Codeasaurus Rex

February 9, 2009

Dealing with web email flakiness

Filed under: General, Howto — Codeasaurus Rex @ 2:21 pm

A lot of webpages are now done with AJAX (fancy Javascript) or just Javascript. This allows a webpage to remain responsive even though your session has timed out and and you’ve been logged off by the web server. You may even be able to navigate to a “compose email” page without server interaction, which makes you think that you’re still online and can compose and send email.

Well, you can compose to your heart’s content because it’s still being handled locally by the browser but when you try to send the email, you get the “session expired” raspberry from the server because your session timed out long ago. Oh, and by the way, your work has disappeared too!

I got bitten by this a few dozen times before I developed this simple (though annoying) workaround: before you ask for the “compose email” page, first do a “check email”. If you’ve been logged off, you’ll find out before you waste time writing something that will be lost. If you’re still logged in, at least it will restart the session expiration timer so you’re less likely to be logged off while you’re composing your email.

Nowadays, I try to realize ahead of time whether something I’m writing will take a while. (Notice that this could happen even with a short email because you can be interrupted by something, anything.) During peak hours when the session expiration times seem to get shorter, I try to remember to save composed email text to a separate, local editor session so that I can be philosophical about the server silently logging me off before I try to send the email.

One could ask why the Javascript doesn’t just back up “email composed so far” to a local file before the server expires your session. First, that would require additional server interaction, which programmers are trying to minimize. Second, it breaks the simple paradigm of user-initiated actions. Third (and most importantly) it means granting the webpage the ability to save files to disk without user input (a big security issue).

You could argue that the webpage could ask the user first, but remember that we’re dealing with a scenario where the user might have walked away from the computer to deal with an interruption and is unable to grant that permission quickly enough to satisfy the web server. There is still the possibility of squirrelling the email away in browser memory somewhere, but that implies extra user interface complexity that the email programmers haven’t seen fit to provide.

Remember that browser technology was invented to enable hypertext browsing, not rich client interaction. However, rich client features have been tacked on using hacks that are either clever, hideous or both. Until the bugs are worked out, or we’re all using Outlook or some other local, non-web-based email client, we’ll need workarounds like the one suggested to smooth the way.

September 7, 2008

Privileged user monitoring in the enterprise

Filed under: Security — Codeasaurus Rex @ 12:09 pm

I just listened to the Tuesday, May 09 2006 webcast entitled “Ask The Expert Webcast: Who’s Guarding the Guards? Employing a Privileged User Monitoring Strategy” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

Too much ground was covered and it could have been better organized, but I’m still recommending this webcast because there were some valuable nuggets of information that I was able to pick out of the torrent of exposition.

I was not aware, for example, that behavioral analysis of database usage is being deployed to identify potential insider abuse like credit card data collection. The webcast also asserted that the majority of serious breaches were committed by employees with five to ten years of service: long enough to gain the requisite levels of experience, trust and privileged access to sensitive–and saleable–data.

What amazed me was the scope of the problem: 300 to 400 billion dollars per year. Now I understand why drug tests and credit checks are becoming part of the IT employee vetting process, though I do not approve. In the final analysis, only the Lord beholds the soul and recourse is had to imperfect substitutes due to the Deity’s lamentable absence from the hiring process

Insider threats to information security

Filed under: Security — Codeasaurus Rex @ 10:24 am

Although most of the information security business seems centered on detecting and intercepting external attacks, dishonest insiders pose a more subtle threat.

A valuable introduction to this topic is the May 3, 2006 webcast entitled “Wednesday Webcast: Web Application Security” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

September 6, 2008

Securing Mobile Access

Filed under: Security — Codeasaurus Rex @ 11:58 am

Exposing a subset of enterprise data and applications anytime, anywhere is a requirement of doing business these days. There are, however, technical challenges to limiting that exposure to authorized parties and protecting against compromised systems they may be using.

This post is to call attention to an interesting presentation by SAN on the implications of mobile access for enterprise security. It is listed as the April 20, 2006 webcast entitled “Part 1: The Mobile User – Secure Access from Anywhere (even the Home PC!)” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

As the first part of a three-part series, it doesn’t provide solutions. It does, however, provide a good summary of the issues that mobile access introduces.

August 21, 2008

Cloud computing or privacy: choose one

Filed under: General, Security — Codeasaurus Rex @ 12:00 pm

The concerns that I’ve had about my own use of third-party-hosted email and CRM have just gotten a shot in the arm by a Security Focus article from Mark Rasch.

As a software developer, I was seduced by the incredible ubiquity and accessibility that browser-based apps provided. Now, however, I’m tending towards the view that if it’s personal, private or sensitive, it doesn’t belong in an electronic medium that was geared from the start towards publishing and not protecting data.

I think it’s time reconsider the tradeoffs of third-party hosting and take control of our own data on hardened server appliances that we own ourselves. As Rasch’s article claims, at least the authorities will need a warrant to seize personally-held data before they pool it for use by any official anywhere for whatever purpose. The protections for my data held by phone companies and ISPs have been under full-scale attack by the government for the last few years, and I don’t expect this trend to spontaneously reverse itself as the price of disk storage continues to plummet.

I therefore predict that there will be a backlash against data-holding service providers in favor of user-owned and user-controlled server appliances simply to escape from the threat of essentially warrantless snooping. Another possibility is to continue to use third party services, but only store encrypted data on them when privacy is at stake: this would require a complete rethinking of the client side and could tip the scale in favor of rich clients.

Read the article here.

August 14, 2008

The Governator versus COBOL

Filed under: Mainframer makeovers — Codeasaurus Rex @ 11:42 am

Or, the irresistable force meets the immovable object:

http://www.theregister.co.uk/2008/08/14/cobol_california/

July 27, 2008

Phishing email attacks

Filed under: IT Backgrounders, Security — Codeasaurus Rex @ 12:11 pm

I used to think of phishing emails as just more spam. It turns out that they are fundamentally different: whereas spam seeks to sell, phishing seeks to steal. Phishing does share some technical features with spam, but adds layers of deception (even simulating legitimate websites) to commit fraud. Most IT professionals have seen enough phishing emails cross their inbox to understand the material.

This post is to call attention to an interesting presentation by SANS on phishing. It is listed as the October 11, 2005 webcast entitled “Tool Talk: The Anatomy of a Phishing Email” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

Phishing has evolved somewhat since it was originally broadcast. For example, it is now common to hear about spearphishing (more selective phishing) and whaling (highly selective phishing). Whaling is targeted at individuals with high net worth or some other characteristic that makes the ability to impersonate them especially valuable.

Although these phishing variants have become better-known since the webcast originally appeared, I still found it to be interesting and informative.

See the Howto for information on how to access a SANS webcast.

June 28, 2008

The Birth of a Notion

Filed under: Mainframer makeovers, SAP — Codeasaurus Rex @ 6:18 pm

I’ve been thinking about getting into SAP for the last few years and often talked to my fellow guild members and brokers about it (I’m a contract programmer and brokers get me most of my jobs). The usual suggestion was to take a year off and spend a pile of money getting schooled, so I let things slide…

The light finally came on this afternoon and one google later, I found the SAP Developer Network website. Poking around, I found that free registration was required to access the training goodies, forums etc.

One registration and email confirmation later and I’m a brand-new SDN member. My first job is to learn the ABAP language used to program SAP, but I pick up programming languages like dogs pick up fleas; after all, what are command shells, awk, grep, sed and SQL but programming languages, in addition to the usual suspects like FORTRAN, COBOL, C, Python etc.?

There appears to be a download for Windows XP that will let me play around with ABAP, in which case I won’t need to get a SAP job first (which would probably be impossible). There also seems to be an opportunity to download some kind of SAP application to learn on, but it has SUSE Linux Enterprise Server from Novell as a prerequisite. (Dang! Just when I was getting excited about the BSDs…)

Note: ABAP is pronounced Ah-Bop by the cognoscenti because SAP comes from Germany. (If you really want to lay it on, say “zahp” instead of “sap”.) I did two years of German during one of my numerous forays into higher education and look forward to reading the SAP scriptures in the original language.

Anyway, what better for this mainframer than to get retreaded with SAP? I know it’s a big system to get your arms around, but I’ve been doing legacy maintenance on and off for twenty years so big systems don’t hold any particular terror for me.

As Fred Astaire sang in Top Hat:

I’m stepping out, my dear,
to breathe an atmosphere
that simply reeks with class,
and I hope that you
won’t mind my dust
when I step on the gas…

Honeypots

Filed under: IT Backgrounders, Security — Codeasaurus Rex @ 8:29 am

A honeypot is a destination on your private network that you don’t use for normal purposes. Any attempt to access it is by definition anomalous and therefore an indication that a security breach of some kind is in progress. This simple idea is what makes a honeypot a valuable network security alarm.

A honeynet is a collection of honeypots, though a single machine and network interface card is sufficient to simulate a honeynet.

SANS provides an informative overview of honeypot/honeynet technology that is interesting whether or not you are personally responsible for network security. It is listed as the December 1, 2005 Wednesday Webcast entitled “Honeypots” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

See the Howto for information on how to access a SANS webcast.

Spam vs. Antispam: A History of the Arms Race

Filed under: IT Backgrounders — Codeasaurus Rex @ 8:23 am

A very listenable and informative overview of the Spam Wars from 1998 to 2005. Now that major ISPs have decent filtering in place, spam isn’t as much of an end-user problem as it used to be (unless of course your email address has been blacklisted as a spam source).

The presentation is listed as the February 2, 2005 Wednesday Webcast entitled “Spam Prevention: Past, Present and Future” on the SANS webcast archive page at

https://www.sans.org/webcasts/archive.php

See the Howto for information on how to access a SANS webcast.

Older Posts »

Powered by WordPress