Building a Better Mousetrap: The Problem of Information Security Professional Organizations

I've been talking about the deficiencies in information security organizations for years.  I've had board experience and other involvement with several such organizations and, let me tell you, it was an interesting learning experience.

I would like us all to do better and emulate professional organizations like the following:

What deficieicies am I talking about?

I'm talking about the excessive amount of vendor pitches.  I'm talking about loads of ego and rockstar syndromes.  I'm talking about overselling certifications and frameworks first and providing resources to forward the community second or not at all.  I'm talking about not being a sales organization.

The best community moments that I've had have often been informal, friendly, and in the spirit of sharing information and comradery.  That's what I would like to focus on and hear from you about.

What are your favorite aspects of community events?  What have been some of the best moments of peer involvement that would not have occured without an event or organization bringing you together?

Are you a fan of:

What is your favorite aspect(s)?  What makes them valuable to you?  How can we add to their efforts?

I'm not looking to start just another local chapter, but I want to provide resources for the global information security community regardless of their physical location.  I want it to be easily accessible.  I want to enable an open forum, not push people away.  We need way more of that.

Will you join me?  

If you are willing, I'm collecting data toward these ends.  Information will be viewable only by me, Ian Gorrie, and destroyed after this exercise is complete.

Thanks for reading.  I very much look forward to your comments and feedback.

 

On wage disparity, civil discourse, and critical thinking

(11:55:36 AM) BILL: I'm working on a list of questions for due diligence of an M&A
(11:55:39 AM) BILL: gah
(11:55:52 AM) iagorrie: you have to have a standardized format?
(11:56:02 AM) BILL: well
(11:56:05 AM) iagorrie: checklist in 3...2....1....
(11:56:06 AM) BILL: we have templates etc
(11:56:17 AM) BILL: but the questions need to be germane to the buy etc
(12:09:10 PM) BILL: I'm running out of things to ask
(12:09:15 PM) iagorrie: heh
(12:09:27 PM) BILL: hah
(12:09:35 PM) iagorrie: that's the inherent problem with standardized assessment, isn't it
(12:09:40 PM) iagorrie: you can't follow leads
(12:09:44 PM) BILL: well 
(12:09:50 PM) BILL: you are correct 
(12:10:00 PM) BILL: also, it doesn't allow for the natural ebb and flow of discovery
(12:17:54 PM) BILL: I worry about the future of this nation
(12:17:54 PM) iagorrie <AUTO-REPLY> : I'm not here right now
(12:33:26 PM) iagorrie: well eventually there will be collapse
(12:33:34 PM) BILL: word
(12:33:34 PM) iagorrie: after it gets heavy enough
(12:33:40 PM) iagorrie: it will collapse in on itself
(12:33:44 PM) iagorrie: and people will have had enough
(12:33:49 PM) iagorrie: and not tolerate this bull
(12:33:54 PM) iagorrie: and they'll make millions
(12:34:05 PM) BILL: yeah
(12:34:10 PM) iagorrie: think of the expense of making things palateable for idiots
(12:34:15 PM) iagorrie: and of consensus 
(12:34:23 PM) iagorrie: it must be measured in trillions
(12:34:31 PM) iagorrie: if you could measure it
(12:34:36 PM) iagorrie: which is another discussion
(12:34:41 PM) iagorrie: one that I would like to hear actually
(12:34:42 PM) BILL: true
(12:34:45 PM) iagorrie: and perhaps participate in

(12:35:35 PM) BILL: I'm a bit torn and sadden by the generic acceptance of one sided arguments in Universities which have managed to permeate the culture
(12:35:46 PM) iagorrie: like which?
(12:36:39 PM) BILL: any of the none distilled ideas about "corporations are evil blah blah blah" we need to have some socialistic equilibrium blah blah blah 
(12:36:50 PM) BILL: no matter how hard you work you should be entitled blah blah blah
(12:36:52 PM) BILL: that rot
(12:37:21 PM) iagorrie: oh
(12:37:40 PM) iagorrie: well they do have a legitimate point buried in that entitlement that people usually chime in with
(12:37:55 PM) iagorrie: let me see if I can find visuals
(12:43:11 PM) iagorrie: there it is
(12:43:13 PM) iagorrie: https://www.nytimes.com/imagepages/2011/09/04/opinion/04reich-graphic.html?pagewanted=all

04reich-graphic-popup

(12:43:20 PM) iagorrie: now that
(12:43:23 PM) iagorrie: is a solid point
(12:43:49 PM) iagorrie: a real problem, as long as you keep it constrained to that
(12:44:37 PM) BILL: yeah
(12:44:45 PM) BILL: that is a solid depiction
(12:45:05 PM) BILL: the real quesion:
(12:45:08 PM) iagorrie: it doesn't show the competitive markets
(12:45:08 PM) BILL: how do we change it
(12:45:24 PM) iagorrie: but it does show that workers have not been compensated for great strides in productivity
(12:45:32 PM) iagorrie: now that would be the question, shouldn't it
(12:45:42 PM) BILL: inded
(12:45:56 PM) iagorrie: is a x450 income disparity betweeen CEOs and average workers in their company acceptable
(12:46:13 PM) iagorrie: I would argue that this is because shareholders are not relevant anymore
(12:46:24 PM) iagorrie: and that wealth is tied up in funds
(12:46:28 PM) iagorrie: and fund managers are in on the game
(12:46:41 PM) BILL: well there is that :)
(12:46:47 PM) iagorrie: isn't there though
(12:46:56 PM) iagorrie: that was the counter to executive power
(12:47:00 PM) iagorrie: they were answerable to the board
(12:47:05 PM) iagorrie: which was answerable to shareholders
(12:47:08 PM) iagorrie: and they aren't anymore
(12:47:25 PM) iagorrie: that broken control is likely responsible for most of this problem
(12:47:40 PM) iagorrie: see also that nokia microsoft holybull
(12:47:50 PM) BILL: yup
(12:48:51 PM) iagorrie: so yeah, that would be my point on it
(12:48:55 PM) iagorrie: should I write this up?
(12:49:03 PM) BILL: you ought to 
(12:49:05 PM) iagorrie: would anyone care?
(12:49:39 PM) iagorrie: I'd like to just post the chatlog with edits and add supporting graphics
(12:49:46 PM) iagorrie: but I guess that's not pro-blogger
(12:50:18 PM) iagorrie: and everyone has to self aggrandize themselves as the polymath super brilliant people they secretly know themselves to be
(12:50:20 PM) iagorrie: :)
(12:51:48 PM) BILL: that is a good point
(12:51:55 PM) BILL: perhaps it would fall on deaf ears
(12:52:10 PM) iagorrie: frankly thats why I don't bother writing about most things
(12:52:19 PM) BILL: I understand

(12:57:52 PM) iagorrie: so if we're not having useful discourse even at the university level
(12:57:55 PM) iagorrie: how do you fix that?
(12:58:08 PM) BILL: that is the real question
(12:58:11 PM) BILL: for starters 
(12:58:26 PM) BILL: Universities should not be afraid to hire faculty who hold different opinions
(12:58:46 PM) BILL: my experience has proven that this is not always the case nor is it welcome by dept heads 
(12:59:01 PM) BILL: they don't want someone to be like TV's Dr.House 
(12:59:05 PM) BILL: contrary but right!
(12:59:05 PM) iagorrie: so it should be like SCOTUS?
(12:59:15 PM) BILL: yep
(12:59:27 PM) iagorrie: or I guess to use an example more people would understand
(12:59:33 PM) iagorrie: like THE HARRY POTTER SCHOOL
(12:59:35 PM) iagorrie: :(
(12:59:43 PM) BILL: hahaha
(12:59:51 PM) BILL: OMG ... um...sadly yes
(1:00:20 PM) iagorrie: well I guess that would be a start
(1:00:36 PM) iagorrie: but I suspect that most are already too polarized to do that
(1:03:31 PM) BILL: I agree
(1:03:32 PM) BILL: most are
(1:03:41 PM) BILL: but conversation is important nonetheless
(1:04:03 PM) iagorrie: well without conversation, it becomes a hopeless situation
(1:04:12 PM) BILL: indeed
(1:04:25 PM) iagorrie: I keep coming back to a study that showed that our schools are producing people who can not differentiate fact from opinion
(1:04:43 PM) BILL: that is deeply disturbing
(1:04:52 PM) BILL: critical thinking and analysis is disintegrating
(1:04:58 PM) iagorrie: more than that, I think it's core to this discussion
(1:05:14 PM) iagorrie: well then the question becomes, how to you cultivate these skills
(1:05:19 PM) iagorrie: is there a time that it's too late
(1:05:24 PM) iagorrie: and why aren't we fixing it
(1:05:28 PM) iagorrie: like right now

 

Solomon Kane (2009)

As a fantasy movie it is one more movie following the traditions of the genre: simple story, poor CGI, poor actors, poor directing. Yet it can be fun, you know: 'the cheaper they are, the better they are'. But since it is called Solomon Kane, I cannot accept it. Imagine a Lord-of-the-Rings movie with a hero Bilbo who fights the black sorcerer Saugalf with the help of his dwarf friend Aragorn and the beautiful heroine Shadowfax. And with a final fight where the three use a magical ring to kill the evil sorcerer who has transformed into the dragon Gondorian. Imagine that. This is exactly what this movie has done with Robert Howard's character Solomon Kane.

This is an awesomely harsh burn review. Excellent!

The Wikileaks international whistleblower subscription and auction supply model

Leak-o-nomy: The Economy of Wikileaks

 

The experiment failed.

The experiment didn’t fail; the experiment taught us about what the burdens were. We would actually need a team of five or six people whose job was just to arrange these auctions.

You plan to continue the auction idea in the future …

We plan to continue it, but we know it will take more resources. But if we pursue that we will not do that for single documents. We will instead offer a subscription. This would be much simpler. We would only have the overhead of doing the auction stuff every three months or six months, and not for every document.

So the exclusivity of the story will run out after three months?

No, there will be exclusivity in terms of different time windows in access to the material. As an example: there will be an auction for North America. And you will be ranked in the auction. The media organisation which bids most in the auction would get access to it first, the one who bids second will get access to it second and so on. Media organisations would have a subscription to Wikileaks.

I'm really interested in seeing how this continues to develop.

Naturally the whole Wikileaks situation is a complicated one:

  • Whistleblowing to abuse of power and corruption is good.
  • Leaking of classified documents and state secrets is (arguably) bad.
  • Subscription and auction models to keep the heat off of journalists who write at news agencies? interesting.

 

A tasty blurb on US Patents

Slashdot Your Rights Online Story | Half of US Patents Issued Out of US For Second Year

by H4x0r Jim Duggan (757476) on Wednesday January 13, @12:11AM (#30747322) Homepage Journal

I can only speak for the domain of software development, but there was a period from 1996-2008 when the USA was disproportionately feeling the rewards of software patenting. The rewards were always severly outweighed by the costs ($11 billion in 2008 [swpat.org]), but there were always people pointing at these rewards.

Now that the companies of the USA's economy will increasingly become the targets of software patents instead of the users, those rewards will diminishing.

Patent policy for other domains can be considered while only looking at the economic effects. For software, the social effects have to be considered too because software development is something that individuals can do and participate in - like writing a book, reporting news, or writing music. So, it makes sense to have economic studies [swpat.org] to make our point, but we also have to remember to have other arguments [swpat.org] and to point out that these other issues exist.

The good news is that there's the Bilski case [swpat.org] which might solve the problem, and there are also initiatives in other countries [swpat.org], most notably Israel [swpat.org], New_Zealand [swpat.org], the EU [swpat.org], Australia [swpat.org], and something starting in [swpat.org]. Help sought.

Another Week, Another GSM Cipher Bites the Dust

Orr Dunkelman, Nathan Keller, and Adi Shamir have released a paper showing that they've broken KASUMI, the cipher used in encrypting 3G GSM communications. KASUMI is also known as A5/3, which is confusing because it's only been a week since breaks on A5/1, a completely different cipher, were publicized. So if you're wondering if this is last week's news, it isn't. It's next week's news.

[T]he attack here is completely practical. Here is a quote from the abstract:

In this paper we describe a new type of attack called a sandwich attack, and use it to construct a simple distinguisher for 7 of the 8 rounds of KASUMI with an amazingly high probability of 2−14. By using this distinguisher and analyzing the single remaining round, we can derive the complete 128 bit key of the full KASUMI by using only 4 related keys, 226 data, 230 bytes of memory, and 232 time. These complexities are so small that we have actually simulated the attack in less than two hours on a single PC, and experimentally verified its correctness and complexity. Interestingly, neither our technique nor any other published attack can break MISTY in less than the 2128 complexity of exhaustive search, which indicates that the changes made by the GSM Association in moving from MISTY to KASUMI resulted in a much weaker cryptosystem.

If breaking 80%+ of the worlds GSM networks wasn't enough for last week, I guess they're breaking the rest this week.

Fun With HTTP Headers

Contrary to popular belief, there are people out there using Smalltalk on the web. Two of them. One Smalltalk software company running a web server written in Smalltalk, and another:

Server: Swazoo 0.9 (Columbus)X-WIKI-ENGINE: SmallWiki 1.0CACHE-CONTROL: no-cacheX-WIKI-COPYRIGHT: Software Composition Group, University of Berne, 2003

running a Smalltalk user’s group web site with a wiki written on Smalltalk on a web server written in, you guessed it: Smalltalk. Cool.

And, of course, it wouldn’t be the Internet without an appearance by a BOFH:

X-BOFH: http://www.xxxxx.de/bofh/xxxxxx.html

The actual URL it points to has been obscured to protect the guilty, and a local mirror provided in its stead.

These kind of people who write articles like this are definitely some of the kind of people I like to hang out with.

My Membership Survey 2010 Response

The LOPSA sent me a survey today.

I am not a paying member.

These were my answers:

1. How did you hear about LOPSA? (This question really matters to us. Providing an answer will greatly assist our planning.)

Bunch of SAGE and ex-consultants I know founded it.

2. What is your age?

29-35

3. Which of the following SysAdmin events have you attended in the past 5 years?

None
Other [ I go to infosec events. Blogs take care of the rest. ]

4. How many years have you been a System Administrator?

16 or more years

5. What benefits could LOPSA provide that might increase your willingness to become a paid member? (This question really matters to us. Providing an answer will greatly assist our planning.)

None really. I'm on the mailing lists and look at them a couple times every few months.

6. Are you a member of any of the following other organizations?

Local Sysadmin Group
Local User/Technical Group
Other [ ISSA (past. not worth it), ISC2 (no value besides their baseline cert). Good ones: CCC, Defcon, Toorcon, LayerOne ]

7. If applicable, what does the above organization(s) provide you, that you find valuable?

Framework and compliance resources. Public speaking engagements.

Like the open source movement, everyone has their own little and irrelevant org that accomplishes not much. Perhaps it issues a certification that no one needs. Maybe it sells a framework.

What an org should really do is pay it forward and make a wiki of useful information. It should attract members by being valuable instead of promising to be valuable sometime and not delivering.

Really a lot of these organizations (and not necessarily LOPSA, but definitely the majority) need to collapse into large organizations that are not just industry relevant, but non-industry relevant.

The sooner admins, network jocks, and risk managers/infosec architects start thinking and treating themselves like a serious business and not just a bunch of dips in parents basement with linux boxes, the better off we and the tech industry in general will be.

If we're not acting serious and akin to the profession of JD or a MD, we deserve not to be taken seriously.
http://www.abanet.org/about/?gnav=global_about_lead
http://www.ama-assn.org/ama/pub/about-ama/our-mission.shtml

We really need to get our acts together. The stuff we do is too important to let this trainwreck continue because a large chunk of our membership are not able to behave in public.