S/MIME Vs RMS -Part I

S/MIME	RMS
Provides non-repudiation and identity attestation of the sender	Provides information usage policy enforcement
Provides for integrity protection and proof of tampering (signature validation)	Prevents tampering due to encryption
Security boundary may span outside corporate boundaries and firewalls	Policy persisted with the content
End to end encryption prevents sniffing and message interception	End to end encryption prevents sniffing and message interception
Cross-platform interoperability and wide application support	Windows Platform only (98SE and above), CE and Mac next
Two factor authentication for sending and receiving s/mime enabled mail	Prevents users from using expired content or information
Strong encryption and very large key sizes	Fixed encryption key sizes and algorithms
Limited message compression only in OWA	Provides message compression for all modes

Threat Model of "Star Wars"

Death Star Threat Modeling –

Part 1- http://www.youtube.com/watch?v=x0HfHmRN9x4
Part 2- http://www.youtube.com/watch?v=OHnXsL4Z3vo
Part -3 http://www.youtube.com/watch?v=ZWT_5TGZ5h4

One of the costly Arthimatic overflow bug resulting in a loss of more than US$370 million

One of the costly Arithmetic overflow bug resulting in a loss of more than US$370 million.

Ariane 5 Flight spacecraft crash in June 1996.

"Because of the different flight path, a data conversion from a 64-bit floating point to 16-bit signed integer value caused a hardware exception (more specifically, an arithmetic overflow, as the floating point number had a value too large to be represented by a 16-bit signed integer). Efficiency considerations had led to the disabling of the software handler (in Ada code) for this error trap, although other conversions of comparable variables in the code remained protected. This led to a cascade of problems, culminating in destruction of the entire flight. "

Source Wikipedia

Common security issues in XML,XSLT,XSD files

Here is some of the issues related XML,XLST,XSD. I know It is very rough list.

· Do validate all user inputs for XML/HTML/Script Tags-XML Injection

· Before creating an XML, data should be properly encoded to avoid XML injection. (Hacker can inject malicious script in the CDATA section)

· XML data should be validated using a native .Net class to ensure that it does not contain any malicious data.

· Serving XML/XSLT/XSD files over HTTP

· Clear text secrets in XML files

· XML Output Escaping Turned off

· XML files in the web root

· SQL injection using invalidated user inputs.

Interesting Example!!! Security ROI: Fact or Fiction?

Interesting Example!!!

Security ROI: Fact or Fiction?

Airport security. Assume that all the new airport security measures increase the waiting time at airports by—and I'm making this up—30 minutes per passenger. There were 760 million passenger boarding in the United States in 2007. This means that the extra waiting time at airports has cost us a collective 43,000 years of extra waiting time. Assume a 70-year life expectancy, and the increased waiting time has "killed" 620 people per year—930 if you calculate the numbers based on 16 hours of awake time per day. So the question is: If we did away with increased airport security, would the result be more people dead from terrorism or fewer?

From CSOnline.

ACE TEAM@ACE CONFERENCE-REDMOND WA

Here is the Team Snap after ACE Conference@Redmond. Entier 4 days are full of security sessions ,presentations, Hands on different tools.

10-15th August : ACE Conference

Attending ACE Security Conference in Redmond, WA,USA. 11th- 15th August 2008. attending more than 100+ Security Professionals from all over the world. Once of its kind of footstep of BLACKHAT.