On Being Ecologically Responsible

Following Charles Stross' lead, I went through this Guardian link last night on how to reduce emissions. In everything but flying it looks like as a household we come out saving about 4.4 tonnes as we do most things right, but then I'm screwed on flights, doing 16 shorthaul and 4 longhaul this year. At least I have cut down since last year by over 70% so I am reducing my footprint.

Amused by the 'take up vegan' idea - can't think of anything worse. Wonder if I get points for giving up all no meat items...

And in Scotland the whole solar power thing.... well...

Scheme to improve business trust in penetration testing is launched

From next month, the Council of Registered Ethical Security Testers (CREST) is open for business. Designed to ensure that penetration testing provided meets minimum standards, and appropriate methodologies and processes are in place, it involves practical assault courses to test skill levels of penetration testers, similar to the UK CHECK scheme.I like this idea - seems more relevant and usable to non-government organisations.



read more | digg story

Ever wanted to go to Morocco for a holiday

Well, my brother went out to Essaouira for a kite-surfing holiday and loved it so much he bought an apartment which he is letting out during the summers. If you fancy it, check out Apartment Simoom

This Post at Blorge.com pitches itself as the definitive security comparison between Vista and XP but actually tells us nothing. Seems weirdly biased towards Vista even though the points laid out do not support this at all.

Most depressing.

Windows Power Shell Tips

Excellent O'Reilly tips on using Windows Power Shell.

Cool thing I saw today

The History of Hacking

Cthulhu Invocations by Language

Sensible use of the Google Code search tool here

This is what being a geek is all about...although does this mean Google is at least measuring evil, if not actually doing it?

Cool blogger hacks

Hoctro's Place

joatBlog

joatBlog has a nice summary of some simple steps we should always get tech folks to run through before passing the problem to IT Security:-)

Security Theatre - liquids on a plane

My thoughts exactly.

Why not follow El Al's lead in this - as they have been dealing with the terrorist threat fro a Very Long Time (tm)

---Use humans trained in this sort of thing to interview everyone who wishes to fly---

It appears to work pretty well!

See Schneier's take on it as well

The Blue Frog is not yet dead

Just decentralised

Antarctic Adventure

Check out my mate Alan and his crazy charity fund raising idea Here

I like this post.

Security testing as 'badness-ometer'

Nice

Multi-tail

Multi-tail seems like a handy tool for general monitoring purposes.

The Blog Worm

For those of you who linked to the blog worm (cute though it may be) please
read this to see why you should replace it with a gif you control.Ahhh - the joys

[the new p0f]

Passive OS fingerprinting - the non-intrusive scan tool:-)

Moves to professionalise Infosec

Was at the ISC2 Secure London conference yesterday. Interesting day, and lots of interesting info. Check out uksaint.org which is a site supported by Intellect, the trade body for the UK hi-tech industry. It is currently hosting the working group info for the move to professionalising the information security industry.

Another interesting URL mentioned was www.staysafeonline.org which could be of use to your average user.

Interesting stats - from Gartner originally

75% of attacks are at application level
70% of vulnerabilities as at application level

and

Reducing the number of application vulnerabilities by 50% should lead to a 75% reduction in costs!

Nice

Non photo realistic Quake



How cool is that?

Security from the start

Dana Epp discusses building security into code and applications. This seems absolutely obvious but you would be astonished at how many organisations do not have secure coding guidelines or even best practices. This should help any application developers.

The end for simple vulnerability scanning?

Nessus is dropping the GPL



Could change the way a lot of security consulting firms run the basic section of a security assessment, as nessus - even though it has its issues around false positives - has always been a staple part of the toolkit.