I’ll Tell You What…

NSA Social Networking Guidelines

Filed under: Internet, Networking, etc., Technology, What was I thinking?! — May 13, 2010 @ 9:36 am

This is supposedly a letter from the NSA to industry partners.

Would you give your address to a stranger on the street? Of course not! What if the stranger were a burglar? They’d know you’re not at home and would be free to ransack your house. So why would you post personal information to social networking sites on the Internet?

The Internet really is the new Wild West, with very few controls and no assurance that your personal information is protected. Despite site privacy settings, you should assume that anything you post can be viewed by anyone with an Internet connection—including cyber and identity thieves, as well as traditional criminals.

The following guidelines are provided to reduce your exposure to potential threats on social networking websites:

• Use your personal email address, not your government or company email address, as the means of identification on social networking sites.
• Do not use any screen name, username, “handle”, URL, personal space name or other designation that would reveal an association with the U.S. Government or any other Enterprise- or Intelligence Community-related word.
• Avoid posting sensitive personal and work-related information, such as plans, schedule and location information; phone number, address or other sensitive contact information; an unclassified government e-mail address; or names and personal information of coworkers, friends and family members.
• Do not reveal any other individual’s affiliation with specific government agencies.
• Do not post pictures, videos, diagrams or other graphics that may reveal an association with your organization. Be particularly aware of compromising information that might be contained in the background of pictures or videos, such as pictures taken in front of your facility, or reflected images from tables or mirrors.
• Ask family and friends not to post photos and information about you without prior approval.
• Avoid adding third-party plugins, add-ons or applications such as “Farmville” or “Mafia Wars” to your social networking profile, especially when not familiar with the associated vulnerabilities and security threats. Remember that many third-party applications may gain unrestricted access to Personally-Identifiable Information (PII).
• Become familiar with the End-User License Agreements of social networking sites in order to know the site’s access and rights to personal information and personal material.

• Periodically monitor privacy settings and security options. Consider using each site’s privacy settings to prevent strangers from viewing your profile/content, e.g., by removing yourself from site search results; prevent photo tagging; define access permissions for social networking associates or “friends” to determine what PII they can view; and define access permissions for public viewing and search results.
• Regularly monitor postings from family and friends to see if they have disclosed PII about you, and respond accordingly. If you are unsure how to respond, please contact your supervisor or your Security Officer.
• Do not allow people you don’t know to be on your “friends” lists.
• Check all groups’ privacy settings before joining them.
• Avoid joining groups or associations that might suggest your employer or job affiliation.
• Ensure that your systems and software (including web browsers) are up to date with the latest virus definitions, patches and malware protection.
• Beware of links and attached files posted to social networking sites, as they may link to or contain malware. Be sure to protect your computer against viruses, trojans, etc.
• Use unique, complex passwords for each online account. Vary usernames and passwords for personal accounts, such as personal e-mail, home banking, blogs, social networking, etc. Then, if one account is compromised, all others should remain secure and not susceptible to unauthorized access.
• Protect your passwords. Do not share them.
• Look for HTTPS and the lock icon that indicate active transmission security before logging in or entering sensitive data (especially when using wi-fi hotspots).
• Avoid accessing social networking sites from especially risky public locations such as hotels, cyber-cafes or airport hotspots, particularly when in a foreign country. Usernames, passwords and other sensitive information could be intercepted during transmission.
• Certain clues could help indicate if your Social Network page has been compromised. If you notice any of these events, contact the site administrators of the SNS and report it. More than likely your page will be locked out until it’s resolved or a new password is generated by the site and emailed to your personal email address. Things to watch for include:

a. A major increase or decrease of friends (someone besides yourself could be sending friend requests to strangers, or removing approved friends from your page.)

b. Wall Posts, Blogs, applications, even the design of your page have been added, modified, or deleted.
c. Your password no longer works.
d. You receive an email on the address that is assigned to your SNS stating that changes have been made.
e. Pictures have been added or removed from your profile or your default picture has changed.
f. Any changes to your identifying information, such as hometown, date of birth, etc.
g. Your profile has been added as a member of Groups or Fan Pages you normally do not join.

Comments (0)

RiffTrax Blog

Filed under: Funny — September 26, 2008 @ 1:09 pm

There’s some really hilarious stuff over at RiffTrax. Check out their blog!

Comments (0)

Bummer

Filed under: Funny, What was I thinking?! — September 26, 2008 @ 1:01 pm

I missed Talk Like a Pirate Day! It was Sep 19. I’ve been talking about it all year at work.

Comments (0)

Windows System Tray

Filed under: Software, Technology — March 25, 2008 @ 12:59 am

So I’m sitting there at work minding my own business when a co-worker walks up and tells me that the “powers-that-be” are testing the security of the UNIX/Linux systems by intentionally doing things that trigger events in our audit logs. I just roll my eyes and think happy thoughts for a minute or two while the situation sinks in. It’s never a good idea to let non-technical people do technical things unsupervised, I think. I’m told that “they” are just trying to make sure that everything we say that we review during a weekly audit gets reviewed. That’s ok. I would hate for someone to gundeck the logs and miss something important. That someone would learn an alternate meaning to “man on the street” I can assure you.

Anyway, much of what we see come to the UNIX/Linux side of the house with regards to security policy comes from the Windows side and the plethora of problems that are encountered there. One thing that is checked is date/time continuity. Let me first say that I am all for ensuring that the time does NOT change in any way except via ntp. Any other change in the date/time of the machine indicates tampering and warrants further investigation.

If you have used a Windows computer for any length of time you’ve discovered the wonders that is the Windows Clock on the Taskbar (also known as the Date and Time Properties). It is one the most useful items in Windows (any version). This thing has been around for so many years that it’s use is part of everyday (or every other day) computer life. Imagine, if you will, an email from a co-worker asking if you can attend a concert or sporting event on a particular date. Your first thought is, “What day of the week is that?” That’s usually my first thought. What’s the quickest way to find out? Yep. Double-click the clock in the Taskbar and check the visual calendar. Virtually everyone I know has done this a few times in their life.

Now imagine a situation where you would not want people to change the date/time because you log important events that are security relevant. One of the programs you would lock down is the Date and Time Properties. Now, if anyone tried to change the time by double-clicking the clock he or she would be told that he or she did not have permission to do that. Also, an event would be logged for the auditor to find. I can’t remember the event number off hand. My point is that this warning and subsequent event can be avoided (for the most part) if another policy were set in place removing the clock in the Taskbar altogether! It’s not that hard to do and can be pushed down from your domain controller so you don’t have to touch each machine.

In the Windows registry (XP or Vista), look for the key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

It should be there but if not just create it. In fact, it may be in a couple of places. F3 is your friend.

If you examine this key, you will see a few of No* DWORDs. You will want to look for NoTrayItemsDisplay in particular because setting that value to 1 (TRUE) will prevent the Taskbar from displaying all the mini-icons on the right-hand side. If this 32-bit DWORD does not exist just create it.

Once you have logged off and back on the little annoying icons should be gone. They’re still running but the mini-icons are block from being shown.

Save yourself a headache or tow or three or four and set that key so the auditors can look for the really important date/time events such as 520 and 577 (assuming that Audit privilege use is set in your Audit Policy)!

Comments (0)

xkcd

Filed under: Funny — March 21, 2008 @ 12:16 am

I’d forgotten how much I enjoyed xkcd.

Comments (0)

Twisted Minds

Filed under: Technology — March 20, 2008 @ 11:51 pm

Some of the things Bruce Schneier says reminds me of me. In his latest commentary in Wired.com, Bruce points out that it takes a different kind of person to see through security-tinted glasses.

Comments (0)

Sink or Swim? Let’s not.

Filed under: Programming — March 20, 2008 @ 11:21 pm

In the continuing saga that is my professional life and programming, I seem to be doing more in Perl than anything else at the moment. Even with the motivation to read and study Java and Python I seem to be falling back on what I know better. And that’s not a bad thing, mind you. I just think I’m falling victim to the old jump in the deep end before you can swim routine with these other languages.

For the most part, though, I think that it’s good to jump into a project and just flail away at the new APIs, functions and such. But there are other times when trying to learn a language on the side is tedious. Life gets in the way sometimes and the time between picking up the books lengthens. The fundamentals that you read about in the beginning didn’t stick like they should and you find yourself going back and reading it again. That sounds pretty negative but if you think about it we learn a lot when that happens. I had a Murphy’s Law page a day calendar several years ago and one of the days said, “Snider’s Law: Nothing can be done in one trip.” All the things I know really well took a lot of repetition to learn. Sometimes it just takes time and a little patience goes a long way.

There a few big projects that I would like to attack but the foundation just isn’t there and I think it would only disappoint more that educate. For example, I would like to create a Java app that would serve as the central control panel for the the tedious things we have to keep up t0 date at work such as updating the Message of the Day, managing the sudoers file, ssh keys, etc. Not necessarily like the Solaris Management Console but similar, I suppose. Who knows if that project will come to fruition. But, the idea is there and there’s a need so who knows. I like to create and solve problems.

So, where am I now? A little further along in … some direction. And some direction is better than standing/sitting still.

Comments (0)

Check, please

Filed under: Deep Thought — March 20, 2008 @ 10:32 pm

I think it’s time to trade this body in for a new one.

Comments (0)

BeerSong.pl

Filed under: Programming, Perl — March 17, 2008 @ 2:27 am

This has a much better output. It actually types out the word for the number instead of just the number itself.


Two bottles of beer on the wall.
Two bottles of beer.
Take one down.
Pass it around.
One bottle of beer on the wall.

One bottle of beer on the wall.
One bottle of beer.
Take it down.
Pass it around.
No more bottles of beer on the wall.


#!/usr/bin/perl -w

use strict;
use Lingua::EN::Inflect qw( NUMWORDS );

my ($beerNumber, $beerNum, @num_word);
my $word = "bottles";

$beerNumber = 99;

while ( $beerNumber > 0 ) {
	$beerNum = wordize($beerNumber);
	
	print "$beerNum " . $word . " of beer on the wall.\n";
	print "$beerNum " . $word . " of beer.\n";
	
	if ($beerNumber == 1) {
		print "Take it down.\n";
		$word = "bottle";
	} else {
		print "Take one down.\n";
	}
	
	print "Pass it around.\n";
	
	$beerNumber--;

	if ($beerNumber == 1) {
		$word = "bottle";
	}
	
	$beerNum = wordize($beerNumber);
	
	if ($beerNumber > 0) {
		print "$beerNum " . $word . " of beer on the wall.\n\n";
	} else {		
		print "No more bottles of beer on the wall.\n";
	}
}

sub wordize {
	my (@beerNumWord, $beerNumReturned);
	
	@beerNumWord = NUMWORDS ( shift @_ );
	$beerNumReturned = ucfirst(shift @beerNumWord); 
	return $beerNumReturned;
}

Comments (0)

BeerSong.java

Filed under: Programming, Java — March 9, 2008 @ 1:55 am


/**
 * Simple program that prints out the words
 * to the 99 Bottles of Beer on the Wall
 * song.
 *
 * Based on the BeerSong example in the
 * _Head_First_Java_ book with corrections.
 */
public class BeerSong {
    public static void main (String[] args) {
        int beerNum = 99;
        String word = "bottles";

        while (beerNum > 0) {

            System.out.println(beerNum + " " + word + " of beer on the wall.");
            System.out.println(beerNum + " " + word + " of beer.");

            if (beerNum == 1) {
                System.out.println("Take it down.");
                word = "bottle";
            } else {
                System.out.println("Take one down.");
            }

            System.out.println("Pass it around.");
            beerNum--;

            if (beerNum == 1) {
                word = "bottle";
            }

            if (beerNum > 0) {
                System.out.println(beerNum + " " + word + " of beer on the wall.\n");
            } else {
                System.out.println("No more bottles of beer on the wall.");
            }
        }
    }
}

Comments (1)

Obligatory First Program

Filed under: Programming, Java — March 8, 2008 @ 9:25 pm


public class hello
{
    public static void main(String[] args)
    {
        System.out.println("hello, hello...");
    }
}

Comments (0)

Choices

Filed under: Internet, Networking, etc., Software, Technology, Programming — February 24, 2008 @ 6:21 am

So I’ve been wondering lately about programming languages. I’d like to thoroughly learn one but I’m stuck as to which one. Over the years I’ve used many different languages from a variety of BASICs to Pascal to Perl to Java and so on but I’ve never really sat down to dive in head first and learn it as if my job depended on it.

I don’t really see a future for me using BASIC even though RealBASIC looks really nice given that it’s a cross platform compiler. If I were writing programs and selling them it would probably be the way to go. I just don’t see how it would benefit my career any at the moment.

The company I work for uses Ada is many of their programs. I’ve taken the internal course and like the structure of the language. In fact, I think that it looks an awful lot like Pascal. They appear to share various key words and such. But as I look at the newer programs and the requirements in the job market I
just don’t see myself going there.

I took a Fortran class in college and received the dubious honor of being the only one in class that thought the language looked like BASIC. My instructor took offense to my half-joking comments but I had an almost perfect score in the class so he didn’t say much about it. That was 16 or 17 years ago (yikes!) and I never used the language outside the class so I think it’s safe to say that Fortran is off the list.

PHP is just a hobby language for me because the only thing I’ve used it for is my own website. It’s not used hardly at all at work. I did make a file browser-type application for some friends but that’s about it. There are several things I like about the language.

I almost forgot my OS/2 days and REXX. The only thing worth while I did with REXX was to write a desktop background changer that stored the history in extended attributes. I thought it was cool.

A few languages that I’ve looked into but never really got very far (disclaimer: I have studied them enough to perform code walk-throughs while providing meaningful input): C, C++.

This just leaves Perl, Python and Java. Of the three, I have the most experience with Perl. In fact, my employer has sent me to classes to study the subject. We have a ton of home-grown applications written in Perl. The most complicated program I’ve written is server-client application that checked with NIS to check on password expiration on successful user log in. There are plenty of opportunities to make use of Perl expertise but they would be limited to server maintenance, which isn’t all bad I assure you. Is this skill portable? As a sys admin, yes but there just aren’t that many jobs needing Perl programmers.

There’s not much Python expertise where I work, unfortunately, but there are some groups that use Mentor Graphics and Python appears to be integrated fairly well. I bought a book to learn Python a while back and have been slowly reading through it and trying it out. I really like the structure and object oriented code that’s used. What I really like is the idea that one would code for maintainability and readability! I know a Perl programmer or two that write code at such a level that it can’t hardly be maintained at all. I look at the code and think that it’s overly complicated. To be honest, I just wanted to check it out to see why so many Perl guys hate Python so much. As I search around the Internet there appears to be more Python programmer positions that Perl but there’s still not a huge demand for them.

A few years back (5 or 6), I was in between projects at work and thought that I might learn Java since I had heard that an upcoming major contract was going to need Java programmers. It was web-based and pseudo-interactive with a somewhat limited amount of knowledge to convey. However, it did whet my appetite concerning objects and GUI programming. I think I spent 2 months studying Java but, in spite of my enthusiasm and constant nagging, my manager never approached the software engineering group about a job. Being too good can prevent you from expanding your horizons, evidently. Anyway, the whole episode just depressed me and I trudged on like a good corporate robot. That was then.

The reason I’m even bringing it up now is that the IT group in my division is laying a few folks off across the corporation (50 total) and even though I’m not on “the list” I’ve been looking anyway. What I’ve found is an over abundance of Java positions and some of them are fairly high paying jobs. In fact, some of them even require a certification such as CISSP of which I am a holder.

I think for now I’ll just do some Python and Java reading with the hope that one of them will jump out at me and say, “I’m the one you’ve been looking for.” We’ll see what happens.

Comments (0)

Categories:
- Uncategorized
- Devotional
- Bible
- Books
- Deep Thought
- Business
- Catholic
- Church
- Jesus
- Education
- Movies
- Faith, etc.
- Internet, Networking, etc.
- Law
- Music
- News
- Prayer
- Just Ask
- Software
- Space
- Technology
- Testimony
- Suffering for Christ
- World
- Fall
- Winter
- Summer
- Funny
- The Purpose Driven Life
- Site News
- What was I thinking?!
- UNIX
- Programming
  - Java
  - Perl
Archives:
eSnider Links
- flickr Pictures
- Technorati Profile
Meta:
- Login
- RSS
- Comments RSS
- Valid XHTML
- XFN

eSnider Links