We’ve known that they have been inadequate for over thirty years, and they have only gotten worse. Can we escape the varying eye-of-newt password rules that plague everyone’s online lives? Can we get grandma safely to the other side of the authentication street?  I will review some of the  many research ideas that have been proposed, and offer some suggestions toward getting us out of this thicket.

Bill Cheswick logged into his first computer in 1968. Seven years later, he was graduated from Lehigh University in 1975 with a degree resembling Computer Science. Cheswick has worked on (and against) operating system security for over 35 years. He has worked at Lehigh University and the Naval Air Development Center in system software and communications. At the American Newspaper Publishers Association/Research Institute he shared his first patent for a hardware-based spelling checker, a device clearly after its time.

For several years he consulted at a variety of universities doing system management, software development, communications design and installation, PC evaluations, etc.

Ches joined Bell Labs in December 1987, where he became postmaster and firewall administrator and designer. In 1990 he published a paper on firewall design that coined the word "proxy" in its current meaning. He followed this with "An Evening With Berferd", and then the publication of "Firewalls and Internet Security; Repelling the Wily Hacker", co-authored with Steve Bellovin. This book taught Internet security to a generation of administrators. In 1998, Ches started the Internet Mapping Project with Hal Burch. This work became to core technology of a Bell Labs spin-off, Lumeta Corporation. Ches has pinged a US nuclear attack submarine (distance, 66ms).

During his sabbatical over the winter of 2007 he worked on science museum including an upgrade for the Liberty Science Center’s digital darkroom.

He joined AT&T Research in Florham Park in April 2007 and is working in security, visualization, user interfaces, and a variety of other things. He is a frequent keynote speaker at securty conferences.

Ches has a wide interest in science and medicine. In his spare time he reads technical journals, hacks on Mythtv and his home, and develops exhibit software for science museums. He eats very plain food—boring by even American standards.

Rebecca Mercuri on “The Black Swan and Information Security”

Dr. Mercuri is the lead forensic expert at Notable Software, Inc.

Her caseload has included matters from contraband, murder, viruses and malware, and election recounts (most notably Bush vs. Gore).  She has testified on the federal, state, and local level as well as to the U.K. Cabinet.

Talk abstract:
The economic theories proposed by Nassim Nicholas Taleb in his book “The Black Swan” have strong parallels in information security. Indeed, the concepts of robustness and risk assessment mentioned in Taleb’s writing are also well known to those who design software and systems intended to withstand attack. Such assaults on computers, networks and data are now so commonplace that if these threats all suddenly vanished, this would likely constitute a Black Swan Event.

But whether a successful and novel attack should also be considered a Black Swan may be debatable. This talk will compare the shortcomings of bell curve (Mediocristan) and power law (Extremistan) event models. The idea that outlier occurrences should be considered more “normal” will shed insight on new methods for recovery mitigation. Attendees need no formal knowledge of statistics or economics in order to appreciate the concepts discussed in this talk.

Register now and avoid the rush!   http://picconf.org   Space is limited!

We’re excited to announce our slate of speakers and world-class tutorials for 2012.

This 2-day conference starts on Friday with long-format tutorials on a wide variety of topics by world-class instructors: Topics include PowerShell, Puppet, Amazon Web Services, WordPress, DNSSEC, IPv6 and much, much more!  (Tutorial schedule: http://www.picconf.org/picc12-training-classes )

Saturday adds invited speakers on a wide variety of topics:

• Learn how Google does backups, how Etsy manages DevOps, and how  Mozilla has radically revamped their software release process.
• Windows users will love the talks on MS Small Business Server  and tutorials on PowerShell (requested back for a 2nd year).
• Linux users will love the talks about high performance computing, he Ganeti free virtualization project, and advanced monitoring techniques.
• DevOps will be impressed by speakers from “the big three” configuration management vendors: CFEngine, Chef, and Puppet.
• Cloud computing training from speakers with “from the trenches” experience.

Speaker list: http://www.picconf.org/picc-12-talkspapers

To register goto http://www.picconf.org/registration/#event

Interested in helping make PICC ’12 happen?

The committee is the most fun group of people I’ve planned a conference with. If you live within 500 miles of New Brunswick, NJ we’d love for you to help out.

Commitment is about an hour a week plus a short phone conference call every other Monday at 8pm.

Here’s some typical volunteer tasks: (we’ll ask you to pick one)

• Forward our mailings to user groups’ mailing lists (The hard part is making sure it actually went out!)
• Someone to maintain our Facebook/LinkedIn/Twitter presences.
• Invent new ways to get the word out about the conference.
• Take meeting minutes so the chair can focus on running the meetings.
• Email famous people (or semi-famous computer geeks) and ask them to submit talk proposals.
• Pick a potential sponsor, reach out to them about being a sponsor.
• Website updates (we have a website, we just need occasional edits)
• Coordinate the people reaching out to sponsors.
• Design flyers, posters, etc. (Photoshop or The Gimp experience?)
• Sysadmin-like things like website account management.

As you can see, none of these tasks are difficult but it takes a lot of people all doing a little bit to make a conference. (Kind of like how a bit open source project works)

I like working on PICC because of all the people I meet. That’s what makes it fun.

The Jan 16 meeting is our "Kick off" for the new year. It’s a really good time to get involved.

Interested? If you are, send email to volunteer@picconf.org

Thanks! Tom

This year’s Theme "System Administration: Scaling, Security, and Saving Money"

PICC ’12: 3rd Annual Professional IT Community Conference
May 11- 12, 2012
New Brunswick, NJ
Hyatt Regency New Brunswick
www.picconf.org/cfp

The organizers of the LOPSA-NJ Professional IT Community Conference (PICC) invite you to submit proposals for papers and talks to be presented at PICC ’12.
PICC12 is a gathering of professionals from the diverse IT (computer and network administration) community in New Jersey to learn, share ideas, and network. The conference includes invited speakers and keynotes, training by top-notch experts that is relevant, useful, and recession-friendly; plus an “unconference” track where attendees propose and host their own topics during the event. We expect attendance of 100 to 150 IT professionals from mid to large sized companies and academia from New Jersey/New York/Pennsylvania. We go by many titles but everyone is invited: system administrators, network administrators, network engineers, Windows, Linux, Unix, DBAs, etc

Presentation Topics
We strongly welcome topics on best practices, new developments in systems administration, and cutting edge techniques to better manage Linux, Unix, or Windows hosts and environments.
Papers should be of a technical nature and speakers should assume that members of the audience have at least a few years’ experience in general IT, Linux/Unix, and/or Windows administration.
The audience will primarily hail from businesses and academic institutions in the New Jersey/New York/Pennsylvania area.

The PICC Conference is the perfect balance of cost and convenience close to home and full of amazing insights and leaders of the system administration community. 

Topics range from vendor neutral best practices to the bleeding edge of computing, hitting all points in-between.

Discussion in the hallway track is lively and enlightening because of the rich diversity inherent to the system administration community.

Enjoy the included meals and meet new and interesting conference goers while you get face-to-face time with the experts and leaders of the community.

The complete program and registration form will be available here in February 2012.