The Sys-Security Group

Disclaimer: I am an apple junky. I have several Apple laptops, I got various iPods, and I assume I will continue to buy their stuff.

That said, I really do not understand what is the excitement over Apple TV and iPhone. I get Apple’s idea, awesome design, great UI, medium features and selling like crazy (see for example the black MacBook, or the U2 iPod). They have done this before, they are doing it now, and they will do this again.

Let’s start with Apple TV. There is absolutely nothing new with the concept. Nothing. There are other alternatives on the market today, which costs less then the 299USD price tag apple is asking. Sure, the UI is superb, but paying the premium for that – not me.

The iPhone’s coolness factor is 10 out of 10. It is a gorgeous device that promises a lot. The problem? I think Steve Jobs hasn’t used a good smart phone lately. I proudly own an HTC TyTN Windows mobile-based smart phone. I admit it, I run Windows on my mobile phone. It is a Tri-Band UMTS, Quad-Band EDGE, Bluetooth® and Wi-Fi® phone. It basically has any type of connectivity option currently available on the market.

What does Steve Jobs tells us about the iPhone?

• “Apple is going to re-invent the phone”
• “The problem is, they are not so smart and not so easy to use”
• “Way smarter then any mobile device, and way easy to use”
• “Bring all of your contacts to the phone”
• “5 years ahead of any other mobile phone”

So Steve Jobs thinks that bringing all of our contacts to the mobile phone is a cool unique feature… Come on.

Let’s examine this. Who does use an ultra cool new mobile phone? My dad? My mom? My folks do not need 3G nor an advanced mobile phone. They are using a phone that can dial a number, do a re-dial show them who calls them and who are they calling.

My folks lives up north from where my wife and I live. I tried convincing my dad to get a 3G phone so we can have a Video call where he would be able to see his grand daughter. I miserably failed. It is simply too complicated for him.

This brings us back to the audience that is the target of the phone. Who do you expect to pick up this gorgeous but extremely expensive phone?

This is all about the UI and the coolness effect and not about the feature set. In my opinion the phone is not a giant leap to the future, and Apple is not inventing the wheel here.

I would like to see iPhone able to sync to the computer meetings and contacts I have inserted on the iPhone to Microsoft Office. I am doubtful this is going to be supported with the first version of the iPhone. If it will not support that, the business world is not going to buy the phone. Simple as that.

As a multimedia device it looks great. If it works like is seems to, it will be the best phone and multimedia device that would be out there. But days would tell.

Another interesting point to make is the security of the device. It is a full-blown operating system (according to Jobs), I wonder what its security issues would be? Would we see the same issues with OS X immediately replicated to the iPhone? That might be dreadful for all.

Will I buy the phone? I did not buy the iPod video since I think its screen is too small. I admit it is hard to walk into an Apple store and resist it. But I do resist it. I am not sure what would be my reaction to the iPhone especially when the 4GB version is 499USD + 2 years contract. Who wants to pay that amount not able to have an unlocked phone?

For those of you who do not know who David Pogue is, David is behind the missing manual book series for MAC OS X. David does all sorts of other things as well, and one of them is writing for the New York Times.

One of his latest posts to his blog is titled “How Secure Is Your Wi-Fi Connection?“.

I selected some quotes from his write-up. I believe they are self-explanatory why user education may miserably fail:

“…None of this took any particular effort, hacker skill or fancy software. Anyone could do it. You could do it.”

“Now, the fact that it’s so easy to intercept your Internet signals in a public hot spot doesn’t mean that somebody is *doing* it. In fact, of course, most of the time, nobody is.”

“Truth be known, since my eyes were opened, my Wi-Fi habits haven’t actually changed much. I still open the laptop in the hotel lobby, exchange e-mail with readers, editors and friends, and check a few news sites or blogs. None of it would really mean anything to an evil eavesdropper nearby.”

One of the things I have learned about network security is that you cannot defend something or against something you are not aware of its existence.

Ask yourself the following questions:

• Do I know what elements reside on my network(s)?
• Do I know who is on my network(s)?
• Do I know what is being done on my network(s)?
• Does the information I have, if at all, is current?

Don’t be surprised if you have answered no to some of these questions.

Apparently knowing the network is one of the most neglected fields within network security.

Let’s take patch management as an example.

• How many of your Microsoft Windows-based elements are currently using a patch management solution?
• How many of your Microsoft Windows-based elements operate outside of an organizational domain?
• To how many Microsoft Windows-based elements the patch management solution do not have access to?
• Can you tell how many Microsoft Windows-based elements reside on your networks?

If your organization is requiered to comply with a certain regulation the organiztion is required to demonstrate its ability of controlling and knowing all of its assets…

Real-time contextual information regarding the IT infrastructure should serve as the basis for different management and security applications such as: Asset Management, CMDB, Compliance & Audit, Helpdesk, Intrusion Prevention and Intrusion Detection, NAC, Patch Management, Vulnerability Management, Etc.

Without knowing the network, one simply cannot manage or secure it.

Frost & Sullivan conducted a through & through research on the current available NAC solutions (any vendor offering a NAC solution) and selected Insightix as its 2006 NAC Best Value product.

Interesting quotes from Frost & Sullivan:

• “Frost & Sullivan recognizes that Insightix delivers technologically solid solutions at an attractive price. By integrating proven asset discovery technology with real-time network access controls, Insightix NAC offers an appealing solution for companies looking to implement NAC without exceeding budget or implementation expectations.”
• “Insightix NAC simplifies a great deal of the implementation challenges by providing an easy-to-understand rule engine to enforce NAC policies across an entire network environment without the costs and problems associated with managing agents or replacing network equipment.” (Frost & Sullivan research analyst Robert Ayoub).