Why encryption is important in communications

Communications between devices often passes over public networks that have varying risks of eavesdropping and interference by adversaries. While the endpoints involved in a communications session may be protected, the communications itself might not be. For this reason, cryptography is often employed to make communications unreadable by anyone (or any thing) that may be able to intercept them. Like the courier running an encrypted message through a battlefield in ancient times, an encrypted message in the modern context of computers and the Internet cannot be read by others.

  • excerpt from a book in progress

In air travel and data security, there are no guarantees of absolute safety

The recent tragic GermanWings crash has illustrated an important point: even the best designed safety systems can be defeated in scenarios where a trusted individual decides to go rogue.

In the case of the GermanWings crash, the co-pilot was able to lock the pilot out of the cockpit. The cockpit door locking mechanism is designed to enable a trusted individual inside the cockpit from preventing an unwanted person from being able to enter.

Such safeguards exist in security mechanisms in information systems. However, these safeguards only work when those at the controls are competent. If they go rogue, there is little, if anything, that can be done to slow or stop their actions. Any administrator with responsibilities and privileges for maintaining software, operating systems, databases, or networks has near-absolute control over those objects. If they decide to go rogue, at best the security mechanisms will record their malevolent actions, just as the cockpit voice recorder documented the pilot’s attempts to re-enter the cockpit, as well as the co-pilot’s breathing, indicating he was still alive.

Remember that technology – even protective controls – cannot know the intent of the operator. Technology, the amplifier of a person’s will, blindly obeys.

DSL Hell

I am a CenturyLink DSL customer in Seattle, WA. CenturyLink advertises 1 Gig Internet, but in our neighborhood, 10MB is all that is available.  Countless inquiries to customer support and tech support have not identified a soul who knows if or when faster DSL is coming to my neighborhood.

Often, the DSL is so bad that simple tasks such as loading web pages often times out. Speed tests typically show < 1MB of download speed. Here is a typical test from earlier today.speednot

CenturyLink techs have been out to the house numerous times. I’ve tried several different modems. I’ve bypassed my internal wiring altogether. Nothing they have done has made any difference.

I am a work from home (WFH) security consultant. However, on bad days, WFH is more like “wait from home”. Some days it seems like a miracle if my VPN connection stays up for more than an hour.

Here in Seattle, my only choices are CenturyLink for DSL and Comcast. CenturyLink has had two years to get the DSL service working right. Comcast, you’re next. My neighbors all say their Comcast Internet rocks and is really fast. Let’s hope so.

Don’t let it happen to you

This is a time of year when we reflect on our personal and professional lives, and think about the coming years and what we want to accomplish. I’ve been thinking about this over the past couple of days… yesterday, an important news story about the 2013 Target security breach was published. The article states that Judge Paul A. Magnuson of the Minnesota District Court has ruled that Target was negligent in the massive 2013 holiday shopping season data breach. As such, banks and other financial institutions can pursue compensation via class-action lawsuits. Judge Magnuson said, “Although the third-party hackers’ activities caused harm, Target played a key role in allowing the harm to occur.” I have provided a link to the article at the end of this message.

Clearly, this is really bad news for Target. This legal ruling may have a chilling effect on other merchant and retail organizations.

I don’t want you to experience what Target is going through. I changed jobs at the beginning of 2014 to help as many organizations as possible avoid major breaches that could cause irreparable damage. If you have a security supplier and service provider that is helping you, great. If you fear that your organization may be in the news someday because you know your security is deficient (or you just don’t know), we can help in many ways.

I hope you have a joyous holiday season, and that you start 2015 without living in fear.


Padding Your Resume

It’s a popular notion that everyone embellishes their resume to some extent. Yes, there is probably some truth to that statement. Now and then we hear a news story about people “padding their resumes”, and once in a while we hear a story about some industry or civic leader who is compelled to resign their position because they don’t have that diploma they claimed to have on their resume.

Your resume needs to be truthful. In the information security profession, the nature of our responsibility and our codes of ethics require a high standard of professional integrity. More than in many other professions, we should not ever stretch the truth on our resume, or in any other written statements about ourselves. Not even a little bit. Those “little white lies” will haunt us relentlessly, and the cost could be even higher if we are found out.

– first draft excerpt from Getting An Information Security Job For Dummies

Understanding success in an information security job

There is a basic truth of information security jobs that can be intensely frustrating to some people but represent an exciting challenge to others: your guidance on improving security and reducing risk will often be ignored.

Many security professionals have a difficult time with the feeling of being ineffective. You can spend considerable time on a project that includes recommendations on improving security, and many of those recommendations might be disregarded. A track record of such events can make most professionals feel like a failure.

A security professional needs to understand that they are a change agent. Because information security practices are often not intuitive to others, your job will often involve working with others so that they will embrace small or large changes and do their part in improving security in the organization. To be an effective change agent, you need the skills of negotiation and persuading others to understand and embrace your point of view and why it’s important to the organization.

You need to realize, however, that even if you are a skilled negotiator, you still won’t get your way sometimes. This should not be considered a failure, and here’s why: it’s our job to make sure that decision makers make informed decisions, considering a variety of factors including security issues. As long as decision makers make informed decisions (meaning, we have informed them of the risks associated with their choices), we have done our job, and we need to be comfortable knowing that sometimes decisions are made that we don’t agree with.

– Excerpt from Getting An Information Security Job For Dummies, to be published in 2015

iOS Apps That Improve My Professional Life

I rarely write publicly about apps I use on my iPhone and iPad, but there are a few I have been raving about with my colleagues and clients lately.

1. Sleep Cycle

sc1This is a unique alarm clock that tracks my sleep quality. It uses the iPhone’s motion sensors to track whether I’m tossing and turning, or sleeping more soundly.  But my favorite feature is the intelligent wake-up alarm that gently wakes me up when my sleep is shallower.  How it works: say that I want my alarm to go off at 6:00am; sleep cycle will monitor my sleep “depth” for the 20 minutes (configurable) prior to 6am and awaken me when I’m almost awake anyway.  The result: since starting to use Sleep Cycle three months ago, I have not been shocked out of a deep sleep by my alarm. Instead, I’m nudged awake and, as the first thing I experience during the day, it makes for a better day.

2. Waze

w1This is the navigation app that sort of “crowdsources” traffic conditions and hazards. Like Google Maps, it speaks turn by turn directions to my destination. But where it’s different: Waze is aware of the speeds of other drivers on my route, and if traffic suddenly slows (on the interstate as well as on city streets and country roads), Waze will navigate me around it.

Another cool feature: if there is a hazard ahead (accident, vehicle in road, vehicle on shoulder, debris), Waze will warn me with remarkable accuracy.  How this works: as you are traveling your route, if you see one of these, two or three taps will mark the hazard and warn others behind you.  When the hazard is gone, you just tap “not there” and drivers behind you won’t be warned.

Another nice feature for me is that the turn by turn directions can be transmitted via Bluetooth to my so-equipped motorcycle helmet, with my iPhone in my jacket pocket. I get turn by turn directions in audio only, and I can still find my way to a new client location in nice weather when I’m motorcycling.

3. Uber

Perfect for my business travel. I really don’t need to say any more.

4. Urban Spoon

As a frus1equent business traveler, I’m often trying new restaurants and looking for something new for internal or client dinners. You can filter by cuisine, distance, rating, cost, or just randomly select someplace nearby if you are feeling adventurous.