My kids' Dad

SecureWorld 2006

Just added a new post on my security blog.

If you don't include the after hours libations with some of the organizers and their distinguished guests, the most interesting discussion was Tim Bates from GM discussing outsourcing. He highlighted a quote from Yankee Group that states that by 2010 90% of enterprise security will be outsourced. This does not necessarily imply that this will be done by overseas suppliers but by those with the right skills and the right price. I expect to see U.S. based security services that concentrate highly skilled specialists in providing services based offerings which are far more affordable than having enterprises do it themselves.

On the topic of overseas outsourcing, Fortune magazine showcases the benefits and costs of overseas operations (in China) against a Michigan based operation producing the same products. Guess what? The US operation has labor costs that are 12 times higher than the Chinese operation, yet the US operation is far more profitable (mostly due to quality issues with the labor pool and the local pricing constraints).

Another article

IT Architect Magazine (formerly Network Magazine, formerly Data Communications Magazine) has published my third article... Hope it is a charm! My first and second.

We called the article, "Groceries: The New Teachers of Network Security" I doubt it will be nearly as controversial as the last two.

There is also a nice little section where others in the industry weigh in as well as an interactive response area.

Interestingly I have recently found another article dealing with the same issue in Baseline Magazine that was very well written and looking at the cost of such an idea. Will update when I get the link.

New Security blog

I am starting a separate site to dig into technical security issues that people may find of interest especially those working in larger companies. Feel free to check it out. I will continue to use this blog as a place to post my personal opinions as I have time. The new blog is in response to what I see is an amazing lack of clear information in the practical use of common security products. If I can't find the information readily available online and am forced to figure out how to configure something on my own then I may be able to help save others the same efforts and perhaps improve my own knowledge in doing so.

Anti Virus Heresy

I thought I was pushing it when I decided that the costs outweighed the benefits in deciding to not install anti virus on our Apple iBook. The risks simply seem minuscule for Mac OSX users considering our environment: we keep the latest OS patched; we run [almost*] all Apple software including Safari, Mail, Preview, AppleWorks, Pages and Keynote; we have the Apple firewall enabled and keep Bluetooth off unless in use. I had been religiously using anti virus software for over a dozen years and have consistently noticed the ill effects of using AV software (as well as the hard costs). So it feels a bit like I am trying to remove my helmet when in the cold deep vacuum of outer space.

Then I figure I was pushed over the edge... My fairly new 2.2 GHz Pentium 4 system has become noticeably slower - nay, painfully slower - since applying Win XP SP2 and the latest in AV "Internet Suites" (and anti-Spyware). I wonder if security orthodoxy requires sacrificing your hardware each year to be able to get something done in a reasonable amount of time.

So my 7 year old son received a Compaq Armada 266 MHz laptop from a relative. It had Windows ME on it and was suffering so I reformatted it with Windows 98 SE in order to get that original snappy performance (since I remember not long ago 266 was a speed demon compared to that old stuff we used to run). I installed a fresh OS onto a clean drive and then proceeded to patch the OS and installed a commercial AV product. The laptop was so slow as to be unusable again. That was the straw that broke the camel's back. I uninstalled the AV software and the laptop actually runs fairly well (IE 6 and Outlook Express installed).

Now before anyone else considers this... I did consider the risks and the operational environment: my son's e-mail account is restricted so that it only accepts e-mail from a handful of trusted people; he doesn't browse the Internet; we have a hardware firewall on our home network; I am careful about only giving him software that is from reputable sources (currently he runs Yahtzee and Monopoly). We also realize that this system can be sacrificed if it gets infected - but my it runs very nicely now!

What say you - reasonable or ridiculous?
Or am I jeopardizing my security credentials?

* We have installed and run Windows Media Player on rare occasion

Don't lose these!

A collection of fine posts that I don't want to lose track of:

Sage advice rarely comes from the corner office except in this blog at BigPictureSmallOffice:

Look to yourself, not to others, for happiness and happiness will come to you. Look to yourself, not to others, for sustenance and sustenance will surely appear.

Some say that corporations suck the life out of us - this 'suit' proves that some people are missing great wisdom. The rest of the advice is equally good.

Drs. Fernette and Brock Eide post on the pitfalls of focusing on interdisciplinary teams instead of interdisciplinary people:

In the name of democratic classrooms, sometimes the emphasis is more on equal treatment than diversity of thinking and problem solving styles. This is unfortunate, though, because it may be that an individual's greatest contribution to a group will be found in their differences - ideas, fund of knowledge, personal history or associations, and thinking style - rather than their traits in common.

This seems to be a general problem in society... diversity is often considered conforming to the definition of those who say so - often what I see is intolerance preached by those who claim to love diversity.

ZenPundit continues to tie together concepts from system resilience to the impact of types of thinking.

What would be the advantages of building "Consilience" in to a network's structure, system and culture? [Survivability - Influence - Compatibility - Adaptability]

Keep reading to see the importance of not getting trapped in narrow expert knowledge and missing the larger picture.

Different River links to What al-Qaida Really Wants found at Der Spiegel (English version)

I admit to getting annoyed when someone writes that terrorists are actually justified in their actions because of our foreign policy.

A Jordanian journalist describes the seven planned phases for al-Qaeda's grand strategy for the next two decades.

1. 2001-2003 Stirring the Muslim world to understand that the west had declared war on Islam
2. 2003-2006 Recruitment of young men into a global movement run by al-Qaeda with Iraq as its center  <--- YOU ARE HERE --- let's make sure we disrupt them here
3. 2007-2010 Syria falls to al-Qaeda carries out direct assaults on Israel and Turkey
4. 2010-2013 More Arab governments are overrun by al-Qaeda which also conducts cyber attacks on the west (globalization and the global economy is directly attacked)
5. 2013-2016 Caliphate is established over the Islamic world
6. 2016+ Caliphate declares war upon the world
7. 2020+ Caliphate rules the world (Finally the Left rejoices!)

I wish I could say that we shouldn't take this threat seriously and all go back to our hobbies.

Lest we forget al-Qaeda is not the only terrorist organization around - the larger set of terrorists and rogue regimes do share in common the intermediate desire of global disconnectedness in order to incubate their regimes until they reach a level that they could eventually challenge the free world.

Different River also reminds us of the incredible good we have done in Iraq by describing a few of the horrors women and children faced under Saddam where Howard Dean is rebuked for saying:

...as of today it looks like women will be worse off in Iraq than they were when Saddam Hussein was president of Iraq.

(Which is kind of like saying that Jewish women have it worse off today than when the Nazis were in power...)

Cindy Sheehan should know that some Iraqis are eternally grateful for our sacrifices (that is the men and women who freely offered to risk their lives for others freedom):

Ma'am, we asked for your nation's help ...
Our request is justified, death was our daily bread and a million Iraqi mothers were expecting death to knock on their doors at any second to claim someone from their families.

Our fellow country men and women were buried alive, cut to pieces and thrown in acid pools and some were fed to the wild dogs while those who were lucky enough ran away to live like strangers and the Iraqi mother was left to grieve...

Thank God for our freedom and for those who have volunteered to risk their own lives so we and others can live in freedom. Let us not squander all of their sacrifice let us prepare for the future.

Our Future is ... Different

The inexhaustible Mark Safranski at ZenPundit compiles a prognostic post "SHORT TERM FUTURISM: ALL CONNECTED, ALL THE TIME" that touches on the ramifications to society on the impact of technology.

The brilliant Wharton link offered by Mark is superbly written:

"Something fundamentally big is happening that will profoundly affect the life of every person and every business over the next five to 15 years -- the collapsing of everything into one single, global, ubiquitous, collaborative virtual IT world."

The biggest challenge? Security, say half of the corporate chief information officers in the U.S.

Just as the Internet burst onto the scene about ten years ago - the upcoming changes will be even quicker and more tumultuous affecting cultures and lives. The comment about security strikes me as even more prophetic than the Information Security context in which it was given. I read security as a broader sense of personal trust - from personal transactions to our political perspectives to our confidence in our own worth and wage earning abilities.

Is there such a thing as cyber terror?

Computer security gurus have long been saying that cyber terror is just so much hype.

"If (terrorists) want to attack they will do it with bombs like they always have," said security guru Bruce Schneier.

Schneier added, "Breaking pager networks and stopping e-mail is not an act of terror."

J Pescatore says: I hope by now all the blow-hards hyping up cyber-terrorism as what we should really worry about have seen that blood and missing limbs and death are what cause terror, not error 404s.

I agree that we can't be scaring people with silly theories and wild spending - it does more harm than good. But this recent article reveals that al Qaeda may be taking this more seriously than our gurus:

A government-prepared dossier says that al Qaeda is targeting middle-class Britons to join its ranks

...likely targets come in two categories: "well-educated undergraduates with degrees or professional qualifications in engineering or IT (information technology); or underachievers with few or no qualifications and often a criminal background."

If al Qaeda can't perform terror with IT talent then perhaps they have gotten into a different line of business? Using IT to hack systems and steal money to fund terrorism isn't exactly cyber terror. And what about disrupting financial, commercial, energy and transportation sectors? Is that cyber terror? Does blood have to be spilled to be considered terrorism? Would wrecking an economy or creating dissension between nations qualify?

My take - let's not get too wrapped up in semantics and make sure we see the greater context and threats and see what we might be able to do to prevent potential tragedies.

Recovering

Finally recovered from the GSEC test - it was three hours of torture. I am not knocking the certification or material... it is all worthwhile and keeping up with bits that are out of your normal routine is commendable. But the test gets into a bit of microscopic detail for a broad certification. Knowing command line switches for an OS I rarely use just seems arcane - although it may give me the ability to appreciate the predicament of some of my peers. Since the test is 'open book' it also helps to know how to search for these answers quickly. The test is not quite as bad as some of the old Novell CNE tests - the ones where you had to know what would be on the menu of the next screen... I wouldn't have been surprised if they would simply have asked, "OK, what is the 4th word on page 247 of the Service and Support Guide?"...

My wife's new Apple iBook continues to amaze me. She took it into work earlier today and had the 6 year olds run around the YMCA and take pictures with her digital camera. She syncs the camera to iPhoto, downloads the 'YMCA' tune from somewhere and the kids have created a terrific slide show! Talk about user friendly! Now if I could figure out why this guy's PowerBook (OSX 10.3) keeps losing his WEP key at work... (at least we'll be moving to EAP shortly)

Despite all of the work and hard studying that has consumed me, I make it a habit not to miss the Wall Street Journal which offered a sane counterpoint to USA Today's headline that the debate on global warming is over. The WSJ article discusses Exxon's CEO's approach to global warming:

Openly and unapologetically, the world's No. 1 oil company disputes the notion that fossil fuels are the main cause of global warming.

Lee Raymond, Exxon's CEO said: 'Why don't you just go spend $50 million on solar cells? Charge it off to the public-affairs budget and just say it's like another dry hole?' The answer is: That's not the way we do things."

You have to admire a company that holds to the truth as it sees it. They employ several very highly respected scientists in the field of global warming who don't dispute the global warming trend - but do want to see how much man made causes contribute to global warming.

If the USA Today article is accurate it should be considered a religious victory not a scientific one - that big companies are rolling over and placating critics by spending some petty cash on 'environmental causes' is simply PR. It is amazing that one can spend so much on USA Today and get so very little.

Still Alive

I am seriously and painfully out of touch with my blog addiction right now but I am getting closer to the point where I can indulge again.

The GSEC studying is intense, not because I couldn't pass the test if I just had to take it - but the updated material is so good and it is worth the effort to review. It is worthwhile going over the subject matter once every couple years it is surprising how much does get updated that often. The most painful part is that the information is often in the form of prose and there is just so much of it that it takes a lot of time. And for those who have never taken a GIAC test... they seem to relish in some of the technical minutiae that you can only get from a close reading. Perhaps a good sexist comment would be, 'this separates the men from the boys' but you wouldn't often hear that come from my mouth ;)

On a couple other fronts...

The wife's new Apple iBook is truly amazing (as someone who has been familiar with Apple for many years and simply hadn't kept up with OSX) in that it handles very complex functions in a deceptively simple and intuitive fashion. A brief look at the e-mail client seemed to reveal a grossly simple architecture - but when I dug deeper to see if and how it handled digital certificates I was amazed at how easy and well it does. Downloading executable content from the Internet brought simple but effective control in the form of a humanly understandable question. The system easily handles updates - not just to system components but also applications that are savvy. I am still mulling over the need for anti virus - the risk is minimal (and the cost not a real issue) but I am concerned about the impact to the system (in terms of stability and performance). And speaking of performance... My relatively new Dell home system (P4 2.4 GHz) is so much slower than the day I first turned it on. I blame it on all of the MS patches including SP2 as well as the anti virus, and plethora of anti-spyware crap I need to run to keep it 'safe'. Oddly in this regard - the Macintosh tends to get faster with code upgrades as Apple claims that more of the underlying code takes advantage of native code optimized for the processors. The G5's still seem to offer a lot of punch - the iBook will be greatly improved once Apple starts to move to the Intel based systems next year but today's G4 is not a poor performer.

And finally our son had a great time fishing this evening catching about a dozen bass in the Grand River - as Matt promised, the small mouth bass delighted him with their fight. Meanwhile our daughter fell into the Gerald Ford Museum pool and came out quite the 'wet fish' - luckily the evening was hot and it helped more than hurt.

Solving World Peace

I started a post on Barnett's Blogging the Future discussion board where I solve for world peace. Actually I start by solving the Palestinian-Israeli problem first. And I offer it from a security perspective, naturally. You can learn more about Barnett's decalogue here but you really need to read chapter four to get the details.

Here is a taste:

Peace is nice, but security is what counts.
Peace activists create more harm than good.