Where Are The Posts About The Websense Outage?

For those who don't know, Websense is filtering software that companies and Universities use to monitor and control Internet access on their networks.  Yesterday morning Websense sent out an update to their software that essentially broke it, plunging hundreds of their customers into Internet darkness...

At my company, we noticed the outage about 3 minutes after the update occurred; we identified Websense as the cause about 10 minutes afterwards, and we had a fix in place within the hour, however we had company-wide Internet access problems for a total an hour and 15 minutes.  Websense sent a fix for the problem about 5 hours after it started, I can only assume that most of their customers had at least a couple of hours of downtime/problems.  So why aren't there any news posts about this?

According to Gartner, Websense is an industry leader in the field of Internet filtering.  With all the companies that were impacted by yesterday's outage, why is there no media coverage of this incredible SNAFU?  During the initial phase of the outage, the only evidence of this being a widespread problem that I could initially find was on social media, and I had to do hashtag searches to find them!

There is a post on the Internet Storm Center that references this issue... so it's not like people aren't aware that it happened.  Why isn't there more talk about this in the media?  You'd think that this outage would raise all kinds of questions from "How could it happen if Websense has proper QA?" to "Should Internet filtering be designed with a 'kill switch' so that downtime can be minimized?" I'm very surprised that there isn't more discussion of this issue today.

We have now implemented a spare web proxy that can be spun up and placed into production in minutes should an issue like this occur again.  We've also set up monitoring of the Websense gateway so we will be alerted should the symptoms of this type of problem show up in the future.  An open discussion of issues like this, along with coverage in the media, will only improve systems and allow people to prepare for future issues.  Hopefully posts like this one will lead to a broader discussion of this outage and the implications it has for Websense's customers.

Cringely vs. Qualcomm

I just wanted to make a brief post to share this article on I, Cringely.  For those of you who are fans of the "Triumph of the Nerds" series (like me), you will be familiar with Robert Cringely as a journalist who has been covering technology for decades.  What you may not know is that the Cringelys lost their infant son to SIDS in 2002.

Robert spent 4 years working to develop a device that could help prevent SIDS, and that device is at the center of his beef with Qualcomm.

Java - No Longer Safe?

On Friday serious vulnerabilities in the Java platform were disclosed.  Oracle has released Java 7 update 10 in an attempt to address this problem, however many experts are saying that it may take months or even years to address the problems in the Java platform.  So what's the average user got to do to protect their computer?

Generally speaking, keeping your software up to date, running good anti-virus software, and doing a monthly ad-ware scan with AdAware or Spybot is enough to keep you feeling relatively secure.  However Java is a platform that works across operating systems and different hardware, and therefore it's a juicy target for anyone looking to steal personal information, compromise a computer, or set up a "bot-net".

As a result many experts are recommending that Java be disabled as a precaution.  Yet the ubiquitous nature of Java could mean that disabling it isn't feasible, or at least would be an inconvenience, for most users.  So are the "experts" overreacting, or is this something that needs to be taken seriously?  How does the average user address this threat?

The answer is likely different for everyone.  The question that you have to ask yourself is "Which is more inconvenient to me; completely disabling Java and only enabling it when I must, or having my system compromised and having to rebuild and restore from backups?"  Also you may look at the sites you frequent and determine if any of them use Java, if they don't, then you're probably better off disabling it.  If many of them do, then you may want to set up a separate browser with Java disabled for your general browsing, and have another browser with Java enabled that you use to access trusted sites that require Java.  (Details on how to do this can be found here.)

As always, my advice is to err on the side of caution.  It's always safer to only have the bare minimum of software running on your computer... making your system as small a target as possible for any potential attackers.  Sure it may be a hassle to have to enable Java when you visit sites that require it, however it is a small price to pay when compared to the cleanup that is required should your information or computer be compromised.

CNET - The End of an Era?

It's been a while since I wrote a post... I've been extremely busy and honestly just haven't had the time.  However the dismay I've been feeling in the wake of the scandal at CNET this week has motivated me to post something.

There's no question that CBS was unethical in its request that CNET make a change to its awards based on current litigation between the would-be winner (Dish TV's "Hopper") and CBS.  It's also easy to understand that the editors were in an untenable position.  However I believe that there were certainly options and avenues available by which CNET could have saved its journalistic integrity.

I used to be a big fan of CNET, and a big part of that was that I trusted their product reviews.  When a large part of a company's worth is tied up in a reputation of impartial reporting, a scandal like this does incredible and irreparable damage to the brand.

I was, and am, a great fan of Greg Sandoval's reporting, and I am certain that he will land on his feet, with his ethics (and reputation) unscathed.  Would that Lindsay Turrentine had shown the same resolve and refused to cave to a request that, if it doesn't destroy CNET altogether, I am certain will tarnish its reputation for a long, long time.

I'm saddened that I'll no longer be able to turn to CNET for product research and recommendations... yet I'm hopeful that those who leave the organization in the wake of this scandal will take their outstanding sense of justice and impartiality to other media outlets, possibly changing them for the better.  So Greg, here's to you... may your vision of journalists as "truth tellers" spread far and wide!

A Disturbing Practice

I've recently received several phone calls from a company that claims my computer has contacted them via the Internet and that it has a "problem".  I've had some clients receive the same call, and even my parents have been harassed by these people.  If you actually engage them in conversation, they will do everything they can to try and get you to run commands on your computer.  I've even actually taken the time to go through the entire script with one of these callers, and if you follow their advice they will actually install and then sell you software that makes your computer more vulnerable to attack.

Something that everyone should know about their computer is that there's no mainstream anti-virus/anti-malware/operating system etc... that "phones home" when it has a problem, so if you receive a call from anyone claiming that your computer has reported anything to them, this is immediately suspect.

Secondly, if you maintain your computer and follow the tips for safe computing (running anti-virus software, running anti-malware/adware software, keeping your system patched, running a firewall, using good wireless security, having a system password, etc.) you greatly minimize the potential for any infection or compromise of your system.

The "bad guys" out there know this, and they know that users are getting more savvy, so they have to figure out new ways to get their hands on your data and/or compromise your system for their zombie army.  If anyone ever asks you to go to a website and download anything, unless you know and trust them, I'd do my research first and make sure that they have your best interests in mind... nowadays it seems that threats to your system come not only via email and the Internet, they can come over your telephone!