PGP for Mac Whole Disk Encryption Review

Wanted to share a quick “how does it work” about PGP WDE for Mac. http://www.pgp.com/mac/ This is the only solution that does pre-boot and true WDE for the Mac. The software is 189 for a yearly license or 239 for perpetual. The software itself is very “apple-ish” with great wizards and walk through for those not familiar with key based authentication and encryption. Some of the features are: WDE for Intel based Mac running 10.4/10.5, no SL due to the 64bit kernel from the debug trace on my Mac Pro :) ...

August 28, 2009 · 3 min · Nick

Systems Engineering and Redundancy

I posted this to ServerFault.com today. Folks loose site of requirements and systems engineering and it drives me batty. Here was my response to the guys question about redundancy and RAID/COOP/etc. ——– Every design and architecture should be requirements driven. Good systems engineering calls for defining the constraints of the design and implementing a solution that meets that. If you have a SLA with your customers that calls for a .99999, then your solution of N+N redundancy should account for all those LRU (line replaceable units) that could fail. RAID, PS, and COOP planning should all account for that. In addition your SLA with vendors should be the 4 hour response time type or account for a large number of spares onsite. ...

August 14, 2009 · 2 min · Nick

Open Source Security Professionals

In economic times such as these it is imperative that architects and leads alike look beyond the glossy software catalog and instead to the web. In the past we often discounted open source as unsupported and hacker-like in the development efforts. One would hope that in this day of enterprise open source powering the majority of web applications that we could back away from the mantra of yesteryear. The argument often heard in corporate America is without a company backing it, how can you trust the source of the code? In the same bated breath they will speak to Microsoft and Oracle as pristine trophy holders of American Ideals. In this global economy and 24×7 development cycle there is very little code still developed stateside only. The pond and time zone allow for rapid development cycles and releases. It is ignorant to think that Microsoft’s code is not spattered with code developed in foreign countries. The bazaar development paradigm has extended well upon the weird GNU hackers in their basements, even Microsoft and other commercial entities have opened the doors to this development process. ...

July 13, 2009 · 3 min · Nick

Weekend Update

What appears to be a world littered with twitter messages and facebook status message updates, I thought it appropriate to update those who care enough to read. I have neglected the communication I often share with everyone due to the constraints of time and sleep. Given the choice to ensure a rigid routine or talk to you all late into the night, I am selfish and choose sleep and eating. Sorry, just the caveman in us all. ...

July 11, 2009 · 5 min · Nick

Legacy in the IT/IA Community

Information technology and assurance both are commonly seen as negative costs in a budget. Deploying a new or replacement server is seen as “sunk” cost for very little gain. In the same vein implementing costly security packages before an attack seems imprudent. “We haven’t had security issues thus far” is a slogan to be plastered on the side of Silicone Valley. Sticking with legacy platforms and code bases to dodge the upgrade bullet only serve to hit you with cost later down the road. As a good friend of mine Marc states “plan to do it right first or plan on doing it again later.” ...

May 22, 2009 · 4 min · Nick