Category: Uncategorized

The DBA in my office doesn’t read my blog and kept trying to convince me her CD-Rom kept opening up randomly until she finally broke down and caught it with her iPhone.

End of Session 2014

Last night I sent an email to a good friend and his boss passing on an amazing career opportunity that paid an ungodly amount of money.

It was basically Scrooge McDuck build a money bin money.

So why didn’t I take it?  After a lot of thinking and discussion with my wife it boiled down to timing and location.

We weren’t crazy about the location. We would have had to relocate to Atlanta. We dont have more than a handful of friends in Atlanta and our nearest relatives would be about 300 miles away.  I dont like grits.

The timing wasn’t great either. My son is getting ready to start Kindergarten next month. My wife has a job that she loves. Our family is a half hour drive away.  We have amazing friends. We love our church. I dont like grits.

Even after that list of cons It was still amazingly hard to say no to a great career opportunity and the possibility of my own money bin.

So why did I?

I remember seeing this quote a few months ago:

“Half of the troubles of this life can be traced to saying yes too quickly and not saying no enough.” – Josh Billings

So I took my time and thought about it.  On Monday I was ready to call a Realtor and put my house and the market. On Tuesday I was trying to figure out if I was going to sound cool with a southern accent.  On Wednesday I woke up and realized it wasn’t the right time to move our family half way across the country.

So yesterday I wrote an email apologizing and declining the position, put in a 16 hour day at my current job and went home and slept like a baby.

It will be hard not owning a Tesla and having a bin full of money to swim around in but I know I made the right choice for my family and hopefully there will be other opportunities like this in the future. 

Meet the Capello Sleep & Charge Dual Alarm Clock with Night Light sold exclusively by Target.

It works fairly adequate as a:

• USB Charging Station
• Alarm Clock
• Radio
• Night Light(?)

Why I hate it is this button right here:

This “DST” button is .25" away from the snooze button, .2" away from the source and sleep timer button. 

Why is this a big deal? Because when you accidentally touch the button it magically makes it an hour earlier in my bedroom than in the rest of the world.  For a feature that will save me 30 seconds two times a year they have basically put a self destruct button right on top of their product.

How in the world do products like this make it to the market?

I was having a conversation about security today with a good friend and the subject came up of what is the most difficult question in security to answer?

After a few minutes of back and we fourth we settled on the following question: 

Who would want to hack us?

This question is nearly always asked with the person asking it implying they aren’t important enough to be hacked.  

As security professionals we mostly do a terrible job at answering this question. Normally we end up answering with something vague like “hackers”.

(This is what a hacker looks like.)

When we answer back with a vague answer like “hackers” we dont make the threat real to the person asking the question.  They will care and think about hackers as much as they do the nebulous bad guy who might break into their car and steal their 3 Doors Down CD.

The best way I have found to answer this question is by asking a question back. 

Here are a few questions I always try to ask back when someone asks me who would want to hack us?

Have you ever had an employee leave on bad terms?
Have you ever made a competitor mad?
Is there anyone that would enjoy you having negative publicity?

Everyone can think of an answer to one of these questions and it plants a mental image of someone who would actually want to do their company harm and not a guy with a ski mask.

How do you answer the question: Who would want to hack us?

I am going to whack the ball the over the fence.

That was my four year olds response when I reminded him that his first T-Ball game was later that day as I woke him up.  I love my son but he spent 80% of his first and only T-Ball practice trying to make the other kids on his team laugh. He is no Jose Abreu.

My first instinct was to tell him:

Logically the chances of you hitting the ball over the fence are not very realistic, why don’t we concentrate on a single and hustling to first base? 

As I sit on his bed getting ready to tell him why he isn’t going to hit a home run he tells me:

I can’t wait for my game tonight, it is going to be a so much fun!

At that moment my 4 year old reminded me that baseball it isn’t as much fun if you aren’t swinging for the fences. The same can be said about life. I can hit singles and hustle to first all day but wouldn’t it be a lot more fun to swing for the fences?

Even if you dont hit a home run you might even end up on 3rd base talking to your friend.

This morning I was out running some errands and NPR had an interview with a David Sklansky a poker player who wrote a book called “The Theory Of Poker” and he said the most important thing to remember about poker is that:

Poker Is Fundamentally A Battle Of Mistakes

That quote stuck with me all day and when I got some time to sit down and Google it tonight I found this amazing excerpt from his book: 

Every time you play a hand differently from the way you would have played it if you could see all your opponents’ cards, they gain; and every time you play your hand the same way you would have played it if you could see all their cards, they lose.

Lets make this about security:

Every time you secure your network differently from the way you would have if you could see all your opponents’ attacks, they gain; and every time you secure your network the same way you would have if you could see all their attacks, they lose.

Poker players spend just as much time while at the table thinking about who they are playing than what they are playing.  Security professionals on the other hand spend a lot of time and a lot of money trying to prevent attacks that people attacking their networks wont or cant use.  I know small companies who are more worried about APT’s than they are of phishing attacks because they watched a 60 minutes story about it.

Can you answer these five questions about the people who would likely attack your network:

Who would want to attack my network?
Why are they attacking my network?
What do they want to steal or change?
Is it possible for them to access the information they want to steal?
If I were them how would I try to steal the information?

I think if you can answer those five questions you would be off to a good start on understanding the correct way to secure your network because:

Security Is Fundamentally A Battle Of Mistakes.