Week 7

I am getting an early start. I am doing a midterm project for Risk Management, so this is one of the assignments I am getting behind me so I can focus on my midterm.

I found this article interesting:

Supreme Court: GPS Tracking Needs Court Warrant

A GPS was installed on a suspect's car and that data was used as evidence to convict a man of drug trafficking. Because it was installed on private property and there was no warrant obtained, the Supreme Court ruled that such collection of data on a person's vehicle is considered a violation of the 4th Amendment. The Department of Justice (DoJ) argued that the suspect had "no reasonable expectation of privacy" because the suspect drove his Jeep on private roads. It did not convince the Supreme Court.

Which kind of reminds me of Google's lawsuit regarding packet sniffing and sniffing packets on unsecure WiFi signals.

Going through several classes and meet many different students all over the country/world has been a fun experience. However, I noticed that some of my classmates talked about a database called Oracle. Until attending Bellevue, I had never heard of the software. I am very familiar with Access, but what is Oracle? In my job hunts, I have also noted that some employers would like potential employees to be familiar with Oracle. Hmmm...ok.

So, if you know anything about Oracle or you work for an organization that uses Oracle, you might be interested in this article:

The Oracle Flaw: Clarifications and More Information

Apparently, there is a bug in the System Change Number (SCN).

The patch will indeed prevent a database from accepting an elevated SCN that could cause that database to hit the soft limit during normal processing and cause problems ranging from lost transactions to a database shutdown. But it may also interfere with normal operations if the calling database has an elevated SCN acquired through a bug or other means. This means that a database with a sufficiently elevated SCN may not be able to link with patched databases until enough time has elapsed to push its SCN below the new, second limit.

Sounds pretty gnarly and with more and more companies using Oracle for their databases, this could quickly become a serious problem that CIOs need to address before it ends up costing organizations a lot of money.

Depending on time constraints, I may add more for Week 7, particularly if I find something really interesting.

Well! I did find something interesting!!!

How To Prevent Thumb Drive Disasters

For such a small device, the plastic, handheld USB flash drive can cause big security headaches. 

Because of the security risks involved with USB flash drives, it has been suggested that an organization should go around and 

Use clear silicone caulk and fill every USB port on every PC to prevent USB attachments.

That's...ummm...pretty severe! But perhaps necessary. Everyone is tempted to "personalize" their computers at work. Makes it "their own" at the job. However, when you bring in those personal photos or MP3 music from home and your computer is not virus free, this can create a huge problem in the workplace. There is also the point that in the private sector (military does not allow USB thumb drives and has already sealed the ports), USB drives are sometimes vital when an employee needs to do their job.

The articles gives four examples as to how organizations are dealing with USB thumb drives. But the author makes this point at the end that unless you seal your USB ports:

Whether the chosen security approach is to allow only one approved thumb drive, prompt users for the reasons they need to copy data, allow only Microsoft Office transfers, or classify files for approved transfers, each technique addresses one simple reality: Employees will use thumb drives, and they will find ways to continue using them.

I couldn't have said it better myself.