David Sirrine, from Red Hat, talks about practical applications for iptables and Linux endpoint security at the April richSEC meeting.
Month: May 2012
Track Your CPEs From Security ConsTraining
I know that folks have some varying opinions on IT certifications (especially IT security certifications). While it’s true that you shouldn’t judge someones worth by the number of certifications they have, if you’re in IT or infosec (and you’re not already a rock star) you know that they are here to stay. And, you know that you have to keep them updated to satisfy the powers that be, if you want to remain current. Some (see DoD or even some security consultants) HAVE to maintain them to keep their jobs. You do that by maintaining the required number continuing professional education points (CPEs).
There are many different ways to attain these CPE’s, but one is attending a conference or training. I will be attending a security conference June 16th called RVAsec. I was talking to someone about it and made the comment about earning CPEs for it, so i figured I’d bring up a neat way of tracking your CPEs from RVAsec (or any trainingstudy CPE earning activity) on mycpes.com. I have been a member of mycpes.com since it started. It’s a handy way to track CPEs for multiple certs, and the development team is always adding features and finding ways to improve the site. It’s free (there is a paid version with more features). Whether you’re IT or you just have certs that require CPEs (like the CPAs out there) it’s a handy tool.
Two Wrongs Make A Right?
While I was checking my feeds the other day I noticed the article here from The Register. The gist of it is a Russian startup has a service that will disrupt torrents. The technical information is still sketchy, but here’s a quote of a quote from The Register article: “We used a number of servers to make a connection to each and every p2p client that distributed this film,” Klimenko says of the technology test. “Then Pirate Pay sent specific traffic to confuse these clients about the real I.P. addresses of other clients and to make them disconnect from each other.” Sounds suspiciously close to the old TCP spoofed reset denial of service from back in the day to me. Rather sending sending RST’s they’re just sending bogus IP info or something.
This seems like it would be on the wrong side of the law in some countries. Maybe not, could be a grey area. My thought: Is DoS-ing a service you (or your investors) think is wrong make it rightlegal? And let’s look at what a DoS is from wikipedia “In computing a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. ” The Pirate Pay sounds like they’re DoS-ing a service to me. I’d be interested to hear what the community has to say? I don’t want to turn this into a “pro-piracyanti-piracy” debate, this more about the principal behind their approach: What do you think about a company using tools or techniques to disrupt operations or traffic on other users’ machines?
Pipefish 