcing it to quit, Windows XP started Microsoft Online Crash Analsysis (OCA) and asked me to send an error report to Microsoft. OCA has been with us for sometimes and I usually clicked on “OK” with an urge to start working as soon as possible. However, today I looked into what was happening behind the simple click and found something unexpected. Opening 5MB file generated by OCA with a notepad, I was stunned to find my entire document appear in plain text (see the figure below). The error-reporting module actually transfers the document I am editing to Microsoft. Immediately, I checkout their privacy website to find out if is declared and it is (see the red circle). At this moment, a lot of questions pop up 1. Most importantly, are the document content necessary for the error investigations? 2. I believe with million of error reporting, Microsoft and their staff will not have the r...
Read more