Thursday May 17

Reader-submitted Lab Defenders: Mr. Potato Head

Friday, 2 December 2011 06:00

Reader-submitted Lab Defenders: Mr. Potato Head

In order to maintain the integrity of the blog, I saved this for a Friday. After Wednesday’s Firewall Barbie post, I received a few comments and photos from readers, some of which are too good not to share with you all!

Read more: Reader-submitted Lab Defenders: Mr. Potato Head

Trusted Infrastructure at NSA’s Trusted Computing Conference

Friday, 16 September 2011 09:49

Trusted Infrastructure at NSA’s Trusted Computing Conference

Next week, I’ll be presenting on trusted infrastructure at the 2nd Annual NSA Trusted Computing Conference  in Orlando. This year’s focus is Using COTS technologies to deliver decisive defensive advantage.

Read more: Trusted Infrastructure at NSA’s Trusted Computing Conference

802.1X-REV It’s a Cryptographic Come Back

Friday, 16 September 2011 09:48

802.1X-REV It’s a Cryptographic Come Back

The new 802.1X-2010 (formerly referred to here as 802.1X-REV) offers a multi-faceted approach to increasing integrity, availability and confidentiality throughout network infrastructures at every segment- from LANs and WLANs to WANs and MANs. Yeah, I threw out the I.A.C. triangle. As much as I hate using it, it is a foundational element of security.

Read more: 802.1X-REV It’s a Cryptographic Come Back

How a State Dept. contractor funneled $52 million to secret family

Wednesday, 20 July 2011 10:41

How a State Dept. contractor funneled $52 million to secret family

Simply amazing, I’m going to summarize this article here, and provide links to the original posting at the Daily Caller.

Here’s what happened: A contracts specialist working at the US Dept of State, employed by contractor ATSG, awarded more than $52 million in contracts to a three-person company, owned and operated by her husband and daughter (two of the three employees). All parties lied about the relationships. The relationships are not mere speculation; wedding photos were found on social media sites, they have joint property and the contractor even has a boat by the same name as the husband-daughter team’s company.

The greater U.S. federal government is one of our primary customers, so I find this particularly appalling. I haven’t seen this story in any mainstream media and I don’t know how credible the source is, but it sure looks like a true story to me.

Worse yet for me personally; ATSG LLC is a group whose foundation we contributed to as early as 2003. In fact, I designed their original logo then for them; it’s still quite similar now eight years later. Some of the original founders are still there, so I truly hope ATSG responds appropriately and maintains its reputation through the incident. This comes as a huge blow in the current economic and political climate, when everyone’s trying to cut fluff spending and government spending. Last I knew in my dealings with ATSG, they were a solid group of folks with good values and a passion for their business. Here’s to hopin’ that’s still the case.

A special investigation by The Daily Caller has discovered that a State Department contract specialist participated in awarding more than $52 million in taxpayer-funded contracts to a company owned and operated by her husband and daughter.

Kathleen McGrade helped their company, Sterling Royale Group, win 43 federally funded contracts over the last few years.

Read the original story State Dept. contract officer steers $52 million to secret husband, daughter by The Daily Caller on 2011-07-19.

The more this investigator dug, the more juicyness he found. In this next article link (part II) The Daily Caller found the daughter’s ex-fiance, who attended the marriage of the contractor, and noted that the daughter didn’t really actually work at the company she supposedly helped run; they put her name on the door so they could be registered as a woman-owned business. I can say from a very recent experience in our office, that several organizations are doing some extreme vetting of woman-owned businesses and other specialized vendor categories that benefit from government assistance and contracting set-asides.

For more on this part of the story, keep reading the link above and proceed to page two. Yep, it just keeps getting better.

It looks like the State Department has terminated this contract employee. That news just comes to us today. I don’t know what will happen next, but personally I hope they make an example out of the family members, as well as the third employee of the seemingly faux company, if he had any involvement. I can’t imagine he didn’t know what was going on – we’re talking about a three-person operation with one person perennially absent.

“Upon learning of the allegations, the Department immediately relieved Ms. McGrade of her responsibilities,” Laine said in an email. “Subsequently, the Department instructed her company that her employment at the Department is terminated.”


Laine also told TheDC in an email that McGrade was not a “contracting officer.” (State Dept. contract officer steers $52 million to secret husband, daughter)

“She was a management analyst, providing support in the contacting [sic] process,” Laine wrote.

This contradicts the State Department’s own website, which calls McGrade a “contract specialist.” Several contracting experts told TheDC that a “contract specialist” is a job title, but she likely approved the contracts personally. McGrade was the only State Department contact listed on publicly available documents related to those contracts.

Read the original story State Dept Terminates Contractor by The Daily Caller on 2011-07-20.

To the Daily Caller, and reporter Matthew, I say kudos on good digging. I hope everything you discovered is true, and I hope the information is put to good use.

As a member of a family-owned business, and a legitimate woman-owned business, servicing the federal government, I’m just appalled. It’s a criminal offense, so I say prosecute to the fullest.

# # #

Book Coming Soon: Low Tech Hacking (JJ)

Friday, 20 May 2011 09:59

Book Coming Soon: Low Tech Hacking (JJ)

I may have fallen off the blog radar for a bit, but I assure you it’s for good reason. Along with our annual IT Hot Topics Conference, wedding planning and customer projects (apparently it’s audit season!), I’ve been working on the content for my contribution to a new Syngress book, Low Tech Hacking.

Read more: Book Coming Soon: Low Tech Hacking (JJ)

Wireless

WEP Sucks, so Why are You Using It?
WEP Sucks, so Why are You Using It?
We all know it… we all talk about… we all say how ‘bad’ it is. Yes, we know WEP SUCKS – so why are you still using it? Yes- I’m talking to YOU!
More
Analysis after the demo: Hole 196 and the WPA2 vulnerability
Analysis after the demo: Hole 196 and the WPA2 vulnerability
You guys asked me to break out this information instead of posting as comments on the original post. Here is more updated information on the WPA2 Hole 196 vulnerability now that AirTight has given the demo at BlackHat/Defcon. More
Four Options for Secure Wireless Authentication with 802.1X
Four Options for Secure Wireless Authentication with 802.1X
The use of 802.1X in wireless is currently the most widely accepted method for secure authentication and key exchange in enterprise environments. More
ProCurve + Colubris… What to Expect
ProCurve + Colubris… What to Expect
With HP ProCurve’s acquisition of wireless provider Colubris, what should the industry expect? Oh, who knows… but people have asked my opinion, so I’ll share my thoughts, musings and speculations with the masses. More

Other Stuff

What is 802.1X? Here’s a Technology Primer for You
I run into two fundamental problems when I start to talk to customers or audiences about Network Access Control and its related standards and protocols. What are they? Number 1, most folks have no clue what 802.1X actually is. Number 2, for the most part, they don’t really understand what NAC is either. More
RSA 2010 Discount Code, Save $600
Geez. I meant to include this in the first RSA post, but I fell victim to a multitasking failure, yet again. As most of you know, if you’re planning to attend RSA, you want to register early for the best price and find the best discount code you can. There are a variety of organizations that offer discount codes and we (speakers) have some to offer as well. Of course, we’d rather you support the speakers by using our codes instead of the other organizations. ;)  You get the same discount either way. More

Search

Get Social

RSSFacebookLinkedinYoutube

NetworkedBlogs

?

Subscribe

Enter your email address:

Delivered by FeedBurner