Category Archives: Security

US Federal CIO calls for Security and Innovation

Steven VanRoekel, the former Microsoft executive and newly appointed Federal Chief Information Officer, has presented his first keynote.

He seems to say the choice between innovation and security is a false dichotomy — you can have both.

Now there are some who say we shouldn’t invest in government information technology in this fiscal environment, or use concerns about cyber security as a blanket excuse to preserve the status quo.

But if anyone doubts that now is the time to invest, consider the fact that more than half of the Fortune 500 companies were founded during an economic downturn. When forced to do more with less – when there is no alternative but to create a better way to get things done – that is when the real breakthroughs occur. In tough times, visionaries and risk-takers can tap into underutilized human capital, technology, information and other resources, picking up the pieces to reassemble them into something completely new.

Excellent point. Innovation is a great by-product of security (e.g. can’t innovate where/how you want if you have to spend your time/money fighting attacks) not to mention security innovation itself is a growth area.

His presentation was at the Palo Alto Research Center (PARC) and he made reference to its important role in American history.

When I was growing up in the 80s, I remember hearing people say that America was “destined” to be a service economy. We didn’t make anything anymore – our best days were behind us. But then ideas like those that came out of PARC helped spark a technology revolution that reestablished America’s leadership and launched the innovation economy.

Nicely said, but I call that a false dichotomy. American companies do not have to innovate in order to make things. Just look at Microsoft.

Nigeria Launches Driver Tracking System

President Jonathan in Nigeria last month announced a new drivers license and car license system:

Today marks another step in our transformation journey. The launch of the new driver’s licence and number plates today is the culmination of three years of hard work which started with a discussion I had with the Corps Marshal in my office then as Vice President on the need to improve our driver’s license for it to meet international standards.

Today’s launch has acquired greater significance following last Friday’s unprovoked attack which led to the loss of lives and has left in its trail gory images of the threat terrorism now poses to the peace and security of our nation and the safety of our citizens.

Since the last bombing episode on October 1, I had directed the hastening of efforts to build a credible database of drivers and vehicles in order to improve public safety. The importance of this project is reaffirmed by the consistent use of vehicles in the conduct of the recent bombing episodes.

Today I heard that the system may be accessible on-line for investigation of Nigerian citizens by external or even foreign agencies. Maybe there even will be a Google Maps API to monitor the movement of Nigerian drivers.

Although the licenses and plates may be unique I suspect they are still a long way away from establishing a link to unique addresses. A whole town may use the same mail stop and could have overlapping names, so numbers for driving will become unique but the rest of the information on the license/plates may remain shared.

It reminds me of the time when I wrote about the Irish Police that struggled to catch a notorious reckless driver that seemed to be everywhere and have many addresses

In a letter dated June 17th, 2007, an officer from the Garda traffic division wrote that it had come to his attention that members inspecting Polish driving licences were noting Prawo Jazdy as the licence holder’s name.

“Prawo Jazdy is actually the Polish for driving licence and not the first and surname on the licence,” he wrote.

Textbook theft in Cameroon

Attackers are said to be targeting children leaving school to rob them of study material, as reported by allAfrica.com

The school has put in place preventive measures to ensure that people who loiter around the school premises to seize textbooks from pupils returning from school are put to shame.

Apart from making sure that guards at the entrance to the school compound are on constant lookout for people loitering around the fence, school authorities have also put in place a system whereby stationery and textbooks of all pupils are kept in school.

I hate to ask this but is there any chance this is a conspiracy by the children to reduce their study time outside the school? It’s not the dog-ate-my-homework story but rather the thieves lurking outside have stolen everything, even the textbook, so I can’t even continue this class story. Perhaps there are textbook shortages and an underground market for used copies, but are students really going to resist having their homework stolen?

Finding the Security Spot for Virtualization

Can there be a single absolute answer to the question of where security should sit within an organization? Take the following as a perfect example of how opinions can sway.

First, you have the argument from an expert on security and networking that VMware is not in the security or networking business.

VMware is not a security or networking company and ignoring the fact that big companies with decades of security and networking products are not simply going to fade away is silly.

He seems to say that security is not just going to move away from where it has been established.

Second, you have an expert tweeting the “biggest change” is that security will move away from security organizations.

Want an example of the biggest change in security that is making the most impact? Moving security away from security orgs. See virt/cloud

This could be an interesting debate if only it were not the same person saying both things.

The answer to the question of where security fits for virtualization is really that it depends. I see security run from many different organizations and there has never been a single best-fit for everyone. Some companies I work with have never moved security to a security organization and probably never will.

Those who chose to create a dedicated security group cited things like the complexity of work as well as the need for operational and investigative independence. Complexity can be a lesser concern through the initial phases of emerging technology (fewer capabilities, fewer products for virtualization control) but conflict-of-interest and independence always remain a factor.