You can't secure what you don't acknowledge.SM

Friday, February 1, 2008

Want a new laptop? You can have mine...

Don't use Windows Vista....don't buy a new computer with it installed, don't upgrade to it in your enterprise, don't install it on your personal system. Stay FAR FAR away from Windows Vista.

Back in December, I forked out way too much $$$ for my dream laptop...The one that had what I needed was HP/Compaq 8510P with all the options. I wanted to go with another brand anyway since I've had lots of problems out of my Dells and IBMs in the past. I elected to have Vista pre-installed since I had heard good things about its usability, and, well, I need to keep up with the times especially with the work I do. BIG mistake.

Long story short, I wasted over 40 hours (that is, half) of my Christmas holiday time off fighting with my new laptop - just trying to get Vista and my apps loaded properly. Nothing seemed to work right *and* I was stuck with the 32-bit limitation of Vista not being able to see the entire 4GB of RAM I paid to have installed. So, thinking that if I just installed the 64-bit version of Vista, I'd get to use all of my RAM and maybe it'd run a little faster. Well, I made the silly mistake of (re-)installing Vista 64-bit (two maybe three times total).

Ever since that time (over a month ago), my brand new and expensive HP/Compaq 8510p has been completely unstable. Firefox crashes all the time, VMWare isn't working right...Internet Explorer is VERY unstable...Heck, Vista won't even boot the first time - most of the time. It just hangs at the ticker screen. To fix it, I have to take my battery out of the laptop (presumably resetting all the hardware) and then power it back on and the OS loads eventually. Oh, and plugging my external hard drive into the Firewire port causes a blue screen of death about 60% of the time. It even locks up constantly for no reason at all...All I can do is sit there and wait.The pains go on and on and on and on.

I even have this nice flickering at the bottom of my screen now where the taskbar jumps out every few seconds...just enough to create an enormous distraction when I'm working.

Since I've had my computer (6 weeks), I've easily lost 35-40 hours of time troubleshooting Windows Vista and Compaq hardware problems.

Maybe Vista Service Pack 1 (that's now delayed even further) will help me..??

I really do think there's something about me and computers...First it started out with all of my security testing tools clogging up Windows XP. So I started doing all of my testing in a VMWare session. That seemed to fix a lot of my problems....until I decided to become one of the idiots who thought Vista would be a good idea. If I could eliminate computer problems from my every day work, I'd be at least twice as productive.

Outside of the bells and whistles that I wanted, I don't even like my new laptop...In fact it hurts use it. Interestingly, HP included some in-your-face info about "safety", "ergonomics", and "proper usage of their product". Well it turns out that typing on my system for more than a few seconds absolutely kills my hands. I go back to my old system and the pain goes away. At the end of every work day, I have very limited fine motor skills - like having trouble reaching for and changing stations on the radio in my car. Wow - they've really come a long way in laptop technology!!

So...I was just kidding about you having my laptop....not only do you NOT want it, I wouldn't do that to you!! Plus, you likely won't have time to come claim it because it's probably to end up out the window soon. Or, back at HP.

Well, now that I got that off my chest, I need to start drumming up a letter to HP's VP of Customer Service to see what they'll do for me before my hands fall off from using their product.

My security content from this week

No articles published this week but here's a new information security podcast I recently recorded for
Wireless Security Basics for Physical Security Pros

For all of my past information security tips and tricks be sure to check out


Tuesday, January 29, 2008

Dumb users the root of security problems?

We don't hear about this much in the "mainstream media" so it's good to see a well-known online publisher writing about the topic of dumb users causing security problems. has a piece on this very topic. According to a study done by GFI (the maker a good entry-level vulnerability scanner among other things), 48% of people believe that better awareness of security among employees would improve overall security...More than getting management on-board (which I disagree with) and way more than having a large security budget.

All that said, we can recommend and claim we've performed "user awareness training" until we're blue in the face but we're still going to have security problems. Why? Because many employees don't listen, they forget, and they - by and large - don't care. They just want to go to work, do what they need to do to earn their paycheck, and not be hassled with security controls and mandates from IT.

Here's the deal: People do things for a reason...They violate policies and create business risks because:
  • they're lazy
  • they don't buy into what's being sold
  • they don't understand what's required of them
  • they know they won't get into trouble if they do get caught
  • their desire to violate your security policies outweighs their perceived risk (usually due to all the above bullets)
Remember that people will continue to violate security policies and create business risks until there's a real incentive for them not to. Period.