The United States House of Representatives voted against the $700 billion emergency rescue package for beleaguered financial companies.
» LAUNCH VIDEO PLAYER
  Washington Post Staff Writer
Monday, September 29, 2008; 5:29 PM

Spooked investors fled the market today after the House rejected the $700 billion financial plan to rescue the financial market.


The Dow Jones industrial average closed down about 778 points, at 10,365. That was nearly a 7 percent drop. The Nasdaq lost 200 points, about 9 percent, and the broader Standard & Poor's 500-stock index fell 106 points, a decline of nearly 9 percent.

The Dow's point drop set a new record, topping the sell-off in the wake of the Sept. 11, 2001, terrorist attacks, when the Dow lost nearly 685 points. The percentage drop was also one of the worst since 1987, when the Dow fell 22 percent in one day.

Today was also the worst drop for the tech-heavy Nasdaq since the Internet bubble burst in 2000. Investor fled to the safety of U.S Treasury bonds. Facing increasing demand, the yield on 2-year bonds, fell from 2.1 percent to 1.7 percent. A smaller yield reflects that investors are willing to accept less from their investment as they seek a safe place for their money.

Investors also sought safety in gold, pushing the price up $24 an ounce today, while oil prices fell $11 to $95 barrel in trading today.

After 11-days of negotiations and three hours of debate, the House rejected the plan pushed by Treasury Secretary Henry M. Paulson Jr. and President Bush as the best way to stabilize the financial market. It would have allowed the government to buy the bad debt, including risky mortgages, of financial firms.



Paulson warned that inaction would lead to a seizure of credit markets and a virtual halt to the lending that allows Americans to acquire mortgages and other types of loans. But opponents have argued it was a bailout of the Wall Street figures that had spurred the problems in the first place. It failed by a vote of 228-205.

Investors were shocked by the news and worried again that more banks will fail before this measure, or something similar, can gain support. "We thought we had a deal that was passable," said Art Hogan, chief market analyst at Jefferies & Co. "We're in trouble and the market is showing you where we're going if we don't have a rescue plan."

For many investors it was the manifestation of their worst fears, analysts said. Many doubted that the plan would be enough to address of all of the market's problems, but saw it as an interim solution until the economy's fundamental problems -- high unemployment and a high rate of housing foreclosures -- could be tackled.

If the bill is not revived, the Federal Reserve and other central banks will be forced to quickly deal with the fallout, including further tightening of credit conditions and upward pressure on borrowing spreads, said Brian Bethune, chief U.S. financial economist for Global Insight. "At a minimum we would be looking for the Federal Reserve to cut interest rates sooner rather than later," he said.

Lawmakers may take up the bill again and the continued debate will add even more volatility to the market, said Joseph Brusuelas, chief U.S. economist at California-based Merk Investments. "If Congress does not get its act together, we could see an increasingly sharp sell-off across all global markets," he said.

This comes at a crucial time, the end of the third quarter, when firms will be seeking to rollover short-term debt, said Brusuelas. Given the seizing up of the credit markets, if Congress does not come up with a plan it may be increasingly difficult for many firms to find short term financing to meet immediate debt requirements and basic payroll obligations.


Posted by CEOinIRVINE
l

Video
The United States House of Representatives voted against the $700 billion emergency rescue package for beleaguered financial companies.
Washington Post Staff Writers
Monday, September 29, 2008; 2:42 PM

In a narrow vote, the House today rejected the most sweeping government intervention into the nation's financial markets since the Great Depression, refusing to grant the Treasury Department the power to purchase up to $700 billion in the troubled assets that are at the heart of the U.S. financial crisis.

The 228-205 vote amounted to a stinging rebuke to the Bush administration and Treasury Secretary Henry M. Paulson Jr., and was sure to sow massive anxiety in world markets. Just 11 days ago, Paulson urged congressional leaders to quickly approve the bailout. He warned that inaction would lead to a seizure of credit markets and a virtual halt to the lending that allows Americans to acquire mortgages and other types of loans.

As it became apparent that the measure was heading to defeat, stock markets took a steep dive. The Dow Jones industrial average fell more than 700 points but then rebounded a bit. By 2:30 p.m. the Dow was down 422 points, about 4 percent. The Standard & Poor's 500-stock index was down 5.4 percent and the Nasdaq was off 6 percent.

After a week of intense debate in both party caucuses, House members opposed the bill just five weeks before they face voters in an election that is shaping up as a referendum on the economy.

"Today's the decision day. I wish it weren't the case," said Rep. Barney Frank (D-Mass.), chairman of the House Financial Services Committee, who kicked off three hours of impassioned debate just as the opening bell sounded on Wall Street this morning.

Global markets have followed the congressional negotiations closely since Paulson's dire warnings to congressional leaders in a Sept. 18 nighttime meeting in the offices of House Speaker Nancy Pelosi (D-Calif.). As debate began today, news broke that Citigroup was purchasing another troubled bank, Wachovia, and an hour into the debate the Dow Jones industrial average had dropped by 285 points.


The bailout plan would have allowed Paulson to spend up to $700 billion to relieve faltering banks and other firms of bad assets backed by home mortgages, which are falling into foreclosure at record rates. Paulson, and his successor in the next administration, would have given the government broad latitude to purchase any assets from any firms at any price and to assemble a team of individuals and institutions to manage them. Paulson and others hoped to contain a crisis that already has caused the failure or forced the rescue of a half-dozen major Wall Street firms and unnerved markets around the world.

Before the debate started, Bush issued a final public plea urging lawmakers to support the plan, acknowledging that the vote will be "difficult" in the face of opposition from taxpayers and voters, but necessary to protect the economy. "A vote for this bill is a vote to prevent economic damage to you and your community," Bush said, attempting to undercut arguments that the proposed legislation bolsters Wall Street at taxpayers' expense. "This is a bold bill that will keep the crisis in our financial system from spreading through our economy."

Frank said no lawmaker wants to approve such a large bailout that was made necessary by the mistakes of Wall Street financiers and the mortgage industry, but inaction risked a more widespread financial meltdown. If nothing is done, he said, "the consequences will be much more severe."

Democratic and Republican leaders frantically pushed for votes this morning among their rank-and-file members to assure passage. During early morning votes on other noncontroversial matters, Pelosi hurried around the chamber floor, button-holing rank-and-file members, asking for their support.

Speaking on the floor of the House, in the final minutes before the close vote, Pelosi tried to assure her most liberal colleagues that further bailout hearings and legislation would come next year. Knowing that her party was fearful of how many Republicans would support the bill, Pelosi noted the bipartisan talks over the last week and the pledges made among both side's leaders to rally support. "I know that we will live up to our side of the bargain, I hope the Republicans will, too," she said.

On Sunday, Rep. Roy Blunt (R-Mo.), a lead negotiator and the GOP's top vote counter, hauled the nearly 30 retiring Republicans into his office to plead for what may be their final vote in office, warning that it will shape their legacy. James Nussle, the director of Bush's Office and Management and Budget and a former House member, worked the Capitol's halls and the House cloakroom in search of votes, cautioning beforehand of a very narrow vote.

 
 
Posted by CEOinIRVINE
l

Risk, Threat, Vulnerability

IT 2008. 9. 30. 03:32
Let's start with NIST publication SP 800-30: Risk Management Guide for Information Technology Systems. In the text we read:

"Risk is a function of the likelihood of a given threat-source's exercising a particular potential vulnerability, and the resulting impact of that adverse event on the organization. To determine the likelihood of a future adverse event, threats to an IT system must be analyzed in conjunction with the potential vulnerabilities and the controls in place for the IT system."

The document outlines common threats:

  • Natural Threats: Floods, earthquakes, tornadoes, landslides, avalanches, electrical storms, and other such events.
  • Human Threats Events that are either enabled by or caused by human beings, such as unintentional acts (inadvertent data entry) or deliberate actions (network based attacks, malicious software upload, unauthorized access to confidential information).
  • Environmental Threats: Long-term power failure, pollution, chemicals, liquid leakage.

I see no mention of software weaknesses or coding problems there. So how does NIST define a vulnerability?

"Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy."

The NIST pub's threat-vulnerability pairings table makes the difference between the two terms very clear:



SP 800-30 talks about how to perform a risk assessment. Part of the process is threat identification and vulnerability identification. Sources of threat data include "history of system attack, data from intelligence agencies, NIPC, OIG, FedCIRC, and mass media," while sources of vulnerability data are "reports from prior risk assessments, any audit comments, security requirements, and security test results."

The end of SP 800-30 provides a glossary:


  • Threat: The potential for a threat-source to exercise (accidentally trigger or intentionally exploit) a specific vulnerability.
  • Threat-source: Either (1) intent and method targeted at the intentional exploitation of a vulnerability or (2) a situation and method that may accidentally trigger a vulnerability.
  • Threat Analysis: The examination of threat-sources against system vulnerabilities to determine the threats for a particular system in a particular operational environment.
  • Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy.

For those of you Microsoft-only shops, consider their take on the problem in the The Security Risk Management Guide. Chapter 1 offers these definitions:

  • Risk: The combination of the probability of an event and its consequence. (ISO Guide 73)
  • Risk management: The process of determining an acceptable level of risk, assessing the current level of risk, taking steps to reduce risk to the acceptable level, and maintaining that level of risk.
  • Threat: A potential cause of an unwanted impact to a system or organization. (ISO 13335-1)
  • Vulnerability: Any weakness, administrative process, or act or physical exposure that makes an information asset susceptible to exploit by a threat.

Microsoft then offers separate appendices with common threats and vulnerabilities. Their threats include catastrophic incidents, mechanical failures, malicious persons, and non-malicious persons, all with examples. Microsoft's vulnerabilities include physical, natural, hardware, software, media, communications, and human. Microsoft clearly delineates between threats and vulnerabilities by breaking out these two concepts.

I'd like to add that the comment on my earlier posting said I should look up "threat" at dictionary.com. I'd rather not think that "security professionals" use a dictionary as the source of their "professional" understanding of their terms. Still, I'll debate on those grounds. The poster wrote that dictionary.com delivers "something that is a source of danger" as its definition. Here is what that site actually says:

  1. An expression of an intention to inflict pain, injury, evil, or punishment.
  2. An indication of impending danger or harm.
  3. One that is regarded as a possible danger; a menace.

Remember what we are debating here. I am concerned that so-called "security professionals" are mixing and matching the terms "threat" and "vulnerability" and "risk" to suit their fancy.

Here's vulnerability, or actually "vulnerable":

  1. Susceptible to physical or emotional injury.
  2. Susceptible to attack: “We are vulnerable both by water and land, without either fleet or army” (Alexander Hamilton).
  3. Open to censure or criticism; assailable.
  4. Liable to succumb, as to persuasion or temptation.

You'll see both words are nouns. But -- a threat is a party, an actor, and a vulnerability is a condition, a weakness. Threats exploit vulnerabilities.

Finally, risk:

  1. The possibility of suffering harm or loss; danger.

Risk is also a noun, but it is a measure of possibility. These are three distinct terms. It is not my problem that I define them properly, in accordance with others who think clearly! I am not inventing any new terms. I'm using them correctly.

I'd like to thank Gunnar Peterson for reminding me of the NIST and Microsoft docs.

'IT' 카테고리의 다른 글

CPU Structure 80x86  (0) 2008.10.02
Linux Memory/CPU administration  (0) 2008.10.02
Android’s threat to the iPhone  (0) 2008.09.30
AT& T, Verizon to Refrain From Tracking Users Online  (0) 2008.09.26
Got an idea to help the world? Here's $10 million  (0) 2008.09.25
Posted by CEOinIRVINE
l