If you caught my weekend rantings on Twitter, I had some free time this past weekend. The Boss was on a girl’s weekend. The kids are away at camp. And I had a meeting with a client first thing Monday morning. So I could have stayed in the ATL and taken an evening flight out. Or I could fly out first thing in the morning and find a way to get my blood pumping.

Shockingly enough, I chose the latter. There is nothing better to get your blood moving than pulling some Gs on a cool roller coaster. I love roller coasters. The anticipation of the drop. The screaming of the folks around you. That exhilaration is hard to match. At least for me.

Until it isn’t. Maybe I was just very calm on Sunday. But my heart rate hardly moved on the first wooden coaster. It was fast. It was fun. But it wasn’t scary. The two-loop two-corkscrew ride barely moved the needle either. Maybe I am just numb to coasters. Sure it’s fun, but where is the rush?

The stand-up coaster was cool. That was pretty exciting. As was the ‘flying’ coaster, where you ride on the outside of the track with your feet dangling. But there was still something missing. Then I saw it. The free fall ride.

I am not a big fan of free fall rides. I’ll take loops, drops, and corkscrews every time. I rode the Tower of Terror at Disney with the girls, but that’s more because I needed to. I had to represent in front of my girls. Sure it was fun, but it’s not my favorite. But in need of an adrenaline rush, I figured it was time. Time to conquer my discomfort and just drop. So I stood in line and within a couple minutes I was ascending 200-something feet in the air.

The view was beautiful. The 16-year-old running the ride started chirping something about the ride being broken. That we’d need to descend slowly. But I wasn’t born yesterday. I took a deep breath and got ready.

Then I dropped. For 4 seconds anyway. It took my breath away, but I lived. My adrenaline spiked. My heart rate elevated. I felt alive! And I conquered the free fall. It was a good day. It’s not great to have to travel for work on a Sunday, but if you need to. at least make sure you have some fun.

–Mike

Photo credit: “Drop zone” originally uploaded by Alan Teo

The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back.

Securosis Firestarter

Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and… hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail.

Heavy Research

We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too.

The Security Pro’s Guide to Cloud File Storage and Collaboration

Leveraging Threat Intelligence in Incident Response/Management

Trends in Data Centric Security

Understanding Role-based Access Control

NoSQL Security 2.0

Newly Published Papers

Incite 4 U

  1. The Imprudence of Clouds: The SNL skit “Common Knowledge” was a game show where the ‘right’ answer to a question was not the factual answer, but whatever popular answer the studio audience thought was right. That’s what ran through my mind when Robert Graham pointed out that the fact that Some in cybersec keep claiming that open-source is inherently more secure or trustworthy than closed-source does not make it true. Rob’s good like that – poking at so-called “common knowledge”. And based on Sonatype’s just-completed open source survey, clearly developers believes this as well. I would not yet call it a cliche – only a couple years ago enterprises prohibited open source as untrustworthy – but Rob has a good point. In many cases open source code is not being reviewed, and while I see some open source code scanning, open code can be just as bad as commercial software: poor usability, bugs, and vulnerabilities. There is crap software all over the place. Whether you pay for it or not. – AL
  2. DDoS: Coming soon to an amateur near you: It was only a matter of time. But it looks like DDoS is about to hit the masses. Between folks using fake Googlebots to blast a site, packaged DDoS kits available for $500, and DDoS bots on Amazon taking advantage of a defect in ElasticSearch, DDoS attacks are becoming more accessible to hackers of all capabilities. What does this mean for you? If you don’t yet have a specific plan for DDoS mitigation, you probably should start working on one. It is not a question of just buying a DDoS mitigation service or front-ending your key web properties with a CDN. There are many ways to address this issue, which you can learn about by checking out our DDoS research: Network DDoS & App DDoS. So plan now – or be down later. – MR
  3. Shared secret: Apparently you can force a debit or credit card transaction through the system, even if you have a bad card number, provided you have a willing cashier and a purchase price that isn’t too high. It appears some people have been ripping off businesses by providing made-up card override authorization numbers of the right length, which seems to be all it takes to force a transaction through. Even with a bogus account number. Only the override code’s length is validated – not its value. That, as we say, is security through obscurity, which works perfectly until it doesn’t. – AL
  4. Managing perception: I talk a lot about managing expectations. More to the point, not having any expectations so you cannot be disappointed. But the flip side of that is managing the perceptions of others. Chris Hayes nicely illustrates this concept by confronting the issues around quantifying risk. Yes, it’s hard. But do you give up? Chris says getting frustrated by the challenge of the job is human. But you cannot let your clients (internal or external) see you sweat. Maybe you can make the problem more manageable by reducing its scope. Maybe some of your buddies have gone through a similar challenge and can provide some guidance. Maybe you need to ratchet back the expectations of your clients to what is achievable with the resources available. But Chris ends with the most salient point: “…as risk professionals it is expected that we deal with tough things so our decision makers don’t have too.” – MR
  5. Cloudflux: In 2009 Chris Hoff gave one of the best security presentations I have ever seen: “The Frogs who Desired a King”. He outlined a few ways to leverage “the Cloud” for fun and mayhem. One idea was to create a FastFlux botnet in the cloud – leveraging trial accounts or stolen credit cards for an ephemeral, zero-cost platform without having to hack a bunch of PCs. That is leverage, folks! Now two researchers have built a working cloud botnet which they will demo at Black Hat next week. Honestly, this is exactly the type of automation and scaling that cloud computing was designed for. It’s a perfect use case for the cloud! Password cracking, spam blasting, litecoin mining, fraudulent web site hosting – the cloud offers infinite possibilities… for crime bosses. As with everything else in security, this will be a game of cat-and-mouse for a while as cloud vendors get better at detecting this type of misuse and introduce controls to throttle it back, but it will be fun to watch for the next few years. Unless you post your secret keys on GitHub, that is… – AL
Share: