Ed Moyle Quotations

When you take into account the fact that a large enterprise might have tens of thousands or hundreds of thousands of machines, the job of securing those machines is very difficult and keeping them secure over time is even more difficult still.

Worry in a CIO reflects uncertainty in the management process.

Make diversity too small and you increase the impact of population-level events, make it too diverse and you can reduce manageability and thereby make individual-level events more likely. Heterogeneity has to be balanced with manageability for the organization's maximum benefit.

Since all ICANN decisions are subject to approval by the U.S. Department of Commerce, President Bush can ultimately decide whether or not to allow that change to proceed. No other country has that level of voice in the process.

Getting the threat of breach entirely to zero is effectively impossible, even in relatively small enterprises. And the closer we aim toward zero, the more expensive and time-consuming it becomes.

If the U.N. intends to softly encourage the transition to IPv6 via policy -- or merely wishes to coordinate or 'track' the deployment of IPv6 over time -- the impact will likely be minimal, ... But if they are going to take a stronger approach -- which they could theoretically do with the new authority -- the impact would once again be tremendous.

If the trends continue, I think it is likely that game platforms will become a more attractive target for attack in the future. Looking far enough ahead, game platforms might ultimately become an even more attractive target than general purpose PCs.

Mass-mailing worms will often leverage issues in Office as part of their method of propagation. As such, I strongly advise that these patches be installed as soon as possible -- particularly within the enterprise where the e-mailing of Office documents is more commonplace and expected.

It allows virus-checking software in an e-mail to filter on that extension and to search files coming in with that extension more carefully, or to exclude them altogether on a content filtering gateway while allowing the majority of the office docs to pass through without hindrance. My only concern is making a smooth transition to the new format.

Even if IM isn't used directly for business purposes, a number of organizations still find it beneficial to provide a standardized IM channel. When IM was emerging, many enterprises attempted to restrict IM use, but found there were administrative advantages to offering a sanctioned and standardized IM portal.

There's no fundamental difference between using QuickBooks to embezzle funds and using a ledger to embezzle funds, ... The technology just changes how the fraud is accomplished and maybe who commits it; it doesn't change why it's committed. As long as there are criminals, they will find a way to use the existing mechanisms to their advantage.

Rather than setting a universally high security bar across all systems in the enterprise, an enterprise might segregate systems into different 'zones,'

As a technologist, I'm not convinced that the U.N. is necessarily better equipped to deal with these issues than any number of other possible oversight bodies, including the U.S. Department of Commerce.

There's also usually a black hat contingent at most mainstream security conferences. Since information security and hacking are two sides of the same coin, many hackers go to security conferences and many security professionals go to hacker events -- neither community seems to mind.

The best security organizations I've worked with understand and attempt to quantify the risk-management decisions they make on an ongoing basis.

In general, black hats learn their tricks the same way that everybody else does: through a network of informational Web sites, magazines, conventions and advice from peers. There's even hacker radio.

I'm cautious about taking a functioning known quantity and turning it into something else -- at least without a full understanding of what the ultimate goal is.

IPv6 is certainly no 'instant on' -- it's a long hard road to get it done.

By using data from their threat-tracking efforts, the CIO can demonstrate how I.T. investment impacted the bottom line in terms of cost savings.

By doing all these things, ... the enterprise will know how to respond to a threat in ways that minimize downtime and keep digital assets secure, even in a world where threats are almost guaranteed.

This helps to explain why trying to prevent the possibility of security breaches entirely is a losing battle.

The enterprise is starting to recognize that IM is here to stay and that it needs to be secured along with other technologies like HTTP and e-mail. As enterprises realize this, they are interested in protecting that technology with products from the vendors they are already using.

The idea sounds good because a lot of viruses have used the macro capability of Office for propagation purposes and that's a huge problem, ... Having a new extension for this will allow the virus-checking software on e-mail gateways to filter on that particular extension, either to search files coming in with that extension more carefully, or to exclude them altogether.