Profile of an IT forensics professional

A snapshot look at the IT forensics profession from the perspective of Rob Lee, an IT forensics expert at Mandiant. He is a graduate of the U.S. Air Force Academy and a founding member of the USAF's Information Warfare Squadron, the first U.S. military operational unit focused on information operations. Name: Rob Lee Title: Director and IT forensics expert at Mandiant, a Washington-based information security software and services firm Related work: Curriculum lead for digital forensics training at the SANS Institute. 30-second résumé: Before joining Mandiant, Lee served as the technical lead for a vulnerability discovery and exploit development team that worked for a variety of law enforcement, government and intelligence agencies. Skills boost: To stay current, Lee does hands-on work in the field and is an avid reader of and contributor to information security journals and blogs.

He also recommends specializing in a particular area of computer forensics. "If you're choosing forensics, be a specialist in firewalls or hacking or mobile devices," Lee says. "Mobile devices alone are extremely complex and constantly changing. "If you're just beginning, classes are the way to go," he advises. "After that, you can continue to learn online. A passion to learn and to continue learning - rather than a formal computer science degree or security certification - is the top requirement for an IT forensics expert, says Lee, who also teaches SANS certification classes. The best thing you can do once you attain a certain level [of expertise] is give of yourself back to the community. Always do research and publish it." Next: Opinion: Web 2.0 security depends on users Choose something you don't think anyone else has [expertise in] and research that.

Wall St.: HP-3Com union a real Cisco threat

Financial analysts see HP's pending purchase of 3Com as a threat to Cisco because it means 3Com Ethernet switches that are inexpensive and very popular in China will have better access to U.S. businesses via well-established HP sales channels. "We see HP's acquisition as primarily a response to Cisco's converged network/CPU strategy," writes Catharine Trebnick, an analyst with Avian Securities. "With Cisco owning the bulk of the enterprise Ethernet market, they have the most to lose if HP is successful in integrating the 3Com portfolio." Trebnick says HP's 3Com acquisition is filling a gap in its high-end networking to better compete with Cisco, and that 3Com's success in China will be a boon to HP. "Our conversations indicate that HP is well on its way to successfully maintaining [3Com's] China presence," she writes in a memo reacting to news of the deal. Trebnick is also optimistic that HP can use its established sales channels to expand 3Com's market share in North America where "success has been limited." "This acquisition has negative implications for every other provider of networking equipment," Trebnick says, spelling out some specifics, with Cisco being the main target with the most to lose by the new HP. She says it seems logical that if HP wants to compete with Cisco on all fronts, it needs to make more purchases, possibly Avaya for unified communications and Polycom for telepresence and videoconferencing gear. A Brief History of 3Com  Nikos Theodosopoulos and Jack Monti of UBS Warburg write that Cisco faces a long-term threat from the beefed-up HP because it could come at Cisco with aggressive pricing. 3Com's plan has been to sell its low-cost H-3C gear that is popular in China in countries around the world, they say.

The deal is bad news for Brocade, she says, because HP sells Brocade storage gear under the name StorageWorks and might have hoped to make inroads with its Ethernet gear as well. Ittai Kidron and Joseph Park of Oppenheimer write that it is now unlikely that HP will try to buy Brocade, and also calls into doubt possible OEM relationships with Brocade and Juniper for data center switching and fibre channel over Ethernet products, because HP will probably try to develop this equipment in-house. But she writes that 3Com has been doing R&D on fibre channel over Ethernet, "raising the possibility that HP may build that functionality organically." Juniper is not affected as directly, she says, but if HP becomes stronger with corporate customers, it could blunt Juniper's momentum in enterprise sales. Near-term, though, the deal could be good for Cisco as well as Juniper and Brocade because integrating 3Com into HP will be disruptive, Kidron and Park write. Still, if HP wants to offer a complete array of network offerings it will have to make other purchases, strike OEM deals or develop its own technology, Theodosopoulos and Monti write in their bulletin about the deal. Analysts were impressed with 3Com's success in China, with Trebnick noting the Chinese government and corporate customers represent 30% of 3Com revenue, and Theodosopoulos and Monti noting its claim to 300 of the top 500 enterprises in China and a low-cost R&D center in that country.

In general, the purchase reduces the probability of other large networking mergers and acquisitions in the near term, they write, and that is likely to put pressure on the price of stocks of other companies they think might be acquisition targets, naming Brocade and F5. They also think that IBM is unlikely to buy networking vendors in the near term because it has OEM deals in the works with Juniper and Brocade that aren't fully up and running yet.

Analysis: Real ID program on life support

A decision by lawmakers to slash funding for the unpopular Real ID national driver's license program has put an already struggling program on life support. But continuing hesitation by Congress to kill the program entirely highlights the somewhat touchy political nature of the program, he said. "A straightforward repeal of Real ID is too much for our Congress to handle at this point," Harper said. "There isn't any love for Real ID in Capitol Hill. Earlier this week, the U.S. Senate approved a $43 billion budget for the U.S. Department of Homeland Security (DHS) for fiscal year 2010, which began Oct. 1. The measure included substantial increases in DHS spending in several key technology areas, but slashed Real ID funding by 40%, from $100 million to $60 million in 2010. That reduction all but ensures that Real ID is going nowhere, said Jim Harper, director of information policy studies at the Cato Institute.

Most in the Senate and the House don't want it." At the same time, many lawmakers are reluctant to openly reject it for fear of being seen as being too soft on national security issues, he said. The law requires states to follow a single national standard for identifying and authenticating people who apply for a driver's license. The Real ID Act was approved by Congress and signed into law by President Bush in 2005 as part of the government's effort to combat terrorism. It spells out specific technical and process requirements, including the use of biometric identifiers, for issuing licenses. Several have expressed particular concern over a Real ID requirement that all state driver's license databases be linked via a central hub for easier information sharing.

But the law has evoked widespread criticism from privacy advocates and civil rights groups who say it would create a de facto national identity card system that would be hard to manage and even harder to secure. Even the DHS itself, which is responsible for implementing the Act, has expressed reservations about Real ID security, privacy and logistics. Many see it as an attempt by the federal government to force costly and unwanted ID standards on them. States, too, have railed against Real ID, largely because it requires them to pay for the program themselves. A majority of states have formally expressed their refusal to participate in the program, including Arkansas, Idaho, Maine, Montana, New Hampshire, Washington and South Carolina. In a bid to make the idea of a national identity standard more palatable to states, several U.S. senators earlier this year introduced a bill proposing some revisions to Real ID . That "Providing for Additional Security in States' Identification" Act of 2009," or Pass ID Act, has the same goal as Real ID, minus some of its more controversial provisions.

DHS Secretary Janet Napolitano, in fact, was one of the first to reject Real ID when she was the governor of Arizona - a fact that many have said makes it especially hard for her to now try and push it on other states. The DHS has also pushed back implementation schedules on numerous occasions in what is seen by some as an attempt to push the issue down the road until someone kills it. But it isn't dead, yet." Pam Dixon, executive director of the World Privacy Forum, said that the proposed budget cuts make it impossible for Real ID to move forward in its present incarnation. "Congress is looking at this realistically and saying that states simply do not have the money to implement Real ID," she said. "For all intents and purposes, real ID has been put on the back-burner.

Rogue Amoeba quits iPhone development

Stories about App Store submission woes have become standard fare in the tech media of late, which has understandably led to some readers groaning "not another App Store sob story" whenever they come across one. Adding its name to a rapidly growing list of disgruntled iPhone developers is Rogue Amoeba, makers of fine audio utilities for the Mac, such as Airfoil, Audio Hijack Pro, and Fission. But, as Dan Moren so ably put it, iPhone developers are entitled "to a little respect," and constantly being on Apple's case with regard to the App Store approval process is the only way to get them to do something substantial about it. The company has also entered the iPhone app market with Radioshift Touch and Airfoil Speakers Touch.

Having submitted the updated version in July, they'd expected the app to be available on the store within a week or two, given that it was almost identical to the version already in the store, with merely minor bug fixes. Having shipped version 1.0.0 of Airfoil for the iPhone earlier this year, the folks at Rogue Amoeba quickly went to work on a 1.0.1 update to fix some bugs relating to audio sync when outputting to multiple sources. If you've read this far, you already know what's coming next: after being rejected three times, Airfoil Speakers Touch 1.0.1 was made available on the App Store on Friday, after floating in App Store submission limbo for three-and-a-half months. This, despite the fact that the first version of Airfoil for the iPhone, which was approved by Apple, had the exact same feature and that the feature uses Mac OS X code provided by Apple expressly for this purpose. I recommend checking out this post on the Rogue Amoeba Website by CEO Paul Kafasis to read about the events in detail, but here's the gist: Apple rejected the update on grounds of trademark infringement because the application displayed a picture of the Mac streaming the audio and an icon of the application whose audio is being streamed. As Kafasis notes in his missive, it's no worse than Apple displaying third-party app icons in the Dock and Finder.

Instead, there's a graphic that you can tap on to visit a Web page about why the icons are missing. That page also suggests that you consider donating to the Electronic Frontier Foundation (EFF), an organization that lobbies for Internet freedom. After having unsuccessfully re-submitted an unchanged binary to Apple for reconsideration, they took the only available recourse and removed the feature from the app, in accordance with Apple's demands. Perhaps the most important part of Kafasis's post comes at the end, where he states that Rogue Amoeba will be scrapping any plans to develop new iPhone applications for the foreseeable future and that updates to existing applications will also be few and far between. It's been more than a year since the App Store opened its doors; there are currently more than 100,000 applications that have cumulatively been downloaded more than two billion times. And, just like that, yet another passionate Mac developer walks out of the App Store, frustrated by its inane and inconsistent policies and their heavy-handed implementation. The argument that Apple is still new to this just doesn't fly anymore.

It's hard to believe that the company that produced the Mac, Mac OS X, the iPod, iPhone, Apple Online Store, and the iTunes Store is incapable of making the App Store work the way it should. Apple's attempts to fix the App Store in the past year have been lukewarm at best.

2009 geek gift guide: Toys and books for techies

Finding the perfect gift for techies is no easy matter. To help you find the perfect gift for the techie in your life - or to steer a loved one toward something you'd really like - InfoWorld.com has looked beyond the obvious to uncover 10 seriously cool new gadgets and 24 must-read tech books that will appeal to the geek in all of us. After all, by definition, geeks are steeped in the latest and greatest of tech gadgets, and it's just as difficult to find a tech-based subject they don't already think they know everything about.

You won't find the iPhone or Droid here, nor will you light upon the latest external network drive; more likely than not, your geek already has those. Sometimes that means toying around with a somewhat esoteric gadget. Instead, you'll find items aimed at satisfying every geek's innermost desire: to explore. [ Discover the 10 best gifts for techies in the InfoWorld.com's "2009 geek gadget gift guide" slideshow. | Discover the 24 best new books for techies in the InfoWorld.com's "2009 geek book gift guide" slideshow. ] Because if there's one thing we geeks all love to do, no matter what type of science, engineering, or tech discipline floats our boat, it's to play with technology that is both cool and useful. Other times that means soaking up new tech know-how we can apply at home or at work. This year's geek book gift guide has recommendations in seven categories: "something different" explorations, personal tech guides, hands-on deep technology how-tos, cloud and architecture expositions, business management primers for IT people, IT management how-tos, and tech best-practices "rethink" books.

This year's geek gadget gift guide includes the 55-cent Animal Clips for budding young geeks to the seriously useful and cool personal Pogoplug cloud storage device to a touch-based laptop that could show the way for real tablet computing. This article, "2009 geek gift guide: The best toys and books for techies," was originally published at InfoWorld.com.

Apple patent filing reignites tablet device rumors

A just-published Apple patent application for hand-writing recognition on pen-based computers has re-ignited speculation the company will soon unveil a tablet device. Technically, the Apple patent application - filed in July but published this week by the U.S. Trademark & Patent Office - is for "acquiring and organizing ink information in pen-aware computer systems." That's a type of device that Apple doesn't currently offer, though hand-writing recognition, dubbed Rosetta, was part of the Newton handheld device and operating system, released in 1993. And, according to Wikipedia, some of that code, renamed Inkwell, was introduced into Mac OS X, for use by peripherals graphics tablets. But if that's Apple's plan, the company may be in a furious race with Microsoft, which is leaking and hinting at details of an innovative small tablet device, Courier, now in development.

One of the developers of Inkwell, Larry Yaeger, is named in the newest patent application along with Richard Fabrick II, and Giulia Pagallo. The Apple filing describes a tablet "input device" that "may be a thin layer of sensing circuitry present either beneath the visible screen/tablet surface…or as part of a thin, clear membrane (not shown) overlying the screen…that is sensitive to the position of the pen on its surface. The worst Apple products of all time One of the first sites to pick up on the filing was Seth Weintraub's daily Apple news site, 9to5Mac.com.  Earlier this month, Craig Mundie, chief research and strategy officer, declined to comment on the Courier device but made it clear that Microsoft not only hasn't given up on tablets, but thinks the pieces are in place for a breakthrough product. "Today, several factors are coming together that will probably make the concept more resurgent or at least become more mainstream," he said. "It's a confluence of small, light devices with the hybrid touch and writing screen technology that will finally probably result in a tablet-type computer going mainstream." One key question is what operating system Courier might be using: a slimmed down version of the recently released Windows 7, or an early version of Windows Mobile 7, expected next year, with dramatically improved touch support on Windows handhelds. But the Inkwell heritage raises the question of just what kind of "tablet" Apple may have in mind. Engadget's Tom Ricker uses the pen-oriented patent filing to mock Apple CEO Steve Jobs, who famously called the finger the "best pointing device in the world" compared to the stylus, which has been a staple for Windows Mobile devices for years. Most of the speculation for much of this past year has been around a portable device with a notebook-sized screen and, in keeping with the success of the iPhone and iPod touch, a multi-touch user interface.

But Apple's patent filing specifically mentions that "A suitable tablet…for use with the present invention includes the Wacom graphics tablets from Wacom Technology Company of Vancouver, Wash." Wacom's products are advanced USB peripherals that plug into a Mac or Windows computers to enable pen or gesture input. The Intuoas4, introduced in March, can capture subtle differences in pressure, for example. The Bamboo products are pads only, using the host computer's screen; the Intuoas and Cintiq products incorporate their own displays as well. Tablets have been about to "happen" for the last 20 years. Yet today, tablets are relegated to small niches and vertical applications, such as healthcare. Microsoft has tried at least twice, most recently in 2001, to promote them as the next big thing in personal computing, investing time and treasure in creating intuitive digital ink technology, to make using the screen as easy as using a piece of real paper.

But the success of the big-screened, Web-browser-equipped iPhone, and the explosion of the netbook, or shrunken notebook, market seems to be reviving interest in finding the Next Big Small Form Factor device. The video, which seems more like an animation than a recorded live demonstration, shows a device that opens flat like a small book, with each "page" being a screen, each roughly 5x7 inches. Gizmodo in September released a Microsoft-created video that apparently shows a new, small tablet-like device from Microsoft, the Courier. The interface combines a pen and gestures to take notes and work with a variety of what seem to be PIM and Web applications. "[T]he biggest question that popped up for me is whether the pen interface (digital ink) is the right choice for the job," writes Network World blogger, Mitchell Ashley. "Is the pen interface something that belongs in the Tablet PC era, but not in new touch interface devices?... I personally would rather type, even with a simulated digital keyboard, than write with a pen stylus"

Maybe the touch keyboard, like [that] used with the iPhone, is the way to go.

Global Dispatches: Ex-Google exec helps Chinese startups

Fund Formed for Chinese Start-ups BEIJING - Kai-Fu Lee, who resigned as president of Google Inc.'s China operation earlier this month, has founded an angel investment fund and plans to help out three to five new Chinese high-tech companies annually. Steve Chen, a co-founder of YouTube Inc., is also an investor in Innovation Works. The fund, dubbed Innovation Works, launched with some $115 million (U.S.) provided by several IT vendors, including Taipei-based Foxconn Electronics Inc. and Lenovo Group Ltd.

The new company said the funds will be used to train young entrepreneurs and help them build Internet, mobile Internet and cloud computing companies. - Owen Fletcher, IDG News Service Telecom Firms Plan Joint Venture LONDON - Deutsche Telekom AG and France Telecom SA plan to form a joint venture that would oversee their respective U.K. mobile communications networks - T-Mobile U.K. and Orange U.K. The combined company would have about 28.4 million customers, or 37% of U.K. mobile subscribers, leapfrogging current market leader O2 U.K. Ltd., which reported 20.7 million customers at the end of June, the companies said. Ombudsman P. Nikiforos Diamandouros said he will rule on the complaint later this month. - Agam Shah, IDG News Service The venture is expected to realize overall savings of more than £3.5 billion ($5.7 billion U.S.) by, among other things, closing some stores and "optimizing" the companies' customer service staffs. - Peter Sayer, IDG News Service Briefly Noted The European Union has confirmed that its ombudsman received a complaint from Intel Corp. in July alleging that "procedural errors" were made by the European Commission during an antitrust investigation that led to a record fine of €1.06 billion ($1.44 billion U.S.) against the chip maker.