Frank W. Abagnale and the irony of security industry

If you remember that name then most probably you have seen the epic movie Catch me if you Can starring Leonardo DeCaprio and Tom Hanks. In short, the movie is about this guy Frank Abagnale, (played by DeCaprio) who figures out novel ways to commit check fraud and embezzle money posing as various people (as a pilot, as a doctor and as a lawyer). The movie is all about how the hacker mindset works and is a must watch if you are in the information security field. The movie is replete with examples of social engineering tricks that determined hackers so often use. Its a good way to train ones thinking in the ways of the hacker.

This movie not a work of fiction but is based upon a real guy who did these things in real life. This is the website of the real Frank Abagnale, who is now, not surprisingly, one of the world's most respected authorities on the subjects of forgery, embezzlement and secure documents. Check out his website for more details on his lifes work in the last 30 years. Ironically, the guy who literally started check-fraud has been at the helm of defending against it for the better part of his life.

This irony presents itself in the security industry again and again with the guys who now defend the world were the ones who were once defended against. There is nothing wrong with it and maybe thats the way it should be but i just found the thought very interesting.

Art of Elevator Pitching

Elevator Pitching is the art of getting your point across to an executive in less than 60 seconds, i.e. about the time you have with an executive in an elevator.

This website is a place where enterpreneurs have to pitch their products to the audience in less than 60 seconds. Some of the pitches are really great. Check it out !

I remember my mentor once telling me the importance of "back-of-envelope" or "back-of-napkin" presentations to executives and this seems to be the same concept but on steroids. It makes a lot of sense, especially for IT Security guys where the investments don't always translate to a predictable ROI.

How the Indian IT Industry is tiding the current global crisis ? - A Nasscom Report

PuneTech blog reports about a recent talk by Ganesh Natarajan of Nasscom on how the Indian IT industry is tiding the current IT crisis. The presentation can be found here. The report is full of graphs and figures and is a very interesting and motivating read.

My summary of the report

• Inspite of global uncertainities, the revenue aggregate (from IT-BPO sector) as a percentage of GDP continues to rise (albeit a little less compared to the rises in previous years).
• This growth (in the face of current global crisis) is partly due to entry into new market verticals like Airlines, Media and healthcare apart from Banking, Financial, Insurance and Telecom. This reduces dependency.
• The industry is progressing towards providing more end-to-end services. The report cites the BPO industry as an example, where in addition to customer support, services like finance, accounting, HR, procurement and knowledge services are also being offered.
• India is exporting its services to more and more regions (though US still holds 61% of the share). The fast growing areas are Europe and Middle East. This makes us less prone to mistakes made by "Superpowers" :).
  
• The report indicates that by 2020 India will lead the world in working age population. The estimated work force in India will be 47mn compared to -17mn in the US. This extreme imbalance in work force will work towards India's sustained growth.

To ensure that India does not lose its advantage a number of initiatives are being undertaken:

• IT Export services are being spread across more cities to manage pressure on Bangalore, Pune, Hyderabad, Chennai, Delhi.Nasscom identifies around 43 Tier 2/3 cities.
  
• There is a comprehensive program in place for making Indias large talent force "employable". These include short-time objectives like making large investments in training, medium-term objectives like faculty development programs to train and sustain faculty (this is very very important given the current crisis of good teachers in our country) and long-term objectives like setting up new IITs, investing in technology innovation etc.
  

Embracing New Technology : The Twitter Case

I am a technogeek and try to integrate new technology in my everyday life as much as possible. This post is about how i am using twitter.

As most of you may know, twitter is this short messaging service which people use to convey updates in real time. It has become the micro-blogging platform of choice and has many cool advantages, one amongst them being able to convey live updates using a computer, regular mobile or smart phones. These updates can then be fetched via RSS feeds.

I use twitter to tell people (whoever is interested) what i am currently upto. These are normally sent to my twitter account as an SMS from my mobile. The current status then appears on my webpage.

So the next time, you call me and i do not pick up the phone, please check the twit on my webpage!

IPv4 Countdown vs. State of IPv6

The Internet Assigned Numbers Authority (IANA) is the body that manages the unicast IPv4 address pool (ie from 0.0.0.0 to 223.255.255.255.255). IANA assigns blocks of this space to the 5 RIR's (Regional Internet Registries) i.e. AFRINIC, APNIC, ARIN, RIPENCC and LACNIC. The RIR's use their distribution policies to further allocate addresses to local registries and ISP's which propogate them to the endhosts.

Potaroo.net predicts the following dates for the exhaustion of IPv4 address space.

Projected IANA Unallocated Address Pool Exhaustion: 04-Feb-2011
Projected RIR Unallocated Address Pool Exhaustion: 05-Mar-2012

A live down-counter counting number of days until we hit exhaustion of the IPv4 address space can be found here . This counter is generated using data from potaroo.net report The report is pretty detailed and explains the modelling used for predicting the dates. Please note that the modelling is based on current address distribution policies used by RIRs and current consumption trends. The following graph (from potaroo.net report) shows the current status of IPV4.

An explanation of the graph follows:

Note that there are 256 /8's where each /8 is 16,777,216 addresses.

IETF_Reserved : Blocks reserved for special purpose. It consists of 16 /8 Multicast blocks + 16 /8 reserved blocks + 1 /8 (0.0.0.0/8) block for local identification + 1 /8 (127.0.0.0/8) for loopback + 1 /8 (10.0.0.0/8) for personal use + 1 /8 (14.0.0.0/8) for public-data networks.

IANA_Pool : Pools of /8 left with IANA for allocation to RIRs.

Allocated : Allocated by IANA to RIR. This does not reflect current consumption because RIRs may have a pool of their own.

So much for IPv4. Now lets look at IPv6.

In 2008, there have been atleast 2 big studies around the state of IPv6.

• Google Study on State of IPv6 for ordinary users
  
• Arbor networks study on overall state of IPv6
  

The reports are detailed but these are a few interesting points.

1) Arbor networks experiment measured the total amount of IPv6 flowing in the backbone , and they note that

At its peak, IPv6 represented less than one hundredth of 1% of Internet traffic.

2) The biggest reason cited in the summary for the above observation is money.

Specifically, the department of commerce estimates it will cost $25 billion for ISPs to upgrade to native IPv6.

3) Googles effort measures the state of IPv6 from a end node perspective as opposed to the Arbor measurement. Their key observations are :

• 0.238% of users have useful IPv6 connectivity (and prefer IPv6).
• 0.09% of users have broken IPv6 connectivity.
• Probably a million distinct IPv6 hosts exist.
• Russia leads the chart in IPv6 penetration.
  
• IPv6 prevalance is low but increasing steadily by the week.
• IPv6 - IPv4 tunelling is the most common transition mechanism.
  
• MacOS has better IPv6 penetration than Vista because of its default policies in the OSes.
  

So given the predictions about end of IPv4 and the rate of adoption of IPv6, are we ready for migration? In Feb 2008, ICANN added IPv6 addresses for 6 of the 13 root DNS servers (news here) which is a step in the right direction but is it enough to prod people to migrate?

I have the following concerns about the migration:

• What would dictate the migration: economics or a better-future-internet?
• Will ISPs be willing to pay the price?
• Even if they are willing to do so, can the consumers and business transition to IPv6 seamlessly?
  
• Will security products continue working the same way?
  
• Are the vendors testing their implementations with IPv6 to make a simple software update to the tons of software already out there?
• How will this migration be different in impact than the Y2k bug of the last century? Are these comparable in any sense?
  

I have a feeling that economics will dominate this race more than anything else. If the migration is going to cost a lot of money for businesses without any added value then there is bound to be a huge pushback. Somehow the cost has to be justified to them to make this transition happen and just saying address space exhaustion may not strike a chord with every business.