Techrights logo

IRC: #boycottnovell-social @ FreeNode: April 4th, 2012

Join us now at the IRC channel.

*abeNd-org (~KKlenke@76.0.115.111) has joined #boycottnovell-socialApr 04 01:59
*oiaohm has quit (Quit: by all)Apr 04 02:04
*schestowitz has quit (Read error: Connection reset by peer)Apr 04 04:25
*pidgin_log has quit (Read error: Connection reset by peer)Apr 04 04:25
*schestowitz (~schestowi@unaffiliated/schestowitz) has joined #boycottnovell-socialApr 04 04:25
*pidgin_log (~roy@host86-147-16-124.range86-147.btcentralplus.com) has joined #boycottnovell-socialApr 04 04:25
*abeNd-org has quit (Remote host closed the connection)Apr 04 06:09
*pidgin_log has quit (Quit: Leaving.)Apr 04 13:28
XFaCEgm qu1j0t3 Apr 04 13:28
*pidgin_log (~roy@host86-147-16-124.range86-147.btcentralplus.com) has joined #boycottnovell-socialApr 04 13:28
qu1j0t3XFaCE: hiApr 04 13:34
MinceRhttp://www.danoah.com/2012/04/a-teens-brave-response-to-im-christian-unless-youre-gay.htmlApr 04 13:34
TechrightsSocialTitle: A Teen's Brave Response to "I'm Christian, Unless You're Gay" .::. Size~: 273.79 KBApr 04 13:34
*oiaohm (~oiaohm@139.brs0109.brs.iprimus.net.au) has joined #boycottnovell-socialApr 04 13:59
*oiaohm has quit (Changing host)Apr 04 13:59
*oiaohm (~oiaohm@unaffiliated/oiaohm) has joined #boycottnovell-socialApr 04 13:59
XFaCEqu1j0t3: What shit's new today?Apr 04 14:03
qu1j0t3dunno. :|Apr 04 14:05
*qu1j0t3 goes to workApr 04 14:05
schestowitzgood luckApr 04 14:07
schestowitzjust got a call, I've been assigned to look into what encryption and security the NHS uses in order to put a proposal for FOSS in itApr 04 14:23
schestowitznhs encryption will hopefully not rely on Microsoft; they used to be using a very old version of IE on all workstationsApr 04 14:24
schestowitzhttp://www.connectingforhealth.nhs.uk/systemsandservices/infogov/security/encryptiontoolApr 04 14:24
TechrightsSocialTitle: NHS encryption tool — NHS Connecting for Health .::. Size~: 36.71 KBApr 04 14:24
schestowitz"Apr 04 14:25
schestowitzNHS Connecting for Health has completed the national procurement of an encryption solution for removable media and full disk encryption on behalf of the NHS.  Apr 04 14:25
schestowitz The selected product, McAfee Endpoint Encryption, is provided by Trustmarque Solutions. The product is an enterprise class solution which integrates with existing software deployment tools and can be deployed in both standalone and organisation-wide scenarios.Apr 04 14:25
schestowitz"Apr 04 14:25
schestowitzit does not specify exactly what algorithms or standards they adhere to for this particular taskApr 04 14:26
schestowitzhttp://www.mcafee.com/us/products/data-protection/endpoint-encryption.aspxApr 04 14:26
TechrightsSocialTitle: McAfee Endpoint Encryption | McAfee Products .::. Size~: 23.82 KBApr 04 14:26
schestowitzIt is reasonable to assume network security will differ from something like disk encryption, for cases of lost media with sensitive information about patientsApr 04 14:26
schestowitzThe NHS put out a data encryption policy too, in the form of a report http://www.mkgeneral.nhs.uk/uploads/documents/ict-gl-21.pdfApr 04 14:27
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 14:27
MinceRcould be a patented, proprietary version of the unbreakable ROT13™ algorithmApr 04 14:28
schestowitzThis is quite a recent document and it will be next reviewed next yeatApr 04 14:28
schestowitzMinceR: but does that say so?Apr 04 14:28
MinceRnopeApr 04 14:28
MinceRyou don't need to know, you just need to pay them :>Apr 04 14:29
schestowitz"Apr 04 14:29
schestowitzIt is paramount that Milton Keynes Hospital NHS Foundation Trust (MKHFT) has theApr 04 14:29
schestowitzability to protect all personal identifiable/business critical information fromApr 04 14:29
schestowitzunauthorised access, disclosure or loss.Apr 04 14:29
schestowitz"Apr 04 14:29
schestowitzoften enough they just package FLOSSApr 04 14:29
schestowitzPut some label on it, invest in marketing and packagingApr 04 14:30
schestowitz"Apr 04 14:31
schestowitzThe need for encryption has increased over recent years due to the loss of data fromApr 04 14:31
schestowitzseveral public sector organisations as reported in the media. Milton Keynes HospitalApr 04 14:31
schestowitzNHS Foundation Trust recognises the need to secure its data, protect its staff andApr 04 14:31
schestowitzpatients and have strict control over data in transit. This has also now become aApr 04 14:31
schestowitzmandatory requirement, in accordance with Gateway Reference 10509 (SeptemberApr 04 14:31
schestowitz2008).Apr 04 14:31
schestowitz"Apr 04 14:31
schestowitzThey strongly insist on encryption all media and connectivity too is being limitedApr 04 14:32
schestowitz"Apr 04 14:32
schestowitzUsers’ privately owned mobile computing equipment or related devices (e.gApr 04 14:32
schestowitzlaptops, PDAs, mobile phones) will not be permitted to connect to the TrustApr 04 14:32
schestowitznetwork nor to access Trust network resources. The only exception to this rule willApr 04 14:32
schestowitzbe outlook webmail and via VPN remote access which is tightly controlledApr 04 14:32
schestowitztechnically and monitored through policy and any specific policies allowing privatelyApr 04 14:32
schestowitzowned devices.Apr 04 14:32
schestowitz"Apr 04 14:32
schestowitzit's a non-technical document. At the end it names an actual standard:Apr 04 14:33
schestowitz"Apr 04 14:33
schestowitzStandards:Apr 04 14:33
schestowitzISO 27001 (BS 7799).Apr 04 14:33
schestowitz"Apr 04 14:33
schestowitzhttp://en.wikipedia.org/wiki/ISO/IEC_27001Apr 04 14:34
TechrightsSocialTitle: ISO/IEC 27001 - Wikipedia, the free encyclopedia .::. Size~: 60.46 KBApr 04 14:34
schestowitz"ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC)."Apr 04 14:34
schestowitz"BS 7799 was a standard originally published by BSI Group in 1995. It was written by the United Kingdom Government's Department of Trade and Industry (DTI), and consisted of several parts."Apr 04 14:35
schestowitzSearchThe ISO17799 Guide http://iso-17799.safemode.org/Apr 04 14:36
TechrightsSocialTitle: ISO 17799 and ISO 27001 Wiki - The ISO17799 Guide .::. Size~: 8.49 KBApr 04 14:36
oiaohmYep and most of these ISO standards still have gaping flaws when compared to the old rainbow books.Apr 04 14:37
schestowitzhttp://iso-17799.safemode.org/Apr 04 14:37
TechrightsSocialTitle: ISO 17799 and ISO 27001 Wiki - The ISO17799 Guide .::. Size~: 8.49 KBApr 04 14:37
schestowitzThis does not seem to deal with actual preferred algorithmsApr 04 14:37
schestowitzoiaohm: where would you look?Apr 04 14:38
oiaohmschestowitz: http://en.wikipedia.org/wiki/Rainbow_SeriesApr 04 14:39
TechrightsSocialTitle: Rainbow Series - Wikipedia, the free encyclopedia .::. Size~: 43.47 KBApr 04 14:39
oiaohmThis is basically your starting point when doing a secure system.Apr 04 14:39
oiaohmMost of the contents is written generically.Apr 04 14:39
schestowitzMcAfee won a contract for encryption of media, not networking/transport layer http://www.ehi.co.uk/news/ehi/3760Apr 04 14:40
oiaohmSo it guides you threw the problem you have at hand.Apr 04 14:40
TechrightsSocialTitle: E-Health Insider :: McAfee wins contract for NHS data encryption .::. Size~: 69.94 KBApr 04 14:40
oiaohmYep that breaks a rule in the DoD book.Apr 04 14:40
schestowitzRainbow Series http://en.wikipedia.org/wiki/Rainbow_Series looks interesting, but it helps cover the US government's requirements, not the NHS'Apr 04 14:41
TechrightsSocialTitle: Rainbow Series - Wikipedia, the free encyclopedia .::. Size~: 43.47 KBApr 04 14:41
oiaohmYou should have the source code to anything that is encryption.Apr 04 14:41
oiaohmschestowitz: Rainbow Series the US offically don't use any more.Apr 04 14:41
oiaohmBecause Microsoft and others argued that it was too hard to implement.Apr 04 14:42
MinceRit probably was, for them :>Apr 04 14:43
oiaohmRainbow Series is basically the starting bible for design something secure.Apr 04 14:43
schestowitzAn article from a couple of years ago speaks of the pressure to improve data security at the NHS http://news.bbc.co.uk/1/hi/uk/8066609.stmApr 04 14:43
TechrightsSocialTitle: BBC NEWS | UK | NHS told to tighten data security .::. Size~: 70.99 KBApr 04 14:43
oiaohmOf course its not 100 percent upto date.Apr 04 14:43
oiaohmYet you see all these ISO standards go out and try to reinvent the wheel.Apr 04 14:44
oiaohmLot of errors were corrected in the rainbow books.Apr 04 14:44
schestowitzThere is a PDF that seems very relevant and very, very recent http://www.nhsdirect.nhs.uk/About/FreedomOfInformation/FOIPublicationScheme/~/media/Files/FreedomOfInformationDocuments/OurPoliciesAndProcedures/ICTPolicies/ICTNetworkSecurityPolicy2011.ashx it's about network security in the NHSApr 04 14:44
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 14:44
schestowitzSome other guides are specific to regions, e.g. http://www.smhp.nhs.uk/LinkClick.aspx?fileticket=jKbrUHqiNzg%3D&tabid=160&mid=582Apr 04 14:45
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 14:45
oiaohmschestowitz: read the table of contents of the orange book out the rainbow series.  http://en.wikipedia.org/wiki/Trusted_Computer_System_Evaluation_Criteria  Then remember that was witten in 1983Apr 04 14:46
TechrightsSocialTitle: Trusted Computer System Evaluation Criteria - Wikipedia, the free encyclopedia .::. Size~: 39.9 KBApr 04 14:46
oiaohmYes all these years latter we still cannot get the basics right.Apr 04 14:46
schestowitzThis is mostly procedural; as such, technical details are hardly being specifiedApr 04 14:46
schestowitzoiaohm: but my goal is to find out what the NHS requires and uses nowApr 04 14:47
schestowitzAn old book won't help thisApr 04 14:47
schestowitzwe're able to get a contract for this... FOSSApr 04 14:47
schestowitzprovided it provides the function that complies with what's requiredApr 04 14:47
schestowitzLike openSSL mightApr 04 14:48
oiaohmschestowitz: basically when you do knowing the old book is handlyApr 04 14:48
qu1j0t3COFFEEApr 04 14:49
schestowitzCfH Infrastructure Security Team: Good Practice GuidelinesApr 04 14:49
qu1j0t3oiaohm: schestowitz morningApr 04 14:49
schestowitzhttp://www.connectingforhealth.nhs.uk/systemsandservices/infogov/securitApr 04 14:49
schestowitzy/gpgApr 04 14:49
TechrightsSocialTitle: Information Governance (IG) — NHS Connecting for Health .::. Size~: 11.45 KBApr 04 14:49
schestowitzApr 04 14:49
schestowitzNHS N3 Network Security OverviewApr 04 14:49
schestowitzhttp://www.n3.nhs.uk/TechnicalInformation/N3NetworkSecurity.cfmApr 04 14:49
TechrightsSocialTitle: N3 .::. Size~: 16.96 KBApr 04 14:49
schestowitzqu1j0t3: already!!!?Apr 04 14:49
schestowitzdo you work in a cafe /sarcasmApr 04 14:49
qu1j0t3schestowitz: would be nice.Apr 04 14:49
schestowitzless stressfulApr 04 14:50
qu1j0t3wellApr 04 14:50
qu1j0t3nahApr 04 14:50
schestowitzthis morning I checked about some university teaching jobs..Apr 04 14:50
qu1j0t3being a barista is hard work. i doubt i'd be up to it.Apr 04 14:50
qu1j0t3i'm just a lazy bum programmerApr 04 14:50
schestowitzGPG is Good Practice Guidelines Apr 04 14:50
schestowitzqu1j0t3: I know the feelingApr 04 14:51
schestowitzlife is not about workApr 04 14:51
schestowitzover-ambitious peer-pressure-conscious people can work their arse offApr 04 14:51
XFaCEschestowitz: gpg encyption is neatApr 04 14:52
schestowitzThey keep their cards close to their chestApr 04 14:52
schestowitz"Organisations which do not have an N3 connection can contact cfh.infosecteam@nhs.net to request copies of GPG's and other associated Information Security guidance."Apr 04 14:52
XFaCEespecially when the fraemwork can be included in the OS (GNU+Linux)Apr 04 14:52
schestowitzA bit cryptic about what's being used, maybe for some increased (perceived) security through obscurityApr 04 14:53
schestowitzXFaCE: it's a different PGP arconymApr 04 14:53
schestowitzacronymApr 04 14:53
oiaohmHi qu1j0t3Apr 04 14:53
schestowitzI should write a short report about thisApr 04 14:53
schestowitzN3 IP Network AddressingApr 04 14:54
schestowitzN3 DNSApr 04 14:54
schestowitzN3 Network SecurityApr 04 14:54
schestowitzN3 Monitoring and Capacity ReportingApr 04 14:54
schestowitzQoS General OverviewApr 04 14:54
schestowitzFAQsApr 04 14:54
schestowitzN3 Network SecurityApr 04 14:54
schestowitzhttp://www.n3.nhs.uk/TechnicalInformation/N3NetworkSecurity.cfmApr 04 14:54
TechrightsSocialTitle: N3 .::. Size~: 16.96 KBApr 04 14:54
schestowitz"N3 is a very large network, with 1.3 million NHS end users and over 40,000 connections in England and Scotland connected to regional Points of Presence (PoPs).  A high speed any to any Multi-Protocol Label Switching (MPLS) core is used to connect the N3 PoPs. There are currently twelve major data centres connected directly to the MPLS network to provide national and local services and applications. Two additional data Apr 04 14:54
schestowitzcentres provide authentication and access profiling."Apr 04 14:54
schestowitz"Data sent across N3 is not encrypted (unless using the VPN N3-12-4 Catalogue service which encrypts traffic across the Internet and the N3 network to a specific site). As with any data network there is a risk that data can be intercepted. "Apr 04 14:55
oiaohmI always like this.Apr 04 14:55
oiaohmRunning always secured networks have been possible for years.Apr 04 14:55
schestowitzThey don't encrypt as much as they can:Apr 04 14:55
schestowitz"Apr 04 14:56
schestowitzData transmitted across N3 is not encrypted (unless using the VPN N3-12-4 Catalogue service which encrypts traffic across the Internet and the N3 network to a specific site). Thus N3 is not considered secure enough to transmit patient identifiable or similarly sensitive data across. It does not meet the Caldicott Guidelines requirements alone. It is the joint responsibility of the sender(s) and receiver(s) of such data - not Apr 04 14:56
schestowitzNHS Connecting for Health, NHS National Services Scotland or N3SP to implement a solution that conforms.Apr 04 14:56
schestowitzThe normal practical solution is to encrypt application data where it traverses N3 between users and application providers. The encryption method must meet NHS Connecting for Health and NHS National Services Scotland requirements.Apr 04 14:56
schestowitz"Apr 04 14:56
oiaohmNote something else.Apr 04 14:56
oiaohmThey mention nothing about regulating vpn end points.Apr 04 14:56
oiaohmSo exactly what stops a desgruntel employee taking vpn access information with them.Apr 04 14:57
schestowitzThey rely also on firewalls/blacklists, not much is said about the implementationApr 04 14:57
schestowitzoiaohm: it doesn'tApr 04 14:57
schestowitzwhat people see people can copyApr 04 14:57
schestowitzand Wikileaks showed a lot can be grabbed with little troubleApr 04 14:57
schestowitzNot even by a high-level officerApr 04 14:58
oiaohmWhat is talked about in implementation is not regulation of end points.Apr 04 14:58
oiaohmNo cover of must rotate encryption keys.Apr 04 14:58
oiaohmBasically its crap as I would expect.Apr 04 14:58
oiaohmIt does not even metion using radius with switchs to make sure only authorised computer can connect to the network. Apr 04 15:00
oiaohmThis is basics.Apr 04 15:00
schestowitzA cambridge researchers did, for a change, publish some technical details in "Apr 04 15:00
schestowitzProblems with the NHS Cryptography StrategyApr 04 15:00
schestowitzRoss AndersonApr 04 15:00
schestowitz"Apr 04 15:00
schestowitzhttp://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.49.5022&rep=rep1&type=pdfApr 04 15:00
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 15:00
oiaohmJust with the internal network design there.Apr 04 15:01
oiaohmThere is no mention of client control.Apr 04 15:01
oiaohmPeople wonder why data gets stolen so much.Apr 04 15:01
schestowitz"Apr 04 15:02
schestowitzbona de hospital doctor.Apr 04 15:02
schestowitzThe use of `certi cation authorities' (CAs) is one established way to manageApr 04 15:02
schestowitzcryptographic keys. An example is given by the new SET protocols for creditApr 04 15:02
schestowitzcard transactions over the Internet; each bank (or group of banks) will establishApr 04 15:02
schestowitza service to which customers can send their encryption keys (and the veri cationApr 04 15:02
schestowitzkeys corresponding to their digital signature keys) and have them certi ed. ThisApr 04 15:02
schestowitzcerti cation has the e ect of binding a customer's keys to his or her accountApr 04 15:02
schestowitznumber.Apr 04 15:02
schestowitzBut the solution proposed by IMG is to use a `trusted third party' (TTP), orApr 04 15:02
schestowitza small number of them, rather than CAs. TTPs di er from CAs in that theyApr 04 15:02
schestowitzretain copies of the private decryption keys in order to provide government accessApr 04 15:02
schestowitzto encrypted tra c if required. They are an initiative of the US governmentApr 04 15:02
schestowitzwhose objective is to bring the civil use of cryptography under the control ofApr 04 15:03
schestowitzthe US government and its allies.Apr 04 15:03
schestowitzThe rationale o ered for TTP services is usually as follows. Cryptography isApr 04 15:03
schestowitz"Apr 04 15:03
schestowitzThe paper is in his homepage too http://www.cl.cam.ac.uk/~rja14/Papers/zergo-critique.pdfApr 04 15:05
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 15:05
oiaohmI guess you were not expecting the flaws to this bad and you have barely scratched it yet.Apr 04 15:08
oiaohmschestowitz: Apr 04 15:09
oiaohmReally if you do serousally look using best prac from 1985 at these things you should be able to produce a 50 to 60 page document just going threw the basic design faults.Apr 04 15:12
schestowitzhttps://joindiaspora.com/posts/1486940Apr 04 15:52
TechrightsSocial@schestowitz@joindiaspora.com: Ubuntu's HUD: Light-years beyond any menu system http://www.techrepublic.com/blog/opensource/ubuntus-hud-light-years-beyond-any-menu-system/3535 #ubuntu #gnu #linux #hudApr 04 15:52
TechrightsSocial-> Title: Ubuntu's HUD: Light-years beyond any menu system | TechRepublic .::. Size~: 102.7 KBApr 04 15:52
schestowitz"It can, it can, I saw it in PlanetKDE several weeks ago. "Apr 04 15:52
schestowitz"To be precise: http://www.afiestas.org/appmenu-runner-meet-the-kde-hud/ "Apr 04 15:52
TechrightsSocialTitle: AppMenu Runner, meet the KDE’s HUD | Afiestas Blog .::. Size~: 72.68 KBApr 04 15:52
schestowitzMinceR: eventually we found out what the NHS usesApr 04 15:55
schestowitz> This looks like the best starting point for us, as it's what they're using for Apr 04 15:55
schestowitz> encryption of data stored on disk - which is the main requirement we have.Apr 04 15:55
schestowitz> Apr 04 15:55
schestowitz> Doing a bit more research on the product reveals that they're using AES-256 Apr 04 15:55
schestowitz> and RC5-1024 as the main encryption technologies (these are both block ciphers Apr 04 15:55
schestowitz> using symmetric keys).Apr 04 15:55
schestowitz> Apr 04 15:55
schestowitz> http://downloadcenter.mcafee.com/products/evaluation/EE_VDisk/Win/4.1/ds_endpoint_encryption.pdfApr 04 15:55
TechrightsSocialNot a web page! Aborting application/pdf typeApr 04 15:55
schestowitz> https://kc.mcafee.com/corporate/index?page=content&id=KB52041Apr 04 15:55
schestowitz> Thanks for that, Roy - a good deal of information there (including notes on Apr 04 15:55
TechrightsSocialTitle: McAfee KnowledgeBase - Cryptographic Algorithms available in Endpoint Encryption for PC 5.x .::. Size~: 21.7 KBApr 04 15:55
schestowitz> how little information the NHS or its suppliers put out).Apr 04 15:55
MinceR:)Apr 04 15:56
*oiaohm has quit (Quit: by all)Apr 04 16:11
schestowitzhttps://twitter.com/shelleyelk/status/187277874686984192Apr 04 16:27
TechrightsSocial@shelleyelk: @alastairotter @schestowitz wonder what it looks like today with the Dallas storm..Apr 04 16:27
schestowitzhttps://twitter.com/socialarchive/status/187280916656291840Apr 04 16:27
TechrightsSocial@socialarchive: RT @schestowitz Incredible art made with open-source weather data http://t.co/el0X7jPq #opendata #art - http://t.co/18QlxbQCApr 04 16:27
TechrightsSocial-> Title: Incredible art made with open-source weather data - Boing Boing .::. Size~: 38.85 KBApr 04 16:27
TechrightsSocial-> Title: Cyber Fnox: RT @schestowitz Incredible art made with open-source weather... from .::. Size~: 25.09 KBApr 04 16:27
schestowitzLinsux trolls https://joindiaspora.com/posts/1489834Apr 04 16:50
TechrightsSocial@slackerd@joindiaspora.com: *looks at stream* ![Alt Text](http://omgcheesecake.net/public/style_emoticons/default/schestowitz.jpg) < I have hijacked your stream. Problem? :PApr 04 16:50
TechrightsSocial-> Title: 404 Not Found .::. Size~: 0.32 KBApr 04 16:50
MinceRhttp://www.smbc-comics.com/index.php?db=comics&id=2568#comicApr 04 18:49
TechrightsSocialTitle: Saturday Morning Breakfast Cereal .::. Size~: 23.1 KBApr 04 18:49
schestowitzOn Sunday we have the last stage of Mr. Fitness. It will be hard, but I'm favourite to win this last one and the entire competition, retaining my title even in my 30s (I have just turned 30).Apr 04 19:21
schestowitzTime to write some blog posts...Apr 04 19:22
schestowitzhttps://joindiaspora.com/posts/1490401Apr 04 20:27
TechrightsSocialNot a Diaspora post?Apr 04 20:27
schestowitz"This is a good thing."Apr 04 20:27
schestowitzLin*** people in diasporaApr 04 20:27
schestowitzhttps://joindiaspora.com/posts/1490447Apr 04 20:27
TechrightsSocialNot a Diaspora post?Apr 04 20:27
schestowitz"And this is good as well."Apr 04 20:27

Generated by irclog2html.py 2.6 by Marius Gedminas - find it at mg.pov.lt!