+ Spire Security Viewpoint +

...

Last Update: Thu Jun 18 22:47:01 2009

+ Security Measurements Illustrated + Once again, Richard Bejtlich at TaoSecurity takes quantitative measures to task: "Calculating risk" or "measuring ROI/ROSI" are all [...] an opportunity to see the value of applying some quantitative measures. Some of you might be agreeing with the statement, but if I...

+ Security and "Healthy" + Last week, Hoff pointed to a presentation by Mark Masterson on cloud security. Given Hoff's level of enthusiasm, I was [...] complexity, so you can't use it (the formula) or prove it even more. Somehow, this proves that people that support "defense...

+ Cost-Benefit vs. Cost-Effectiveness + Dans Geer and Conway have their new "For Good Measure" column up where they deprecate cost-benefit in favor of cost-effectiveness. It [...] of course, is flawed. If you are operating in the interests of your enterprise, you can't opt-out of cost-benefit, you can...

+ Security and Risk in the Cloud, ongoing... + There has been a lot of discussion recently about whether the cloud is the same or different. Most of the time, these chocolate-peanut [...] completely misses the changes in architecture and appears to ignore the changes in risk. From an architecture perspective, the big...

+ R.I.P. Peter Bernstein + I just found out that Peter Bernstein died last week. I can think of no other book that has influenced me more in my career in risk [...] Tversky's Prospect Theory and the entire field of behavioral economics. For that, I thank him. (hat tip: the Curious Capitalist)

+ The Cloud's Pay-per-use Model + A while ago I posted my take on "Defining the Cloud" that was mostly tongue in cheek, but I also made a comment about the NIST [...] I replied: Yes, mostly because my position is that cloud should focus on technical architecture and ppu is a pricing model. If the...

+ Recession-ready Acquisitions: The Strong will Survive + Well, from a mergers/acquisitions standpoint, 2009 has been fairly robust for security companies. Perhaps there are fire sales going [...] Mi5 Networks April Thoma Bravo Entrust April Trend Micro Third Brigade May McAfee Solidcore May QinetiQ Cyveillance May EMC...

+ A Few "Favorite" Security Metrics - RSA 2009 Edition + I moderated a "Security Metrics Exchange" peer-to-peer roundtable at RSA 2009. Here is the abstract: "Many metrics sessions never [...] security environments." So, the goal was a simple one, and it is clear that there is no overarching structure to the metrics, but I...

+ Is PCI Working? + I was just going down the path of looking for PCI numbers to follow up on my post about the Verizon DBIR Report and PCI Compliance, [...] breached out of, say 2 million, then that is a pretty good effectiveness ratio. And if we compared it to 81 non-PCI companies out...

+ [Web Server] Size Matters + Doing some cloud research and I came across the High Scalability website which collects information on some of the largest Internet [...] and its location) Microsoft: 218,000 They have many others. Don't forget to read the comments that have a number of other numbers.