Microsoft released advisory 2416728 on Friday after researchers Thai Duong and Juliano Rizzo demonstrated the attack on ASP.NET with their Padding Oracle Exploit Tool.  The attack itself preys on a bug in ASP.NET’s AES implementation, which you can read about over here at threatpost.  So what’s the reward for a successful attack?  It’s not going to allow the attacker to execute code or elevate rights, but it does all the attacker to read potentially sensitive data that could then be further used to compromise the system. The mitigation for this attack is to obfuscate the server errors by ensuring that no matter what the error, the same error page is returned.  This can be done manually in your configurations by addressing the section of the web.config file, or, you can mitigate centrally at your web farm’s front door with (of course!) an iRule.   1... (more)

Cloud Computing and the Security Paradox

Cloud Computing and the Security Paradox On September, 14th  I participated in a local IBM conference titled: Smarter Solutions for a Smarter Business. One of the most interesting and practical presentations was Moises Navarro's presentation on Cloud Computing. He quoted an IBM survey about suitable and unsuitable workload types for implementation in the Cloud. The ten leading suitable workloads included many Infrastructure services and Desktop Services. The unsuitable workloads list included ERP as well as other Core Applications as I would expect (for example, read my previous ... (more)

Glimmerglass Networks Demonstrates Remote Optical Path Provisioning, Monitoring With Laser 2000 at European Conference and Exhibition on Optical Communication 2010

Glimmerglass Networks, the leading supplier of intelligent optical layer management solutions, today announced that it will display the latest breakthroughs in purely optical, photonic switching solutions alongside Laser 2000, a specialized supplier to the photonics market, at the 36th European Conference and Exhibition on Optical Communication (ECOC) 2010 – Booth 467. By enabling service providers to provision and reconfigure the optical layer remotely and instantly, Glimmerglass intelligent optical layer management solutions reduce OPEX, improve network availability, reduce SLA... (more)

Finding the Flaws of the Whole, Not Just the Flaws of the Parts

The Visible and the Invisible in SAP It would seem like the last thing we need in SAP systems is more metrics. Automated solutions that investigate, monitor and track ERP systems are common, so why are major corporations increasingly employing automated metrics for SAP systems? Like all systems that span the enterprise, SAP systems suffer from the "six blind men and the elephant" problem - each man is able to envision his own part of the elephant, but putting together a picture of the whole animal is a problem. It is this "whole is greater than the sum of its parts" view that SA... (more)

Mark Hurd and Steve Mills

This is more like a long Tweet than a short blog entry. Personal issues aside Mark Hurd was a brilliant CEO for HP and he will be remembered as one of the greatest CEOs HP ever had. Like the rest of the world, we were curious and watched him from the beginning. I knew he was off to a brilliant start when - within days of getting the job - he put together an internal group of PhD economists specialized in game theory who developed a system that saved HP billions of dollars in purchases. Wikipedia defines game theory as "attempts to mathematically capture behavior in strategic situ... (more)