An Information Security Place

OK, I am going to do a little self-pimping here.  For those of you who have been reading my blog for a year or so, you probably know that I also blog over at Computerworld.  But if you haven’t been around a while, or you just plain missed it, please go take a look when you get the chance (and subscribe to the feed).  My writing is typically a little more subdued over there, simply because CW can’t have me calling people an ass. 

Also, there are a lot of blogs over at CW, and they have a bunch of different subjects.  The site is great (it has won some awards), and the editing staff is awesome as well.

OK, self-pimping is over.

Vet

Well, if Mark at securityBuddha can do it, so can I?  What am I talking about?  Well, I am going to make this blog a more pure infosec blog, and I am going to start a personal blog.  It will be called My Tangential Mind.  It will still be at infosecplace.com, but I am adding a subdomain for it.  Nothing is there but an intro post right now.  I will eventually put more work into it.  I am not hooping for it to be some great success.  I just wanted a place to put down personal and random thoughts.

Vet

Here’s another Taekwondo toe picture for you. I got this injury tonight. I think I got it while I was sparring. I’ll keep you posted on the progress of the bruise (’cause I am sure you want to know, right?)

Still having fun, though. I got to run exercises today (all the stretches and pushups and squats and crunches, etc, etc, etc), which is a big deal since the instructor has to have faith you know what you’re doing. And he has me helping with sparring practice as well, so I feel pretty good that I have fooled him into thinking I know what I am doing so far.

Anyway, I am proud of my injuries. I guess that is a guy thing, though most of the blackbelts in the class are girls or women, and they are tougher than I have ever thought about being. And they hit hard.

Vet

As many of you know from my toe post a while back, I am taking Taekwondo. Well, I just tested for my yellow belt. I passed, so now I am officially a yellow belt (yea, it is a VERY low belt). AND, I tied for best test out of about 20 people testing for yellow belt, green tab, and green belt. That felt pretty good as well.

Go here for a video of me breaking my boards.

Vet

Well, I am back from our annual sales kickoff meeting. The week was rough, but the content was great, especially the last day (we had a three of our top SE’s teaching our processes and how to be a more effective SE – the sales people were in there as well, so they got a good idea of what we have to deal with). I am more jazzed up now about working for Accuvant. The people I met were great. Everyone is stoked about 2007. I am convinced more than ever that this was a good move for me.

I know. Everyone is highly motivated by these meetings, and it will probably wear off. I agree to a point, but what you have to understand is that I have never worked anywhere that I felt like a part of something good. This is the first company that I am proud of being a part. It is a good feeling. Maybe that’s a little cheesy, but that’s the way I feel.

It was held at Copper Mountain in Colorado. Very nice location, but we never had any time to get out and enjoy it since we were in meetings the whole time. Oh well.

I could barely breath up there. I think it is somewhere around 9,500 feet where we were staying. Since I live in Houston, which is about 6′ about sea level, I was completely unprepared for the thin air. I had a headache the whole first day and was gasping for air all night when I was trying to sleep. That REALLY sucked. I got about an hour of sleep that night.

I got used to it the next day, but I was so friggin’ tired that I still don’t remember much of the day. I slept like a baby the second and third night, and I was fine just walking around. Next time I will be taking as much of this advice as I can.

Vet

Either my toe post turned everyone off, or announcing I am a Cowboys fan must have made some people mad. Either way, my Feedburner subscriptions went from the 130’s (been there for a few weeks) to 112 yesterday and 99 today (reflects the previous day). Anybody else see anything like this, or am I just losing my readers?

Not feeling the love here, people.

***UPDATE*** Read comments to this post for an explanation of what is going on. Thanks to Eric over at Feedburner for a quick response!

Vet

Well, you are probably wondering why I have a picture of my feet on my blog. Well, it is really not my feet that are the subject of this post. Look at my left big toe. Look different than my right big toe? Maybe a little more colorful? That is what Taekwondo will do for you. I got it during a race we were doing (the instructor likes to incorporate some fun stuff in the training at the end of class). I won, by the way. I think it is sprained. It doesn’t really bother me too much.

Yep, I started Taekwondo last night. I have always wanted to take martial art classes. But growing up in a small town didn’t offer many perks like martial arts classes, and I just never had the funds when I was single or didn’t have kids.

My oldest son (5 years old) has been going for about 6 months now, and I am usually the one to take him and sit in the parent’s section and watch. So I figured, why not? I joined last night. I went tonight as well. My son is helping me learn the step sparring and the self defense moves.

I am having a great time, and I hope it will help me lose some weight. Maybe Mike Rothman and I can have a Biggest Loser contest! The loser (the one who loses LESS weight – not the Biggest Loser,…uhhhh, I’m confused) buys the beer at RSA.

I guess it should be light beer. *YUCK*

** Taekwondo Toe Update: The bruise is now moving up my foot. Not sure if that is a good or bad thing.

Vet

Alan and Mitchell at the StillSecure After All These Years podcast interviewed me last week for their podcast. It is up here at Alan’s site and here at Mitchell’s site.  I gave an update on my move to the channel, about honesty in selling security, the converging of the security professional and the general IT professional article I wrote at CW, and some other stuff.  It was fun.
Thanks to Alan and Mitchell for having me on again. I really enjoy talking about myself, as anyone can plainly see, and Alan and Mitchell actually seem to genuinely be interested in the people they interview. They are two great guys that I hope to meet soon at the RSA Conference security blogger gathering (not sure if Mitchell is going to be there, but I know Alan is going to show).

Thanks for the kind words, guys. You are two class acts.

And Alan, notice that I did not alter the picture in any way!  Or did I?
Vet

…but this transition is taking most of my time.  I promise I will be posting soon.  I am travelling to Dallas for the rest of the week, so I will try to hit some stuff this weekend.

Please keep coming back.  This blog is not dead!!!!  Really!!!!!

Vet

When I was looking to make a move out of security management, I knew I had a few choices as to what I wanted to move into.  I knew I wanted a pre-sales type of position, but I wasn’t sure about the type of company I wanted to work for.  Should I go for a vendor, or should I get back into the channel?  A few things came to mind:

1. Working for a vendor would force my hand on what products I could recommend.  So, if I knew of a solution that was a better fit for a company, I couldn’t suggest it and stay loyal to my employeer.  That was a negative for me.
2. Working for a reseller could possibly force my hand to some degree on what products I can choose, but at least I would have a bigger pool of products from which to work.  That was a positive for me.
3. A negative that comes from number two, however, is the fact that many resellers are nothing but vendor sluts and will sell anything to make a buck.  I am not adverse to making money, but I believe that if you are a reseller, you should be able to support the products that you sell.  I really did not want to get into the whole “we’ll take you to a ‘Stros game if you put our box in front of your client.”  I’ve been there, and I don’t want to deal with that again.  It just ain’t ethical.
4. I wanted to work for a company whose focus is security, but I wanted an organization that was diverse enough in that field to offer other opportunities in the future.
5. Another negative that often comes with vendors and resellers is high pressure sales.  I did not want to work for an outift that constantly called the client asking when they were going to cut a PO.  That reflects bad on everyone that works for that organization, no matter if you are a sales guy or an engineer.
6. I wanted to work for an outfit that had a good reputation, plain and simple.

Taking these factors into consideration, I looked for a company that could pass muster on most (preferrably ALL) of these areas.  I also preferred that I had done work with in the past since I would have a good feel for them and would not haave to rely solely on others’ opinions.

The first factor would be the hardest to pass if I went to work for a vendor.  That is because I don’t know of ANY vendor whose products fit every company in every situation.  There just ain’t no such animal.  And even though I interviewed (and ALMOST got the job) with a big vendor, I still had some hesitation because of this.

So that left me with a reseller.  I wanted a company with higher standards, who didn’t sell every possible product, and who could support what they sold.  That led me to Accuvant.  I had worked with them in the past, and to be honest, I never bought a single prodcut from them.  To be clear, that was not because they lacked the skill to sell or didn’t have any products I wanted.  It almost always came down to timing (I met them when I was looking at outsourcing some security tasks, then they came in with a possible SEM product after I had already purchased another) and their lack of full time staff here in Houston.  But their sales guys and engineers were always willing to help out, and they NEVER pressured me to buy.  They were diverse in their offerings because they could do security consultation and implementations of technologies.  And to top it off, they also had a great reputation in the industry, both from vendors that they partner with and with other security managers that I dealt with.  So, they basically fit all my criteria. 

Now this may sound like a commercial for Accuvant, and to some degree it might be.  But because this is such a big thing for me in my career and this blog, I wanted to explain the decision of the company for which I decided to work.  Also, many of these reasons for choosing them as an employeer also work when you are looking for a reseller or consultant, so many of you security managers out there who need a quality security company to help out, they might be a good choice.  And if you are in Houston, you will get me as your top notch security engineer!

Vet

…is crap like this.  I am honestly tired of having to worry about keeping up with the latest security flaw and making sure my IPS has the latest filters and trying to make sure my network admin is keeping the patches up to date and yada yada yada.  It just gets old.

A while back, I published a list of all the things I do on a daily / weekly / monthly basis as a security manager.  When I look back at that list, I am seeing about nine tenths of it as reactionary chores.  And I am tired of being in such a state of constant reaction, even when I do everything I can to be proactive.  It just gets old. 

I realize this may sound discouraging.  Believe me when I say I don’t want to give up the fight.  I just want to help some other people fight the fight instead of being on the front lines every day. 

When I first thought about it, it kinda felt like the front line troops were going to lose a man to battle fatigue.  But to clarify by carrying the military analogy a little further, think of me as a REMF (ask your military buddies – they know what that stands for).  Basically, REMF’s are the people who sit in the back away from the front lines.  They drive fuel trucks, they fix broken vehicles, they cook food, deliver MRE’s, deliver ammunition, etc.  They are support.  They don’t always get a lot of respect.  But without the support the REMF provides, the grunt, the M1A1 tank crewman, the Apache pilot, and the howitzer gunner can’t fight the fight.  So you gotta love the REMF, even if he is not looking at bullets every day.

It may sound like I am trying to convince myself that I am making a good move, and to some degree I probably am.  I know this is the move I am supposed to make.  I feel that deeply.  I just want people to know that I am not giving up.  I am just moving to the back lines.  Is there some fatigue?  You betcha.  But I am not going to be the guy who Patton slaps.  I’m gonna be the guy driving the ammunition to the front line so you can shoot at the bad guys.

Of course, if the guy who brings the ammunition had to convince the tank commander every time that his ammunition was better than that other guys ammunition, and that his ammunition fit better in the gun tube and would make pretty lights when he shot it down range, then our military would be in a bad way.  OK, so maybe the analogy doesn’t play all the way through, but work with me here, OK?

Vet

I posted a few days back about some transition going on with me. So, I got some ’splainin’ to do. Well, here it is. I am changing jobs. I know, what’s the big deal? But this is more than a job change for me. The last few years as an Information Security Manager have made me realize that the technical side of my job, though still a good part of what I do, is starting to fade into the background. As I get more and more resources in place and grow the security infrastructure, I am starting to focus more and more on personnel manangement and security maintenance, with the project and technical work becoming much less frequent. Basically, my skills is sufferin’. And they are suffering at a time in my life where I just can’t afford it. I am only 34 years old (today, in fact – happy B-day to me!!), so I think the move into management is not for me yet. Maybe it never will be,but I definitely know it is not the time now.

So, I decided to make a change. I wanted a job where I would get to see different technologies and get to be a lot more technical. However, I wanted to stay in security and not go out into another technical job that pushed me back into network engineering. So, I started looking a while back to see what was out there. I did not put a lot of effort into it. I figured if it was supposed to happen, then it would happen.

Well, it did. On Friday, I accepted a position as a Security Engineer with a security reseller and consulting company. Basically, it is a pre-sales engineering job with a lot of consultation, design work and some implementation work. There a couple of reasons I decided to make the move: 1) I believe this will keep my technical skills up, and 2) it is going to allow for a lot of freedom that I have been looking for.  This is the company’s first permenant presence in Houston, so I will be starting the office (we will be bringing in a sales person in a couple of months – any sales people looking for a job, shoot me an email at m1a1vet-at-infosecplace.com).  That is exciting to me.  And I will be able to work from home for a while, so I will be seeing more of my family. Basically, I am excited about this, and I think it will be good for me and my career.

I guess I should tell where I am going! The company is Accuvant.

I will spare you the marketing hype, but I can say that they are a top-notch security company. They have some really quality folks over there, and I know I will learn a lot from them. I have worked with them over the last year or so, and my experience has been nothing but positive.

Just to explain, the reason I am making such a big deal about this here ay An Information Security Place is because this move might have a big bearing on my blogging. I have worked for VAR’s before, but my view of the security industry is likely to change quite a bit. I have spent the last three years as a security manager, sothat will always be there and will affect my thinking. But I take my blogging very seriously (though I have a great time doing it), so I have to recognize that this is going to affect what I blog about and how I see issues.

I know many people read my blog because they are security practitioners and they like that I have the same viewpoint. I promise those people that I will do my best not to betray those views. Security management is a part of me. But I will also be seeing things from the reseller perspective. I think that will give me a fresh outlook that will only add to what I can think and write about.

So, that is what’s going on with me. I plan on always keeping this site and my Computerworld blog going strong, but please understand if I have some dry times in the next few weeks as I move over. Thanks for reading. Please stick around and see the things that are to come.

Vet

Just some random thoughts here on why I write this security blog:

1. Simply, I enjoy writing
2. Simply, I enjoy security
3. I enjoy people reading and commenting on my opinions
4. It might make me famous one day!
5. It helps me become a better security professional because I have to research to write viable and informed opinions
6. It helps me to become a better writer
7. I get to meet great people (Martin, Alan, Mike, Chris, Mitchell, etc.)
8. It gives me something to do when I am up at 1am in the morning (I need to go to sleep)
9. Looks cool on my resume
10. Some other stuff

Vet

Just to let all my thousands (yea, right) of loyal readers know, I am going through some transition right now.  I will explain more fully later, but that is the reason I have not been posting this week (and the fact that I am preparing for our annual audit here at work).  I hope to get some time this week to look at the news more closely and develop some opinions (developing opinions is not too difficult for me, as you may well know).

Vet

If you have me on your blogroll, can you make sure to change your link to the new domain when you get the chance?  Trying to get my link count back up.  Because you know it is all about me, right?

Thanks.

Vet

When I first started blogging, I searched around the Web for advice on how to be a success.  One of the keys, so I was told, was to post often.  Another bit of advice I found was to NOT apologize if you don’t post for a while.  But I am going to ignore the above advice and apologize anyway.  So,  I humbly, sincerely, and profusely apologize for the extended amount of time between posts these last few days.

As to why I have not been posting, I have been on vacation.  I travelled to to see my parents and other family in the dark depths of back woods south Mississippi, where the fastest Internet connection is a 26.4 baud dialup to the local ISP (who has a strangle hold on the local area, by the way).  I tried to check mail, and it turned out to be a 20 minute ordeal just to get connected and have the screen fully load.  I did manage to post on Sunday, but that was quite painful as well.

Now, as to the new blog site, I think I finally have the theme where I want it.  I have learned a lot about style sheets, Wordpress tags, etc. (a lot more than I wanted to know, to be honest).  Also, I have done some back end work to get my site stat trackers and other stuff pointed to the new location.  I have also noticed that the new location is popping up now when I perform a vanity google, so things are coming along.

One thing I thought was funny and a little frustrating was that I finally obtained a good Google rank (Google bar shows 5 of 10) at my Blogger site (I don’t know when that actually happened).  So now I will have to build that back up.  Oh well.

So let me know what you think of the new site and the theme.  I have had people tell me that it is easier to read, and I have to agree.  I would like this one to have more of an edge, but I don’t want to go overboard.  Also, I want to make some kind of logo for the title.  I have a friend (David Nester of Spidynamics) who is going to be helping me with that and with working on the home site page (infosecplace.com), but if you have any suggestions on a logo, let me know.

Thanks for reading.

Vet

You may see the theme of the blog change a few times in the next weeks.  I am experimenting still over here, but I just didn’t have the patience with or the faith in Blogger with all the issues they have been experiencing.  Please have patience with me.  If you have any advice on a good theme, let me know!

I’m not sure anybody wants to see a full picture of me, but a friend (David Nester) sent me a blogging t-shirt, and I thought this was too cool. My 5 year old took the picture, so excuse the weird angle.  Click on it to get the big picture (if you dare).

  

Vet