Quick update on pattern progress as it has been quiet lately given the core team have been very busy.

• The DMZ pattern has been promoted from draft
• Board of Directors pattern requires a few small updates to bring into line with the standard template then will be finalised.
• We are working an Industrial Process Automation pattern and should have a draft ready for comment in coming weeks
• 2 other patterns are pending owners: Secure Network Zone and Consumer Devices

All work is credited back to originators.

The pattern naming convention has been changed to [SP-xxx: Name of area Pattern] where SP stands for Security Pattern. For example SP-019: Secure Adhoc File Exchange Pattern

This allows all patterns to be uniquely referenced, with version information held within the pattern itself. It also means that the patterns are easier to read through in the library, and we can use the same directory structure when working on them offline.

How unique and traceable is your browser? A lot more than you realise. This research project from the EFF looks at various characteristics from your browser strings, and in my case when I checked, uniquely identified me in the 1 million plus tests done so far.... Interesting privacy implications given that some companies on the web are starting to use this to track users uniquely across sites...

Just read an interesting article on Ars about hacking ATM's at the recent BlackHat conference.

Reading it reminded me about how important the basic foundations are in IT security. Get the physical security right first, in this case the ATM's used the same $10 security key available from eBay for all machines to increase usability. Then make sure you properly test before you release your software, product, or system. The hack on one machine could be stopped by reducing the attack surface and stopping the remote access facility... or ensuring that only signed code could be run.

It's not secure if you haven't tested!