An Information Security Place

Argh.  Just…argh…

Vet

If you have some interest in web application security and you live in or are going to be in the Houston area on Oct. 10, come on by for a great presentation.  Bring your copy of Cross Site Scripting Attacks: XSS Exploits and Defense for Jeremiah to sign.

I am going to be speaking about Accuvant for a bit (we actually compete with Whitehat Security on some levels), and then Mr. Grossman will do his thing.  Should be great stuff.

BTW, here’s the Houston OWASP chapter website.

Vet

Kudos to Joat on this post about this article @ Darkreading.  Some expert in the article is warning of insider threats (we all know they exist) and how you can detect when an employee is about to get medieval on you.  Joat advice is to secure your environment, keep a watch on people but don’t be so aggressive that you drive people off.  Get your crap together to protect against problems.  Don’t MAKE people the problem.

Joat says it better here:

I’ve got news for you: If you run a totalitarian environment (AKA micro-managed, micro-monitored), every single one of your users will be evil and you’ll end up wondering why your organization has such a high turn-over rate.

Joat also says that you have to use your brain and quit trying to automate every process (this is mentioned because of some software the article points out called WarmTouch).  Very good point.  I have this issue on a regular basis with clients looking at SIEM.  They want something that does the job for them, but this just does not exist.  You have to have people on the job.  Unless LucasArts builds a real C3PO, that is just the way it is.

Vet

I know so many people have asked this question before in security, but just what is it we are trying to do?  Are we trying to make a difference in security, or are we just trying to make a buck?  Of course, you can ask the question, “Why can’t it be both?”  But really, are we trying to do something about the state of security?  If fact, why don’t I ask the real question: do we even care about the state of security?  Or do we simply want things to keep rolling like they are?

Let’s look at it this way.  I liken security to the medical field.  I have run into doctors and nurses before who would like to be out of a job, meaning they would love it if modern science would find a cure for the disease in which they specialize (a lot of those people work right here in Houston at the MD Anderson Cancer Center).  If their area of specialty was no longer needed, they would rejoice, and they would move on to another disease to fight.

But at the same time, you have some of those same medical professionals who make you wonder if they are just there because their momma wanted them to be doctors or because nurses make pretty good money.  They do their job without much interest and bed-side manner, and then they go home.

The same is true about security.  There are some security professionals who want to fix security ills.  They want their family and friends to be safe from harm when they go online.  They want everyone’s data to be locked safely away from criminal snooping.  They care that the Internet is a dangerous place, and they want to do something about it.

Then there are others who heard in high school or college that information security seemed cool, and it also tended to pay big paychecks (not always true, BTW).  They show up and maybe write a couple of policies or sell a couple of firewalls.  But they are not there to make things better.

Now before we slam these people, we have to ask ourselves if they are really evil or bad.  I think that most are not.  They simply choose their profession based on misguided principles.  The medical field is just too important a choice to make based on the fact that the men in your family have been doctors for three generations (ever see Gross Anatomy?).  The same is true for security.  It is not a field you go into just because you thought WarGames was cool (I guess I am also saying something about watching movies – I’m not exactly sure).

So I guess what I am asking is for all of us to be honest.  Take a close look at what you are trying to accomplish.  Security is a field that MATTERS.  If all you want to do is make a buck, then do something that won’t get anyone hurt or ruin someone’s life (not sure what that is right now, but it dang sure ain’t security or the medical field).  If you are trying to help others and you have a talent for security in some way (there is a lot of room for different talents in security), then let’s make security a goal we can all pursue together.

And hey, if we make a buck or two in the process, then we have proved that capitalism works.

Vet

OK, I have officially set a date, time, and location for BayouSec.  It will be on Oct 4, 7pm, at the Dave and Buster’s at:

Richmond at Fountainview
6010 Richmond Avenue
Houston , TX 77057
713/952-2233

If you are currently or are aspiring to be a security professional and live in or around the Houston area (or just happen to be in Houston at that time), come by and have some fun.  This is strictly informal.  No vendors, no security speech, no sponsors, nothing like that.  Just plain fun.

See you there.

Vet

First off, I have always thought my wife is smarter than I am.  She is a serious science and math person, where I am more about more philosophy and literature (basically comes down to me not wanting to work hard enough to come up with a real answer for a question).  But just like most people, including me, she had to learn to be security aware.  It really comes down to the fact that most people are basically trusting.  So when someone calls you and says, “I am so-and-so from such-and-such company”, we tend to say “OK, I believe you.”

Here’s what I am talking about.  A while back, we signed up for a service that would send us a new water filter every 6 months for our refrigerator.  It was very convenient, and it reminded us not to wait until the water turns a funny color before we changed filters.  But when we starting moving into our new house, we got a new fridge which has a different water filter which the company we were using doesn’t sell.  So, we canceled the old service.

Well, the cancellation didn’t go through for some reason, and they shipped a water filter and charged our credit card.  The filter got lost in the mail since the post office didn’t forward it to our new address (probably better since we didn’t have to worry about shipping it back).  So we called and told them what was going on.  They said they would now cancel the service, and they would credit us for the lost filter.  Great, thanks.

Well, this morning, my wife got a call from the same company.  The lady said that for some reason they couldn’t find our credit card information in their system, so they could not credit our card.  So, she asked my wife for our credit card number.  My wife told her that she was not comfortable giving that information out to someone who called us.

OK, I love my wife so much.  How many people would have just said, “OK…here it is.”  More than likely everything is kosher with the call, especially since the story the lady gave fit so well with the situation.  But that is not the point.  If someone calls and asks for this kind of information, I don’t care if the caller ID says it is coming from the right number (it didn’t), the story fits well (it did), and you recognize the person’s voice (she didn’t because I made the original call).  You still have to be cautious.  And that company really needs to make themselves aware of this.

Awesome job, April.  Have I told you I love you lately?

Vet

Sorry everyone.  I just got Internet at my new house (AT&T needs an ass-whoopin’ – I may talk about it in my personal blog), so I have only been able to get online during work hours.  And though I sometimes blog when at work (I hope none of the Accuvant big bosses see this post ), I have been pretty swamped while I have been at work.  So, no posting.

Anyway, I got back into the swing of things over at CW with this post about compliance.  Of course, Cutaway’s comment-conversation with a dentist had better stuff than my post.  Figures…

I am just glad to be back and having things settle down.  I ain’t moving again for 20 years.  I swear it!

Vet