Savannah W-ITS

Some recent events illustrate current, seemingly innocuous examples of personal data collection. You don’t know or can’t imagine this being a problem – but it could be.   Examples:

Any commercial web site (where a product is being sold and data about your ‘web visit’ is being collected and maintained.)
Facebook privacy & security policies and practices.
Google Maps [...]

I previously posted about using the mod_geoip Apache module to control web access via .htaccess files or server configuration adjustments (i.e. editing httpd.conf.)   Here we are adding the mod_security Apache module into the mix.
Wait!  if we can control access via mod_geoip why do we need mod_security?
The simple answer is….  you don’t need it – but [...]

The GOOD news – using the GeoIP module (mod_geoip.c.) can be quite simple.  The module provides much more than simply a relatively easy means to manage web server access – it opens up some opportunities for data mining.
The BAD news – when limiting access make sure that this is what you really want/need to do [...]

Well, it happened to Google (and a number of other companies in late 2009, early 2010) – hackers reached deep? into the information trove. So, who cares?  This goes on constantly, yes?
We have been lulled by our penchant for convenience – it has to be ‘easy’ or we are reluctant to ‘go there’; this happens [...]

Defense in Depth (DiD) is a layered security posture – all devices (or as many as possible) in your infrastructure must be able to stand alone (for some period of time) if the ‘outer wall’ is breached. Many systems currently on the Internet have multiple ‘weak links’ (no firewall, outdated binaries, mis-configured applications, no security monitoring, etc.) If the outer wall comes down then the candy store is open and everything is free…