A case of...no cases

I wanted to write a column talking about the intersection of privacy, security and the law for a while now.  The only problem I keep running into is what the heck angle to take that can summarize how important law is to the privacy and security professions.  Privacy is a little more obvious in that privacy laws are touted with roots (albeit vague ones) to the Constitution (OK, quiz time: where in the U.S Constitution is the strongest link to our personal privacy?); however, security is a tad more obtuse.  Therein lies my difficulty: where do I start? 

I think I will start with an important talk that I listened to at Defcon 23.  The speaker was Cory Doctorow, a well-known fighter of the security profession via the EFF.  His talk was titled ‘Fighting Back in the War on General Purpose Computing’ and it primarily discussed the impact of the DMCA on security research.  If you are scratching your head trying to figure out how these two are related, I highly suggest that you read up on the EFF website.  The gist of it was that by trying to our jobs, we could be breaking the law.  But that’s actually not what I found interesting.

What stills smacks me in the head was the fact that while there is a lot of threats in regards to our profession being held as criminals by exposing important issues, but that there is very little case law supporting actions against our profession that establish precedence.  Wait, wait.  I am not saying that I want actions against our profession!  No, but I do want people that use vulnerabilities for their own personal gain (aka criminals) to be punished for such actions.

If you look at what cases have actually come to completion with jail time and penalties, there are not a whole lot that have bite.  I just read an article where a school tutor received a year in jail for installing keyloggers, stealing credentials and changing student’s grades.  One.  Year.  Need I say more?  (OK, I will: one year is not much of a deterrent.  Although who knows what the lasting implications will be).

And this is why the law is so important.  If we can’t build the case law needed to help put that bite into breaking security ‘laws’, then that means the security laws have to get better.  We all know how hard that has been and continues to be.  Until we look at things like better partnering with foreign countries on extradition laws, allowing research to not be illegal, harsh penalties (monetary and jail time)  for illegal acts and strict enforcement, then we will continue to struggle to protect our organizations.

OK, so great.  This is a big problem.  How do you help?  Well, get involved.  Get active.  Talk to your local politicians.  Comment on public papers and requests for ideas on this issue.  Talk to the EFF.  Find a way.  It’s too important not to, folks.   Don’t sit on your hands and complain about it; do something because you can!

Turtle soup

It's been a while since I've posted anything, but that's what happens when you go back to school!  I just returned from New Orleans, where I received a little inspiration.  My purpose in New Orleans was to present at a conference, but I went a few days ahead of time with my husband to enjoy the French Quarter.  We checked off many things while here: carriage ride, cemetery tour, ate at a famous restaurant, and sampled many of the fine local cuisines.  Not only was the conference a success, but so was our mini-vacation.

Except for one thing.  While not on my checklist, my husband really wanted turtle soup and we didn't find it on any of the menus where we ate.  It made me start to think though.  OK, so we didn't get turtle soup.  But we had a fantastic trip!

Security is a lot like that.  We do have victories all the time.  We get that one person in our awareness session whose light bulb went off.  A server gets built more securely, and better yet, maybe even automatically.  We build trust with our business partners to mutually achieve a goal.  But then comes the other shoe. 

Something almost always doesn't work.  We have to handle incidents.  We have to do forensics.  We have to brief executive management on what went wrong and how we'll fix it.  Then what happens?  We forget about all that good stuff that we did up to that point and get wrapped up in the bad.

I will let you in on a secret: something will always go bad.  I know this is shocking, but it'll all be OK, one way or another.   The key is to remember the good stuff, and more importantly: just be happy.  If you refuse not to be happy, then the downward spiral just continues and no good ever comes from that.

Next time you feel that descent start occurring, take it from me.  Just think about the turtle soup.

Change, failure, defeat and...motivation?

This month hasn't been the best for me.  I won't go into detail, but there were enough challenging things that happened personally that I actually tried to sing them all to the tune of the 12 days of Christmas.  Once I realized it would go over 12, I quit trying.

Instead, I started thinking about work.  This can be dangerous, but I encourage everyone to take a step back and try it, especially this time of year.  As security professionals, we face change, failure and defeat all the time.  My favorite TV show line this fall was from 'Sleepy Hollow': "Crane, you and I can't have lunch without peril".  Our jobs are a lot like that.  The key is not to let it get to us.  Yes, it may seem like we are never going to make progress, no one wants to help us and maybe we should just go eat worms.  Me, personally, I don't care to eat bugs, so I chose to do something completely different.

After I got over the Christmas carol thing, I got motivated.  Maybe even a little aggravated in an energizing way to quit whining and go do something.  I started small- I literally just went for a quick walk.  But after that, I started thinking again.  What do I need to do next year?  Who are three people that I need to work better with?  How can I do my job better?  And, even better than that:  how can I learn from my failures and improve the next time?

Its all about understanding what is truly important, prioritizing what is, and charging ahead.  I find this good advice for not only my fellow security professionals, but also personally.  There is always some way to do things.  If you keep asking questions and friends for their thoughts, you will figure it out.

What I am not saying is go off and make some New Years' resolutions.  Typically, those don't last (and either will my energized euphoria).  But I will take the energy for now.  I won't let challenges defeat me.  After all, challenges are temporary too.

Here I go, thinking again

I talked in a previous post about being clear, but this last week, I achieved a moment of clarity.  Several moments actually- which felt quite nice!  I thought I would take a minute to reflect on the experience in the hopes to remind/inspire others to do the same.   

The best place to start is to stop for a minute and think about your typical day.  If it’s anything like mine, it’s pretty chaotic.  You move from one fire to the next while trying to make sure the fire you just put out doesn’t start up again.  Somewhere in your head swims the long-term strategy that you should be striving for as well as how you will get there.  But you never seem to slow down enough to make it to that next strategic step, or even get the chance envision what the next step is.  Sound familiar?

My moment of clarity occurred during a class I was taking.  The class was incredible in itself, but it also allowed me to get out of the fray for a little while.  I had a peaceful few minutes in between to let my brain settle, and suddenly I figured a few things out that I haven’t had a lot of time to figure out.  It was almost alarming how easily things just fell into place.  I wrote down my thoughts quickly before they escaped my head, though.  Good thoughts tend to do that!

My message today is simply this: there is no magic formula to what happened, no specific list of things to take away this time.  Just strive to find that quiet time (whatever is your version of quiet) to think.  As leaders, thinking time is invaluable.  So whether it’s a few quiet moments first thing in the morning when you get in the office, or on a crowded bus on the way home, or right before you go to bed, stop checking emails, stop facebooking or linkedin-ing, just stop doing everything…and don’t even try to think.  Just be and your brain will do the work for you.

Privacy? Seriously?

I have been looking a lot at privacy lately.  At a professional level, I want to provide value in this area by making sure that my organization is compliant with relevant privacy laws.  At a personal level, I feel like my privacy erodes on an hourly basis with the nearly weekly data breaches of companies that I use on a regular basis. 

So how do we resolve this conundrum?  First of all, don't panic!  You don't have to live in a shack in the woods herding goats to protect yourself (although some days, I think this might be a nice option).  I think the good old detective controls come into play, in addition to some still proactive useful ones.  The key, at least to me, is a balance that won't make you crazy.

The controls are simple:

1) Get a credit card you can use for purchases (online and in person).  It doesn't seem to be better one over another any longer, so just get one that you monitor frequently for oddball transactions.  Then commit to reviewing it.  As soon as you get something, dispute it and get a new number.

2) Keep your passwords different for different services and secure them in a key safe.

3) Keep your personal information OFFLINE.  I have a dear friend who posts every single place she goes at all times.  It's kind of cool to know what she is up to, but (sorry) I don't trust privacy settings of sites.  They change too frequently and you never know what glitch will happen that exposes your info.

4) Keep you online presence fairly limited.  Since you will ignore step 3 because you like to interact with everyone else in your social circle, then focus on a site so you can monitor it.

The last step is really just to make sure that you keep breathing.  Its pretty easy to panic, but there are some things in life you can't control.  You can either never leave your house or you can just monitor what you can, limit the threat vectors (to throw a security term in the mix) and keep on going.

Quick check:  breathe in, breathe out. 

See?  I knew you could do it!

Sent from my iPad=

Promises, promises

"Let's do lunch!"

"I will make that happen"

"I can get that to you by Friday"

I bet either you've said that or heard that recently.  If you said it, did you deliver?  Nothing is more irritating than having something promised to you, then the commitment is not met.  Then you have to nag the person mercilessly until they provide it.  So, did you promise something and then not deliver it, and now you are being nagged?

An instant way to build trust is to deliver on your promises.  No matter how little, following up on something you said you'd do will pay off handsomely in the long run.  The key to  this; however, is not over-promising. We tend to automatically spit things out like: "of course I can do that in 24 hours!"  when our brain truly knows that we can't in fact do that in a week.  There is no shame in taking more time to provide a realistic estimate rather than promising to do something then not doing it.

Even worse, if you can't make your commitment, don't ignore the promisee!  Communicate a clearly revised deadline with plenty enough notice so that they can reasonably adjust whatever may rely on the output of your task.  Again, I don't care how small you think the promise is, the person you committed to may think that it is much more important.

Lastly, if you can't do it, then say so!  How often would you have appreciated a real answer versus a tap dance?  As infosec professionals, being honest and ethical is part of the job description.  If our partners can't believe and trust in our work and ourselves, then why would they want to work with us?  Think about the traits of people that you like to work with: I bet one of them is delivering on their promises.  We must be the examples if we are to succeed, so start practicing now!

For a little more on this topic, here is a good article.  

 

 

To be clear....

Do you catch yourself saying this out loud once and a while?  Do you find that the more you say this, the less clear you are?  I do, so I am hoping some of you do the same, and we can help each other get out of this mess.

Being clear in writing and speech is critical in our field today.  How many times do you give direction to someone, or have a meeting with a bunch of someones only to come back later to have them produce something that's not what you asked for.  And how do we know if we are being clear or not?  Short of saying "repeat that back for me" a thousand times, it can be a little challenging.

One of the best ways that I find to be more clear is to...yes...talk to people. Heck, even if you do that, you may think you have something completely clear, only to have it be interpreted very differently.  However, if I hear:

"I think we should measure density."

And you aren't exactly sure that makes a ton of sense in the context of your discussion, then ask more questions, or provide clarifying statements.  Sending and receiving the right message is crucial.

I do a lot of writing, and let me tell you, I may think that I wrote something that was brilliant, only to come back later and realize it was full of typos and missing crucial pieces, oh like, nouns.  A great little book I found called: How to Speak and Write Correctly (free in Kindle), has a whole chapter dedicated to this topic.  'The Pitfalls to Avoid' chapter discusses good stuff (e.g. mistakes) like putting the verb to far away from its subject with a bunch of unnecessary words, split infinitives (she was scarely able to even write)  and overuse of the words 'one' or 'only'.

There are a lot more great examples in that chapter, and every once and a while, I like to go back and read part of it to make sure that I remember grammar and little things like that.

After a while of realizing that maybe you haven't been too clear lately, and you work to be more clear, then you'll know you are on your way when that little lightbulb goes off.  Yes, indeed, they call those moments of clarity.  Pat yourself on the back, turn around and keep trying.  You'll have plenty of more opportunities to find these without even trying too hard!