On Tuesday, April 21, I am leading a Peer-to-Peer (P2P) session at the RSA Conference in San Francisco. The title is “Hacking High: Teaching Our Kids Vital Cyber Skills.” The premise is that we need more kids with cyber smart skills, but they aren’t educated enough on the underlying technologies. This discussion explains those issues and brainstorms ideas for solving them. As the US CyberPatriot mentor of the year, Ron Woerner will talk about his experiences and show you how you can get involved in your community. See more at: https://www.rsaconference.com/events/us15/agenda/sessions/1879/hacking-high-teaching-our-kids-vital-cyber-skills#sthash.NxeQRUQm.dpuf
I was interviewed by Fahmida Y. Rashid, the Editor-in-Chief of the RSA Conference about the session. Her questions along with my answers are below.
1. Who are the attendees who will most benefit from—and contribute to—this peer2peer session? Do you have a specific role or job title in mind? Or even the kind of skills and mindset you are looking for?
The Peer-to-Peer session, “Hacking High: Teaching Our Kids Vital Cyber Skills” is for anyone who sees the great need in our industry for developing skilled cybersecurity professionals. This could be hiring managers, security trainers and educators, or anyone with the passion for building the next generation. This session will explain the issues and brainstorm solutions for meeting that need. There are many great opportunities for existing security professionals to work with the new generation. This goal of this session is to show them easy ways to be part of the solution.
2. Why do you believe that your topic is important for the information security industry—and your attendees—to be thinking about?
We’re in a national crisis. There is a continued need for more skilled cybersecurity professionals, yet we don’t have a consolidated plan for building people with those skills. Additionally, many kids know how to point and click, but they don’t know how the underlying technology works or worse yet, basics on how to keep themselves and their information safe online. This leads to bad choices. To make it worse, most teachers lack resources and personal knowledge to teach technology to teenagers.
The articles below demonstrate the need:
• “Demand to fill cybersecurity jobs booming” – http://peninsulapress.com/2015/03/31/cybersecurity-jobs-growth/
• Cybersecurity’s hiring crisis: A troubling trajectory –http://www.zdnet.com/cybersecuritys-hiring-crisis-a-troubling-trajectory-7000032923/
• Developing the Next Generation of Cyber Leaders – http://www.serco-na.com/docs/materials/2012-cisse-nextgencyber.pdf
There are solutions available, but we need to work together as an industry to implement them. My simple solution is to teach hacking in schools. Kids will do it anyway, so we might as well guide them to keep them out of trouble and develop those critical skills. Everyone I talk with agrees that we need to start teaching IT and cybersecurity skills earlier in schools, but we don’t have a plan to do it. One of the solutions I will discuss is the role of cybersecurity and hacking competitions for 7-12 grade students. As the 2013-2014 Air Force Association CyberPatriot Mentor of the Year, I will be sharing my experiences with participants to show how easy it is to get involved and the many rewards in doing so.
3. Can you describe one or two things you would like the attendees to think about prior to the session, as a way to prepare themselves for the discussion?
Two things I’d like attendees of my session to consider is:
1. How is your community or school system educating the younger generation to prepare them for the multitude of IT and Cybersecurity careers? Is a cybersecurity curriculum in place? If so, what does it contain?
2. What are solutions for filling that gap? How can we work together to implement those solutions for our school aged kids.
This allows attendees to understand the problems and then be able to generate and implement solutions for addressing the needs.
4. What kind of outcome are you hoping for at the end of the session? What will attendees walk away with afterwards?
We need more security professionals to lead the education of our next generation. We can’t just leave it to the teachers. Attendees of the “Hacking High” session will fully understand the issues and come away with actionable ideas to be part of the solution. They will hear from other industry experts who are doing successfully doing it in their community to everyone’s benefit. They will see the bright star of hope to meet the critical needs of our industry in a fun and safe way, by teaching hacking in high school.
For more information on these topics, please see my blog entries:
• Why Aim for the Ground? Teaching our kids the right computer skills
• Hacker High – Why we *need* to teach hacking in school
• Lock IT Down @ CYBER++
We all need to work together to solve this international issue. In doing so, we not only build up a new generation, but build ourselves as well.
Are you watching what you are telling your neighbors? Do you guard information in your care to make sure only those people with a need to know can see it? Hopefully, you’re not accidentally letting any secrets slip. It could be disastrous if confidential information got out to your competitors. It could hurt your sales, your stock price and your reputation.
It happens in a variety of ways: accidental disclosure, carelessness in storage and protection, and corporate espionage. Many times, it happens because people are not always conscious about how they handle sensitive information. Employees are often the greatest threat in the compromise of sensitive information.
Following the simple steps below will help assure your ship is not sunk by loose lips:
1. Know your information. Is the information you handle sensitive or confidential? What would be the damage if it gets out to the public or one of our competitors?
2. Label sensitive, proprietary or confidential information. You may know that the information is sensitive, but do your co-workers? This is solved by labeling the document or data source as confidential.
3.Stop and think before doing anything with the information. You should be conscious on how you use the information and where you store it. Don’t share it with someone who doesn’t need to know.
4. Protect sensitive, proprietary or confidential information. This is a separate article by itself. In general here are some things you can do:
- Place it in a secure location (not the public folder or even your laptop hard drive).
- Better yet, don’t store a copy outside of a protected area. Your PCs hard drives are neither secure nor protected. If you don’t need a copy of a document, then don’t keep it on your computer.
- Don’t send it to an outside email address unless absolutely necessary.
- Encrypt it (using a tool like Microsoft Bitlocker)
- Remove any extra copies of sensitive documents. Maintain originals in a secure location and get rid of all other copies.
5. Ask for help. Work with your security department. If you are the security department, ask for help from others.
6. Be on the lookout. Inform security if you find sensitive information that you shouldn’t be able to see. It’s not to get someone else in trouble, but to protect your company. Security should collaborate with the originator to ensure its proper protection.
These may seem like simple ideas, but they are still overlooked. A little time in security now can save many headaches later.
“Never give in, never give in, never; never; never; never – in nothing, great or small, large or petty – never give in except to convictions of honor and good sense” – Sir Winston Churchill, Speech, 1941, Harrow School
Perseverance is one of the better traits to have for security professionals and anybody. Rarely do things work out the first time tried. It often takes multiple attempts using multiple techniques to accomplish the goal. The key is to never give up (or give in as Sir Winston Churchill says in the quote above).
While I’m sure I had this trait beforehand, I really got this trait in College. This was back in the late ’80’s when all they had was Computer Science and they mostly taught C programming. Some people are born to program, but I’m not. Most assignments were a battle. I’d try one thing, test it, figure out what I did wrong, and then try again. It was totally trial and error. Although I don’t remember very much C, I do maintain the trait of perseverance.
This is also important in computer security where you often need to try multiple approaches to reach your goal. It can be seen in vulnerability or penetration tests, forensic investigations, or configuring an application. Fortunately with most systems, there are multiple ways to do things. So if one way doesn’t work, try another. When you begin to get frustrated, take a break. It’s okay to ask for help, but make sure you’ve done your homework and tried everything you can think of. You may even want to write down what you’ve done to track your progress. Don’t take the easy way out and quit trying. A good part of the learning is not in reaching your goal, but in the lessons you learn along the way.
I’ll finish with a quote from one of the best philosopher’s of our time, Yoda: “Do or do not… There is no try.”
Viruses on our computers are about as prevalent as the common cold. It’s not a matter of if you’ll get infected (or a cold), but when. Cold remedies are a multi-billion dollar industry. Anti-Virus (A/V) and malicious software (aka malware) defense and clean-up is quickly catching up. There are a few good sources on A/V products that may help you decide the one that’s best for you (note: these are all for PC):
- AV Comparatives Independent Test of Anti-Virus Software Provides a good comparison of top brands. It’s consistent with other, similar reports. See http://www.av-comparatives.org/dynamic-tests/
- Techradar provides their list of “Best Free Antivirus Software, 2014″ http://www.techradar.com/us/news/software/applications/best-free-antivirus-9-reviewed-and-rated-1057786
The things with colds is that they usually go away on their own given 3-10 days (taking zinc early on helps, btw). That’s often not true with computer viruses. Anti-virus solutions aren’t 100% effective against all types of malware.
What can you do if your PC gets infected and your A/V product isn’t taking care of it? Below is an email from a student who’s grandparent’s computer got infected along with my response. It’s not intended to single-out this student or his grandparents, but to use it as a case on how to respond when the inevitable infection hits.
From the student:
We shouldn’t get tunnel vision when protecting our homes and with all the emerging methods to breach security (e.g. bash bug), we have to stay diligent. Indeed the low hanging fruit is the one to get plucked. I talked with my fiance’s grandparents this week and they have unfortunately fallen victim to a classic social engineering scam. Someone called the grandmother claiming to be a technician from her anti-virus software company. He then asked for various sensitive information from her (i.e. passwords, credit card numbers, etc.) and she naively gave up the information trusting this gentleman, when he told her that something was wrong with her computer.
Now every time she connects to the internet, this d%&$ has remote control over her PC. He contacts her saying that he will not give up control of the PC unless she pays him more money. I’m planning on doing some serious overhaul on their laptop the next time I visit.
This is a classic case of ransomeware. Re-imaging the PC and starting with a clean slate is the only sure-fire way to get rid of the problem(s). Most companies now don’t even spend time trying to remove malware. They’ll just save any important files first and then re-image. This person should be able to boot to safe mode to grab any local files on the PC before they re-image it.
If the you have time and wants to experiment, she/he can use SysInternals Suite tools to try to manually remove it. Have her/him watch the video, “Malware Hunting with Mark Russinovich and the Sysinternals Tools.” It’s a great tool to learn how to effectively use the SysInternals Process Monitor, Process Explorer, and Autoruns, focusing on the features useful for malware analysis and removal. He makes it look easy.
(I’m assuming this is a Windows PC.)
What tools / techniques do you like to use for malware defense and removal? Please comment and share your ideas.
We’re in a national crisis. Many kids know how to point and click, but they don’t know how the underlying technology works or worse yet, basics on how to keep themselves and their information safe online. This leads to bad choices. To make it worse, most teachers lack resources to teach technology to teenagers. In a talk at DerbyCon 2014, Professor Phil Fitzpatrick explains why our kids need to learn fundamental computer skills in a fun and ethical way; through education and competitions like CyberPatriot. It’s a discussion of why high school students should learn more than just simple computer applications and what security professionals can do to help.
Below are are problems as we see it:
– The general public understands that most jobs out of high school, are based in knowing and having IT skills. Yet, most parents hand off their kids starting in 6th grade assuming all areas of education are covered, especially technology.
– High schools are trying to answer the call for more IT workers by adding technology classes to their curriculum. However, they don’t have a lot of room for a variety of courses because of school year length, teaching expertise and availability, and their nature of school environment.
– Kids only need to take one technology course to graduate and they look for the easy “A” rather then what will help them with their careers.
– Schools are challenged with keeping the curriculum and technology up to date to meet current needs.
– High schools are more concerned with getting students ready for college or working by teaching necessary life skills.
There are solutions available:
– Establish technology academies in schools that teach a variety of cyber skills, not just what’s on the computer science AP test.
– Provide courses in application develop, systems and network administration, database management, and cybersecurity.
– Encourage teachers to build their knowledge base on different computer skills needed by industry.
– Use grants to ensure technology is up to date.
– Promote competitions and clinic like US CyberPatriot (http://www.uscyberpatriot.org/).
– If you’re an IT or Cybersecurity Professional, become a mentor. These kids need someone with experience to help guide them in the journey. They’re not looking for an expert, just someone who cares. AND it’s very rewarding for the mentor.
Lastly, educate yourself. Here are some links to get you started:
– Cybersecurity’s hiring crisis: A troubling trajectory – http://www.zdnet.com/cybersecuritys-hiring-crisis-a-troubling-trajectory-7000032923/
– Developing the Next Generation of Cyber Leaders – http://www.serco-na.com/docs/materials/2012-cisse-nextgencyber.pdf
– DoE: Science, Technology, Engineering, and Math: Education for Global Leadership – http://www.ed.gov/stem
– Cyber-Security, IAS and the Cyber Warrior – http://www.cisse.info/archives/category/29-papers?download=297:p11-2012
– High School 12-Week Cybersecurity eLearning Pilot – http://www.cisse.info/archives/category/29-papers?download=295:p09-2012
– Secure Coding Education: Are We Making Progress? – http://nob.cs.ucdavis.edu/~bishop/papers/2012-cisse/seccode.pdf
– Where are the STEM Students? – http://www.stemconnector.org/sites/default/files/store/STEM-Students-STEM-Jobs-Executive-Summary.pdf
– ACM: Toward Curricular Guidelines for Cybersecurity – http://www.acm.org/education/TowardCurricularGuidelinesCybersec.pdf
Also see the previous post, “Hacker High – Why we *need* to teach hacking in school.”
Please help be part of the solution by promoting cyber education in your community.
As both an educator and a security professional, I often see people who get frustrated. It could be with a school or work assignment. To help reduce frustration, here are some words of advice:
- DON’T PANIC. This is my first rule of incident response. Getting all worked up never solves the problem. Take a deep breath or a time-out if needed and then proceed.
- Understand “Who Owns the Headache?” So often, we get frustrated with things outside of our realm of control. Basically, we try to fix things that we can’t because we don’t have control or “Own the Headache.” Acknowledge what you can control and what you can’t. Only focus on the things you can.
- Research it. Ask yourself: Is this information available from an Internet source (iow, Google it)? One thing hammered into me when I was in ROTC was “use your resources.” You don’t need to know everything. You just need to know how to find the information and then use it intelligently.
- Look at the problem from a different perspective. Is there another way to solve the problem? In computers, there’s usually at least 2, if not many more ways to solve any problem. That’s why I don’t usually have a set answer in mind. You may think of something I haven’t that works just as well.
- Take a time out. Step away from the problem for a little while. Sometimes they resolve themselves, as in the case with bellevue.edu being down. Sometimes, it will give you a chance to think about it and think it through. This also gives your subconscious some time to process and develop a solution. (Have you ever had a “duh, I should’ve thought of that” moment?)
- Ask someone. A person is also a resource (see use your resources above). First try a fellow classmate or colleague. I love it when students work together and help each other to solve problems. The student’s who collaborate get bonus points in my book. It’s truly a win-win for everyone. This is also part of my personal mantra, “By helping each other, we’re all smarter/stronger/better.”
- Ask good questions. If no one else has the answer (about an assignment), then ask your professor or your boss. If something’s not clear, then ask for clarification. In today’s world, it’s not the answers you have, but the questions you ask. Come up with good questions, then be bold and ask them.
The idea is to prevent frustration, which inhibits learning and growth.
“Every man…should periodically be compelled to listen to opinions which are infuriating to him. To hear nothing but what is pleasing to one is to make a pillow of the mind.” St. John Ervine
This rant is in response to Quinn Norton’s opinion piece from May 20, 2014, “Everything is Broken.” (Link: https://medium.com/message/81e5f33a24e1)
I have a simple solution that’s hard to implement: TEACH HACKING IN HIGH SCHOOL*! Yes, you heard it right. We need to teach our kids all about technology. Including how to break it and how to fix it. It’s incredible how little they really know. To them it’s PFM (Pure Frickin’ Magic). We won’t solve this problem with our adults. That’s why we need to get the kids involved. The problem is that they think they understand technology, but it’s only how to use it. Many (most) are clueless about systems & network administration as well as security. “Dad, the computer’s broken again…” I don’t think this is just my teenage kids.
The curriculum development is easy; adoption is hard. This is for three reason:
1. Cyber isn’t included in the common core curriculum, so they don’t have time to teach it as a primary subject. They try to teach it on the side with limited affect. The problem is also with our government officials who don’t see cyber as important. A fun study would be to see how many government leaders are proficient in technology. My hypotheses is that it’s less than 10%.
2. We don’t have teachers qualified to cover it and the good computer folks don’t want to take the huge pay cut. [At my daughter’s middle school, cybersecurity is taught by history and English teachers… I’ve volunteered many times to come into their classrooms and hear crickets…] It’s often that the teachers don’t know what they don’t know and are afraid to look ignorant if they ask for help. [NOTE: There are some fantastic teachers out there doing great work. This doesn’t apply to them. The problem is that they are the minority. They are also limited by what they can do and what they can teach.]
3. There’s no standard curriculum for Information Technology or cybersecurity. It’s up to the teacher to develop his/her own, which is therefore based on his/her knowledge. (See #2.) Local school boards are responsible for deciding what’s included in their schools curriculum, but they don’t seem to understand cyber. Another fun study would be to see how many school board members are proficient in technology. My hypotheses is that it’s less than 20%. We need a standard cyber curriculum for the teachers to work from. It should be broad enough to allow flexibility for the teachers, yet cover primary topics of how the technology works.
We need to find a way to teach IT and cybersecurity to our kids starting in elementary school and then throughout middle and high school. The problem is that we’re blocked by adults who don’t understand the necessity. The solution is out there people. For example, see staysafeoneline.org and stopthinkconnect.org. We just need to use it.
Help spread the word that we need to TEACH HACKING IN SCHOOLS. Talk to your local school board and elected officials.
*NOTE: I use the broad definition of hacking, meaning developing a curiosity on how things work. It’s not the malicious kind. When teaching hacking, ethics must be included. The intent is to keep the kids out of the orange jumpsuits (even if it’s the new black).
[This rant reflects my opinion and not necessarily the views of my employer. ]
Albert Einstein defined insanity as, “doing the same thing over and over again and expecting different results.” Isn’t that exactly where we are today with passwords? We keep using the same method for protecting ourselves online, but it’s not working. How many times this year have you had to change your password because of a breach?
Well let’s see… There was the heartbleed bug forcing users to change passwords on numerous sites… Michels… AutoNation… Spotify… and now eBay… All in the last 4-5 months.
This is a royal pain for anyone, but especially the uninformed user. Many use the same password across sites. When there’s a breach, they receive a notification to change their password. But it’s not only for that one site/service. It’s for all of the others where they used that same password. Now, this poor user needs to remember which sites had that same password. Then they need to go to that site, find where they change their password and enter a new one. It’s a lot of work. Oh, and “Who wants my account anyway?”… Let’s be honest, most people won’t go through the trouble…
The bottom line is that PASSWORDS SUCK! There’s just no other way to say it. They’ve sucked for years, but yet they’re still the major form for authenticating ourselves online. They’re cheap and easy for both the user and the service provider.
Yet time and time again, we see they’re not safe. Passwords alone don’t provide the level of protection needed on the world wild web.
There is hope! Many online sites are now providing multi-factor authentication. This allows users to easily secure their accounts using with the standby password (something you know) tied to a second factor: something you have (a physical token, chip, fob, or phone), something you are (your voice or fingerprint) or somewhere you are (your home location). Adding this second factor provides you with added security and will save you the hassle of having to change your password when the security is invariably breached on the site.
StopThinkConnect (http://stopthinkconnect.org/) has made it very easy for users to learn more. They’re new site (http://stopthinkconnect.org/campaigns/details/?id=460) and campaign “Two Steps Ahead: Protecting Your Digital Life” provides a single place to learn how to enable two-factor authentication. But Wait! There’s more!* This one site has links to many other popular sites (e.g., Google, Outlook, Facebook, Tumblr, Twitter, etc.) where you can easily setup two-factor authentication. It’s easy and convenient right from this one site.
UPDATE: There’s one other site you need to be aware of: http://twofactorauth.org/. It’s a crowdsourced site started by a researcher from Iowa State University. It’s a comprehensive list of what websites and services use 2-Factor Authentication (2FA) and which ones don’t.
Please, help stop the insanity. Take the time to set up two-factor authentication. Share this with others. Let’s move together to a more secure tomorrow.
*Sorry, if I sound like a infomercial. It really is a great site.
Cybersecurity is one of the hottest career fields today. Getting into it takes education and experience. Basically you need practice to hone your skills in securing IT infrastructure systems. This month, you get that chance to practice.
Bellevue University is hosting the CYBER++ Lockdown Competition on April 26, 2014 as part of the Nebraska Science Festival. This is a cyber defense competition designed to test your science, technology, engineering, and mathematics skills in a safe, virtual environment. It’s free and open to all high school and undergraduate college students in the Omaha, NE area. In this competition, teams of 2 to 4 students along with a mentor/coach will match wits to fix vulnerabilities and toughen systems security. No prior cyber security experience is needed. Prizes will be awarded to the top scorers in each category.
Name of Event: CYBER++ Competition
Date/Time: Saturday, April 26, 2014, 8:30 am – 3:00 pm
Location: Bellevue University, Educational Services Building, 1000 Galvin Rd South, Bellevue, NE 68005
Open to: All High School and Undergraduate College Students interested in Cybersecurity.
Cost: FREE! (Breakfast & Lunch will be provided to registered contestants)
For more information and to register, go to http://www.bellevue.edu/cyberplusplus/.
Sign up your team today and please help spread the word about this great event.
I recently was asked, “What books, article, websites, blogs, or videos do you recommend for those just beginning in Cybersecurity?”
It’s a great question with many answers. Too bad you can’t just come to my office and look on my bookshelf…
There are many reading and viewing options for cybersecurity. The challenge isn’t the lack of material, but the overabundance (which is a good topic for another blog post).
The following resources are great for all levels of cybersecurity professionals.
Blogs & websites:
– RSA Conference 2014 On-Demand Sessions: http://www.rsaconference.com/events/us14/downloads-and-media/video-index
– TED Talks Playlist, Who are the hackers? – http://www.ted.com/playlists/10/who_are_the_hackers.html
– TED Talk, Bruce Schneier: The security mirage: http://www.ted.com/talks/bruce_schneier.html
– Cambridge Ideas, Professor Risk (Dr. David Spiegelhalter): http://www.youtube.com/watch?v=a1PtQ67urG4
– “The Cuckoo’s Egg,” Clifford Stoll,
– “Secrets & Lies,” Bruce Schneier
– “The Art of Deception,” Kevin Mitnick
– “Spies Among Us,” Ira Winkler
Book Reviews & Commentary:
– At the 2014 RSA Conference, Rick Howard of Palo Alto Networks gave a talk titled, “The Cybersecurity Canon: Must-Reads.” You can also find the list of his favorite cyber/security books on his Terebrate blog at http://terebrate.blogspot.com/2014/02/books-you-should-have-read-by-now.html.
– Ben Rothke, a well-known security guru / speaker / writer, provides numerous book reviews for RSA including The Best New Books from RSA Conference 2014. You can see all of his RSA blog posts at www.rsaconference.com/blogs?keywords=rothke.
The time you spend on these resources will be well spent in developing yourself as a cybersecurity professional. If you have one you think is missing, please provide a reply or email me.