Perfection is the destination, not the starting point
Preface: This post is not directly related to security. It’s something for all professionals to consider.
It’s the start of a new day. The sun is shining, birds are singing, and we have a fresh start. We have time to smell the roses and ensure everything goes our way (Zip-A-Dee-Do-Dah!). Yet how often do our mornings actually start like this?
More often our days start frenetically as we rush to our jobs and other activities. We miss critical details that may or may not make a difference. It’s really the same with anything new.
Many of us want things to be perfect when we start something, whether it’s a new day, a new job, or a new project. There are those who won’t even start until everything is in line according to their plans. The expectation of perfectionism isn’t realistic and really hampers our efforts. This leads to the title of this piece: “Perfection is the destination, not the starting point.” Being perfect is something to strive for, not to start with.
If you wait to start anything until whatever you’re doing is perfect, you’ll start nothing. Or To take from Jeff Bullas’ blog Are You Waiting to be Perfect?, “If you don’t start then nothing will happen…. it is that simple.” Or as Leo Tolstoy puts it in Anna Karenina, “If you look for perfection, you’ll never be content.”
It’s unrealistic not to expect something to go wrong or at least not be exactly like we want. It’s better to embrace life’s imperfections and know when “good enough” is really what you need. This sets the level of expectations for everyone, even (if not especially) ourselves. Admitting our propensity for errors demonstrates our humanity and shows that we are real. It’s a paradox that when we allow for our weaknesses, it demonstrates our strengths.
“The journey of a thousand miles begins with a single step” and that step doesn’t need to be perfect; it just needs to be there. An organization’s culture needs to embrace this concept and allow employees to be willing to step out and start. Guy Kawasaki’s book, The Art of the Start: The Time-Tested, Battle-Hardened Guide for Anyone Starting Anything he encourages entrepreneurs to make meaning, make mantra, and get going. It’s a definitive guide for anyone starting anything.
What do you need to start? Are you waiting for it to be perfect before you do? Don’t. It’s okay to be human. If you never start anything, you’ll never go anywhere.
[Note: This is being cross-posted on IBC Viewpoints.]
What’s in Your [Security] Wallet?
No, this isn’t a blog about the credit card you use or identity theft. This is about the tools you have on hand as a security professional.
Like any tradecraft, Security Professionals should have a set of tools, in this case applications, that they keep handy for when they need them. Fortunately, there are many security tools readily and freely available that fit nicely on a 2-4Gb USB thumb drive. These tools have a variety of purposes to help the IT or Security professional diagnose and troubleshoot problems. A quick note before I dive into my tools of choice, sectools.org contains an almost complete set of security apps that should be known by all security professionals.
- Windows SysInternals (http://technet.microsoft.com/en-us/sysinternals) – This is the toolbox for Windows. Maintained by Mark Russinovich, these are the applications not included with the Windows Operating Systems, but should be. The tools that I use most are Process Explorer, Autoruns, and Zoomit.
- Wireshark (http://www.wireshark.org/) – Wireshark is an open-source network analyzer that works on many platforms. You can use it to look into network packets for both security and troubleshooting.
- Firecat (https://addons.mozilla.org/en-US/firefox/collections/clausv/firecat1_5_plus/) – This is a collection of add-ons for Firefox that allow you to (A) safely browse and (B) test the security of a web application.
- NMap (http://nmap.org/) – Nmap is the network scanning and security auditing tool. Often featured in movies, this open-source application is used for network inventory, managing service upgrade schedules, and monitoring host or service uptime.
- Backtrack / Kali (http://www.kali.org/) – This is a Linux-based operating system that comes complete with most security tools. You need to install it on a clean thumb drive and boot from it.
A couple of quick notes:
- These are just a small handful of good tools, but there are many others out there. If there’s one you think I missed, please reply to this post with your favorite. A caveat is that the tool must have a useful, free or open-source version readily available. It also must be small enough to fit on a thumb drive.
- Neither I nor my employer are directly associated with these sites and tools. As always, use at your own risk.
What’s in your (security) wallet? Do you have a favorite tool that you keep in your security tool belt? Let us know.
Threat Modeling – What’s the worst that can happen?
A threat is defined as “a person or thing likely to cause damage or danger.” Threats are all around us, but we shouldn’t treat all threats as equal. Too often we fail to identify threats because they aren’t readily apparent or we consider them to be too small.
Threats and vulnerabilities are both part of the overall risk equation. While organizations are getting better at identifying and fixing weaknesses, many still don’t understand the potential threat landscape. We’ve all heard, “Oh no one would ever want to attack us. We’re so small and our systems have no value.” I can hear Target saying that about their HVAC systems. Malicious hackers can use anything connected to a production network in order to gain access. It shouldn’t be assumed that a small target means it can’t be hit.
All organizations should conduct assessments to understand the multitude of threats they face both in and out of their cybersystems. Threat modeling is still a new arena in security, but it’s gaining in prevalence. In CSOOnline (http://www.csoonline.com/), George V. Hulme has an article, “Can threat modeling keep security a step ahead of the risks?” where he makes a case for more effective threat modeling. He references how a CISO uses threat modeling to understand the organization’s risks, prioritize security spending, and focus security efforts.
Adam Shostack is also calling for increased threat awareness. In his book coming out on Feb 17 called, “Threat Modeling: Designing for Security“ he explores various threat modeling approaches, explains how to test system designs against threats, and learn effective ways to address threats that have been validated at many top companies.
What does this mean for you? As security professionals, we conduct threat modeling throughout our career. That’s why we take the time to study threat modeling and apply it.
Breaking into Security
One of the common questions I am asked is, “How do I get a job in information security?” Infosec continues to be a hot career field with many job opportunities. Therefore, we continue seeing people who are interested, but don’t know the steps it takes to gain employment in information security. This blog post answers the question, “How do I break into (the) security (career field)?”
A few years ago, I was asked a similar question of how I got started in security. It all started as a computer science major at Michigan State University. I was also in Air Force ROTC. This combination allowed me to start developing my security mindset. As a military intelligence officer, I learned about data classification and safeguarding sensitive information. I left the Air Force for a job as a UNIX systems administrator where I learned how to apply technical controls to protect the systems and its data. As a junior security analyst, I learned the importance of policies and awareness. The combination of technical and managerial experience led me to security management roles. (You can read more about my experiences here: Me and my Job: Ron Woerner, Bellevue University, SC Magazine, April 2011)
To become a security professional, you need a mix of experience, knowledge, and abilities. It’s not generally an entry level career field, because you need time to develop yourself as a security professional who understands the many aspects of cybersecurity. The security community has a vast number of articles on breaking into the security career field.
- This article from the great security blog site Securosis contains recommendations for starting in security and potential career tracks: “Who to Recruit for Security, How to Get Started, and Career Tracks”.
- “I Am InfoSec, and So Can You:” is an article by Ben Tomhave now a Gartner analyst. In particular see his second paragraph explaining what we really need in security. He also has a number of tips for those who are still crazy enough to enter the field.
- Layer8’s blog on “Bootstrapping the next generation” explains what it takes to develop as a security professional.
- Lastly, Jenifer Noss (currently a MS Cybersecurity student) has a nice piece on “Finding work as an IT Security Specialist.” She is not only a student, but also a seasoned cybersecurity professional. Check out the links in her blog for where to go tshe provides for increasing your cybersecurity potential.
This reminds me that everything old is new again. Many of the articles I mention above were written a few years ago. Things really haven’t changed over the years. The career path still requires education, training, experience, and persistence.
As an extra, added bonus, here’s a 3 ½ minute Ted talk from Richard St. John: 8 secrets of success - http://www.ted.com/talks/richard_st_john_s_8_secrets_of_success.html (Watch for his explanation of CRAP). It’s great, general information on how to succeed in any career.
Is it time of Security Rating of Software and Systems?
One of the fundamental papers in the Information Security industry is “The Protection of Information in Computer Systems” written by Jerome Saltzer and Michael Schoeder in the mid-1970s. This paper defines eight design principles to ensure the safety, security, and functionality of computer systems and applications. It’s timeless as those principles still apply today. If you haven’t seen it yet, Adam Shostack of Emergent Chaos does a great job in his blog of explaining the Saltzer and Schroeder Design Principles and equating them to something almost everyone can understand: Security in Star Wars.
One of the ideas that come out of it is the concept of “work factor” and the fire/safety ratings on safes. Safes are classified by Underwriters Laboratory for their ability to protect their contents from both fire and burglars. It’s the degree of protection that safe will protect its contents. There are both construction and performance requirements. The former defines the minimum specifications for the container. The latter defines how long the safe must withstand a burglary attempt. You can read more about it here: http://www.maximumsecurity.com/safes/pc/Burglary-Fire-Rating-Guide-d92.htm.
This idea isn’t new. A DARPA research report from 2001 presents it from a scientific standpoint: “Adversary Work Factor as a Metric for Information Assurance.” In this paper, Schudel and Wood present the hypothesis, “that adversary work factor is a quantifiable metric that yields valuable insights into the relative strengths and weaknesses of modern complex information systems.” The authors go on to develop an approach for observing and reporting adversary work factors for information systems.
It’s time we used the same approach in Cybersecurity. The UL rating system is a standard that’s long been in use in the physical world. Why not begin to follow it in the cyber world? The IT industry should consider creating construction and performance standards for all computer systems and applications. An unbiased, standardized security work factor rating would allow consumers to understand the safety of an application or system to determine if it fits into their risk appetite.
Why reinvent the wheel?
Protecting Yourself in an Insecure Cyberworld
A friend of mine recently asked for 5 quick tips for people to protect themselves from cyberfraud and identity theft. While there are many great ideas out there on the sites listed below, here are the five I promote:
- Watch your credit card. When paying with a credit or debit card, pay attention to who has it and where it’s going. It’s easy for the waiter/waitress or cashier to steal the information when they take it out of your sight. Most identity theft occurs with the physical card and not online.
- Keep track of your charges. Know each time you spend money especially with credit and debit cards. This will make the next steps easier when you check your statements. You won’t need to rely on your memory as much (“What’s this charge?” and “Did I make it?”). While this is mostly important for payments made by credit or debit card, it also applies to cash.
- Pay attention to your statements. At least once a month, go through all of your bank and credit card statements to ensure all transactions are credible. It’s so easy to get lazy and neglect reviewing what’s being charged in your name. With electronic statements, you can do this multiple times a month. This allows you to catch potential problems earlier.
- Be careful when using public wi-fi. It’s a great convenience that so many places allow us to connect to the Internet using their free wi-fi. Keep in mind though that it’s like yelling in public; it’s not secret. Malicious hackers can “sniff” the airwaves and steal your information. I don’t recommend using public wi-fi for anything sensitive.
- Use strong passwords and keep them safe. Passwords are our keys to our identity and personal data. Choose and use the wisely. Don’t use the same password for all websites. That’s the same as having the same key for your house, car, office, safe, etc. Use different passwords especially for sensitive areas like your financial institutions. Microsoft has a good, online password checker to help you select strong passwords.
Below are some of the websites* and resources you can use to learn more about keeping yourself and your family safe online:
- FTC – Consumer site: http://www.consumer.ftc.gov/topics/protecting-your-identity
- IRS: http://www.irs.gov/uac/Identity-Protection-Tips
- Microsoft – Safety & Security Center: http://www.microsoft.com/security/default.aspx
What tips or sites do you have? Please share using the comments.
* These sites are not associated with Bellevue University. They are provided for your reference. Use at your own risk.
Security for the Real World – Password Policies
Passwords suck. They always have; they always will. But we’re stuck with them. They are the cheapest and easiest means of user authentication.
With passwords, come the ubiquitous password policies. This post addresses two of them seen at most organizations*:
1. Thou shalt not share they password.
2. Thou shalt not write down thy password.
* “Thou shalt” isn’t usually used in policies. I’m using it for effect.
There are many problems with these rules. First, they are almost impossible to enforce, unless it’s a really small organization or you have a large police force. Second, they are often violated by the top echelon in the company. How many CEO’s share their account with their admin? Are you going to tell the CEO that he’s violating the company policy? That’s a CLM (Career Limiting Move) if you ask me.
Rules like the ones above are to protect the organization, not the employee. They cannot be enforced, except when something bad happens. Then, the enforcer can point to the policy and report the violation. I call it a “speed limit” policy, which are good to follow, but aren’t continually nor consistently enforced.
Here’s the key to making those policies work: make the user responsible for his/her account. The policy statement would then be, “All users are responsible for protecting their login credentials from unauthorized access like they would protect any other corporate asset.” This puts the onus on the user. If someone gains unauthorized access to the user’s account because he/she didn’t follow the rules, then the user is accountable. They are guilty until they can prove themselves innocent. If someone (like the CEO) wants to share their account, they can as long as they realize that’s it’s them who will be held responsible for any actions taken by the other party.
With so many passwords to remember, people need to write them down. Telling people not to just isn’t realistic. Some use a password vault application. Others use a piece of paper. Both are fine as long as it’s rigorously protected. It’s fine for people to write down their passwords as long as they store it in a very safe location. My mom has a piece of paper with all of her passwords on it in a desk drawer in her apartment. I’m fine with it, since I may need it one day as her power of attorney. Her apartment is in a secure facility, so the risk is minimal. There’s a lot bigger risk of her becoming incapacitated and me not having access to her accounts.
That’s what it comes down to: understanding RISK and establishing Accountability. What are the risks associated with the actions? Who’s responsible? Answer those and you make a cognitive decision that’s both realistic and enforceable.
Cybersecurity Degree vs. Certification
What’s best for your career – a Cybersecurity certification or a degree in Information Technology (IT) security?
[Guest Author: Laura Linhart]
A few years ago, this question would not have been as relevant as it is today. The CISSP® (Certified Information Systems Security Professional) sponsored by the International Information systems Security Certification Consortium (ISC2) first offered as a security certification in 1994, was the first information security certification to meet ISO standards.[1] Since then, the number and types of information or Cybersecurity certifications and professional organizations that offer these certifications has proliferated.
The growth and evolution of information or Cybersecurity as a degree unto itself has also been significant in recent years. Today, many colleges or universities offer it is a field or major unto itself, offered as both undergraduate and graduate degrees. In previous years it was only available as a subset of another major such as data processing, computer networking or computer science.
From a career or professional perspective, information security appears to be a stable and growing profession[2] . As the profession continues to grow and evolve, the question of which is more relevant – a degree or certifications is now a consideration. As with most things in life, the best answer is “it depends”. Where you are at in your career, life’s journey (i.e., age) and your own ambitions are things to consider.
Degree – to expand or gain knowledge. On the positive side, a degree is forever, and does not require any upkeep. It will get you in the HR screening process door if an IT degree is a particular job requirement. It indicates that you have the work ethic to complete something.
Certification – to establish your credibility. Require continuing care and feeding (continuing certification requirements). Most also require years of experience in the specific area of certification. It indicates that you have the subject matter expertise.
Another variable to consider is practical experience. In some situations, practical experience means the most. It indicates that you have the ability, and can apply and expand on what you know.
The bottom line is that there is no one answer that fits all. It depends on your particular circumstances.
In reality, you will probably need both a degree and certification(s).
Security Convergence – Ready or not, it is here!
The security industry has been talking about the convergence of physical and information security functions for years. Many act as if it’s a big deal or that it’s a difficult endeavor to accomplish. I say, ready or not, it’s already here. Security functions and technology has merged right under our eyes. Let me explain.
First, let’s define “Security Convergence”. According to ASIS, it’s, “The identification of security risks and interdependencies between business functions and processes within the enterprise and the development of managed business process solutions to address those risks and interdependencies.” The key words are risks, interdependencies, and solutions. It’s critical to review the risks to the business and determine the best methods for mitigation. Notice that this definition contains no reference to information security or physical security.
Traditional practices have caused many large organizations to create security silos to solve individual problems rather than looking at the best solution to reduce risk. They separate physical from logical (or information) security without realizing that these groups serve the same purpose: mitigating risks. More progressive organizations have their security converged and are thus better able to handle common risks. These organizations are addressing the reality of risk management, which looks at methods to address risks regardless of the form.
Many new or small organizations lack a separate physical security force that is seen in established firms. They will often outsource physical security functions as part of their lease. They believe it covers all types of risks and ignore others that they cannot address due to time or money constraints. These businesses would be better served with a converged security function under a single employee who’s responsibility is to address all types of security risks: both physical and logical. With this, the company is better positioned to manage their security risks in a consolidated function.
One last point on the physical/logical security convergence is that most of the equipment used by physical security, such as cameras and monitoring, badge systems, etc. is already on the network. The camera system in your facility is most likely on your corporate IP network. There’s also a strong possibility that’s also true with your badge system. They are network servers, but are usually managed outside of IT. This is another case where a converged security function can better maintain critical company services.
Security isn’t something you bolt on and hope it works. It needs to be incorporated into the fiber of the organization. A converged security function allows this to occur in the most cost-effective way.
What do you think? Feel free to comment below.
What do you need? Security Education or Training
As you’re looking to improve yourself as a Cybersecurity citizen, you often need help from an outside source to increase your knowledge and/or abilities. Security is a broad topic encompassing many disciplines and Cybersecurity is no different. There are technical, procedural, and managerial aspects to be considered to grow what you know about Cybersecurity. There are often many, different ways to solve the same security problem. Knowing what to do and how to do it requires both knowledge and experience. How do you gain it though?
The answer is Cybersecurity training and education. There’s often a question as to which you need: training or education. There is a difference between the two, which I’ll explain below. You need to be aware of your needs, wants, and goals before proceeding, or there’s a chance you won’t meet them.
Cybersecurity education provides a more general background on the philosophies and concepts behind Cybersecurity. It allows you to understand the context for security tools, techniques, and technologies. With security education, you understand why it’s important to have particular protection methodologies in place and is at the strategic level of thinking. Cybersecurity education emphasizes principles of risk management and how security fits into an organizational culture and structure. Education is long term taking many months if not years to acquire. Finally, education teaches critical thinking and allows the student to learn how to learn, which is crucial for new subjects or technologies.
In contrast, Cybersecurity training is more specific to a technology, procedure, or skill. It’s tactical or operational, rather than strategic. Training emphasizes the building of explicit skills and applying what you know to a particular situation. When you attend cyber training, you are learning about a specific technology or practice that can meet an immediate need. Lastly, training is short term and can often be accomplished in days or weeks.
In this discussion, I’m trying not to sway your though as to which is better, because both are important for expanding your Cybersecurity knowledge and abilities. You need to decide for yourself the method you want to take in order to meet your goals. The important thing to consider is that you keep growing and increasing your knowledge. Feel free to comment below on your views of education versus training. Don’t stop learning!