Steve Goodbarn

Mark Hurd cuts pay, not staff at Hewlett Packard

HP (or HPQ to the financial world) had a bad quarter  - no surprise in this economy - and took action to cut costs and preserve competitiveness by reducing salaries. (See Network World, including a link to Digital Daily for the actual memo to employees).

Hurd is cutting salaries, starting with a 20% reduction for himself, 15% for executive council members, 10% for less senior executives, 5% for remaining salaried employees, and 2.5% for hourly workers. Bonus plans are being left in place so there is still upside potential.

This plan avoids what could be up to 20,000 layoffs and a big demoralizing brain drain.

HP did this before in 1985 and in the late 1970s. If anyone out there remembers the details please post a comment. Several news sources are citing this as "unprecedented" and that is not the case.

The HP way is in stark contrast to Wall Street. Financial executives must be throwing up. They have laid off thousands, taken billions in bailout money, and still pay huge bonuses to their leaders.

To get through these tough times without a depression or social unrest will require this type of leadership: 

• Avoid layoffs as the very last resort
• have leaders make the biggest sacrifices
• keep incentives in place
• preserve intellectual capital

Hp is also limiting 401(k) contributions and eliminating discounts on stock purchases. This may sound like punishment but given investment returns over the past few years is probably saving people from themselves.

Protect your employees and they will protect you. A company should feel like a family and not the empire of Dr. Evil. High morale = innovation in times like these. We can invent our way out of this.

Dan Kaminsky takes time off to push DNSSEC

According to Security Focus, Dan Kaminsky has taken a 2 month leave from IO Active to promote adoption of DNSSEC. Network World expands on his talk at the Black Hat DC conference today.

This could be just what is needed to get the root signed.

I am a little miffed that Kaminsky and others continue to say DNSSEC is complicated to implement and to operate. Secure64 has a DNS Signer that fully automates the process and makes it a virtual "no-excuses, no-brainer".  Signing the root will make things easier for everyone down the road but it is not a roadblock for those wishing to adopt today.

Federal data not safe

USA Today stated that reported raids on federal computer data have grown from about 2,000 in 2006 to almost 5,500 in 2008. Presumably there are also unreported raids that make the situation even worse. According to the article this is based upon a sampling of only 1% of agencies. The data came from the Homeland Security Department's US Computer Emergency Readiness Team (US CERT).

Let's see, 5,500 X 100 = 550,000 raids using simple extrapolation. Quite disturbing given initiatives to put even more private data, such as medical records, on-line.

I expect the attacks will continue to increase but the government is doing something to stop them from succeeding. Federal agencies under the .gov domain and their service providers are required to adopt DNSSEC by the end of 2009. DNSSEC is the top IT Federal priority for 2009 and will provide a new web of trust that does not exist today. It will spawn further security applications for email, VoIP and other Internet services that will make it more and more difficult for attackers.

The Obama administration has taken these threats seriously and is moving fast. He has appointed Melissa Hathaway, to complete a 60 day review of Federal cyber security. Hathaway is a very competent and experienced person who headed the Cyber Security Initiative. I think this is a better move than appointing a cyber security czar who would have an indefinite pulpit. Sixty days puts a finite timetable for a report.

I look forward to her report in April.

A new Internet?

John Markoff of the New York Times had an excellent article over the weekend entitled "Do We Need a New Internet?" The article highlights some of the security shortcomings and touches on the Clean Slate project to build a new secure Internet.

Here are some excerpts:

“Unless we’re willing to rethink today’s Internet,” says Nick McKeown, a Stanford engineer involved in building a new Internet, “we’re just waiting for a series of public catastrophes.”

“In many respects we are probably worse off than we were 20 years ago,” said Eugene Spafford, the executive director of the Center for Education and Research in Information Assurance and Security at Purdue University and a pioneering Internet security researcher, “because all of the money has been devoted to patching the current problem rather than investing in the redesign of our infrastructure.”

"Despite a thriving global computer security industry that is projected to reach $79 billion in revenues next year, and the fact that in 2002 Microsoft itself began an intense corporate-wide effort to improve the security of its software, Internet security has continued to deteriorate globally."

It's great to see the The Times writing about the vulnerabilities of the Internet. It's also great that we have projects like Clean Slate, and if it comes together to save us from cyber meltdown then it will have been money well spent.

But big changes tend not to happen.

We already have the tools to fix these problems without building a new, more Orwellian Internet. If we can't implement a few simple changes then it is very unlikely that a new secure but also less anonymous and more expensive Internet will happen. There are too many worldwide constituencies to please. The world is in an economic free fall and higher cost is not in the cards.

So what can be done today?

1. Sign the root DNS servers. DNSSEC implementation enables authentication while preserving anonymity. The .gov zone is signed (officially it is not signed but if you dig the servers you will see they are). Signing the root will make adoption easier. Market forces will lead to further adoption. My previous blogs drive home the benefits and low cost of DNSSEC.
2. Insist on secure operating systems and hardware for mission critical activities.

Most infrastructure is based upon hardware and operating systems that were designed pre-Internet. They were not designed for security. Therefore we have endless patching and bolt-on security such as firewalls, intrusion detection systems, anti-virus, anti-bot, etc, that still do not solve the problem. These systems seem cheap but with an annual computer security market of over $79 billion they are not cost effective. They burn a lot of coal for power and cooling and they require over-provisioning so service providers, such as Google, are far from being as efficient as they claim.

Lastly, this mess leads to endless expense, frustration, delay and anxiety for users. Secure operating systems exist today, my company Secure64 has one.

These suggestions are very easy to implement. The root could be signed by the end of the month. It's an inexpensive way to make real progress in Internet security and better enable this low-cost tool to remain that way.

A bounty on the conficker worm

Round up the cyber security posse! According to Network World, Microsoft is posting a $250,000 bounty for the perpetrators of the Conficker/Downadup worm.  I'm not sure if that means dead or alive, plugged or unplugged.

That may be $250,000 well spent and could start a trend in tracking down malware. The fact that a reward is posted indicates to me that we might see more damage from this worm as it continues to propagate. So far it appears to have grounded a few French jets.

Follow the links on Network World to learn more.

Stay tuned and be careful with USB sticks.

The .gov domain is signed - the first GTLD to adopt DNSSEC

As many of you kow if you read this blog, there is a requirement that federal agencies under the .gov domain adopt DNSSEC by the end of 2009. The process of DNSSEC adoption for individual sites is facilitated when the top level domain (e.g. .com, .edu, .gov, .org) is signed using DNSSEC. This week the .gov domain began signing their zone. DNSSEC is alive in the US of A.

This is one of the first big steps to improve Internet security and reliabiity. It's a big, big deal in meeting campaign promises to make government more efficient by using the Internet. And it doesn't cost very much.

I'm suprised by the lack of publicity. I've been sitting on this knoweldge for a couple days now wondering if I should write about it. Congress - especially Representative Jim Langevin, the Administration and the responsible agencies should be congratulated for getting this done.

Clever scams proliferate

PC Mag.com Security Watch has a post today about a clever parking ticket scam: Yellow Parking Violation Fliers on Windshields Get Drivers to Visit Malicious Web Site.

This particular scam seems amateurish but It doesn't take too much imagination to see how this technique could be used more effectively to load malware onto a PC, a network, or a handheld device. How about "Download your ticket for a free breakfast. . .iPod. . . ski pass. Expires at midnight"

With more and more Internet access on handhelds they are a logical attack vector for malware and a way to get malware into a PC or a network.

The US-CERT site has tips on protecting your handheld device. The suggestions are mostly common sense advice on passwords, backups and installation of bodyguard applications like firewalls and anti-virus. The performance and hassle (e.g. downloads/backups, synchronization and keeping patches up to date) of having these apps on your cell phone or PDA are not discussed.

How many of you have antivirus and firewalls on your handheld? Do you remember your passwords, if any? If not, where do you write them down? I suspect most people avoid the hassle and take the risk, with varying levels of anxiety. That isn't good if you are a CISO of an organization with a lot of people.

Here is a better idea: Let's work on making the Internet and communications more secure so malware has no place to hide. Take the burden off the user and make their life easier. We already have all of the technology to do this cost effectively.

Risk versus Opportunity

I am CEO of a software company that produces secure software - meaning it is immune to malware and resists network attacks (e.g. denial of service). We get lumped into the IT Security space even though we do not sell security products such as firewalls, intrusion protection or anti-virus. Security risks are an important market consideration for our products, but I cringe at being described as a security company. Our products simply remove the security worry.

Anyone selling IT security will tell you that products sell on FUD - fear, uncertainty, and doubt. Industry magazines and even the general media are awash in articles about the latest exploit, identity theft and malware threat. We use it in our marketing and I will keep posting them on this blog.

But by emphasizing the risks and threats the industry is missing a point about the opportunities afforded by better and especially more simple IT and Internet security. At the end of the day very few people are victimized by cyber crime. Far more are inconvenienced by these threats and by the numerous bodyguard applications and software updates they need to stay relatively safe.

And there is a further but very large group who have minimal on-line activity either because it is too complicated (security and patching being POTP) or because they had some sort of problem or system slowdown and don't know/can't afford help in getting their system working again.

If we could make users more secure, remove their administrative pain, it would lead to growth, new and more efficient ways of using the Internet and IT. The tools exist to do this, but most of industry continues on the "band aid and body guard" approach with old technology. It's a big business. But a secure Internet would unleash a tidal wave of new applications, new jobs and new ideas that would improve our world. It would improve peoples lives by making things easier and less costly.

I urge the IT security industry to put some emphasis on the opportunities afforded by a secure Internet infrastructure. We need to break with past practices in order to get the efficiency and growth needed to restart our economy.