The past week has been a bit of a whirlwind. Last Friday I flew out to Denver for a family thing, then transferred over to Boulder for a DevOps.com advisory board meeting, Camp DevOps (where I presented), and Gluecon.
In between I spent a day with the friends who are loaning us their house for the month of July (while they caravan around the US with their kids), snuck in a 30 mile bike ride and 5 mile run, and hit some of my favorite Boulder restaurants (SouthSide cafe, Southern Sun, & Mountain Sun). I also learned I have a bad habit of telling people I’m “from Boulder but I live in Phoenix” when they ask.
Camp DevOps was a really great event on multiple levels. First it was pretty great to be back on the University of Colorado campus. I spent 8 years there as an undergrad, and worked everything from low-level student jobs to full-time staff. It is where my IT career started, and I loved getting back and having the opportunity to share some of what I’ve learned in the decades since.
Alan Shimel put on a solid first-time event. The very first track talk resolved an issue I have been researching (sending backups and logs to Amazon S3), and I picked up plenty of tidbits through the day. The Boulder tech community has a great vibe. It is very supportive in a way that is hard to replicate in larger cities which don’t shut down on powder days. Gluecon in Denver was also a solid show, although I wish I didn’t have to bail out early in an attempt to avoid some bad weather (more on that in a moment).
Camp DevOps was also slightly intimidating for me personally. I was giving a technical security talk to a bunch of developers. The challenge was to keep their interest, provide relevance, and meet their deep content expectations. According to the feedback, I was right on target. And based on other sessions I attended, I have rebuilt a lot of skills I lost when I moved more into the analyst world.
We in the security community often talk about developers like we do about Mac users. We assume they don’t care about security or prioritize it. In both cases, as I have become part of these communities I realized that they do care about security, but within a different context. It has to meld with their primary priorities, and we can’t harangue or insult them for their naivete. Participate, don’t preach, and you get a very positive reaction. Everyone wants to stay safe.
And speaking of staying safe, Adrian left the event right in time to dodge a tornado at the Denver airport. We were in different terminals when the tornado warning hit, and Adrian texted that he was evacuated to the shelter as I started to wonder if my terminal… was less important. About 10 minutes later we got the order, and as a well-trained emergency responder I found a big window right next to one of the shelter areas.
I joined the crowd gawking as the storm clouds started rotating overhead and the hail moved in, followed by blue skies. The tornado touched down 8 miles away, and my flight took off only an hour late. Oh well – I was really hoping to knock that one off the bucket list.
On to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
Favorite Securosis Posts
- Adrian Lane: Recitals. “The FUD is strong in this one”
- Mike Rothman: Firestarter: The Wife-Beater (t-shirt) edition. No spouses were harmed in the production of this week’s Firestarter. But we were able to give Adrian a hard time about his attire before we started recording. Which was full of win. The actual video cast was pretty good too, even though Rich was mostly pixelated.
- Rich: CEO on Line 2.
Other Securosis Posts
Favorite Outside Posts
- Adrian Lane: Chip and Skim: cloning EMV cards with the pre-play attack. I am not certain how viable this attack is, but if it’s true you can use an arbitrary nonce value as part of a replay attack, this is a serious flaw.
- Mike Rothman: Buffett: Teach kids financial literacy to spark entrepreneurship. Adrian and Gunnar’s idol (and I’m a fan myself) has some great perspective on teaching kids about money. This sums it up: “Financial literacy is a base requirement like spelling or reading or something of the sort that everybody should acquire at any early age.” Yup.
- Rich: U.S. Companies Hacked by Chinese Didn’t Tell Investors (via The Verge). I still believe many, if not most, breaches aren’t reported – even when there is a legal requirement. I have been told in multiple cases that the companies determine it is in their interest not to disclose. Often they use the law enforcement investigation loophole.
- Gal: Lifelock deletes user data over safety concerns. Then Goldman downgrades them over concerns that their app wasn’t PCI compliant. Security and compliance has impact on the larger business… duh.
Research Reports and Presentations
- Defending Against Network-based Distributed Denial of Service Attacks.
- Reducing Attack Surface with Application Control.
- Leveraging Threat Intelligence in Security Monitoring.
- The Future of Security: The Trends and Technologies Transforming Security.
- Security Analytics with Big Data.
- Security Management 2.5: Replacing Your SIEM Yet?
- Defending Data on iOS 7.
- Eliminate Surprises with Security Assurance and Testing.
- What CISOs Need to Know about Cloud Computing.
- Defending Against Application Denial of Service Attacks.
Top News and Posts
- eBay Urges Password Changes After Breach
- ICS-CERT Confirms Public Utility Compromised Recently.
- NSA Reform Bill Passes the House–With a Gaping Loophole.
- Buzzkill: FBI director says he was joking about hiring weed-smoking hackers. There go the Washington and Colorado FBI offices…
- New IE8 0-day by ZDI.
Comments