Friday Summary: May 13, 2011By Rich
If you follow me on Twitter (@rmogull) you might suspect that last week I took a short vacation. And that said vacation started somewhat auspiciously. And said event really pissed me off to a degree I normally don’t let myself hit. And, just perhaps, American Airlines was responsible.
Like many of you I spend a heck of a lot of time in airports. Enough that I tend to shun personal travel since it isn’t really worth the hassles. Starting a vacation at the airport is, for me, like trying to start a vacation by heading to work in a traffic jam, hunting for a parking spot, getting groped by the security guard at the door, and having my ass duct taped to a chair for 5 hours while being force-fed flavored cardboard.
Well, I suppose there’s beer and wine. If by “beer” you mean some piss-yellow watered down crap with a german name, and by “wine” you mean a small bottle of grape juice likely fermented in a cattle stall.
Back to the story.
This trip was special. It was the first time my wife and I would get away without the kids since our second little nugget showed up. Plus it was for my 40th birthday and our 5th anniversary. The idea of sleeping more than 3-4 hours at a stretch was drool-inspiring.
Our first plane took off on time. It even landed early. WAY early. At the airport we started from. With a mechanical.
As soon as we hit the runway I was calling AA and holding a space on a backup for our connecting flight. Then we were told it would be a 2 hour wait (at least) so I was back on the phone getting our next flight, and then an even later connecting flight to our eventual destination.
Our new flight was then delayed. With a mechanical.
We landed with mere seconds to spare for us to get to our connecting flight, so we literally sprinted through the airport and arrived maybe 60 seconds after the 10 minute cutoff. Most airlines will hold a connecting flight for a minute or two, or at least leave the gate door open a little longer, if they know there are connecting passengers and it’s the airline’s fault they’re late.
But not AA. That door slammed closed leaving about 5 of us (from different delayed flights) waiting another 4 hours for the next one.
For the first time ever I asked to speak with a supervisor. He told me that because they were #16 of 17 for on-time rate, they never hold flights.
Nice. So they get to maybe improve their numbers and piss off their passengers in the process. While I was speaking with him about a half-dozen other passengers from different flights and connections all made the same complaint. This is a classic example of focusing on a metric to the detriment of the business.
As for us? We finally got to our destination over 7 hours late. On the upside it was the Margaritaville Beach Resort and the bar was still open. I wasn’t quite as angry after my first top-shelf marg. By the time we saw Jimmy Buffett at the New Orleans Jazz Fest? Well, heck, I would have kissed one of those crappy AA planes. On the nose, not the tail. It isn’t like I’m some sort of weirdo.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian’s Dark Reading Post on Secure Access to Relational Data.
- Rich’s Cloud Encryption Use Cases. (registration required)
Favorite Securosis Posts
- Adrian Lane: Thoma Bravo Trips the Wire Fantastic. Money trumps security strategy.
- Mike Rothman: SIEM: Out with the Old. SIEM is not the only technology companies are looking to swap out in the near term. Adrian does a good job of dealing with how to select that new SIEM.
- Rich: Sophos Wishes upon A-star-o. First we like RSA/NetWitness, now this. I swear we must be going soft or something.
Other Securosis Posts
- Incite 5/11/2011: Generalists and Specialists.
- Incomplete Thought: Existential Identities (or: Who the F*** are You?).
Favorite Outside Posts
- Gunnar: Process kills developer passion. Best practices sound good in isolation, but they can suck the life out of developers.
- Adrian Lane: Process kills developer passion. When you de-Agile Agile, it’s no longer Agile, and no freakin’ fun!
- Mike Rothman: A Veteran of SEAL Team Six Describes His Training. Not security related, but a great read. These guys are bad ass.
- Pepper: Apps to stop data breaches are too complicated to use. Sounds like folks need guidance, eh? ;)
- Rich OpenStack Beginner’s Guide for Ubuntu 11.04. I’ve been banging my head against OpenStack and this is the best how-to guide I’ve hit.
Research Reports and Presentations
- React Faster and Better: New Approaches for Advanced Incident Response.
- Measuring and Optimizing Database Security Operations (DBQuant).
- Network Security in the Age of Any Computing.
- The Securosis 2010 Data Security Survey.
- Monitoring up the Stack: Adding Value to SIEM.
- Network Security Operations Quant Metrics Model.
- Network Security Operations Quant Report.
- Understanding and Selecting a DLP Solution.
Top News and Posts
- Google Fixes Two Chrome Bugs, Adds Flash 10.3 to Browser.
- Microsoft Security Intelligence Report (SIRv10) released.
- Zeus Source Code Leaked.
- VUPEN Whitehats Claim To Have Broken Chrome Sandbox.
- FCC Chairman becomes FCC Lobbyist. For a firm she just ruled in favor of. Meredith Attwell Baker rates an 8.5 on the scumbag scale.
- Microsoft Patch Remote Code Execution Vulnerability in WINS.
- Anonymous Splinter Group Implicated in Sony Hack.
- FBI Spyware and Electronic Surveillance.
Blog Comment of the Week
I’d like to point out one of the massive flaws in our security systems – one that all the vendors out there exploit: those that make the purchasing/planning decisions at most of the businesses / institutions / governments / etc. out there have no more understanding of the technology and risks than the ‘pointy haired boss’.
Sure… we know that APT can be stopped by AV the same way a wishful thinking will fly you to the moon.
But to them the ability to say to their peers/subordinates/random-strangers/reporters “Hey… I fixed it… we’re protected!” is all the carrot the vendors need to come a calling and peddling their wares.
The only realistic solution I’ve thought of is to get all those CISSP card holders to live up to their pledge and do the ethical thing: tell the truth. Dispel the FUD. And for the love of all that is precious (and not just that ring)… don’t sell their “approval” for a damn pay cheque.
Sorry… but people being willfully ignorant and buying snake oil for a quick ego boost annoys me.