User Bob Watson | chat.stackexchange.com

Bob Watson

Feb 12, 2013 11:11

Just like that? Well, that saves room in the whisky budget.

Bob Watson

Feb 12, 2013 11:09

Can one of you kind fellows add a tag synonym 'security-theatre' for 'security-theater'?

Bob Watson

Feb 11, 2013 10:49

I wish our pen-testers would do something cool like mount high-res cameras

Bob Watson

Feb 10, 2013 01:09

@ScottPack I should show you this list of policy documents I have to review; they all contain the words "Best Practice" or "Better Practice" somewhere.

Bob Watson

Feb 10, 2013 01:02

Well, in the case where I'm the auditor and my reference policy contains that sentence.

Bob Watson

Feb 10, 2013 01:00

So in case of a question about complying with an auditor, etc. - that'd be compliance

Bob Watson

Feb 10, 2013 00:58

etc.

Bob Watson

Feb 10, 2013 00:58

"Demonstrate the application of Best Practices..."

Bob Watson

Feb 10, 2013 00:58

Ah, ok. It shows up in audit documentation all the time.

Bob Watson

Feb 10, 2013 00:57

You don't like best-practices?

Bob Watson

Feb 9, 2013 06:42

Sounds like a uni project someone wanted to do, and their instructor really didn't want them doing.

Bob Watson

Feb 9, 2013 06:07

blog.whitehatsec.com/cracking-aes-256-dmgs-and-epic-self-pwnage was posted just a little while ago; kinda kicks up the 'should I encrypt?' argument again tho, forgive me for that :)

Bob Watson

Feb 9, 2013 05:11

Trawling the wiki is my only form of entertainment

Bob Watson

Feb 9, 2013 05:10

Well, I'm laid up sick at home at the moment, and my only internet access is via a work machine that blocks pretty much anything even slightly suss

Bob Watson

Feb 9, 2013 05:07

Cross-interleaved Reed–Solomon coding

In the compact disc system, cross-interleaved Reed–Solomon code (or CIRC) provides error detection and error correction. CIRC adds to every three data bytes one redundant parity byte. Overview Reed–Solomon codes are specifically useful in combating mixtures of random and burst errors. CIRC corrects error bursts up to 3,500 bits in sequence (2.4 mm in length as seen on CD surface) and compensates for error bursts up to 12,000 bits (8.5 mm) that may be caused by minor scratches. Characteristics * High random error correctability * Long burst error correctability * In case the burst correcti...

Bob Watson

Feb 9, 2013 05:06

There's parity checking at least

Bob Watson

Feb 9, 2013 05:04

So grain of salt.

Bob Watson

Feb 9, 2013 05:04

And it was that seminar they explained DVD error checking

Bob Watson

Feb 9, 2013 05:04

Yeah

Bob Watson

Feb 9, 2013 05:03

Though I remember sitting in a seminar at national archives once when they told us to burn 640mb of data to a DVD because it'll 'spread it out'

Bob Watson

Feb 9, 2013 05:02

*not

Bob Watson

Feb 9, 2013 05:02

A lot less error-check with CD, and the laser is a much lower wavelength too - so maybe npt

Bob Watson

Feb 9, 2013 04:59

That's about right

Bob Watson

Feb 9, 2013 04:58

DVD has dye in the mastering process for professional stuff

Bob Watson

Feb 9, 2013 04:57

Wonder how that translates to DVD/Blu-ray

Bob Watson

Feb 9, 2013 04:55

They don't say what they use for optical though

Bob Watson

Feb 9, 2013 04:54

Optical at 50

Bob Watson

Feb 9, 2013 04:54

Ultrium at 30 years

Bob Watson

Feb 9, 2013 04:54

hpstoragemedia.com/main/en/mdt/medialast_eee.pdf has some stats

Bob Watson

Feb 9, 2013 04:50

Those were singles mostly - but cracked to the point of being unreadable inside 5 minutes in the player

Bob Watson

Feb 9, 2013 04:50

You would probably pick better quality for archive, but I've had stamped CDs from the 90s just come apart putting them in a CD player.

Bob Watson

Feb 9, 2013 04:44

Stamped CDs are really variable - they're all sorts of thickness / types of plastic / etc

Bob Watson

Feb 9, 2013 04:38

So leaving them unplugged is also not great for longevity

Bob Watson

Feb 9, 2013 04:38

But voltage 'leaks' over time in SSDs, and relies on having a power source to get it back in line

Bob Watson

Feb 9, 2013 04:37

But those are under massive use - so they definitely don't last as long in motion.

Bob Watson

Feb 9, 2013 04:37

Well, we've got a 6tb array of 256gb SSDs, and we replace one about every 12 weeks.

Bob Watson

Feb 9, 2013 04:35

I don't think SSDs have been around anywhere near long enough to have a good read on that

Bob Watson

Feb 9, 2013 04:25

It's not really possible to get to any agreement

Bob Watson

Feb 9, 2013 04:25

That's true, and really - without knowing the specifics around who's going to need access, if it's likely to be in a hurry (are they wills? Do you want to take the risk the person executing your will won't understand the principle behind the encryption?), and a host of other things

Bob Watson

Feb 9, 2013 04:23

And yeah - there are ways to do it, certainly. I just question whether or not they're the best approach.

Bob Watson

Feb 9, 2013 04:23

Yeah, but 'long-term' doesn't conjure up 3-5 years.

Bob Watson

Feb 9, 2013 04:21

Iszi disagrees, " First, protection of this data is very important as it will likely contain PII and other sensitive information for several generations of one's family - at least two of which are likely to be currently living. Second, securely storing a "failsafe" copy of your encryption software and keys in a place other family members can get to is just as easy as storing the records themselves in a safety deposit as you suggest."

Bob Watson

Feb 9, 2013 04:20

And my answer was essentially "Get a securely lockable box, secure the keys and put it in a safety deposit box at your bank."

Bob Watson

Feb 9, 2013 04:20

I'm assuming 'arbitrary' that he mentions is 20+ years

Bob Watson

Feb 9, 2013 04:20

Long-term storage is also important here

Bob Watson

Feb 9, 2013 04:19

4

Q: How to avoid to lose data encrypted because it was encrypted by no longer supported software?

How can I avoid losing data that is encrypted using methods that may become obsolete? I have valuable family records I wish to secure, so I plan to encrypt them before putting them in long-term storage. But how can I ensure that the encryption is future-proof, and that I will be able to access th...

Bob Watson

Feb 9, 2013 04:18

I just think that, overall, you're much more likely to be able to get at your data if you use less technology, and that the tech you use is well understood.

Bob Watson

Feb 9, 2013 04:17

Secure from whom?

Bob Watson

Feb 9, 2013 04:17

Though, much less secure is hard to quantify,

Bob Watson

Feb 9, 2013 04:16

Yes, that is the sacrifice

Bob Watson

The DMZ