The Security Roundtable http://www.securityroundtable.com Security Podcasters Discussing Top Issues Thu, 12 Jun 2008 04:24:46 +0000 http://wordpress.org/?v=2.5.1 en ©Michael Santarcangelo | Catalyst Media http://www.securityroundtable.com/feed/ SecurityCatalyst@gmail.com (Michael Santarcangelo | Catalyst Media) SecurityCatalyst@gmail.com(Michael Santarcangelo | Catalyst Media) 1440 cissp, privacy, awareness, policy, security, compliance, cism, cisa, rsa Extending the conversation around how people think about and protect information. Hosted by Michael Santarcangelo (The Security Catalyst) and Martin McKeay. Michael Santarcangelo | Catalyst Media Michael Santarcangelo | Catalyst Media SecurityCatalyst@gmail.com No no http://www.securityroundtable.com/srtlogo.jpg The Security Roundtable http://www.securityroundtable.com 144 144 Security Roundtable for June 2008: Clarion Call of the Jericho Forum http://www.securityroundtable.com/2008/06/12/security-roundtable-for-june-2008-clarion-call-of-the-jericho-forum/ http://www.securityroundtable.com/2008/06/12/security-roundtable-for-june-2008-clarion-call-of-the-jericho-forum/#comments Thu, 12 Jun 2008 04:24:46 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=22 If you believe the Jericho Forum has called for the end to firewalls, then you need to stop what you’re doing and take a listen to this month’s Security Roundtable.

After attending an interesting discussion during RSA, Martin and I invited the Jericho Forum to join us at the roundtable to talk more about what Jericho Forum is, an what it does. We learned a lot and share the discussion with you…

Joining us on the program:

 

Learn more about Jericho Forum: http://www.opengroup.org/jericho/

 

 

Paul Simmonds, Co-founder and board of management Jericho Forum  & former CISO, ICI
Until May 2008 Paul Simmonds was the CISO at ICI (www.ici.com). Paul’s varied career has included Electronic counter-measures, Theatre Lighting, North Sea Oil control systems, JET (Nuclear Fusion Research) and commercial radio. Prior to joining ICI in 2001 he was Head of Information Security with a high security web hosting company and before that spent seven years with Motorola, as global information security manager. 

Paul was awarded European Chief Security Officer of the year at the 2005 SC Magazine Awards and is listed in both the 2004 & 2005 global top 50 most powerful people in networking by the US publication Network World.  Paul sits on the management board of the Jericho Forum and the Executive Advisory Board of ISSA UK. He also is a British Canoe Union Level 3 Kayak Coach.

Shane Buckley, President & CEO, Rohati Systems, Inc.

Shane Buckley is the President and Chief Executive Officer at Rohati Systems, Inc. Buckley comes to Rohati with more than 20 years of global executive and general management expertise, having held senior executive positions in the United States, Europe, the Middle East and Asia-Pacific.

 

Before taking the helm at Rohati, Buckley served as Chief Operating Officer at Nevis Networks, Inc. a leader in network access control. Previously, he was Vice President of Worldwide Enterprises for Juniper Networks. Prior to that, he served as the International President of Peribit Networks, the leader in Network Optimization. Juniper Networks purchased Peribit in June 2005 for $380M. Before Peribit, Buckley served as Chief Executive Officer of Conduit Software, a provider of Directory Assistance and Wireless Applications solutions. Previously, he was Vice President, EMEA at 3Com. In this role, he managed a $2.2 billion business unit and was responsible for 3Com’s distribution strategy, OEM partnerships and reseller channels. Buckley also chaired 3Com’s Global Distribution Council, was a member of the company’s worldwide OEM steering team, and served as 3Com’s head of operations for the Asia-Pacific Region based in Hong Kong and Tokyo. 

 

Buckley is a frequent speaker at high-level industry trade shows and events such as Gitex, CeBIT and The Wall Street Journal Europe conference. He has also contributed to a number of magazines and news programs including MSNBC, SABC and Middle East Business news. He holds an engineering degree from the Cork Institute of Technology in Ireland.

]]> http://www.securityroundtable.com/2008/06/12/security-roundtable-for-june-2008-clarion-call-of-the-jericho-forum/feed/ 54:21 If you believe the Jericho Forum has called for the end to firewalls, then you need to stop what you're doing and take a listen ... If you believe the Jericho Forum has called for the end to firewalls, then you need to stop what you're doing and take a listen to this month's Security Roundtable. After attending an interesting discussion during RSA, Martin and I invited the Jericho Forum to join us at the roundtable to talk more about what Jericho Forum is, an what it does. We learned a lot and share the discussion with you... Joining us on the program: Michael Santarcangelo - The Security Catalyst and author of Into the Breach Martin McKeay - Host of the Network Security Podcast and Captain Privacy Chris Hoff - Luminary and Jogger Paul Simmonds (bio below) - Co-Founder Jericho Forum Shane Buckley (bio below) - CEO Rohati Systems nbsp; Learn more about Jericho Forum:nbsp;http://www.opengroup.org/jericho/ nbsp; nbsp; Paul Simmonds, Co-founder and board of management Jericho Forumnbsp; #38; former CISO, ICI Until May 2008 Paul Simmonds was the CISO at ICI (www.ici.com). Paulrsquo;s varied career has included Electronic counter-measures, Theatre Lighting, North Sea Oil control systems, JET (Nuclear Fusion Research) and commercial radio.nbsp;Prior to joining ICI in 2001 he was Head of Information Security with a high security web hosting company and before that spent seven years with Motorola, as global information security manager.nbsp; Paul was awarded European Chief Security Officer of the year at the 2005 SC Magazine Awards and is listed in both the 2004 #38; 2005 global top 50 most powerful people in networking by the US publication Network World. nbsp;Paul sits on the management board of the Jericho Forum and the Executive Advisory Board of ISSA UK. He also is a British Canoe Union Level 3 Kayak Coach. Shane Buckley, President #38; CEO, Rohati Systems, Inc. Shane Buckley is the President and Chief Executive Officer at Rohati Systems, Inc. Buckley comes to Rohati with more than 20 years of global executive and general management expertise, having held senior executive positions in the United States, Europe, the Middle East and Asia-Pacific. nbsp; Before taking the helm at Rohati, Buckley served as Chief Operating Officer at Nevis Networks, Inc. a leader in network access control. Previously, he was Vice President of Worldwide Enterprises for Juniper Networks. Prior to that, he served as the International President of Peribit Networks, the leader in Network Optimization. Juniper Networks purchased Peribit in June 2005 for $380M. Before Peribit, Buckley served as Chief Executive Officer of Conduit Software, a provider of Directory Assistance and Wireless Applications solutions. Previously, he was Vice President, EMEA at 3Com. In this role, he managed a $2.2 billion business unit and was responsible for 3Comrsquo;s distribution strategy, OEM partnerships and reseller channels. Buckley also chaired 3Comrsquo;s Global Distribution Council, was a member of the companyrsquo;s worldwide OEM steering team, and served as 3Comrsquo;s head of operations for the Asia-Pacific Region based in Hong Kong and Tokyo.nbsp; nbsp; Buckley is a frequent speaker at high-level industry trade shows and events such as Gitex, CeBIT and The Wall Street Journal Europe conference. He has also contributed to a number of magazines and news programs including MSNBC, SABC and Middle East Business news. He holds an engineering degree from the Cork Institute of Technology in Ireland. Podcast Michael Santarcangelo | Catalyst Media no No Security Roundtable for May 2008 | RSA Conference - Beyond the Hype http://www.securityroundtable.com/2008/05/14/security-roundtable-for-may-2008-rsa-conference-beyond-the-hype/ http://www.securityroundtable.com/2008/05/14/security-roundtable-for-may-2008-rsa-conference-beyond-the-hype/#comments Wed, 14 May 2008 21:54:45 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=21 For the May SRT, we welcomed:

Dr. Anton Chauvakin | http://chuvakin.blogspot.com/

James Costello | http://genesyswave.blogspot.com/

Jennifer Leggio | http://mediaphyter.wordpress.com/

Martin McKeay | http://www.mckeay.net/

Michael Santarcangelo | http://www.securitycatalyst.com/

 

We discussed the RSA 2008 conference from a variety of perspectives. 

]]> http://www.securityroundtable.com/2008/05/14/security-roundtable-for-may-2008-rsa-conference-beyond-the-hype/feed/ 00:01:01 For the May SRT, we welcomed: Dr. Anton Chauvakin #124;nbsp;http://chuvakin.blogspot.com/ James Costello #124;nbsp;http://genesyswave.blogspot.com/ Jennifer Leggio #124;nbsp;http://mediaphyter.wordpress.com/ Martin McKeay #124;nbsp;http://www.mckeay. For the May SRT, we welcomed: Dr. Anton Chauvakin #124;nbsp;http://chuvakin.blogspot.com/ James Costello #124;nbsp;http://genesyswave.blogspot.com/ Jennifer Leggio #124;nbsp;http://mediaphyter.wordpress.com/ Martin McKeay #124;nbsp;http://www.mckeay.net/ Michael Santarcangelo #124;nbsp;http://www.securitycatalyst.com/ nbsp; We discussed the RSA 2008 conference from a variety of perspectives.nbsp; News Michael Santarcangelo | Catalyst Media no No September Security Round Table: Do we have privacy anymore? http://www.securityroundtable.com/2007/09/23/september-security-round-table-do-we-have-privacy-anymore/ http://www.securityroundtable.com/2007/09/23/september-security-round-table-do-we-have-privacy-anymore/#comments Mon, 24 Sep 2007 02:02:58 +0000 SecurityCatalyst http://www.securityroundtable.com/2007/09/23/september-security-round-table-do-we-have-privacy-anymore/

Welcome to the Security Round Table for September, where our panel of passionate security and privacy professionals considers the question: Do we have privacy anymore?

Our Panel

 

Talking points

  • Definition of privacy
  • How does privacy in the 21st century differ from privacy in the 20th century and before?
  • How have the attitudes of government and the populace changed privacy in the last decade?
  • Does the average end user understand privacy?
  • Online databases
  • What can we do today and can we recover the privacy we’ve lost (or never had)?

 

Coming in October

In October we will be exploring the role/value of end-user awareness with a panel of differing opinions. If you are responsible for creating an end-user awareness program – this is an episode you will not want to miss!

As an added bonus, we’re going to start using Talk Shoe for our monthly SRT episodes – and after the show taping, Security Catalyst Community (http://www.securitycatalyst.org) members will have the option to participate in a live Q&A session.

If you have ideas for topics or want to be invited to serve on one of our panels, contact me directly at securitycatalyst@gmail.com

 

]]> http://www.securityroundtable.com/2007/09/23/september-security-round-table-do-we-have-privacy-anymore/feed/ 63:31 Welcome to the Security Round Table for September, where our panel of passionate security and privacy professionals considers the question: Do we have privacy ... Welcome to the Security Round Table for September, where our panel of passionate security and privacy professionals considers the question: Do we have privacy anymore?Our PanelMichael Santarcangelo ndash; Moderator ndash; expert on changing the way people protect information. www.securitycatalyst.com #38; www.intothebreach.comRebecca Herold - Information security, privacy and compliance professor, writer and consultant.nbsp; http://www.realtime-itcompliance.com #38; http://www.privacyguidance.comAndrew Hay - Manager of Integration Services @ Q1 Labs, blogger (http://www.andrewhay.ca), author (OSSEC Host-based Intrusion Detection)Dr. Anton Chuvakin - Chief Logger and Blogger :-) from the "No privacy - 'get over it!' camp" -nbsp; http://www.securitywarrior.orgMartin McKeay - Affectionately called Cpt. Privacy by Mike Rothman, he still refuses to wear tights and a cape (especially the tights) http://www.mckeay.netDan York - Producer and Co-Host, Blue Box: The VoIP Security Podcast - http://www.blueboxpodcast.com/ nbsp;#38; nbsp;http://www.voipsa.org/blog/nbsp;Talking pointsDefinition of privacyHow does privacy in the 21st century differ from privacy in the 20th century and before? How have the attitudes of government and the populace changed privacy in the last decade?Does the average end user understand privacy?Online databasesWhat can we do today and can we recover the privacy we've lost (or never had)?nbsp;Coming in OctoberIn October we will be exploring the role/value of end-user awareness with a panel of differing opinions. If you are responsible for creating an end-user awareness program ndash; this is an episode you will not want to miss!As an added bonus, wersquo;re going to start using Talk Shoe for our monthly SRT episodes ndash; and after the show taping, Security Catalyst Community (http://www.securitycatalyst.org) members will have the option to participate in a live Q#38;A session.If you have ideas for topics or want to be invited to serve on one of our panels, contact me directly at securitycatalyst@gmail.comnbsp; News Michael Santarcangelo | Catalyst Media no No The Security Round Table for August 2007 - Security Career Success http://www.securityroundtable.com/2007/08/17/the-security-round-table-for-august-2007-security-career-success/ http://www.securityroundtable.com/2007/08/17/the-security-round-table-for-august-2007-security-career-success/#comments Fri, 17 Aug 2007 12:27:05 +0000 SecurityCatalyst http://www.securityroundtable.com/2007/08/17/the-security-round-table-for-august-2007-security-career-success/

The August Security Round Table podcast assembled an expert panel to explore the keys to a successful security career - and how you can find the perfect job for you.  We recorded this discussion on Tuesday, August 14th 2007 and present it now for your listening pleasure.  

Your esteemed panel

Michael Santarcangelo | http://www.securitycatalyst.com/ & http://www.intothebreach.com/

Martin McKeay | http://www.mckeay.net/

Mike Murray | http://episteme.ca/ & http://www.forgettheparachute.com/

Ron Vereggen | http://www.rapidsuccesscoach.com/

Daniel Sweet | http://fracat.com/

 

Questions or Comments?

If you have questions or comments for our panelists, please send an email to question [SHIFT-2] securityroundtable [DOT] com and we’ll work to answer it - either in the Security Catalyst Community forums (http://community.securitycatalyst.com/forums/index.php) , or in an upcoming episode.

 

Coming up on future Security Round Table Episodes

We’ll be exploring and debating.. 

 

  • Security Fundamentals
  • Do we have privacy anymore?
  • Security ROI: Fact or Fiction

 

Do you want to participate or listen live? 

We’re also exploring the ability to host the SRT on a regular basis so that SCC members can listen live - and then participate in a private chat right after the recording. I’m exploring some different options, but if you have an idea or suggestion - please let me know by sending a message to me – securitycatalyst [SHIFT-2] gmail.com

]]> http://www.securityroundtable.com/2007/08/17/the-security-round-table-for-august-2007-security-career-success/feed/ 52:52 The August Security Round Table podcast assembled an expert panel to explore the keys to a successful security career - and how you can find ... The August Security Round Table podcast assembled an expert panel to explore the keys to a successful security career - and how you can find the perfect job for you. nbsp;We recorded this discussion on Tuesday, August 14th 2007 and present it now for your listening pleasure.nbsp;nbsp;Your esteemed panelMichael Santarcangelo #124; http://www.securitycatalyst.com/ #38; http://www.intothebreach.com/Martin McKeay #124; http://www.mckeay.net/Mike Murray #124; http://episteme.ca/ #38; http://www.forgettheparachute.com/Ron Vereggen #124; http://www.rapidsuccesscoach.com/Daniel Sweet #124; http://fracat.com/nbsp;Questions or Comments?If you have questions or comments for our panelists, please send an email to question [SHIFT-2] securityroundtable [DOT] com and wersquo;ll work to answer it - either in the Security Catalyst Community forums (http://community.securitycatalyst.com/forums/index.php) , or in an upcoming episode.nbsp;Coming up on future Security Round Table EpisodesWersquo;ll be exploring and debating..nbsp;nbsp; Security Fundamentals Do we have privacy anymore? Security ROI: Fact or Fictionnbsp;Do you want to participate or listen live?nbsp;Wersquo;re also exploring the ability to host the SRT on a regular basis so that SCC members can listen live - and then participate in a private chat right after the recording. Irsquo;m exploring some different options, but if you have an idea or suggestion - please let me know by sending a message to me ndash; securitycatalyst [SHIFT-2] gmail.com News Michael Santarcangelo | Catalyst Media no No The Security Roundtable for February 2007 - OpenID http://www.securityroundtable.com/2007/03/15/the-security-roundtable-for-february-2007-openid/ http://www.securityroundtable.com/2007/03/15/the-security-roundtable-for-february-2007-openid/#comments Thu, 15 Mar 2007 19:48:06 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=17 We’re back! Dan York, Martin McKeay and Michael Santarcangelo came together to revitalize the SRT effort and concept. First up - Dan York led an effort to research and put together a program on OpenID. In this episode, we explore the question, “what is open ID and should we care?”- Dan York, Blue Box: The VoIP Security Podcast- Martin McKey: The Network Security Podcast- Michael Santarcangelo: The Security CatalystThese show notes are going to be swamped with links and information about OpenID. A HUGE thank you to Dan York for an amazing effort, here. This is actually the single best collection of OpenID links I’ve yet to see.If you feel like discussing OpenID (or looking to find some positive and passionate security professionals), come discuss this in the Security Catalyst Community: http://community.securitycatalyst.com/forums/index.phpHere is the OpenID thread: http://community.securitycatalyst.com/forums/index.php/topic,46.0.htmlNOTE - found another recent (Dec 2006) podcast about OpenID:- blog entry - http://herestomwiththeweather.blogspot.com/2006/12/openid-podcast.html (interesting notes about moving a site over to OpenID)- MP3 - http://www.stuffopolis.com/interactive/openid.mp3- Outline - http://www.stuffopolis.com/interactive/openid_talk.txt
Main focus of the show - what is OpenID and why should you care? 

Why is OpenID in the news right now?

Microsoft Announcement at RSA generated news - announced by Bill Gates in keynote:

Excellent summary - “Five Key Takeaways from Microsoft, OpenID Announcement“Other recent news - AOL support OpenID: http://journals.aol.com/panzerjohn/abstractioneer/entries/2007/02/15/aol-and-openid-where-we-are/1406It also appears that AOL enabled OpenID support for all 63 million AIM users! - http://chimprawk.blogspot.com/2007/02/is.html

What is OpenID? What problem is it trying to solve?

Main OpenID website - http://www.openid.net/Wikipedia - http://en.wikipedia.org/wiki/OpenIDCommunity marketing - http://iwantmyopenid.org/illustrated overviews:

OpenID specification- http://openid.net/specs.bmlZDNet: “The Case for OpenID” - http://blogs.zdnet.com/digitalID/?p=78

How does it work?

See http://openid.net/about.bmlList of presentations at http://openid.net/presentations.bmlOpenID screencast - http://simonwillison.net/2006/openid-screencast/From http://www.openidenabled.com/openid/about-openidGood description of process (from Microsoft’s Kim Cameron ): An interaction starts with the user telling the RP (relying party) what her URL is (1). The RP consults the URL content to determine where the user’s IP is located (not shown). Then it redirects the user to her IP (identity provider) to pick up an authentication token, as shown in (2) and (3). To do the authentication, the IP has to be sure that it’s the user who is making the request. So it presents her with an authentication screen, typically asking for a username and password in (4). If they are entered correctly, the IP mints a token to send to the RP as shown in (5) and (6). If the IP and RP already know each other, this is the end of the authentication part of the protocol. If not, the back channel is used as well.More details:

  • You register with a Identity provider (IdP or “i-broker”). Some are commercial, some are free. Examples:
  • You can also set up your own OpenID server/service
  • Note that you can use your own URL with an OpenID service: http://www.openidenabled.com/openid/use-your-own-url-as-an-openid
  • When you now go to a website, you can login with your OpenID. Sites that can use OpenID:
  • You are required to then login to your OpenID provider’s site (if you have not already done so)
  • You are logged into the site

    • So for a blog comment, for instance, instead of typing in your username, password, etc., you could just use your OpenID.More sites will be using it soon… note the bounty for OpenID in open source projects: http://iwantmyopenid.org/bounty

    Security issues - phishing

    Open option for Firefox: PHOff - http://chile.ootao.com/phoff/Other commentary on the phishing issue:

    Security issues - single point-of-failure

    • So what happens if your Identity provider goes away? Or you decide you want to stop trusting them?
    • Two solutions:
      1. Have multiple OpenIDs - no reason you can’t.
      2. Use a domain that you own as your OpenID and delegate back to a IdP - just by adding two lines of HTML code to that website - see http://simonwillison.net/2006/Dec/19/openid/
    • This second solution is probably best because you retain control. In first solution, what happens to all those accounts you created with the ID that you no longer trust.

    Future of OpenID

    Links for more research:

    Dan’s del.icio.us links - http://del.icio.us/dyork/openidPlanet OpenID (splice of blogs) - http://planet.openid.net/OpenID Wiki - http://openid.net/wiki/index.php/Main_PageMore del.icio.us links - http://del.icio.us/keepthebyte/openid and http://del.icio.us/tag/openidConverting your site to OpenID: http://kveton.com/blog/2006/11/28/converting-your-site-to-openid/emphemeral profiles - do some people really want identity anyway? http://www.zephoria.org/thoughts/archives/2007/01/01/ephemeral_profi.html and http://vquill.com/2007/01/throwaway-identities.htmlKim Cameron’s lengthy paper on digital identity - see the “Laws of Identity” section: http://www.identityblog.com/?page_id=352/

    ]]>     http://www.securityroundtable.com/2007/03/15/the-security-roundtable-for-february-2007-openid/feed/ 42:32 We're back! Dan York, Martin McKeay and Michael Santarcangelo came together to revitalize the SRT effort and concept. First up - Dan York led an ... We're back! Dan York, Martin McKeay and Michael Santarcangelo came together to revitalize the SRT effort and concept. First up - Dan York led an effort to research and put together a program on OpenID. In this episode, we explore the question, "what is open ID and should we care?"- Dan York, Blue Box: The VoIP Security Podcast- Martin McKey: The Network Security Podcast- Michael Santarcangelo: The Security CatalystThese show notes are going to be swamped with links and information about OpenID. A HUGE thank you to Dan York for an amazing effort, here. This is actually the single best collection of OpenID links I've yet to see.If you feel like discussing OpenID (or looking to find some positive and passionate security professionals), come discuss this in the Security Catalyst Community: http://community.securitycatalyst.com/forums/index.phpHere is the OpenID thread: http://community.securitycatalyst.com/forums/index.php/topic,46.0.htmlNOTE - found another recent (Dec 2006) podcast about OpenID:- blog entry - http://herestomwiththeweather.blogspot.com/2006/12/openid-podcast.html (interesting notes about moving a site over to OpenID)- MP3 - http://www.stuffopolis.com/interactive/openid.mp3- Outline - http://www.stuffopolis.com/interactive/openid_talk.txt Main focus of the show - what is OpenID and why should you care?nbsp;Why is OpenID in the news right now?Microsoft Announcement at RSA generated news - announced by Bill Gates in keynote: Microsoft view: http://www.identityblog.com/?p=668 JainRain view: http://kveton.com/blog/2007/02/06/cardspace-openid-working-together/ Sxip Identity: http://identity20.com/?p=90 Netmesh: http://netmesh.info/jernst/Digital_Identity/cardspace-openid.html Brad Fitzpatrick (who wrote OpenID back at LiveJournal): http://brad.livejournal.com/2287909.html - see the TailRank summary for follow-on commentary Digg adopts OpenID: http://www.techcrunch.com/2007/02/20/kevin-rose-at-fowa-digg-adopts-openid Slashdot discussion - good comments: http://yro.slashdot.org/comments.pl?threshold=0#38;mode=thread#38;commentsort=0#38;op=Change#38;sid=221002Excellent summary - "Five Key Takeaways from Microsoft, OpenID Announcement"Other recent news - AOL support OpenID: http://journals.aol.com/panzerjohn/abstractioneer/entries/2007/02/15/aol-and-openid-where-we-are/1406It also appears that AOL enabled OpenID support for all 63 million AIM users! - http://chimprawk.blogspot.com/2007/02/is.htmlWhat is OpenID? What problem is it trying to solve?Main OpenID website - http://www.openid.net/Wikipedia - http://en.wikipedia.org/wiki/OpenIDCommunity marketing - http://iwantmyopenid.org/illustrated overviews: OpenID 1.1 protocol flow - http://openid.net/pres/protocolflow-1.1.png http://www.openidenabled.com/openid/openid-protocol OpenID pingpong - http://enthusiasm.cozy.org/archives/2005/05/openid-part-iii-pingpong/ Screencast - http://simonwillison.net/2006/openid-screencast/ Presentation - http://identity20.com/media/ETECH_2006/ - great history of web identity systems - gets into company-specific stuff at the end, but does a nice overall job.OpenID specification- http://openid.net/specs.bmlZDNet: "The Case for OpenID" - http://blogs.zdnet.com/digitalID/?p=78How does it work?See http://openid.net/about.bmlList of presentations at http://openid.net/presentations.bmlOpenID screencast - http://simonwillison.net/2006/openid-screencast/From http://www.openidenabled.com/openid/about-openidGood description of process (from Microsoft's Kim Cameron ): An interaction starts with the user telling the RP (relying party) what her URL is (1). The RP consults the URL content to determine where the userrsquo;s IP is located (not shown). Then it redirects the user to her IP (identity provider) to pick up an authentication token, as shown in (2) and (3). To do the authentication, the IP has to be sure that itrsquo;s the user who is making the request. So it presents her with an authentication screen, typically asking for a username ... News Michael Santarcangelo | Catalyst Media no No     Security Round Table Episode #6 http://www.securityroundtable.com/2006/10/30/security-round-table-episode-6/ http://www.securityroundtable.com/2006/10/30/security-round-table-episode-6/#comments Mon, 30 Oct 2006 19:25:56 +0000 Martin McKeay http://www.securityroundtable.com/?p=16 Finally, the sixth episode of the Security Round Table! Earlier this month we had the opportunity to talk with Krishna Kurapati, Chief Technology Officer of Sipera Systems.

    We know that Intstant Messaging is in the workspace and is increasingly harder to block. Should it be blocked, how can it be blocked or should it become part of the corporate infrastructure, just like voice and email? And more importantly, what are the dangers of Instant Messanging?

    Thanks once more to Krishna Kurapati for joining us on the conference call. He answered an email sent out by Dan York to the VOIP Security mailing list with very short notice.

    Present on this episode:
    Larry Pesce | Pauldotcom Security Weekly
    Alan Shimel | SSAATY (Still Secure After All These Years)
    Martin McKeay | Network Security Podcast

    And this will be the last time I ever give Michael a hard time for taking a couple of weeks to post a podcast. - Martin

    ]]>     http://www.securityroundtable.com/2006/10/30/security-round-table-episode-6/feed/ 00:01:01 Finally, the sixth episode of the Security Round Table! Earlier this month we had the opportunity to talk with Krishna Kurapati, Chief Technology Officer of ... Finally, the sixth episode of the Security Round Table! Earlier this month we had the opportunity to talk with Krishna Kurapati, Chief Technology Officer of Sipera Systems. We know that Intstant Messaging is in the workspace and is increasingly harder to block. Should it be blocked, how can it be blocked or should it become part of the corporate infrastructure, just like voice and email? And more importantly, what are the dangers of Instant Messanging? Thanks once more to Krishna Kurapati for joining us on the conference call. He answered an email sent out by Dan York to the VOIP Security mailing list with very short notice. Present on this episode: Larry Pesce #124; Pauldotcom Security Weekly Alan Shimel #124; SSAATY (Still Secure After All These Years) Martin McKeay #124; Network Security Podcast And this will be the last time I ever give Michael a hard time for taking a couple of weeks to post a podcast. - Martin News Michael Santarcangelo | Catalyst Media no No     Security Round Table - Episode 5 - Security of VoIP in the Enterprise http://www.securityroundtable.com/2006/10/02/security-round-table-episode-5-security-of-voip-in-the-enterprise/ http://www.securityroundtable.com/2006/10/02/security-round-table-episode-5-security-of-voip-in-the-enterprise/#comments Tue, 03 Oct 2006 03:27:14 +0000 SecurityCatalyst http://www.securityroundtable.com/2006/10/02/security-round-table-episode-5-security-of-voip-in-the-enterprise/ Join us for our fifth exciting episode of the Security Round Table. Our special guest (and now newest member) is Dan York from: Blue Box: The VoIP Security Podcast. In this episode, we look at the general overview of VoIP technologies and the security risks - as well as the myths.

    Dan is a true expert and instructor on this topic - and school was definitely in for the SRT team!

    Joining in on this episode:

    Paul Asadorian | Pauldotcom Security Weekly
    Martin McKeay | Network Security Podcast
    Larry Pesce | Pauldotcom Security Weekly

    Michael Santarcangelo | The Security Catalyst
    Alan Shimel | SSAATY (Still Secure After All These Years)
    Dan York | Blue Box: The VoIP Security Podcast

    ]]>     http://www.securityroundtable.com/2006/10/02/security-round-table-episode-5-security-of-voip-in-the-enterprise/feed/ 57:27 Join us for our fifth exciting episode of the Security Round Table. Our special guest (and now newest member) is Dan York from: Blue Box: ... Join us for our fifth exciting episode of the Security Round Table. Our special guest (and now newest member) is Dan York from: Blue Box: The VoIP Security Podcast. In this episode, we look at the general overview of VoIP technologies and the security risks - as well as the myths. Dan is a true expert and instructor on this topic - and school was definitely in for the SRT team! Joining in on this episode: Paul Asadorian #124; Pauldotcom Security Weekly Martin McKeay #124; Network Security Podcast Larry Pesce #124; Pauldotcom Security Weekly Michael Santarcangelo #124; The Security Catalyst Alan Shimel #124; SSAATY (Still Secure After All These Years) Dan York #124; Blue Box: The VoIP Security Podcast News Michael Santarcangelo | Catalyst Media no No     SRT Episode 4 - Responsible Reporting of Breaches http://www.securityroundtable.com/2006/09/17/srt-episode-4-responsible-reporting-of-breaches/ http://www.securityroundtable.com/2006/09/17/srt-episode-4-responsible-reporting-of-breaches/#comments Sun, 17 Sep 2006 16:14:59 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=14 How many times have you wondered what you would do if you find out your company wasn’t protecting information as they promised? What if you were a consultant or contractor?

    Is there a right way to report on privacy and security breaches?

    Join the Security Round Table with Special Guest Randal Schwartz to discuss this important issue.

    On this episode:

    Larry Pesce | Pauldotcom Security Weekly | Haxor the Matrix
    Martin McKeay | Network Security Blog & Podcast
    Michael Santarcangelo | The Security Catalyst
    Randal Schwartz | Stonehenge | Legal Information: Friends of Randal Schwartz

    Note: we did reach some interesting conclusions and directions for future advancement. Continue the discussion at the Security Catalyst Community (currently open to trusted catalysts until October 15, 2006 when it becomes available to the entire community).

    ]]>     http://www.securityroundtable.com/2006/09/17/srt-episode-4-responsible-reporting-of-breaches/feed/ 56:33 How many times have you wondered what you would do if you find out your company wasn't protecting information as they promised? What if you ... How many times have you wondered what you would do if you find out your company wasn't protecting information as they promised? What if you were a consultant or contractor? Is there a right way to report on privacy and security breaches? Join the Security Round Table with Special Guest Randal Schwartz to discuss this important issue. On this episode: Larry Pesce #124; Pauldotcom Security Weekly #124; Haxor the Matrix Martin McKeay #124; Network Security Blog Podcast Michael Santarcangelo #124; The Security Catalyst Randal Schwartz #124; Stonehenge #124; Legal Information: Friends of Randal Schwartz Note: we did reach some interesting conclusions and directions for future advancement. Continue the discussion at the Security Catalyst Community (currently open to trusted catalysts until October 15, 2006 when it becomes available to the entire community). Podcast Michael Santarcangelo | Catalyst Media no No     Security Roundtable Discussion: NAC http://www.securityroundtable.com/2006/08/13/security-roundtable-discussion-nac/ http://www.securityroundtable.com/2006/08/13/security-roundtable-discussion-nac/#comments Sun, 13 Aug 2006 22:35:00 +0000 Martin McKeay http://www.securityroundtable.com/?p=13 Join me while I listen to a spirited discussion between Alan Shimel, Richard Stiennon, Mike Rothman and Chris Hoff about the relative merits and downfalls of Network Access (or Admission) Control. This all started a couple of weeks ago when Richard and Alan started a little disagreement between them about NAC on their blogs. Chris and Mike decided they needed to throw some fuel on fire, which generally seems to be their way. After reading their back and forth, I invited them to join me on a Skype call where they could each explain their positions and how the other bloggers were wrong. While this is a fairly serious security topic, as NAC seems to be one of the technologies everyone is talking about, we took the whole argument in fairly light-hearted manner.

    I hope you enjoy listening to the podcast as much as we enjoyed recording it. Thanks again to Richard to saving my bacon when I had technical problems with my recording software. And while I was part of the podcast, I was mostly just an innocent observer. I think I learned more that way.

    -Martin McKeay

    ]]>     http://www.securityroundtable.com/2006/08/13/security-roundtable-discussion-nac/feed/ 41:30 Join me while I listen to a spirited discussion between Alan Shimel, Richard Stiennon, Mike Rothman and Chris Hoff about the relative merits and downfalls ... Join me while I listen to a spirited discussion between Alan Shimel, Richard Stiennon, Mike Rothman and Chris Hoff about the relative merits and downfalls of Network Access (or Admission) Control. This all started a couple of weeks ago when Richard and Alan started a little disagreement between them about NAC on their blogs. Chris and Mike decided they needed to throw some fuel on fire, which generally seems to be their way. After reading their back and forth, I invited them to join me on a Skype call where they could each explain their positions and how the other bloggers were wrong. While this is a fairly serious security topic, as NAC seems to be one of the technologies everyone is talking about, we took the whole argument in fairly light-hearted manner. I hope you enjoy listening to the podcast as much as we enjoyed recording it. Thanks again to Richard to saving my bacon when I had technical problems with my recording software. And while I was part of the podcast, I was mostly just an innocent observer. I think I learned more that way. -Martin McKeay Podcast Michael Santarcangelo | Catalyst Media no No     Security Round Table - Episode 3 - Liability for Vulnerabilities and Responsible Reporting http://www.securityroundtable.com/2006/07/21/srt3/ http://www.securityroundtable.com/2006/07/21/srt3/#comments Fri, 21 Jul 2006 20:12:52 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=12 I am excited to present to you the SRT’s third episode. The goal of these podcasts is simple: bring together podcasters and occassional guests to discuss important security topics. This episode had some great (read: diverse) representation as we tackled the issue of who should be responsible for vulnerable code and “good practices” around notification, patching and the like.

    This podcast went a bit longer than planned, and I suspect we could have kept talking all night long! I personally learned quite a bit and enjoyed the opportunity to explore some of these issues and hear different perspectives. I hope you enjoy it too!

    Joining us on this effort was:
    Martin McKeay (The Network Security Podcast)
    Paul Asadoorian (Pauldotcom Security Weekly)
    Jamal Khan (Hdaar Security Radio)
    Alan Shimel (Still Secure, After All These Years)
    Ron Woerner (Security Catalyst Contributor)

    Ideas? Comments? Suggestions? securitycatalyst@gmail.com

    Michael (The Security Catalyst)

    ]]>     http://www.securityroundtable.com/2006/07/21/srt3/feed/ 00:01:01 I am excited to present to you the SRT's third episode. The goal of these podcasts is simple: bring together podcasters and occassional guests to ... I am excited to present to you the SRT's third episode. The goal of these podcasts is simple: bring together podcasters and occassional guests to discuss important security topics. This episode had some great (read: diverse) representation as we tackled the issue of who should be responsible for vulnerable code and "good practices" around notification, patching and the like.This podcast went a bit longer than planned, and I suspect we could have kept talking all night long! I personally learned quite a bit and enjoyed the opportunity to explore some of these issues and hear different perspectives. I hope you enjoy it too!Joining us on this effort was:Martin McKeay (The Network Security Podcast)Paul Asadoorian (Pauldotcom Security Weekly)Jamal Khan (Hdaar Security Radio)Alan Shimel (Still Secure, After All These Years)Ron Woerner (Security Catalyst Contributor)Ideas? Comments? Suggestions? securitycatalyst@gmail.comMichael (The Security Catalyst) Podcast Michael Santarcangelo | Catalyst Media no No     Security Round Table - Episode 2 - What to do about stolen laptops and Privacy in the EU http://www.securityroundtable.com/2006/06/24/srt2/ http://www.securityroundtable.com/2006/06/24/srt2/#comments Sun, 25 Jun 2006 03:48:41 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=11 Join Michael Santarcangelo of the Security Catalyst podcast, Martin McKeay of the Network Security Podcast and special Guest Alan Shimel from the Still Secure Podcast. We shared an energetic and insightful discussion about the recent reports of laptop theft leading to identity breach (or the possibility of it) and then talked about privacy and breaches in the EU.

    ]]>     http://www.securityroundtable.com/2006/06/24/srt2/feed/ 54:14 Join Michael Santarcangelo of the Security Catalyst podcast, Martin McKeay of the Network Security Podcast and special Guest Alan Shimel from the Still Secure Podcast. ... Join Michael Santarcangelo of the Security Catalyst podcast, Martin McKeay of the Network Security Podcast and special Guest Alan Shimel from the Still Secure Podcast. We shared an energetic and insightful discussion about the recent reports of laptop theft leading to identity breach (or the possibility of it) and then talked about privacy and breaches in the EU. Podcast Michael Santarcangelo | Catalyst Media no No     Disposable Email Address Resources http://www.securityroundtable.com/2006/05/27/disposable-email-address-resources/ http://www.securityroundtable.com/2006/05/27/disposable-email-address-resources/#comments Sat, 27 May 2006 04:28:48 +0000 Martin McKeay http://www.securityroundtable.com/?p=7 After listening to our first podcast, Robert Elam of elamb.org sent me a link to ten disposable email services. I’ve never tried any of these services, so please please give us some feedback if you’ve used them before. I think I’ll stick with manipulating my sendmail configuraton and using the ‘name’+'whateverIwant’@gmail.com trick, but these are worth using if you don’t have your own mail server.

    Thanks Robert.

    Martin (nsp_AT_mckeay.net)
    Technorati Tags: ,

    ]]>     http://www.securityroundtable.com/2006/05/27/disposable-email-address-resources/feed/     Security Round Table - Episode 1 - Email Security http://www.securityroundtable.com/2006/05/25/security-round-table-episode-1-email-security/ http://www.securityroundtable.com/2006/05/25/security-round-table-episode-1-email-security/#comments Thu, 25 May 2006 21:04:15 +0000 SecurityCatalyst http://www.securityroundtable.com/?p=6 Listen in as Martin McKeay (Network Security), Dan Kuykendal (Mighty Seek), Larry Pesce (Pauldotcom Security) and Michael Santarcangelo (The Security Catalyst) discuss email security during the first Security Round Table. We recorded the podcast from a conference bridge, so the quality is about what you would expect from the broadcast radio.This is our first effort - and I learned some ideas that I wrote down, and hope you do, too! Please send us feedback and let us know what other topics you would like for us to cover.

    ]]>     http://www.securityroundtable.com/2006/05/25/security-round-table-episode-1-email-security/feed/ 50:24 Listen in as Martin McKeay (Network Security), Dan Kuykendal (Mighty Seek), Larry Pesce (Pauldotcom Security) and Michael Santarcangelo (The Security Catalyst) discuss email security during ... Listen in as Martin McKeay (Network Security), Dan Kuykendal (Mighty Seek), Larry Pesce (Pauldotcom Security) and Michael Santarcangelo (The Security Catalyst) discuss email security during the first Security Round Table. We recorded the podcast from a conference bridge, so the quality is about what you would expect from the broadcast radio.This is our first effort - and I learned some ideas that I wrote down, and hope you do, too! Please send us feedback and let us know what other topics you would like for us to cover. security,,email,,bluefrog,,spam,,phishing,,gmail,,privacy,,cissp,,santarcangelo,,catalyst,, Michael Santarcangelo | Catalyst Media clean No     Martin invites Dan as his rotating co-host http://www.securityroundtable.com/2006/05/24/martin-invites-dan-as-his-rotating-co-host/ http://www.securityroundtable.com/2006/05/24/martin-invites-dan-as-his-rotating-co-host/#comments Wed, 24 May 2006 14:33:08 +0000 Mighty Seek http://www.securityroundtable.com/?p=4 Network Security Blog: Network Security Podcast, Episode 28

    In this episode of Martin McKeay’s Network Security Podcast listeners get two SRT podcasters in one show when Dan Kuykendall from The Mighty Seek podcast as his co-host of the week.

    ]]>     http://www.securityroundtable.com/2006/05/24/martin-invites-dan-as-his-rotating-co-host/feed/     SRT in the iTunes Music Store http://www.securityroundtable.com/2006/05/24/srt-in-the-itunes-music-store/ http://www.securityroundtable.com/2006/05/24/srt-in-the-itunes-music-store/#comments Wed, 24 May 2006 14:32:57 +0000 Mighty Seek http://www.securityroundtable.com/?p=5 The Security Round Table is currently featured on the iTunes music store

    SRT on the iTMS Home Page

    This links to our own Artist Group within iTunes

    SRT Page on the iTMS

    The direct link is

    http://ax.phobos.apple.com.edgesuite.net/WebObjects/MZStore.woa/wa/viewArtist?s=143441&id=155860327

    ]]>     http://www.securityroundtable.com/2006/05/24/srt-in-the-itunes-music-store/feed/     Watch this space. http://www.securityroundtable.com/2006/04/22/watch-this-space/ http://www.securityroundtable.com/2006/04/22/watch-this-space/#comments Sat, 22 Apr 2006 14:37:01 +0000 Matt Yoder http://www.securityroundtable.com/?p=3 Behind the scenes, we are currently working on bringing you a series of great podcasts on the state and technology of information security!

    The members of the Security Roundtable include:

    ]]>     http://www.securityroundtable.com/2006/04/22/watch-this-space/feed/