I just realised that its been a year since I posted a blog post - Information-centric Security is Dead.
Ironically enough, next week I am presenting at a Security Summit on, well, Information-centric Security.
The article, I believe is one of my most important ones. Information-centric security is not really dead. But it is a stepping stone. Read my last blog post and the one linked above together and you will see what I believe is the most exciting and important development in our industry, probably since Firewalls.
If you aren't busy next week Tuesday then maybe come see me talk. It'll be fun, I'll make jokes. Promise.
Showing posts with label blogs. Show all posts
Showing posts with label blogs. Show all posts
Friday, May 22, 2009
Monday, March 9, 2009
Fame! I'm gonna live forever!
[The esteemed writer of Security Thoughts Gets a Mention in Two of His Favourite Blogs]
Yes, not only did I get a mention on The Hoff's Rational Survivability.
But I also got a mention on Securosis.
Life is good.
Yes, not only did I get a mention on The Hoff's Rational Survivability.
But I also got a mention on Securosis.
Life is good.
Thursday, January 17, 2008
2007
I have been trying to get the motivation together to blog about my predictions for 2008 but I'm not finding it. So, I've decided to break it up into smaller pieces and hopefully that will make it easier.
So, looking back...
2007 started with me being very motivated, excited and happy. It was going to be a great year with lots of promise. It ended with me feeling very down, de-motivated and depressed. But I am still optimistic for 2008 which either means I am hard to get down or just really naive. I guess time will tell.
My first prediction for 2008 is that I will be a very different person by this time next year. And I will be sitting in a very different place. If I am not - I will have failed.
I don't like to get too much into the personal aspects of my job but a lot of the energy I put into getting security to move forward has been in vain and I am feeling that I am now wasting my time trying to move forward. I have put myself into "cruise" mode while I work behind the scenes to improve myself and then with a big bang I'll be back.
There were some some really excellent moments in 2007. I think that the most important was when I started my blog. I highly recommend blogger. I also recommend feedburner. Both companies are owned by the big G.
A big thank you goes out to Alan from Still Secure who got me motivated and introduced me to the Security Bloggers Network.
While it helps that I am a member of the network and that drives some views to my blog, it has helped me more to explore and find people on the network. I have been able to populate my RSS feed list from a number of bloggers and I hope to add more. I just need the time.
So, who is honoured to be in my RSS feed?
First up is my brother-from-another-mother - Andy the IT guy. I call him that because he has a very similar job, a wife and two daughters and he has had a very similar career path to me. More importantly, I usually see eye-to-eye with him.
Next up is "Security Mike" - Mike Rothman. The daily incite is an amazing tool to get an idea of what is happening in the security blog world. How Mike can read so much still amazes me. One day I'll have saved up enough. The new Audio is also worthwhile.
Next is (this is the order I read my blogs in - obviously I'd want to get the best first) the Mogull. One can see from his postings just how much research he has done into the security field. They are well written and very useful.
Just as wordy and usually more fun is the Hoff. The Hoff is worth reading because of how he pushes the boundaries of what security (or survivability) is all about. He does not pull his punches and is not afraid to sacrifice a few sacred cows along the way.
There are other bloggers that I respect and read too - Anton Chuvakin, Randy Armknecht, Richard Bejtlich, etc etc
I think that the best part of reading all of the above blogs is that the authors all read each others blogs too. This leads to debates, arguments but hopefully lessons learned.
2007 was also the year that I learned about the Security Catalyst Forums where more debate happens. This just proves how new our industry is and how much passion is being put into finding out the answers. This can only be a good thing.
Locally I've kept up with my visits to ISG Africa which has great presentations every month.
I completed almost 100 blog entries over the year, putting into word my thoughts about our exciting industry. My "70s" entries show where we went wrong in the 80s with our IT plans and how we are putting things right again. My 7 habits show how popular business and life philosophies can be used in InfoSec to move us in the right direction. I will hopefully finish those off shortly. (Prediction 2?)
Thank you everyone who has shared their views and hard work with me via their blogs and forums and I hope all that read this blog have learned something and will continue to follow my progress and read my thoughts.
Soon I will post my predictions for 2008.
So, looking back...
2007 started with me being very motivated, excited and happy. It was going to be a great year with lots of promise. It ended with me feeling very down, de-motivated and depressed. But I am still optimistic for 2008 which either means I am hard to get down or just really naive. I guess time will tell.
My first prediction for 2008 is that I will be a very different person by this time next year. And I will be sitting in a very different place. If I am not - I will have failed.
I don't like to get too much into the personal aspects of my job but a lot of the energy I put into getting security to move forward has been in vain and I am feeling that I am now wasting my time trying to move forward. I have put myself into "cruise" mode while I work behind the scenes to improve myself and then with a big bang I'll be back.
There were some some really excellent moments in 2007. I think that the most important was when I started my blog. I highly recommend blogger. I also recommend feedburner. Both companies are owned by the big G.
A big thank you goes out to Alan from Still Secure who got me motivated and introduced me to the Security Bloggers Network.
While it helps that I am a member of the network and that drives some views to my blog, it has helped me more to explore and find people on the network. I have been able to populate my RSS feed list from a number of bloggers and I hope to add more. I just need the time.
So, who is honoured to be in my RSS feed?
First up is my brother-from-another-mother - Andy the IT guy. I call him that because he has a very similar job, a wife and two daughters and he has had a very similar career path to me. More importantly, I usually see eye-to-eye with him.
Next up is "Security Mike" - Mike Rothman. The daily incite is an amazing tool to get an idea of what is happening in the security blog world. How Mike can read so much still amazes me. One day I'll have saved up enough. The new Audio is also worthwhile.
Next is (this is the order I read my blogs in - obviously I'd want to get the best first) the Mogull. One can see from his postings just how much research he has done into the security field. They are well written and very useful.
Just as wordy and usually more fun is the Hoff. The Hoff is worth reading because of how he pushes the boundaries of what security (or survivability) is all about. He does not pull his punches and is not afraid to sacrifice a few sacred cows along the way.
There are other bloggers that I respect and read too - Anton Chuvakin, Randy Armknecht, Richard Bejtlich, etc etc
I think that the best part of reading all of the above blogs is that the authors all read each others blogs too. This leads to debates, arguments but hopefully lessons learned.
2007 was also the year that I learned about the Security Catalyst Forums where more debate happens. This just proves how new our industry is and how much passion is being put into finding out the answers. This can only be a good thing.
Locally I've kept up with my visits to ISG Africa which has great presentations every month.
I completed almost 100 blog entries over the year, putting into word my thoughts about our exciting industry. My "70s" entries show where we went wrong in the 80s with our IT plans and how we are putting things right again. My 7 habits show how popular business and life philosophies can be used in InfoSec to move us in the right direction. I will hopefully finish those off shortly. (Prediction 2?)
Thank you everyone who has shared their views and hard work with me via their blogs and forums and I hope all that read this blog have learned something and will continue to follow my progress and read my thoughts.
Soon I will post my predictions for 2008.
Wednesday, June 27, 2007
Nice term - horrible concept
Part of the reason I blog is to put my ideas down in something more tangible than fleeting thoughts, hence the name of the blog. Others can benefit from my thoughts but sometimes I use the blog to record interesting things I have heard and seen. This blog entry is about that.
I was reading a blog and came across the term "intermittent variable reward". It is basically the quick happiness one gets from doing something that is repetitive but rewards you differently. The example given in the blog entry I was reading (see below) is a jackpot. You pull the handle and each time you get a different reward.
I think facebook is like that. Woo-hoo, a new friend, a new wall posting, a new comment, etc. MXit is even more like that. You are never sure when someone will contact you and what they will say. So hope is always there and the addiction comes very easily.
This is something I've been meaning to blog about for a long time but never really took the time until I saw something similar here but about "twitter" which I haven't really come into contact with much yet.
When I was in University I spent more time than I should have on IRC. I made some good friends along the way and found a beautiful wife. So, some good came out of it but I must say I was addicted to the the rush of seeing what is going to happen next even to the point where I would sit and stare at my computer screen doing nothing, just waiting. What a waste of time.
My brother-in-law is the next generation. Every time I see him he has his cell phone out and it is always beeping from some contact somewhere. MXit prides itself on being next to free but the amount of time spent on MXit by some of the youth of South Africa is scary.
And now I have a term for this addiction: "intermittent variable reward".
Tuesday, June 26, 2007
Information Security - its for Small Businesses too!
I am (about) number 30 in the Business section on Amatomu. For those of you who don't know what it is - it is a list of South African blogs, ranked and indexed.
I have read some of the blogs and am impressed at the quality of them and most of them (the business ones) seem to be aimed at small businesses, which is great.
But I am an Information Security blogger and from what I have seen - small businesses don't seem to take Information Security seriously.
For example, I went to a business the other day and they have me listed on their database. But they had my password on their system in plain text. Thank goodness I use a different password for each online service I use but I know some people that use their pin number as a password and some use the same password for every service. Sorry friend, your password is no longer secure.
When you sign up for a movie contract, where does the information go? Who has access to it? Are your credit card details listed, your ID number? If you have to fill in a piece of paper first, where does that go? You probably fill in enough stuff when taking out a movie contract to allow the young kid behind the counter to be able to impersonate you and mess you around.
When you had over your credit card in a restaurant, does the waiter take down all the numbers? More to the point - is this something the manager will look out for?
Does your lawyer, who works from home, keep all your information on his laptop? Or any of it? Is it encrypted? What if the laptop gets stolen? What if all the documents he is busy with for you get wiped out in a fire/virus attack/mistake? Does he do backups? Do you?
Its not like me to sow some fear, uncertainty and doubt but I think that small businesses need to play along.
For their clients and for themselves.
Tuesday, June 12, 2007
And Now for Some Bible Education (Part 3)
Finally, just a word of thanks to Jewishanswers.org who put me in contact with Rabbi Seinfeld (yes, really) who helped me find the information I needed for these posts.
A rabbi with a blog sounds like the start of a jewish joke but his blog is interesting and I have bookmarked it.
The actual article I used for my blog is here. And is from commentary on Exodus 18.
A rabbi with a blog sounds like the start of a jewish joke but his blog is interesting and I have bookmarked it.
The actual article I used for my blog is here. And is from commentary on Exodus 18.
Monday, April 23, 2007
Allen Baranov is alive, well and living a State of Fear (Part One)
"Is something wrong, she said
Well of course there is
You're still alive, she said
Oh, and do I deserve to be?
Is that the question?" - Pearl Jam, "Alive"
Yes. I am still about.
The last few weeks have been mad. My folks are visiting from Australia, blogger has been doing funny things, work has been hectic and I'm trying to work out what to do with my life. Lots of excuses why I have not posted in a long while...however...
... I am reading "State of Fear" by Michael Crichton. It is a really good book and worth reading as are all his books. The basic story behind it (besides all the fast paced action you should expect from his novels) is that Global Warming is junk invented by Earth Rights groups to get money that should go to starving kids in Africa and not some theory that may or may not be true.
So, what does this mean for us security professionals? This IS (sorta) an info-sec blog.
Well, he takes it further near the end of the book. He says that there are always issues facing mankind. The press and interested parties (in each case) just blow them up for their own gain. Interested parties so that they can get funding and the press so they can sell their media.
I know I get excited every time some bit of security news makes the papers (sometimes front page) even if once I dissect it, it is really some arbitrary news. It puts what I do in the spotlight and I can get a warm fuzzy feeling. I can also (maybe one day) tell people exactly what I do instead of "I'm in IT". And maybe more companies will take Information Security more seriously and spend more and some of that will trickle down into my usually empty pockets.
Bruce Schneier seems to think about this issue a lot and I like the title of his book "Beyond Fear" because that sums up where I think we should be going. Manage your systems correctly and don't worry.
Still, there are the Fear-mongers - buy security (and then even more) because you may go to jail if you don't secure your company down to the last little screw.
There are also...hmmm... the naive ones... who believe everything can be put into black and white. I always thought I was missing something because even in all my (too many) years in security I have no idea what numbers to use in a risk assessment.
Recently I posted to a security list asking "is a firewall really necessary?" and one answer was "do a risk assessment". I wasn't talking about an external firewall but the answer came from someone who didn't know that.
I can't see how my time would be best spent trying to (research/invent) numbers to prove that a firewall is needed. Its just plain sense (at least on the border) - I think.
Maybe there is a fine line between State of Fear and State of Risk. I hope that I am there.
Well of course there is
You're still alive, she said
Oh, and do I deserve to be?
Is that the question?" - Pearl Jam, "Alive"
Yes. I am still about.
The last few weeks have been mad. My folks are visiting from Australia, blogger has been doing funny things, work has been hectic and I'm trying to work out what to do with my life. Lots of excuses why I have not posted in a long while...however...
... I am reading "State of Fear" by Michael Crichton. It is a really good book and worth reading as are all his books. The basic story behind it (besides all the fast paced action you should expect from his novels) is that Global Warming is junk invented by Earth Rights groups to get money that should go to starving kids in Africa and not some theory that may or may not be true.
So, what does this mean for us security professionals? This IS (sorta) an info-sec blog.
Well, he takes it further near the end of the book. He says that there are always issues facing mankind. The press and interested parties (in each case) just blow them up for their own gain. Interested parties so that they can get funding and the press so they can sell their media.
I know I get excited every time some bit of security news makes the papers (sometimes front page) even if once I dissect it, it is really some arbitrary news. It puts what I do in the spotlight and I can get a warm fuzzy feeling. I can also (maybe one day) tell people exactly what I do instead of "I'm in IT". And maybe more companies will take Information Security more seriously and spend more and some of that will trickle down into my usually empty pockets.
Bruce Schneier seems to think about this issue a lot and I like the title of his book "Beyond Fear" because that sums up where I think we should be going. Manage your systems correctly and don't worry.
Still, there are the Fear-mongers - buy security (and then even more) because you may go to jail if you don't secure your company down to the last little screw.
There are also...hmmm... the naive ones... who believe everything can be put into black and white. I always thought I was missing something because even in all my (too many) years in security I have no idea what numbers to use in a risk assessment.
Recently I posted to a security list asking "is a firewall really necessary?" and one answer was "do a risk assessment". I wasn't talking about an external firewall but the answer came from someone who didn't know that.
I can't see how my time would be best spent trying to (research/invent) numbers to prove that a firewall is needed. Its just plain sense (at least on the border) - I think.
Maybe there is a fine line between State of Fear and State of Risk. I hope that I am there.
Thursday, March 15, 2007
Missed out...maybe next year
It seems all the guys who I read online have been honoured by it security.com. I missed out by coming late to the party. Maybe next time I'll be able to slot in just above Alan Shimel.
It has been an interesting few months and I look forward to doing this for a while.
It is an honour ("honor" for Alan and his American friends) to be part of the Security Bloggers Network (and hence number 19 on the list!)
I check the RSS feed of the Security Blogger Network every day and have added a few websites like SSAATY to my list of have to reads.
It has been an interesting few months and I look forward to doing this for a while.
It is an honour ("honor" for Alan and his American friends) to be part of the Security Bloggers Network (and hence number 19 on the list!)
I check the RSS feed of the Security Blogger Network every day and have added a few websites like SSAATY to my list of have to reads.
Tuesday, January 30, 2007
Initial Thoughts
Right, here we go.
Post number 1.
According to the blog article on Wikipedia:
"Gartner Group forecasts that blogging will peak in 2007, levelling off when the number of writers who maintain a personal website reaches 100 million. Gartner analysts expect that the novelty value of the medium will wear off as most people who are interested in the phenomenon have checked it out, and new bloggers will offset the number of writers who abandon their creation out of boredom. The firm estimates that there are more than 200 million former bloggers who have ceased posting to their online diaries, creating an exponential rise in the amount of dotsam and netsam (i.e. unwanted objects) on the Web."
So, is my Blog just for jumping on the bandwagon? Or is it more than that?
Well, at least by submitting this one little comment onto the huge Internet for Google to preserve for ever I become Time magazine's person of the year. Which is not bad going for a few minutes of playing around while on the Company's payroll.
It means I join such greats as JFK (former president), Nelson Mandela (former president) and Rudi Giuliani (for President!). Of course, also in the same company is Stalin and Hitler.
This is not the first time I have left my footprints on the virtual sands of the Internet, if I google (lowercase "g") myself I find little traces of Me all over. Some are surprisingly insightful, (incite-fool?) and some are quite embrazzering.
Blogging is new to me - this is my first geniuine post. And I am amazed at how easy it is. Well done blogger. I look foward to doing more posts as soon as possible. Starting with the next one - what this blog is all about anyhow.
Post number 1.
According to the blog article on Wikipedia:
"Gartner Group forecasts that blogging will peak in 2007, levelling off when the number of writers who maintain a personal website reaches 100 million. Gartner analysts expect that the novelty value of the medium will wear off as most people who are interested in the phenomenon have checked it out, and new bloggers will offset the number of writers who abandon their creation out of boredom. The firm estimates that there are more than 200 million former bloggers who have ceased posting to their online diaries, creating an exponential rise in the amount of dotsam and netsam (i.e. unwanted objects) on the Web."
So, is my Blog just for jumping on the bandwagon? Or is it more than that?
Well, at least by submitting this one little comment onto the huge Internet for Google to preserve for ever I become Time magazine's person of the year. Which is not bad going for a few minutes of playing around while on the Company's payroll.
It means I join such greats as JFK (former president), Nelson Mandela (former president) and Rudi Giuliani (for President!). Of course, also in the same company is Stalin and Hitler.
This is not the first time I have left my footprints on the virtual sands of the Internet, if I google (lowercase "g") myself I find little traces of Me all over. Some are surprisingly insightful, (incite-fool?) and some are quite embrazzering.
Blogging is new to me - this is my first geniuine post. And I am amazed at how easy it is. Well done blogger. I look foward to doing more posts as soon as possible. Starting with the next one - what this blog is all about anyhow.
Subscribe to:
Posts (Atom)