BalaBit blog

GUARDING YOUR BUSINESS

Archive for November, 2011


Joint Solution Controls Privileged User Activity with Movie-Like Playback and Free-Text Searches of Audit Trail Content

New York/Los Angeles – November 29, 2011 – BalaBit IT Security, one of the global leaders in privileged activity monitoring, trusted logging and proxy-based gateway technologies, and Lieberman Software Corporation, developers of the first fully automated privileged identity management solution, today announced a strategic alliance that integrates BalaBit’s Shell Control Box (SCB) with Lieberman Software’s Enterprise Random Password Manager™ (ERPM). The integration provides fine-grained control of user activity during privileged access.

“Controlling who can access powerful privileged accounts and tracking the actions taken by users with privileged access are both crucial elements of a secure and compliant enterprise,” said Philip Lieberman, president and CEO of Lieberman Software. “The partnership between Lieberman Software and BalaBit allows our mutual customers to answer the question of ‘who did what and when’ in the IT infrastructure with details that can be provided to regulatory compliance auditors.”

“BalaBit created a new product category when it announced the very first activity monitoring solution in 2006, and today we are one of the technology leaders in this niche market,” said Zoltán Györkő, Business Development Director at BalaBit IT Security. “Our latest Shell Control Box 3 F2, together with Lieberman Software’s industry-leading Enterprise Random Password Management, provides best-of-breed technologies in both product categories, without compromising on either. With this joint solution companies can meet regulatory compliance requirements more easily than with any other monitoring and control solution.”

SCB is an activity monitoring appliance that controls access to remote servers, virtual desktops and networking devices, and records the activities of the users accessing those systems. It can produce indexed movie-like records and audit trails of actions performed with privileged access for fast and cost-effective IT forensics.

ERPM automatically locates every privileged account in the enterprise, frequently changes each account’s password to a unique and complex value, and deploys the password changes wherever they are used in the data center. It provides the accountability of showing precisely who on the IT staff had access to sensitive data, at what time and for what stated purpose.

The ERPM-SCB integration protects the confidentiality of privileged account passwords by preventing their sharing and reuse. When integrated, these products provide centralized, automatic management of privileged account passwords, fine-grained access control of privileged accounts, and independent monitoring of each privileged access with customizable reporting capabilities.

ERPM and SCB work together without changing server and client resources and without limiting the way that IT staff normally performs daily tasks. Users are authenticated by SCB and credentials for accessing systems are retrieved transparently through ERPM.

Key benefits of the Lieberman Software – BalaBit IT Security integration:
•    Simplified password management and improved access control on remote servers
•    Sharing of privileged user passwords for server administration is eliminated
•    More secure access without changing how users perform their everyday work
•    Users can utilize special capabilities (like file-transfer, remote printing, etc.) of remote access protocols such as RDP, SSH and others if authorized
•    Central automatic management of passwords, fine-grained access control and independent audit-proof access monitoring with customizable reports

Supporting Resources
•    Figure: Secure authentication with BalaBit’s SCB and Lieberman’s ERPM
•    More information about Shell Control Box and Enterprise Random Password Management integration
•    What is BalaBit’s Shell Control Box good for? – video
•    About BalaBit’s Shell Control Box 3 F2 Administrator Guide
•    About Lieberman’s Enterprise Password Management

About Lieberman Software Corporation
Lieberman Software provides privileged identity management and security management solutions to more than 1000 customers worldwide, including 40 percent of the Fortune 50. By automatically discovering and managing privileged accounts everywhere on the network, Lieberman Software helps secure access to sensitive systems and data, thereby reducing internal and external security vulnerabilities, improving IT productivity and helping ensure regulatory compliance. The company developed the first solution for the privileged identity management space, and its products continue to lead this market in features and functionality. Lieberman Software is headquartered in Los Angeles, CA with an office in Austin, TX and channel partners throughout the world. For more information, visit www.liebsoft.com.

About BalaBit
BalaBit IT Security is an innovative information security company, one of the global leaders in developing privileged activity monitoring, trusted logging and proxy-based gateway technologies to help customers be protected against insider and outsider threats and meet security and compliance regulations. As an active member of the open source community, we provide solutions to a uniquely wide range of both open source and proprietary platforms, even for the most complex and heterogeneous IT systems across physical, virtual and cloud environments.
BalaBit is also known as “the syslog-ng company”, based on the company’s flagship product, the open source log server application, which is used by more than 650 000 companies worldwide and became the globally acknowledged de-facto industry standard.
BalaBit, the second fastest-growing IT Security company in the Central European region concerning Deloitte Technology Fast 50 list (2010), has local offices in France, Germany, Italy, Russia, and in the USA, and cooperates with partners worldwide. Our R&D and global support centers are located in Hungary, Europe.
For more information, visit www.balabit.com.

###
Product and company names herein may be trademarks of their registered owners.

For more information, please contact:

Andrea Ipolyi
PR manager
BalaBit IT Security
phone: +36 20 390 4139
e-mail: andrea.ipolyi@balabit.com
blog: http://andrea.blogs.balabit.com

Kevin Franks
Marketing Communications Manager
Lieberman Software Corporation
512-583-9762
www.liebsoft.com
www.identityweek.com
www.twitter.com/liebsoft
kfranks@liebsoft.com

Walter Caon
BalaBit USA
410 Park Avenue 15th Floor Suite 1500
New York, 10022
phone: +1 917 546 6715
e-mail: walterc@us.balabit.com

IOCCC vs Clean Code

Sunday, November 27, 2011 @ 10:11 PM Author: athos

I found this piece of code at the website of the International Obfuscated C Code Contest. (Did you know the contest is open for this year?) Since I read tons of books, papers and even videos about clean code nowadays, I couldn’t resist refactoring it, just to see how much a heavy code cleanup can improve a source code that was intentionally written to be obscrure as possible, and of course, to abuse both IOCCC and Clean Code as hard as can be. :-)

The original code

main(n,i,a,m){while(i=++n) for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;);}

To compile it using GCC, the following command can be used:

$ gcc -ansi -o makarios makarios.c

The only thing it does is slowly printing a bunch of numbers to stdout in an infinite loop. Note that this is pretty much all the information that can be extracted from the code at first blink, either by running it or by reading it.

Refactoring without tests is suicide

Before refactoring it, I needed to make it testable. Since this is a very simple program, I decided to test it end-to-end, by saving a reference output to a textfile (say, for example, the first 150 numbers it prints) and by breaking the infinite loop (of course it would terminate once n overflows, but that’s way too slow):

main(n,i,a,m){while(i=++n) #define STOP_AT 522233 main(n,i,a,m){while((i=++n) <= STOP_AT) for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;);}

Note that it prints numbers in octal base, and 522233 is the 150th number in the reference output in decimal base. It could’ve been written in octal, but in the end I’d like to get rid of this hard-coded constant, so it will do the job well for now. Let’s see if it still generates the expected output:

$ gcc -ansi -Wall -o ./makarios makarios.c && ./makarios 2>&1 | diff expected_output.txt - && echo OK

After each and every change, I ran the test and created a patch only if the test passed. (Find the individual patches at GitHub.)

Recovering structure

So do you have any idea how this code works? Me neither. But there are a couple of things to note:

  • Some indentation might come handy in the future.
  • Local variables are defined as arguments to main(), OMG!
  • The output depends on n (which will always be the number of command line arguments to the program), but all the other variables are overwritten sooner or later, before used. (a and i are trivial to see, and since i is always positive and a is 0, a<i will always be true in the beginning of the inner loop, so the positive branch of the ternary is executed first, which means m gets overwritten as well).
  • Easy to see by experiment, this program does not print numbers smaller than the number of command line arguments (note that the output is in octal base), so if one would want to see only numbers greater than eg. 64 (100 in octal base), the program should be invoked like this:
    ./makarios `seq 1 64`

    This is not very useful, so I decided to drop this feature. Variable n will start from 1, like when the program is invoked without arguments (making the first parameter of main() be 1).

  • There are a couple of compiler warnings, these are better cleaned up so we can see if we mess up something.

After a couple of minutes, my code looked like this:

#include <stdio.h> #define STOP_AT 522233 main(n,i,a,m){while((i=++n) <= STOP_AT) for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;);} int main(int argc, char* argv[]) {  int n = 1,  i, a, m;  while((i=++n) <= STOP_AT)  {  for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;)  {  }  }  return 0; }

Next I converted the for loop into a while loop and moved a and m inside the outer loop since they are not used outside of it:

#include <stdio.h> #define STOP_AT 522233 int main(int argc, char* argv[]) { int n = 1, i, a, m;  i; while((i=++n) <= STOP_AT) { for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;)  int a = 0,  m;  while (a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m) { } } return 0; } 

Now if that ugly expression in the condition of the loop would be inside the block, it could be easily broken up:

 int a = 0, m;  m, is_not_ready; while (a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m) } do {  is_not_ready = a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m; } while (is_not_ready); 

First, replace the ternary with an if statement:

do { is_not_ready = a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;  if (a < i)  {  is_not_ready = a=a*8+i%8,i/=8,m=a==i|a/8==i,1;  }  else  {  is_not_ready = (n-++m||printf("%on",n))&&n%m;  } } while (is_not_ready); 

Notice that I did not even try to understand the hows and whys. The only thing I did so far was to analyze the code, breaking up expressions, replacing them to more readable alternatives, but I have no ghost of an idea what this code does and why it does it so. Let’s continue the work by breaking up the assignment in the true branch of the if statement (from now on, a good cheat sheet of operator precedence will be a life saver):

if (a < i) { is_not_ready = a=a*8+i%8,i/=8,m=a==i|a/8==i,1; a = a*8 + i%8; i /= 8; m = (a == i) | (a/8 == i); is_not_ready = 1; } else { is_not_ready = (n-++m||printf("%on",n))&&n%m; } 

Notice the value assigned to m? Those are two booleans with a binary OR in the middle. That’s ugly, using a logical operator instead will change nothing:

m = (a == i) | (a/8 == i); m = (a == i) || (a/8 == i); 

Now breaking up the assignments inside the else block: printf() will always return non-zero making the expression inside parenthesis true, so is_not_ready depends only from n%m. Since it’s a boolean expression, I added a comparison to zero:

is_not_ready = (n-++m||printf("%on",n))&&n%m; (n-++m||printf("%on",n)); is_not_ready = 0 != n%m; 

Due to lazy evaluation, printf() is only executed when n-++m equals to zero. To make that expressed in code, an if statement can be used instead of the ignored boolean expression:

(n-++m||printf("%on",n)); if (0 == n-++m)  printf("%on", n); is_not_ready = 0 != n%m;

To make the condition more readable:

if (0 == n-++m) if (++m == n) printf("%on", n); 

So far, so good:

 #include <stdio.h> #define STOP_AT 522233 int main(int argc, char* argv[]) { int n = 1, i; while((i=++n) <= STOP_AT) { int a = 0, m, is_not_ready; do { if (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); is_not_ready = 1; } else { if (++m == n) printf("%on", n); is_not_ready = 0 != n%m; } } while (is_not_ready); } return 0; } 

This is kinda readable, isn’t it? No! This is not much better than it was in its 105 bytes size.

Let’s do some Command-query separation here by extracting state-changing operations from conditionals.

if (++m == n) ++m; if (m == n) printf("%on", n); 

Pretty straightforward. Now ++n and the assignment to i require slightly more work:

int main(int argc, char* argv[]) { int n = 1, i;  int n = 2; while((i=++n) <= STOP_AT)  while(n <= STOP_AT) { int a = 0,  i = n, m, is_not_ready; do { if (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); is_not_ready = 1; } else { ++m; if (m == n) printf("%on", n); is_not_ready = 0 != n%m; } } while (is_not_ready);  ++n; } return 0; }

Actually the outer loop can be written shorter as a for loop:

int main(int argc, char* argv[]) { int n = 2;  int n; while(n <= STOP_AT)  for (n = 2; n <= STOP_AT; ++n) { int a = 0, i = n, m, is_not_ready; do { if (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); is_not_ready = 1; } else { ++m; if (m == n) printf("%on", n); is_not_ready = 0 != n%m; } } while (is_not_ready); ++n; } return 0; }

Now we can get rid of is_not_ready, it was just a temporary helper to break up some magical expressions:

 for (n = 2; n <= STOP_AT; ++n) { int a = 0, i = n, m, is_not_ready;  m; do { if (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); is_not_ready = 1; } else { ++m; if (m == n) printf("%on", n); is_not_ready = 0 != n%m;  if (0 == n%m)  break; } } while (is_not_ready);  } while (1); }

For an infinite loop, it does not make much difference if it’s a post-test or a pre-test:

do while (1) { if (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); } else { ++m; if (m == n) printf("%on", n); if (0 == n%m) break; } } while (1); }

If you look at carefully, that’s two inner loops for the price of one:

  • Variable a is starting from 0 and is compared to i which is always positive. This implies that in every iteration of the outer loop the positive branch of the if statement is executed first.
  • The negative branch of the if statement changes neither variables read by the positive branch, nor those used in the condition.
  • In other words, once the negative branch is executed during an iteration of the outer loop, the positive one is never executed again in that iteration.
  • These together imply that in every iteration of the outer loop, the positive branch of the if statement is executed some times, then the negative branch, which finally exits from the inner loop. I.e. during execution, practically there are two separate loops.
  • Separating them in code as well makes understanding the behavior of the program easier.
while (1) { if (a < i) while (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); } else while (1) { ++m; if (m == n) printf("%on", n); if (0 == n%m) break; } } 

Now the last compiler warning can be easily eliminated once we notice that m is not used inside the first inner loop, but it’s always overwritten before evaluating the loop condition again, which means it can be extracted to be after the loop (knowing that for every possible values of i and a the loop iterates at least one, so m is never uninitialized before the second inner loop).

while (a < i) { a = a*8 + i%8; i /= 8; m = (a == i) || (a/8 == i); } m = (a == i) || (a/8 == i); 

Now let’s take care of the second inner loop! Reverting back to a post-test loop (getting rid of always true conditional):

while (1) do { ++m; if (m == n) printf("%on", n);  if (0 == n%m) break; } } while (0 != n%m); 

Notice that conditional printing can be extracted because the loop will either exit before the condition of printing could become true or increment m until it reaches n, but when the latter happens, the loop will break anyways.

do { ++m; if (m == n) printf("%on", n); } while (0 != n%m); if (m == n)  printf("%on", n); 

Now m is used in two roles: sometimes it holds a boolean value, sometimes it’s used in arithmetical expressions. This violates Single Responsibility Principle, so let’s get rid of one of the roles. Notice that when m is 0, the do-while loop will iterate only once, and then no printing will happen since n is always greater than 1 and m will be equal to 1, and 1 is a divisor of any n. Which means we can skip the do-while loop when the magical expression after the first inner loop is false, and start m from 1 when it’s not:

m = (a == i) || (a/8 == i); if (!((a == i) || (a/8 == i)))  continue; m = 1; 

There’s one more tiny thing disturbing me: I don’t really like post-test loops when they’re used unnecessarily, so let’s get rid of this one:

m = 1; do m = 2; while (0 != n%m) { ++m; } while (0 != n%m); } 

The code so far:

#include <stdio.h> #define STOP_AT 522233 int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { int a = 0, i = n, m; while (a < i) { a = a*8 + i%8; i /= 8; } if (!((a == i) || (a/8 == i))) continue; m = 2; while (0 != n%m) { ++m; } if (m == n) printf("%on", n); } return 0; }

Cleaning the code

Now that’s clean, isn’t it? Of course not! For instance, nothing in it has a nice, explanatory name. It’s just a messy mix of one-letter variables, magical expressions and a spaghetty of loops.

Notice that m is only used in the second half of the outer loop starting from the assignment and ending at the conditional of the if statement. If those lines would be in a separate function, m could be a local variable and n would be a parameter. Similar can be done for the first part starting from the declaration of a and i and ending at the first if statement. Note that the two loops have no variables in common, but both can be parametrized by n. Let’s move those loops into functions in the hope they will be easier to understand without their disturbing contexts:

#include <stdio.h> #define STOP_AT 522233 static int magic_algorithm(int number); static int other_magic_algorithm(int number); static void print_octal(int number); int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { int a = 0, i = n, m; while (a < i) { a = a*8 + i%8; i /= 8; } if (!((a == i) || (a/8 == i)))  if (!magic_algorithm(n)) continue; m = 2; while (0 != n%m) { ++m; } if (m == n) printf("%on", n);  if (other_magic_algorithm(n))  print_octal(n); } return 0; } static int magic_algorithm(int number) {  int a = 0,  i = number;  while (a < i)  {  a = a*8 + i%8;  i /= 8;  }  return (a == i) || (a/8 == i); } static int other_magic_algorithm(int number) {  int m;  m = 2;  while (0 != number%m)  {  ++m;  }  return m == number; } static void print_octal(int number) {  printf("%on", number); }

That printf() with the format string are ugly implementation details that shoul be buried inside a small, well named function somewhere at the bottom.

The first loop is called magic_algorithm() and the second is other_magic_algorithm() from now. I’m sure they could be given more rational names, but coming up with better names would require understanding the code, which I don’t want to do without making it obvious at the same time, so let’s continue refactoring.

The easiest thing to do is simplifying main() by joining the two if statements:

for (n = 2; n <= STOP_AT; ++n) { if (!magic_algorithm(n)) continue;  if (other_magic_algorithm(n))  if (magic_algorithm(n) && other_magic_algorithm(n)) print_octal(n); }

Now main() is pretty obvious to understand: it prints numbers that are accepted by both of our magic algorithms in octal format. The question is, what and how do these magic algorithms do?

The second is simplier: by extracting the condition of the while loop into a well named function, it becomes almost obvious:

static int is_divisable(int dividend, int divisor); static int other_magic_algorithm(int number) { int m; m = 2; while (0 != number%m)  while (!is_divisable(number, m)) { ++m; } return m == number; } static int is_divisable(int dividend, int divisor) {  /* FIXME: handle division by zero */  return 0 == dividend % divisor; } 

Note that there’s a reason this function is static: it’s not reusable, becuase it does not handle unexpected input, that’s why a FIXME comment is added. Now let’s focus on refactoring.

After extracting is_divisable(), the role of m becomes clear, so let’s find a good name for it:

static int other_magic_algorithm(int number) { int m;  int smallest_divisor = 2; m = 2; while (!is_divisable(number, m))  while (!is_divisable(number, smallest_divisor)) { ++m;  ++smallest_divisor; } return m == number;  return smallest_divisor == number; }

What do you call a number that equals to its smallest divisor greater than 1?

#include <stdio.h> #define STOP_AT 522233 static int magic_algorithm(int number); static int other_magic_algorithm(int number); static int is_prime(int number); static void print_octal(int number); int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { if (magic_algorithm(n) && other_magic_algorithm(n))  if (magic_algorithm(n) && is_prime(n)) print_octal(n); } return 0; } static int is_divisable(int dividend, int divisor); static int other_magic_algorithm(int number) is_prime(int number) { int smallest_divisor = 2; while (!is_divisable(number, smallest_divisor)) { ++smallest_divisor; } return smallest_divisor == number; } 

Do you see Single Responsibility Principle being violated? I do:

static int is_divisable(int dividend, int divisor); static int find_smallest_divisor_greater_than_one(int number); static int is_prime(int number) {  /* FIXME: handle 0 and 1 */  return find_smallest_divisor_greater_than_one(number) == number; } static int is_divisable(int dividend, int divisor); static int find_smallest_divisor_greater_than_one(int number) {  /* FIXME: handle negative numbers */ int smallest_divisor = 2; while (!is_divisable(number, smallest_divisor)) { ++smallest_divisor; } return smallest_divisor == number;  return smallest_divisor; }

Finding the smallest divisor and deciding if a number is prime are at different abstraction levels. Besides, it was never mentioned in the code that 1 is not considered a divisor.

Don’t worry about function call overhead, the first thing compilers will do when encountering this code will be to make is_divisable() and find_smallest_divisor_greater_than_one() inline. Then why did we extract them? Because this code is being written for humans, not compilers!

Now to the other magic function.

What is 42 % 10? It’s 2 of course. What is X % 10? Yes, it’s the last digit of X in base 10. Now replace 10 with 8, and you’re doing the same in octal base. This may help a lot to understand what to extract from the other magic algorithm and how to name the functions extracted:

static int get_last_octal_digit(int number); static int remove_last_octal_digit(int number); static int magic_algorithm(int number) { int a = 0, i = number;  i = number,  digit; while (a < i) { a = a*8 + i%8; i /= 8;  digit = get_last_octal_digit(i);  a = a*8 + digit;  i = remove_last_octal_digit(i); } return (a == i) || (a/8 == i);  return (a == i) || (remove_last_octal_digit(a) == i); } static int get_last_octal_digit(int number) {  return number % 8; } static int remove_last_octal_digit(int number) {  return number / 8; }

This starts to make sense, so let’s continue with this octal digit theory:

 static int get_last_octal_digit(int number); static int append_octal_digit(int number, int digit); static int remove_last_octal_digit(int number); static int magic_algorithm(int number) { int a = 0, i = number, digit; while (a < i) { digit = get_last_octal_digit(i); a = a*8 + digit;  a = append_octal_digit(a, digit); i = remove_last_octal_digit(i); } return (a == i) || (remove_last_octal_digit(a) == i); } static int get_last_octal_digit(int number) { return number % 8; } static int append_octal_digit(int number, int digit) {  /* FIXME: handle invalid digits */  return number * 8 + digit; } static int remove_last_octal_digit(int number) { return number / 8; }

(Sorry, that’s another FIXME added.)

Now the roles of those variables are getting clearer: in every iteration, a digit is removed from the end of i and is appended to the end of a. This will make a contain the digits of the given number in reversed order, though the algorithm is stopped when reaching the digit in the middle.

static int get_last_octal_digit(int number); static int append_octal_digit(int number, int digit); static int remove_last_octal_digit(int number); static int magic_algorithm(int number) { int a = 0, i = number, digit;  int reversed_digits = 0,  remaining_digits = number; while (a < i)  while (reversed_digits < remaining_digits) { digit = get_last_octal_digit(i); a = append_octal_digit(a, digit); i = remove_last_octal_digit(i);  int digit = get_last_octal_digit(remaining_digits);  reversed_digits = append_octal_digit(reversed_digits, digit);  remaining_digits = remove_last_octal_digit(remaining_digits); } return (a == i) || (remove_last_octal_digit(a) == i);  return (reversed_digits == remaining_digits)  || (remove_last_octal_digit(reversed_digits) == remaining_digits); } 

When the digits of a number in a base remain the same when the order is reversed, then the number is called palindromic in that base. This algorithm is a test for the octal base. Note that the algorithm stops moving the digits when it reaches the one in the middle. That’s why the expression in the return statement is built from two parts: one is for an odd number of digits, the other is for the even case. This is enough to rename magic_algorithm() (oops, I noticed a new FIXME again):

#include <stdio.h> #define STOP_AT 522233 static int magic_algorithm(int number); static int is_palindromic_in_octal_base(int number); static int is_prime(int number); static void print_octal(int number); int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { if (magic_algorithm(n) && is_prime(n))  if (is_palindromic_in_octal_base(n) && is_prime(n)) print_octal(n); } return 0; } static int get_last_octal_digit(int number); static int append_octal_digit(int number, int digit); static int remove_last_octal_digit(int number); static int magic_algorithm(int number) is_palindromic_in_octal_base(int number) {  /* FIXME: handle negative numbers */ int reversed_digits = 0, remaining_digits = number; while (reversed_digits < remaining_digits) { int digit = get_last_octal_digit(remaining_digits); reversed_digits = append_octal_digit(reversed_digits, digit); remaining_digits = remove_last_octal_digit(remaining_digits); } return (reversed_digits == remaining_digits) || (remove_last_octal_digit(reversed_digits) == remaining_digits); } static int get_last_octal_digit(int number) { return number % 8; } static int append_octal_digit(int number, int digit) { /* FIXME: handle invalid digits */ return number * 8 + digit; } static int remove_last_octal_digit(int number) { return number / 8; }

Now the while loop could be extracted from is_palindromic_in_octal_base() (remember SRP?), but that would require:

  • output parameters: ugly
  • iterating through the whole number to calculate reversed order to the end: might be slow, notice that the original author might have done it this way to save half of the steps
  • structs and pointers: overkill
  • macro magic: can be confusing

In short: the code is not clean, but we cannot refactor it better. Let’s admit this failure by adding some explanatory comments to this function:

static int is_palindromic_in_octal_base(int number) { /* FIXME: handle negative numbers */ int reversed_digits = 0, remaining_digits = number;  /* NOTE: The loop will stop when the digit in the middle is reached. */ while (reversed_digits < remaining_digits) { int digit = get_last_octal_digit(remaining_digits); reversed_digits = append_octal_digit(reversed_digits, digit); remaining_digits = remove_last_octal_digit(remaining_digits); }  /* NOTE: For an odd number of digits, reversed_digits contains  an extra digit (coming from the middle). */ return (reversed_digits == remaining_digits) || (remove_last_octal_digit(reversed_digits) == remaining_digits); }

After these steps, I realized the need for a Makefile so I could extract reusable code to new compilation units (in addition, I created some quick and dirty unit tests which you can find at GitHub):

lib/primes.h:

#ifndef _PRIMES_H #define _PRIMES_H int is_prime(int number); #endif 

lib/primes.c:

#include "primes.h" static int find_smallest_divisor_greater_than_one(int number); int is_prime(int number) { /* FIXME: handle 0 and 1 */ return find_smallest_divisor_greater_than_one(number) == number; } static int is_divisable(int dividend, int divisor); static int find_smallest_divisor_greater_than_one(int number) { /* FIXME: handle negative numbers */ int smallest_divisor = 2; while (!is_divisable(number, smallest_divisor)) { ++smallest_divisor; } return smallest_divisor; } static int is_divisable(int dividend, int divisor) { /* FIXME: handle division by zero */ return 0 == dividend % divisor; }

lib/palindromes.h:

#ifndef _PALINDROMES_H #define _PALINDROMES_H int is_palindromic_in_octal_base(int number); #endif 

lib/palindromes.c:

#include "palindromes.h" static int get_last_octal_digit(int number); static int append_octal_digit(int number, int digit); static int remove_last_octal_digit(int number); int is_palindromic_in_octal_base(int number) { /* FIXME: handle negative numbers */ int reversed_digits = 0, remaining_digits = number; /* NOTE: The loop will stop when the digit in the middle is reached. */ while (reversed_digits < remaining_digits) { int digit = get_last_octal_digit(remaining_digits); reversed_digits = append_octal_digit(reversed_digits, digit); remaining_digits = remove_last_octal_digit(remaining_digits); } /* NOTE: For an odd number of digits, reversed_digits contains an extra digit (coming from the middle). */ return (reversed_digits == remaining_digits) || (remove_last_octal_digit(reversed_digits) == remaining_digits); } static int get_last_octal_digit(int number) { return number % 8; } static int append_octal_digit(int number, int digit) { /* FIXME: handle invalid digits */ return number * 8 + digit; } static int remove_last_octal_digit(int number) { return number / 8; } 

Reviewing primes.c, it’s obvious it could perform better, but premature optimization is the root of all evil, so let’s just add a comment for now:

static int find_smallest_divisor_greater_than_one(int number) { /* FIXME: handle negative numbers */  /* OPTIMIZATION FIXME: The smallest divisor is always less than  the square root of the number. */ int smallest_divisor = 2; while (!is_divisable(number, smallest_divisor)) { ++smallest_divisor; } return smallest_divisor; }

The most interesting part of the refactoring process ends here.

After the above, I removed all the FIXME comments one by one. Some of them were bad idea, others got converted to unit tests. All of them were easy to fix by adding some parameter checks to various functions.

Next I generalized palindromes.c to work with other bases than octal, then I created a function named find_octal_palindromic_prime_bigger_than(int number), so I could write this:

void print_first_150_octal_palindromic_primes() { int n = 0, i; for (i = 0; i != 150; ++i) { n = find_octal_palindromic_prime_bigger_than(n); print_octal(n); } }

Of course, main() is pretty understandable now:

int main(int argc, char* argv[]) { print_first_150_octal_palindromic_primes(); return 0; }

The details are not very entertaining, though you can find individual commits at GitHub.

Performance

I changed both the refactored and the original version to print all the numbers 10 times. Here are the results (ran on my eeePC, compiled to 64 bit with GCC using -O3):

Obfuscated version: real 0m15.230s user 0m15.180s sys 0m0.010s Clean version: real 0m15.401s user 0m15.130s sys 0m0.040s

The clean version is slightly slower than the original. Sad. But luckily we have a couple of unit tests so we can change the way calculations are done anytime we want, and we already have a good guess on what can be slow: testing each and every number as divisor in primes.c!

After rewriting is_prime() to test only odd numbers and to stop when reaching the square root of the given number, the refactored version gets nearly 14 times faster than the original! The results for 40 iterations of 150 numbers on the same machine:

Obfuscated version: real 0m59.723s user 0m59.610s sys 0m0.000s Clean version: real 0m4.432s user 0m4.410s sys 0m0.000s

Maybe it could be improved further if it didn’t test numbers whether they are palindromic or not, but it generated palindromic numbers at the first place instead.

How much information did the cleanup give?

I mean literally.

That’s the question I wanted to answer when I began writing this post. Lucky we have some mathematical theory to apply here: entropy, ie. the expected value of information (measured in bits). Though Shannon’s entropy could easily be calculated for these files, I’ll be happy with an approximation. By compressing the complete source code (including unit tests but excluding the textfile containing expected output and performance tests) and looking at compressed sizes, theoretical entropy can be approximated well enough. I will compress the source code from four stages: the original, the structure recovered, the function extracted and the final version:

Original makarios.c (commit 0b966486f8)

main(n,i,a,m){while(i=++n) for(a=0;a<i?a=a*8+i%8,i/=8,m=a==i|a/8==i,1:(n-++m||printf("%on",n))&&n%m;);}

Somewhat readable makarios.c (commit bcf7f4046b)

#include <stdio.h> #define STOP_AT 522233 int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { int a = 0, i = n, m; while (a < i) { a = a*8 + i%8; i /= 8; } if (!((a == i) || (a/8 == i))) continue; m = 2; while (0 != n%m) { ++m; } if (m == n) printf("%on", n); } return 0; }

Function extracted makarios.c (commit 18b94d3210)

#include <stdio.h> #define STOP_AT 522233 static int is_palindromic_in_octal_base(int number); static int is_prime(int number); static void print_octal(int number); int main(int argc, char* argv[]) { int n; for (n = 2; n <= STOP_AT; ++n) { if (is_palindromic_in_octal_base(n) && is_prime(n)) print_octal(n); } return 0; } static int get_last_octal_digit(int number); static int append_octal_digit(int number, int digit); static int remove_last_octal_digit(int number); static int is_palindromic_in_octal_base(int number) { /* FIXME: handle negative numbers */ int reversed_digits = 0, remaining_digits = number; /* NOTE: The loop will stop when the digit in the middle is reached. */ while (reversed_digits < remaining_digits) { int digit = get_last_octal_digit(remaining_digits); reversed_digits = append_octal_digit(reversed_digits, digit); remaining_digits = remove_last_octal_digit(remaining_digits); } /* NOTE: For an odd number of digits, reversed_digits contains an extra digit (coming from the middle). */ return (reversed_digits == remaining_digits) || (remove_last_octal_digit(reversed_digits) == remaining_digits); } static int get_last_octal_digit(int number) { return number % 8; } static int append_octal_digit(int number, int digit) { /* FIXME: handle invalid digits */ return number * 8 + digit; } static int remove_last_octal_digit(int number) { return number / 8; } static int find_smallest_divisor_greater_than_one(int number); static int is_prime(int number) { /* FIXME: handle 0 and 1 */ return find_smallest_divisor_greater_than_one(number) == number; } static int is_divisable(int dividend, int divisor); static int find_smallest_divisor_greater_than_one(int number) { /* FIXME: handle negative numbers */ int smallest_divisor = 2; while (!is_divisable(number, smallest_divisor)) { ++smallest_divisor; } return smallest_divisor; } static int is_divisable(int dividend, int divisor) { /* FIXME: handle division by zero */ return 0 == dividend % divisor; } static void print_octal(int number) { printf("%on", number); }

Modularized version tarball (commit c6c01681e3)

lib/octal_palindromic_primes.c lib/octal_palindromic_primes.h lib/palindromes.c lib/palindromes.h lib/primes.c lib/primes.h makarios.c Makefile tests/test.h tests/test_octal_palindromic_primes.c tests/test_palindromes.c tests/test_primes.c

The amount of information in the source code from each stages:

  • Original: 128 bytes (note that the uncompressed C source is smaller, 105 bytes!)
  • After recovering structure: 265 bytes
  • After extracting functions: 689 bytes
  • After organizing into modules with unit tests: 2872 bytes

To summarize: the “compressed” version of the original code contains more information (the gzip header I guess) than the uncompressed file. That’s how you rule at IOCCC! Adding indentation and using the appropriate control structure for each task doubles the information in the code. Extracting some well named functions, adding some comments and naming variables well introduced 2.6 times more information into the source (6.5 times the original 105 bytes), and organizing everything into standalone units with standalone tests multiplied that amount by another 4.1. (That’s 27.3 times more than the original 105 bytes!)

How much work?

According to commit logs, I made visible progress during the following time intervals:

  • Nov 23 18:50:43 2011 – Nov 23 20:54:56 2011: ~2 hours
  • Nov 23 22:56:29 2011 – Nov 24 01:01:11 2011: ~2 hours (with some breaks)
  • Nov 24 23:04:42 2011 – Nov 25 02:09:22 2011: ~3 hours (with many breaks)
  • Nov 26 21:26:47 2011 – Nov 26 23:21:41 2011: ~2 hours

That’s 9 hours of work which includes writing more detailed commit messages than I usually do, taking notes for this blog post, and committing changes way more frequently than I usually do. Also consider that I’m not an experienced C developer, and to make that even worse, most of the work was done in the night, after getting home from real-life work.

Conclusion

I’m not going to suggest anything, since this was just a funny experiment and what’s more, I don’t even think this coding style matches with the C world. The numbers are interesting though.

As an advice, I can say only one thing: when you’re writing code, please think for a moment how long it will take others to understand it. If your code is not crystal clear just by reading through it (without the need for stopping to think for a millisecond, without scrolling back and forth taking notes etc.), then everytime others look at that code, you’re spending your co-worker’s time (thus your company’s money) on something you could’ve got for a one time prize, or even for free if you’d took that three seconds to extract that loop into a separate function or name that variable something better than a and m

syslog-ng Insider – November 2011

Wednesday, November 23, 2011 @ 06:11 PM Author: Zoltán Bagi

Dear syslog-ng users,

This is the 8th issue of the syslog-ng Insider, a monthly newsletter that brings you syslog-ng related news.
Your feedback and news tips about the next issue is welcome at
documentation(at)balabit.com

FEATURED NEWS

syslog-ng 3.3.2 is about to be released!

A new version of syslog-ng is about to be released! There are no new features to announce, but all problems reported since 3.3.1 should be fixed by now! To make it the best syslog-ng ever, please test it to make sure, that all your problems are fixed.

Sources are available in git or as a snapshot:

Binary packages are available are available for several Linux distributions:

syslog-ng and CEE

The latest syslog-ng release, version 3.3 can be used to implement part of the “CEE over syslog” standard. BalaBit’s patterndb technology was able to extract information from syslog messages already for a long time. With this release JSON output was added, meaning the extracted information can be output as JSON data. What it means in practice, that syslog-ng is able to parse log messages, and output the extracted fields in the form required by CEE.
To see, how it works, check http://czanik.blogs.balabit.com/2011/10/cee-and-syslog-ng/

Development of syslog-ng 3.4 started

While 3.3 was just released, development of 3.4 is already started. The first version of a JSON parser is already merged ( https://github.com/bazsi/syslog-ng-3.4/commit/e5569687bba2551c89a78faee55bcf8b4944066f ). There are some pending fixes and enhancements, which add boolean, array and nested JSON parsing ( https://github.com/algernon/syslog-ng/commits/feature/3.4/json/parser ). Value-pairs key rewrite is work in progress <!–( https://github.com/algernon/syslog-ng/commits/feature/3.4/value-pairs/rekey )–> and nested JSON output is also planned.
The above features among others help us to better support CEE. With key rewriting we could use a “.cee.” prefix in CEE related patterns and rewrite it later. It also makes parsing of messages possible.
All the current code is available for testing in Algernon’s 3.4 sandbox project: https://github.com/algernon/syslog-ng/tree/sandbox/3.4
To download it, use git:
$ git clone -b sandbox/3.4 git@github.com:algernon/syslog-ng

OTHER SHORT NEWS

NEW RELEASES

WHITE PAPERS

A longer paper about the “Future of logging tools”, which also provides some background information about HSRL, as used in syslog-ng.

It is available at http://andrea.blogs.balabit.com/files/2011/10/HSRL_backgrounder_english_final1.pdf

ARCHIVE

http://insider.blogs.balabit.com/

Nomios annonce la signature d’un accord de partenariat avec BalaBit IT Security

Thursday, November 17, 2011 @ 06:11 PM Author: Andrea Ipolyi

Avec ce nouveau partenariat, Nomios complète son offre de solutions de sécurité et d’optimisation des performances des systèmes d’information pour répondre aux besoins des grands comptes en matière de monitoring et de surveillance d’activité des utilisateurs

Paris, le 16 novembre 2011 – Nomios, société spécialisée dans la mise en place de solutions de sécurité et d’optimisation des performances des systèmes d’information, annonce la signature d’un accord de partenariat avec BalaBit IT Security, l’un des leaders dans le monitoring et la surveillance d’activité des utilisateurs privilégiés.

Nomios a observé chez ses clients un réel intérêt pour l’audit de configuration. Pour répondre à cette demande croissante, une étude sur le sujet a été réalisée par des ingénieurs de Nomios qui ont testé et évalué différents éditeurs présents sur le marché.

Ainsi, Nomios a retenu BalaBit IT Security et l’intégrateur propose désormais à ses clients le produit Shell Control Box.

L’objectif principal de Shell Control Box est de surveiller les actions effectuées par les administrateurs sur les équipements critiques du SI. Le résultat peut être fourni sous la forme d’une vidéo ou d’un fichier texte selon les besoins. On dispose donc d’un historique clair, précis et exhaustif. La solution supporte plusieurs modes de déploiement et s’adapte ainsi à la majorité des architectures réseau. Elle assure donc une double protection face aux menaces, qu’elles soient internes ou externes.

“En effet, il s’agit de la solution la plus complète de celles qui ont été testées. Grâce à ses différents modes de déploiement, BalaBit permet de répondre aux besoins de diverses architectures. Ses nombreuses options de configurations permettront aux administrateurs d’auditer les connexions de manière précise et de contrôler au mieux leurs parcs d’équipements. Enfin, son management web est très complet et très intuitif. C’est sans aucun doute un produit à suivre et les évolutions à venir rendront la solution encore plus attractive” confie Arnaud Cassagne, directeur technique de Nomios.

Shell Control Box est complémentaire avec d’autres solutions proposées par Nomios telles que Splunk ou Q1 Labs. Nomios garantit ainsi à ses clients le respect des normes en vigueur, qu’elles soient environnementales, industrielles ou sécuritaires. En effet, ces solutions permettent de satisfaire même les plus hauts niveaux de sécurité des SI et les besoins de réglementation ou de mise en conformité.

“Le partenariat avec Nomios est l’occasion pour BalaBit de renforcer sa présence sur le territoire français. La proximité et la confiance durable existant entre Nomios et ses clients en font le partenaire idéal pour nous”, commente Zoltán Györkő, Business Development Director de BalaBit IT Security.

A propos de Nomios
Créée en 2004, Nomios est une société spécialisée dans la mise en place de solutions de sécurité et d’optimisation des performances des systèmes d’information. Nomios accompagne ses clients tout au long du cycle de vie leur système d’information : audit & conseil, intégration, maintien opérationnel de l’architecture / support.
Réactivité, disponibilité et flexibilité sont au cœur du service de Nomios tout en respectant les crédos suivants : service, sur-mesure et expertise technique.
Nomios, filiale du groupe Ambitio est présent à Boulogne Billancourt et dispose d’agences régionales à Sophia Antipolis et  Rennes. Nomios compte plus de 30 salariés dont 75 % d’ingénieurs experts de la sécurité du système d’information et plus de 150 clients actifs (banque, assurance, télécom, industrie, média, presse, secteur public…). Nomios a réalisé en 2010, un chiffre d’affaires de plus de 8 millions d’euros.
Pour plus d’information concernant Nomios, merci de consulter l’adresse suivante : www.nomios.fr

A propos de Balabit IT Security
Le siège et les bureaux R&D de Balabit se trouvent en Hongrie. Créée en 2000, elle compte aujourd’hui 140 employés et a réalisé en 2010 un chiffre d’affaires de 6 millions d’euros en affichant une croissance de 59 %. Balabit est implantée depuis plusieurs années en France,  en Allemagne, en Italie, en Russie et aux Etats-Unis. Elle a des partenaires dans plus de 30 pays et travaille avec des intégrateurs locaux en Afrique, en Asie et en Australie.
BalaBit offre la solution la plus complète de contrôle des accès distants et des utilisateurs à privilège dans l’industrie. La forte croissance du chiffre d’affaires de Balabit témoigne de la demande du marché pour ce type de solutions.
Pour plus d’informations : Shell Control Box : Présentation de la solution
Livre blanc  ”La conformité, est plus qu’un coût: Créer de la valeur au-delà de la conformité” (#IDCWP05T) publié en février 2011 et sponsorisé par BalaBit

 

Contacts Presse:

Nomios          
13/15 rue de l’Eglise, 92100 Boulogne Billancourt
Sébastien Kher
Email : sebastien.kher@nomios.fr
www.nomios.fr

Agence : CYMBIOZ
31, rue des Petits-Champs – 75001 PARIS
Pauline Moreau / Laëtitia Berché
Tel : 01 42 97 93 32 / 06 14 48 02 95
Email : pauline.moreau@cymbioz.com /  laetitia.berche@cymbioz.com

BalaBit IT Security     
Andrea Ipolyi, Responsable RP
Tel : +36 20 390 4193
Email : andrea.ipolyi@balabit.com

Zorp the Firewall of Bastard Operator from Hell

Tuesday, November 15, 2011 @ 04:11 PM Author: Pfeiffer Szilárd

The main goal of the presentations given on recent free software conferences at Budapest and Szeged was to show a few examples from the vast repertoire of Zorp’s deep protocol analysis and modification capabilities, that can benefit a system administrator in her everyday work.

In particular, virus scanning within different protocols (typically HTTP and SMTP), filtering, modification or rejection of certain protocol elements (e.g. filtering out the referer host, or replacing the user-agent header in HTTP traffic; or disallowing write commands within an FTP session), decryption and re-encryption of SSL traffic, or server auditing support.

The presentations are available here, the accompanying demo videos here.


BalaBit IT Security surveyed IT professionals and found that in spite of the fact that 74% of them have already misused the company’s IT system, and could have lost his/her job, if a video recording could have proven wrongdoing, 92% of the surveyed would not object to being observed by an activity monitoring tool.

New York, November 15, 2011 – BalaBit IT Security, one of the global leaders in developing privileged activity monitoring, trusted logging, and proxy-based gateway technologies, announced the “Top 6 list of the most popular prohibited activities in the workplace among IT staff” as a results of its survey. The survey revealed that in spite of the fact that 74% of the interviewed IT professionals have already misused the company’s IT system, and could have lost their job, if a video recording could have proven wrongdoing, 92% of those surveyed would not object to being observed by an activity monitoring tool. The reason is that almost half of the IT staff needs to share user names and passwords for some server administration tasks, and 41% of them were already in a situation where it would have been beneficial if there had been a detailed video of their work.

According to BalaBit’s survey, 74% of the IT staff have already misused the company’s IT system, and could have lost their job, if a video recording could have proven wrongdoing. Most of those found breaking company IT policies admitted to multiple offences. The survey shows an average of two offences per person. Only 36% of IT staff state that they have never tried any of the following activities.

Top 6 list of prohibited activities in the workplace among IT staff:
1. 54% of those interviewed said that have already downloaded illegal content in their workplace
2. 48% of them answered that they have made exception rules in the firewall or in other IT systems for personal purposes, to get around the IT policy
3. 29% of them “have taken home” company details
4. 25% have looked into confidential files, stored on the company’s server (e.g. list of salaries)
5. 16% have read their colleagues email (without the colleague’s permission)
6. 15% have already deleted or modified log files (in order to hide or destroy evidence)

Supporting quote
Zoltán Györkő, Business Development Director at BalaBit IT Security said: “Implementing an activity monitoring solution, which controls and monitors privileged users’ (such as system administrators, high level managers and employees working with sensitive data or outsourcing services providers) activities, will  be inevitable in the near future, not only among the bigger enterprises but middle size organizations as well. Gartner recently published its “Top 10 Strategic Technologies for 2012″ and predicted* an increasing number of smartphones and tablets will be used by employees, as well as the potential for broad, long-term impact of cloud computing in most industries. Both of these trends require a new approach to IT security strategies, one enabling real-time control of user access to the IT system, tracking of activities and the ability to report who had access to which sensitive content and what changes were made and by whom to mission critical IT systems. An activity monitoring tool helps companies passing compliance audits as well as protects the privileged users.”

Although no one likes to be observed during work – even if they have previously been informed about it – controlling privileged users’ activities is mandatory because of industry- and compliance regulations. For instance, financial institutions need to meet Basel III, the Markets in Financial Instrument Directive (MiFID II), the Market Abuse Directive, SOX-EuroSox, PCI DSS and several other standards forcing the adoption of IT controls such as ITIL, COBIT or ISO 27001/27002. Passing these audits successfully is required for organizations to continue everyday operations and prevent financial losses and damage to the company’s reputation.

Unique situation of the IT staff: 92% of them would not object to being observed
Because of this contradiction BalaBit’s research also examined how employees feel about implementing such an activity monitoring tool which can track all their activities in the IT system during work. Would they protest against a monitoring system, even if the success of the audit and business continuity depended on it? Or would they rather support the implementation, even if it meant that their work was observed and every mistake and the responsible person could be reported? According to the survey, only 8% of respondents indicated that they would strongly protest against implementing an activity monitoring solution, the remaining 92% would welcome (34%) or – depending on the tool itself – would not mind (58%). Why?

An activity monitoring tool protects the system administrators
Among privileged users, system administrators and outsourcing partners more often find themselves in a difficult position as they share user names and passwords for some server administration tasks. The recently announced Password 2011 survey of Lieberman Software Corporation revealed that 42%** of the IT staff are sharing passwords or access to systems or applications in their organizations. BalaBit believes that this is the reason why 92% of IT staff would not object to being observed as in case of any incident, it is difficult to assign blame if multiple users share passwords. Privileged users have personal interest in finding who is responsible for the costly downtime of the IT system. BalaBit’s survey result clearly shows that 41% of the IT professionals were already in a situation where it would have been beneficial if there had been a detailed video of their work.

About the survey
BalaBit IT Security has conducted this survey between July and October 2011 and interviewed more than 200 IT professionals (CIO’s, CSO’s, system administrators, system managers and other IT workers) in Central and Eastern Europe. Questionnaires were filled in anonymously, among Hacktivity Conference and System Administrator Appreciation Day participants as well. 51% of respondents work for large, 17% for middle size, 25% for small size companies. They are mainly from IT and telecom (53%), financial (24%), government (12%), retail (7%) and manufacturer (4%) sectors.

Supporting Resources
•    An example, how illegal content downloading can lead to an incident: Joe’s last day video
•    InfoGraphic: To have or not to have evidence?
•    The full results of the survey can be found at http://www.balabit.com/popular-prohibited-activities

Sources:
*Gartner, “Gartner Identifies the Top 10 Strategic Technologies for 2012″
**Lieberman Software Corporation, “Password 2011 survey”

About BalaBit
BalaBit IT Security is an innovative information security company, one of the global leaders in developing privileged activity monitoring, trusted logging and proxy-based gateway technologies to help customers be protected against insider and outsider threats and meet security and compliance regulations. As an active member of the open source community, we provide solutions to a uniquely wide range of both open source and proprietary platforms, even for the most complex and heterogeneous IT systems across physical, virtual and cloud environments.
BalaBit is also known as “the syslog-ng company”, based on the company’s flagship product, the open source log server application, which is used by more than 650 000 companies worldwide and became the globally acknowledged de-facto industry standard.
BalaBit, the second fastest-growing IT Security company in the Central European region concerning Deloitte Technology Fast 50 list (2010), has local offices in France, Germany, Italy, Russia, and in the USA, and cooperates with partners worldwide. Our R&D and global support centers are located in Hungary, Europe.
For more information visit www.balabit.com.

Press contact
Andrea Ipolyi
PR manager
BalaBit IT Security
phone: +36 20 390 4139
e-mail: andrea.ipolyi@balabit.com
blog: http://andrea.blogs.balabit.com/

Walter Caon
BalaBit USA
410 Park Avenue 15th Floor Suite 1500
New York, 10022
phone: +1 917 546 6715
e-mail: walterc@us.balabit.com

Frühstücksspezialitäten: Revisionssichere Administrationskontrolle für mehr Compliance

Tuesday, November 8, 2011 @ 02:11 PM Author: Andrea Ipolyi

Administratoren und Supportpartner benötigen weitreichende Zugriffsrechte im Unternehmen, um ihre Aufgaben einwandfrei erledigen zu können. Doch wem ist diese Elite Rechenschaft schuldig? Kontrollen sind selten und Aktionen lassen sich oft nicht gerichtsfest nachvollziehen. Das tangiert empfindlich die Vorgaben für eine rechtskräftige Compliance. TÜV Rheinland stellt auf seinen Security-Breakfasts zusammen mit BalaBit IT Security Lösungen für die Praxis vor.

Hamburg, Frankfurt, Stuttgart, Berlin, München und Düsseldorf sind die Austragungsorte der TÜV Rheinland Security Breakfasts. Dort erfahren Unternehmen, wie in der Praxis die Lösung für das Problem “Kontrollierbarkeit von Administratoren und externen Dienstleistern” aussehen kann. Die Spezialisten für Informationssicherheit von TÜV Rheinland und BalaBit IT Security spielen mit den Gästen folgende Fragestellungen durch:

Was wäre wenn …

  • Ihre Daten manipuliert oder gelöscht werden?
  • Ihre Daten unkontrolliert nach außen gelangen?
  • Ihre Daten missbraucht werden?

Können Sie gewährleisten, dass …

  • alle Remote-Administrationsvorgänge an Servern und Netzwerken unveränderlich protokolliert werden?
  • verdächtige Administrationsvorgänge gemeldet werden?
  • Ihre Mitarbeiter nicht falschen Verdächtigungen ausgesetzt werden?
  • das 4-Augen Prinzip beim Zugriff auf die Systeme eingehalten wird?

Entlang von drei kompakten Fachvorträgen werden in der Diskussion mit den Frühstücksgästen praktische Lösungen aufgezeigt, wie sich diese Anforderungen sowohl technisch als auch organisatorisch einfach umsetzen lassen. Die Shell Control Box von BalaBit kontrolliert Zugriffe und zeichnet sie revisionssicher auf. Damit ist die notwendige Transparenz zur Einhaltung und Überwachung von Sicherheitsrichtlinien und SLAs gewährleistet. Die Experten von TÜV Rheinland unterstützen ihre Kunden dabei, von der Planung, über die Konzeption und Installation bis hin zum Betrieb der passgenauen Lösungen.

Veranstaltungsorte
15.11.2011   Hamburg, Radisson Blu Hotel
17.11.2011   Frankfurt, NH Hotel Frankfurt City
18.11.2011   Stuttgart, Parkhotel Messe Airport
21.11.2011   Berlin, ABION Spreebogen Hotel
22.11.2011   München, Azimut Hotel City Ost
24.11.2011   Düsseldorf, Airporthotel van der Valk

Interessenten können sich anmelden unter: http://www.tuv.com/security-breakfast

Über BalaBit IT Security
Das Unternehmen wurde im Jahr 2000 in Budapest (Ungarn) gegründet und beschäftigt über 100 Mitarbeiter. BalaBit ist weltweit tätig und unterhält Niederlassungen in Deutschland, Frankreich, Italien und Russland. Das Forschungs- und Entwicklungszentrum sowie das Support-Center befinden sich in Ungarn. BalaBit ist auf die Entwicklung Proxy-basierter Gateway-Technologien spezialisiert, es bietet Lösungen für die Kontrolle und Auditierung privilegierter IT-Zugriffe und das Log-Lifecycle Management. Die Produkte sind bei führenden Unternehmen aus den Bereichen Finanzdienstleistungen, Telekommunikation, Luft- und Raumfahrt sowie dem Gesundheitswesen im Einsatz. Zu den Kunden zählen zudem Behörden und öffentliche Einrichtungen. BalaBit vertreibt seine Produkte über ein weltweites Partnernetzwerk.
Im Markt bekannt ist BalaBit zudem als die “syslog-ng-Firma”: Die Log-Server-Anwendung, die als Open-Source-Software zur Verfügung steht, ist weltweit bei mehr als 650.000 Kunden im Einsatz und hat sich zum De-facto-Industriestandard in diesem Bereich entwickelt.
www.balabit.com

Über TÜV Rheinland
TÜV Rheinland bietet Unternehmen ganzheitliche Informationssicherheit von der strategischen Beratung über Konzeption und Prozessoptimierung bis zu Implementierung, Betrieb oder Zertifizierung der Systeme. Exzellente Technologie-Expertise, umfassendes Branchen-Know-how und strategische Partnerschaften mit Marktführern ermöglichen die Entwicklung standardisierter und individueller Sicherheitslösungen. Kerngeschäftsfelder sind die Strategische Informationssicherheit, Qualität und Sicherheit für Online-Anwendungen und Portale, Mobile und Network Security sowie die IT-Sicherheit in der Produktion. TÜV Rheinland ist in 61 Ländern an 500 Standorten vertreten, 220 davon allein in Deutschland.
www.tuv.com/informationssicherheit

Kontakt Presse TÜV Rheinland Informationssicherheit
Sabine Rieth
Fon +49 (0)221 806-3975
Mobil +49 (0)174 1880269
sabine.rieth@i-sec.tuv.com
www.tuv.com/informationssicherheit

Pressekontakt
punktgenau PR
Christiane Schlayer
Fon +49 (0)911 9644332
Mobil +49 (0)179 5053522
christiane.schlayer@punktgenau-pr.de
www.punktgenau-pr.de

Kontakt zu BalaBit IT Security
BalaBit IT Security GmbH
Dietmar Wilde
Stefan-George-Ring 29
81929 München
Fon +49 (0)89 9308-6157
dietmar.wilde@balabit.com
www.balabit.com

Please don’t fix if ain’t broken

Wednesday, November 2, 2011 @ 12:11 AM Author: athos

Today both GMail and Google Reader have come up with a new, similar look. And I don’t like them. When I use the web UI of both Reader and GMail, I’m usually sitting with my eee PC in my lap, that’s 1024×600 pixels and not a single one more. This means that while I’m infotaining myself, I need every single pixel, so I don’t like the idea that I have to waste more than 2/3 of my screen to display

  • that black Google Applications menu that I have never-ever used,
  • the Search bar that I use maybe once or twice in a month,
  • the navigation tree of Google Reader that I never really use,
  • those little buttons and whistles and bells at the top of Reader that I don’t even know what the heck they do actually,
  • and big white, unused spaces!!!
Google Reader - only 1/3 of the screen can be used

In the old UI, I could simply hide UI elements I didn’t need, either by scrolling them out of the screen or clicking the edge in Google Reader to hide navigation stuff. In the new UI, I cannot do either.

Old GMail UI - unused parts scrolled out from the screen

Then those buttons in GMail! They got bigger, icons are ugly, button borders have no contrast, and the labels are displayed only when hovering the mouse on them.

GMail buttons

And the colors! Big red buttons always visible on the screen saying: “look at me! I’m here! Can you see me?!” Oh please, red and grey? I want those nice lightblue tones back!

Big red button hurting the eye

The only positive thing I can think of is that the speed of the UI seems to be faster. But if that’s the price, I’d better revert to the old, somewhat slower but more usable UI, thanks.