Free PDF Download of “Beautiful Security” Chapter (Tomorrows Security Cogs and Levers) Here
Posted June 22, 2009 by mcurpheyCategories: information security
Mark Curphey here…(@curphey on Twitter)
A few months ago I got an opportunity to work on a collaborative security book for O’Reilly called Beautiful Security. The concept was to gather together some folks who to share their thoughts on information security topics that they have some passion about. There is a great range of authors from Mudge (L0pht) to Phil Zimmerman (creator of PGP) to and Ed Bellis (CSO for Orbitz). You can buy the book on Amazon here.
O’Reilly are great to work with on books. While all the proceeds of the Beautiful Security book go to the IETF, O’Reilly encourage the authors to republish their own work at will and they even kindly provided me with a beautifully formatted PDF to redistribute. I hope you enjoy it!
Download “Beautiful Security – Tomorrows Security Cogs and Levers by Mark Curphey” PDF here.
Airport Security – May Contain Nuts
Posted June 18, 2009 by mcurpheyCategories: Humor
(Written at 38,000 ft from the BA277 from Heathrow to Hyderabad, India. I am lucky enough to turn left when I get on a plane and so I bashed this little diatribe out with the help of a few glasses of red wine in my belly.)
It never ceases to amaze me at the false sense of security and warm cozy feeling we all appear to get from airport security.
After checking in on the Internet last night using nothing more than an six character code* sent via email ( for anyone who didn’t already know email is like a postcard; anyone who delivers it can read it) and my surname, I joined the FastTrack security line at the new Heathrow Terminal 5. As the SlowTrack line meandered toward the conveyer belt I removed my belt, watch and shoes and took my laptop from my briefcase. The four trays needed to pass my carry on apparel (1 for laptop (must be alone), 2 for glasses, cell phone and laptop bag, 3 for shoes and sweater and 4 for the carry-on bag) through the scanner followed a bleached blonde females fake Luis Vuitton handbag, Mac Book Air and pink cell phone (that her ear seemed to have been attached to five minutes before). She beeped as she walked through the scanner and I smiled smugly. I then heard her telling the minimum wage security guard that she had “body piercings”. After the wand passed again over her boobs and nothing beeped she nodded towards the floor and coyly said “its my front bits”. The blushing guard (female) passed the wand in front of the womans genitals and smiled “ah yeah”. I of course was thinking “prove it”. If you have the balls (sic pun intended) to mutilate your sensitive organs then surely you have the balls to get them out in public? She was ushered on, collected her tacky luggage and waddled off into insignificance like a “Big Brother” star expecting some paparazzi to jump put on her. If you can get your vagina pierced but can’t even say the word in public (I guess technically its a vulva as a vagina is internal but ….) then something is wrong in my book and surely warrants further investigation?
I of course passed without incident, reassembled my travel camel and went to the BA Lounge. When I got to the the lounge I freshened up in what can only be described as a “port-a-loo” inside an airport lounge. In my wash bag was a new pot of moisturizer (that I forgot to take out and put into a clear plastic bag but surely bigger than is allowed) and a sharp razor like blade used to deal with my ailing foot (another story) that I had also forgotten was packed. Lucky (I guess) I didn’t have a Prince Albert or I would have surely been frisked!
As I checked into gate 10b I was behind a “lady” dressed in a Burka. I say “lady” as I could only see her eyes (I am sure my wife who lived in the UAE will correct me that it’s a “hib-something” and not a Burka). Intrigued as to how you check a passport photo when you can’t see the face I watched the other lane as I approached the desk and asked the lady at my desk “How on earth do you check people when you can’t see their face?”. She whispered embarrassingly “we ask them to lift their head dresses” and sighed with a sarcastic look that told me a lot. I wasn’t looking for the sigh or sarcasm; I was genuinely interested in a straight non-judgmental answer. As I joined the queue for the bus (why you need to get a bus to a plane in a brand new airport is beyond me) I turned to see if the lady had been asked to remove her head dress. No, it was a quick visual scan of the passport and then she was ushered to join the queue for the bus.
I get onboard the plane and settle down in seat 3A. Late lunch is served along with the wine that fueled this post. Having recently flown the other way around the world (London > Seattle) house hunting economy I was reminded that in business you get a (chilled) set of metal cutlery. I am sure I just got a plastic knife in baggage class the week before last. Do global terrorists not have a few thousand pounds to upgrade to business class I ponder? I guess not…..
So in summary (and I suspect all terrorists already know this) : Get your bits pierced, wear a Burka and fly business class.
In the meantime for the rest of us I hope the queues and checks continue to give us a warm fuzzy feeling of security.
Fly on!
Warning : This blog was written on board a plan that possibly also served nuts (either definition of the word!).
* Sure its actually not that small a key space but when you consider the amount of people flying and the speed of guessing….
Gem of a Security Post
Posted June 15, 2009 by mcurpheyCategories: Long Tail Security, Security Bullshit, Security Industry, Software Security, information security
I think I am going to rename this blog “Stuff that doesn’t fit into 140 chars” (stolen from Chris Anderson). I am mainly posting on Twitter these days, you can follow me here www.twitter.com/curphey .
I am not sure how I missed this absolute gem of a blog post but I did. It’s a great read and has this superb phrase;
Utterly amazing waste of resources to spend so much money on toys and shenanigans just so "security" people can play cops and robbers on the shareholder’s dime, while the enterprise crown jewels – apps, data, and users are left wide open.
http://1raindrop.typepad.com/1_raindrop/2009/03/where-we-are-and-where-we-are-going.html
Ray Kurzweil – Singularity University From Ted 2009
Posted June 4, 2009 by mcurpheyCategories: information security
Ray Kurzweil’s latest graphs show that technology’s breakneck advances will only accelerate — recession or not. He unveils his new project, Singularity University, to study oncoming tech and guide it to benefit humanity. (Recorded at TED University 2009, February 2009, in Long Beach, California. Duration: 8:42)
Brilliant stuff!
Want a Free Copy of Beautiful Security?
Posted June 4, 2009 by mcurpheyCategories: information security
Follow me on Twitter using @curphey
I will send a one free copy of a book that I recently contributed to called Beautiful Security (published by O’Reilly) to the lucky winner of a simple competition. Here is how to play.
Post a message on Twitter to @curphey with the hashtag #beautifulsecurity and the message “I want a copy of Beautiful Security” as close as you can past 12:00:00 PST (20:00:00 GMT) today, Thursday 4th June, 2009. The first message that shows up in my client after the exact time specified (anything as much as a milli-second before 12:00:00 PST will not count) will get a free copy of the book sent to them.
I will be publishing my chapter “Tomorrows Security Cogs and Levers” free in PDF form on this blog next week. You can buy the book on Amazon here.
Note: While I haven’t looked at the Twitter API I am pretty sure you can automate this. I have no idea how Twitter or my client queues posts. A bonus book will be sent to anyone who shares code / method of a creative way of gaining an unfair advantage!
The Alice and Bob After Dinner Speech
Posted June 3, 2009 by mcurpheyCategories: Humor
Priceless – http://downlode.org/Etext/alicebob.html
(Hat tip to Dinis Cruz)
Follow me on Twitter @curphey http://www.twitter.com/curphey
SDL in Visual Studio Team System
Posted May 19, 2009 by mcurpheyCategories: Security Industry, Software Security
![3351321706_284ab62aee_o[1] 3351321706_284ab62aee_o[1]](http://blogs.msdn.com/blogfiles/stevecla01/WindowsLiveWriter/TheCoolestResumeCV_D17B/3351321706_284ab62aee_o%5B1%5D_3.jpg)

Recent Comments