] "Explicit Authorization. A user's authorities must only
] be provided to other actors as a result of an explicit
] user action that is understood to imply granting. "

Marking this for my own later reference.

Secure Interaction Design

] "Recent software upgrades to certain WatchGuard VPN
] appliances gives customers the ability to pair the
] machines so they share packet processing, and if one
] device fails the other can pick up the entire load."

Geez....Finally!

WatchGuard rolls out high-availability upgrade

] "Sun this week is scheduled to introduce a bundle of its
] server hardware with Check Point Software technology to
] create firewall/VPN appliances that, at the high end, are
] suitable for protecting data centers.
] Dubbed the Sun LX50 VPN-Firewall Appliance Secured by
] Check Point Software, the gear comes with either one or
] two processors to offer a range of throughput up to a 2G
] bit/sec firewall or 640M bit/sec VPN encryption, fast
] enough to filter and encrypt traffic in and out of
] corporate data centers. "

Sun, Check Point join forces

Analysis on number of systems still vulnerable to OpenSSL bug.

Many still vulnerable to OpenSSL bug

This isn't meme'ed yet. It needs to be.

One man's rant on how to fix poor development. A dry wit yields some tastey little chuckles.

The Peon's Guide To Secure System Development

Roll your own. Firewalls are going to be crushed in the next couple of years by robust opensource competition.

[Hijexx: Excellent work, wow... BSD licensed active/active with the IPSEC flexibility of a NetScreen or a PIX would *KILL* Check Point dead. Oh yeah, and we'd finally get CHAINS!!! :) ]

[Rek: Actually, it seems like dropped connections aren't a big connection. Most people will live with this as long as they can reconnect and everything is running. It only seems like certain kinds of usage (e.g. financial transactions) require full state failover. ]

High Availability OpenBSD pf Firewalls!

Good read on how a stateful filter works plus some pragmatic information about the general state of the space in open source.

Interview: Daniel Hartmeier - OpenBSD 'pf' (packet filter) developer

Prelude to future attacks?

Largest DDoS attack against the root nameservers to date

This article describes how your mail system can be exploited so as to provide a covert communications channel between an aggressor and their proxy in your midst. A channel whereby commands can be sent to your computer, and information returned from your computer, but you, the user are unable to see the traffic, albeit that such exchanges are happening as you use the computer quite normally.

Practical Covert Channel Attack Using MAPI

Type "Intrusion Response Procedure" into google and you're likely to get nothing. Just lots of references to "you should create an IRP, blah, blah, blah..." Well, I found a reasonable paper. Here it is.

Intrusion Response Paper with Substance