<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress.com" -->
<rss version="0.92">
<channel>
	<title>IT in Transition</title>
	<link>http://signacert.wordpress.com</link>
	<description>Forward Thoughts On Managing IT</description>
	<lastBuildDate>Fri, 24 Jul 2009 22:39:34 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>Why Software Provenance Matters, Part III:  Supply Chain Management</title>
		<description><![CDATA[Another interesting use case for whitelist-based configuration management is bubbling to the surface (again):  IT Device Supply Chain Management
I say *again* because this one came to our attention several years ago, when we built a successful Proof of Concept (PoC), but the IT device manufacturer (who will go unnamed in this blog post) never [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=248&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/07/24/why-software-provenance-matters-part-iii-supply-chain-management/</link>
			</item>
	<item>
		<title>Unsafe at Any Speed:  Distributed Denial of Service Attacks and Whitelisting</title>
		<description><![CDATA[Some of us gray-haired folks remember Ralph Nader’s provocative book “Unsafe at Any Speed” published in 1965.  Basically the book (very controversial when released) took on the automakers for building unsafe cars that threatened the safety of All people that travel the roads.  It struck me over the 4th of July holidays that [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=238&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/07/15/unsafe-at-any-speed-distributed-denial-of-service-attacks-and-whitelisting/</link>
			</item>
	<item>
		<title>Why Software Provenance Matters, Part II</title>
		<description><![CDATA[I posted a blog a few days ago that covered some of the operational issues of Why Software Provenance Matters, but in talking with partners recently, and listening to other use cases, I thought that I’d add some detail to address these needs and perspectives.
In statistical error analysis we talk about Type One (T1) and [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=211&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/06/06/why-software-provenance-matters-part-ii/</link>
			</item>
	<item>
		<title>Gartner, Whitelists and Virtualization Methods</title>
		<description><![CDATA[I have mentioned this post before, but to keep you current see:
http://blogs.gartner.com/neil_macdonald/2009/04/21/its-virtualization-security-week/
This post seems like a great &#8220;connect the no-brainer&#8221; dots together opportunity.  Here’s a recap of Neil MacDonald’s Security No-Brainers (SNB) so far:

SNB #1: We Need a Global Industry-wide Application Whitelist
SNB #2: Use whitelisting in the hypervisor/VMM (especially in the “parent” or Dom0 [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=192&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/06/02/gartner-whitelists-and-virtualization-methods/</link>
			</item>
	<item>
		<title>Why Software Provenance Matters</title>
		<description><![CDATA[We have announced and talked about the concept of “known provenance” as a crucial software-assurance and IT-lifecycle-management metric for some time, but it struck me today that I haven’t really underscored some of the reasons and use cases that led us to this conclusion.
Firstly, there are multiple dimensions to software integrity assurance that leverage cryptographic [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=186&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/05/29/why-software-provenance-matters/</link>
			</item>
	<item>
		<title>Enter Configuration-Based Whitelisting</title>
		<description><![CDATA[This post is going to tie a couple of prior discussions together (I hope).
In August 2008, I posted a blog entitled:
Whitelist Emerges from the Shadows: Re-enforcing the Three-Tier Security and Systems Management Model
And in my most recent post entitled:
The “Whitelist Space” seems to be heating up a bit….
I took a stab as creating a taxonomy [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=179&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/05/27/enter-configuration-based-whitelisting/</link>
			</item>
	<item>
		<title>The “Whitelist Space” seems to be heating up a bit….</title>
		<description><![CDATA[These pages have been talking about the bigger issues of “IT in Transition” for a long while.  The shift to “defense in depth”, with the AV players adding whitelist methods, has been a persistent theme on these and other blog pages.
Well in the last few weeks, we’ve seen a couple major moves: first, Microsoft [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=157&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/05/21/the-%e2%80%9cwhitelist-space%e2%80%9d-seems-to-be-heating-up-a-bit%e2%80%a6/</link>
			</item>
	<item>
		<title>Speaking of Standards…..</title>
		<description><![CDATA[I continue to follow with interest the work that Neil MacDonald from Gartner is doing as he examines trends in physical and virtual security methods and trends.
Here is his latest blog reporting on some observations gleamed from RSA around virtualization and security.  Good stuff Neil.
http://blogs.gartner.com/neil_macdonald/2009/04/23/rsa-and-virtualization-security/
I lock onto these things partially just because I am [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=149&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/04/30/speaking-of-standards%e2%80%a6/</link>
			</item>
	<item>
		<title>A Standards-based approach</title>
		<description><![CDATA[A few months ago a bunch of my friends and colleagues decided to do something crazy:
To collaborate and write a book pooling collective knowledge, experience and vision around the state of the security and information assurance business.
My good friend Carlos Solari took the lead (he really did the heavy lifting regardless of the exceptionally generous, [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=135&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/04/24/a-standards-based-approach/</link>
			</item>
	<item>
		<title>SignaCert Announcement relating to Microsoft at RSA</title>
		<description><![CDATA[Today at RSA we announced a significant “arrangement” with Microsoft.  We also participated in the Microsoft Theater (link to presentation coming soon).
Obviously this is a big deal for us, but that is not why I am writing this blog entry.
This blog is titled “IT in Transition” and if this isn’t transitional, I don’t know what [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=signacert.wordpress.com&blog=718119&post=122&subd=signacert&ref=&feed=1" />]]></description>
		<link>http://signacert.wordpress.com/2009/04/21/signacert-announcement-relating-to-microsoft-at-rsa/</link>
			</item>
</channel>
</rss>
