Analogy between (biological) epidemiology and computer virus propagation

Links to some articles follow :

http://engr.smu.edu/~tchen/papers/talk-lmu-Nov2004.pdf
http://as.wiley.com/WileyCDA/WileyTitle/productCd-0471007684.html
http://www.research.ibm.com/antivirus/SciPapers/Kephart/VIRIEEE/virieee.gopher.html
http://www.research.ibm.com/antivirus/SciPapers/Kephart/Spectrum/Spectrum.html
http://ieeexplore.ieee.org/xpl/abs_free.jsp?arNumber=275061
http://ieeexplore.ieee.org/iel3/6/6814/00275061.pdf?isNumber=6814&arnumber=275061&prod=JNL&arSt=20&ared=26&arAuthor=Kephart%2C+J.O.%3B+White%2C+S.R.%3B+Chess%2C+D.M.
http://www-2.cs.cmu.edu/~garlan/17811/Readings/p88-forrest.pdf
http://csgrad.cs.vt.edu/~rpande/worm_modeling.html
http://csgrad.cs.vt.edu/~rpande/Thesis%20Proposal.pdf (see references 3, 9 and 11 for foundational readings on epidemiology)
http://cscs.umich.edu/~crshalizi/Dawkins/viruses-of-the-mind.html
http://vx.netlux.org/lib/static/vdat/epepidem.htm
http://www.securityfocus.com/library?cat=41&offset=20
http://dimacs.rutgers.edu/Workshops/Analogies/announcement.html
http://www.textfiles.com/virus/readlist.vir
http://www-personal.umich.edu/~mejn/papers/email.ps (postscript file)
http://www-personal.umich.edu/~mejn/dmn.html
http://www.nsf.gov/od/lpa/newsroom/pr.cfm?ni=15000000000118
http://www.theinquirer.net/?article=11268
http://www.cs.uwyo.edu/~wspears/virus.html (two papers are linked from this page)
http://www.jour.unr.edu:16080/j705/AB.LI.VIRUS.HTML
http://www.dartmouth.edu/~dujs/2001S/beubonica.pdf
http://www.cacs.louisiana.edu/cybersecurity/malware-tutorial/material/8-Bibliography.pdf
http://www.sciencemag.org/cgi/content/full/292/5520/1316
http://www.madchat.org/vxdevl/papers/avers/
http://www.google.com.sg/search?q=cache:ytjdm1u7Uz4J:www.usenix.org/publications/login/2004-12/pdfs/propagation.pdf+epidemiology+computer+virus&hl=en
http://www.chass.utoronto.ca/~wellman/publications/viruspaper/version.PDF
http://www.aegis.com/news/upi/2002/UP021211.html
http://www.jaist.ac.jp/library/thesis/ks-master-2003/abstract/m-minou/abstract.pdf

Comments anyone ? Does the analogy yield any useful insights ?

Articles on the psychology of virus writers

Links to some popular press articles on the topic ...

http://www.research.ibm.com/antivirus/SciPapers/Gordon/GenericVirusWriter.html http://www.haaretz.com/hasen/objects/pages/PrintArticleEn.jhtml?itemNo=363504
http://www.informationweek.com/story/showArticle.jhtml?articleID=16000606
http://newsvote.bbc.co.uk/mpapps/pagetools/print/news.bbc.co.uk/2/hi/technology/3172967.stm http://newsvote.bbc.co.uk/mpapps/pagetools/print/news.bbc.co.uk/2/hi/technology/3240901.stm http://www.frame4.com/php/article721.html
http://www.theregister.co.uk/content/56/34326.html
http://observer.guardian.co.uk/review/story/0,6903,1153270,00.html

Anyone wants to comment on the realism of these descriptions ?

'Laser scam' gamblers to keep ?1m

The trio - a Hungarian woman and two Serbian men - were arrested in March but police have apparently decided that they did not break the law.

A laser scanner linked to a computer was allegedly used to gauge numbers likely to come up on the roulette wheel.

But police said the case had now been closed, with no charges brought.

Simson Garfinkel's Database Nation describes a similar incident when a gambler observed slot machines to predict the randomness generated by machines and then played and won a sizeable sum but he was not allowed to keep the money.

Seinfeld Dictionary

A little refresher on the special brand of terminology used on the show

Global IT Security Market Forecast to Near $13 Billion

Revenues for the world's IT security market is expected to near $13 billion in 2004, with Cisco Systems Inc., Symantec Corp. and VeriSign Inc. leading the market, a research firm said Monday.

The projected $12.9 billion market consists of three components, threat mitigation, command and control and managed security services, The Yankee Group said.

Source: Yahoo! News

Related Links
Cisco Systems
Symantec Corporation
VeriSign Inc.
The Yankee Group

Clean bandwidth

The rise in distributed denial of service (DDoS) attacks is creating a market for ISPs that offer that offer a 'clean feed' to clients. Hosting companies and ISPs might be able to charge a premium of between 20 and 50 per cent for bandwidth filtered to remove hostile traffic, according to security appliance firm Top Layer.

Source : The Register

Related Links
Top Layer
Tipping Point

SSL VPN (& Hybrid VPN) Gateways - Product Matrix

The SSL VPN competitive landscape has all the typical markings of a young and vibrant hi-tech marketplace. By the start of 2004 the vendor ranks had expanded to 20+ companies, and until recently, most were small ventures that had shipped their initial SSL VPN Gateways only in the past two years. Since July 2003, several well-established public companies have acquired SSL VPN Technology- F5 Networks (uroam), Juniper (NetSceen ((Neoteris)), Symantec (Safeweb) and SafeNet (Rainbow). No vendor yet enjoys a large, defensible position - although Juniper is currently leading the pack based on 2003 product sales. While Cisco has announced SSL support on firewall/IPsec VPN products, this is not yet a feature-rich, remote access solution. Check Point announced its first SSL VPN appliance in May 2004.

Source: SSL VPN Central

Citrix buys Net6

Server-based computing firm Citrix yesterday announced a deal to acquire SSL VPN vendor Net6 for approximately $50m cash. The deal is expected to close by the end of the year.

Source: The Register

Popular Risk Metrics for IT Security

Information Systems Security Association - GAISP
The International Information Security Foundation (IISF) - GASSP (GAISP Predecessor)
The International Standards Organization (ISO) - ISO 17799
The Organization for Economic Cooperation and Development (OECD) - Information Security Principles
The European Information Security Forum (ISF) - Standard of Good Practice
The Institute of Internal Auditors (IIA) - Systems Assurance and Control (SAC)
The Information Security Audit and Control Association (ISACA) - Control Objectives for Information and Related Technology (CobiT)

USPS gets SSO

To move the mail across the network of 37,000 locations, Postal Service workers must access mail processing systems, tracking and distribution software, scheduling and financial recordkeeping databases and the usual array of office applications. The average user has 10 unique identities, higher than the six-to-eight average of most enterprises. Stretch that across 300,000 regular computer users and the dizzying array of applications they touch every day, and you've got a lot of pain, says Bob Otto, the Postal Service's CTO.

"If users can't remember their passwords, they'll write them on sticky notes and post them on their monitors, or call our help desk, which costs us money and lost productivity," says Otto. "We wanted to simplify."

Quantifying Infosecurity

For a long time (at least in Internet terms), businesses didn't take security into consideration when launching e-commerce ventures and online services. Security was usually injected as a secondary consideration, and sometimes not until there was a security breach--the proverbial closing of the barn door after the horses got loose.

The real cost of open source

"With open source, who's going to support the hundreds of thousands of users?" asked Quazi Zaman, platform technology specialist manager for Microsoft's federal division, based in Washington, D.C. "With commercial software, end users have direct vendor support, third-party systems integrators and help desks. Then there's the training piece. How am I going to reduce enterprise costs if I have to get thousands of people up-to-date in using open source?"

Source: Federal Computer Week

Whats that supposed to mean? By that logic we shouldnt invent new things, no new cars, no new phones etc. because who is going to train the users? From the way I see it IT is just a tool, and of course there will be some pain when learing new ways to harness its power that doesnt mean we shouldnt do it.

A good risk to take

At the request of Sen. Sam Brownback (R-Kan.), GAO analysts studied the idea of creating a system that could crunch reams of economic and social indicators to create something of a national barometer — a Web-based system for evaluating the state of the state. It is within the realm of possibility, they determined, although it would not be easy.

Indeed, the risk of failure is real. There's no shortage of data to analyze, nor is there a dearth of technology to analyze it. But how do you develop a system that turns all that data into a reliable gauge of the nation's health?

Source: Federal Computer Week

Handbook of Information Security Management

(Imprint: Auerbach Publications)
(Publisher: CRC Press LLC)
Authors: Micki Krause, Harold F. Tipton
ISBN: 0849399475