The morning sessions of the security symposium were pretty vendor heavy. I did get to see a pretty cool demo of Cisco’s video surveillance product, but other than that, it was all vendors, all morning. The keynote, which came during lunch, however, was absolutely wonderful. Lawrence Baldwin talked about his work with myNetWatchman and the products he’s making available to the security world, namely secCheck (there were others, but this one particularly caught my eye). I’ve used secCheck before, but not really in a formal way, so hearing about how he developed it, uses the information garnered from it and helps catch criminals with it was pretty darn cool. He also discussed his home set up, using a custom designed, multi-drive system he calls the TeraTivo. That was wild! He then segued into some of the work he’s done, giving examples of a church’s computer that got infected with a keylogger so that everyone who called in a donation (and skipped the scary, insecure internet donation button) got their information stolen anyway and how criminals use a sort-of proxy (2 layers deep) to keep law enforcement from finding them easily. That got him talking about the issues with cybercrime laws and how they are weak enough to discourage prosecution, strong enough to falsely convict the innocent and can easily become another tool for criminals.
Finally, he said that the weakest link in any security system is the millions of poorly secured systems in homes and small offices around the world. The infrastructure can be secured and core computing resources hardened, but as long as there are people out there who still don’t realize that clicking on links you don’t trust (and even some that you do) can be dangerous, the Internet will never be secure.
