<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body dir="ltr" bgcolor="#ffffff" text="#000000">
Danny Lieberman wrote:
<blockquote
cite="mid:e1d1de4e0908180606m7a891d5du560a9dc464cc9030@mail.gmail.com"
type="cite">
<div dir="ltr">Shachar, Geoff<br>
<br>
<br>
b) the threat probability of one of our operations getting a US court
injunction is so low that I don't even bother with security
countermeasures. OTOH - the threat of dos/web defacing/site
downtime/poor response time is high enough that we considered and
eventually deployed outsourced services for messaging and hosting. We
use slicehost, <a moz-do-not-send="true" href="http://rackspace.com">rackspace.com</a>
and Google Apps. Dev servers are inhouse.<br>
<br>
</div>
</blockquote>
Your threat level rises significantly when you use free services. If
you are going to be using Google's services for your business, my
recommendation is that you find a route in which you pay them for it.
The logic is that by paying them, you are creating accountability of
them to you. Many of the privacy concerns diminish significantly as a
result.<br>
<br>
I'll add that, specifically with Google, the amount of concentrated
cross-referencable personal info is what bothers me the most.<br>
<blockquote
cite="mid:e1d1de4e0908180606m7a891d5du560a9dc464cc9030@mail.gmail.com"
type="cite">
<div dir="ltr">>>> Apropos - My personal estimate is that
the probability of a privacy breach is higher in the Israeli Ministry
of Defense than in GooglePlex.<br>
<br>
</div>
</blockquote>
Not when my own servers are involved. At least not without my knowledge.<br>
<blockquote
cite="mid:e1d1de4e0908180606m7a891d5du560a9dc464cc9030@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
d) We deploy security countermeasures to protect assets:<br>
0) We don't use Google docs, Never.<br>
</div>
</blockquote>
So you are, essentially, saying that you agree with me to a degree, but
don't go quite as far.<br>
<blockquote
cite="mid:e1d1de4e0908180606m7a891d5du560a9dc464cc9030@mail.gmail.com"
type="cite">
<div dir="ltr">3) we physically destroy hard disks (it's fun...)<br>
<br>
</div>
</blockquote>
That I'm curios about. What do you specifically do to destroy the hard
disk?<br>
<br>
The way I see it, either you believe that "recover seven generations"
is not possible (like some do), in which case just do "dd
if=/dev/urandom of=/dev/sdb" followed by "dd if=/dev/zero of=/dev/sdb"
(or just settle for the later), or you believe that it is possible, in
which case the only solution I know of is melting the drive's plates.
Personally, I don't have any way to do the later, so I just do the
former and hope that my attackers don't have the $100K+ it allegedly
requires to recover the data.<br>
<br>
Shachar<br>
<br>
<pre class="moz-signature" cols="72">--
Shachar Shemesh
Lingnu Open Source Consulting Ltd.
<a class="moz-txt-link-freetext" href="http://www.lingnu.com">http://www.lingnu.com</a>
</pre>
</body>
</html>