Incite 7/30/2014: Free Fall
If you caught my weekend rantings on Twitter, I had some free time this past weekend. The Boss was on a girlâs weekend. The kids are away at camp. And I had a meeting with a client first thing Monday morning. So I could have stayed in the ATL and taken an evening flight out. Or I could fly out first thing in the morning and find a way to get my blood pumping. Shockingly enough, I chose the latter. There is nothing better to get your blood moving than pulling some Gs on a cool roller coaster. I love roller coasters. The anticipation of the drop. The screaming of the folks around you. That exhilaration is hard to match. At least for me. Until it isnât. Maybe I was just very calm on Sunday. But my heart rate hardly moved on the first wooden coaster. It was fast. It was fun. But it wasnât scary. The two-loop two-corkscrew ride barely moved the needle either. Maybe I am just numb to coasters. Sure itâs fun, but where is the rush? The stand-up coaster was cool. That was pretty exciting. As was the âflyingâ coaster, where you ride on the outside of the track with your feet dangling. But there was still something missing. Then I saw it. The free fall ride. I am not a big fan of free fall rides. Iâll take loops, drops, and corkscrews every time. I rode the Tower of Terror at Disney with the girls, but thatâs more because I needed to. I had to represent in front of my girls. Sure it was fun, but itâs not my favorite. But in need of an adrenaline rush, I figured it was time. Time to conquer my discomfort and just drop. So I stood in line and within a couple minutes I was ascending 200-something feet in the air. The view was beautiful. The 16-year-old running the ride started chirping something about the ride being broken. That weâd need to descend slowly. But I wasnât born yesterday. I took a deep breath and got ready. Then I dropped. For 4 seconds anyway. It took my breath away, but I lived. My adrenaline spiked. My heart rate elevated. I felt alive! And I conquered the free fall. It was a good day. Itâs not great to have to travel for work on a Sunday, but if you need to. at least make sure you have some fun. âMike Photo credit: âDrop zoneâ originally uploaded by Alan Teo The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back. Securosis Firestarter Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and⊠hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail. July 22 â Hacker Summer Camp July 14 â China and Career Advancement June 30 â G Who Shall Not Be Named June 17 â Apple and Privacy May 19 â Wanted Posters and SleepyCon May 12 â Another 3 for 5: McAfee/OSVDB, XP Not Dead, CEO head rolling May 5 â There Is No SecDevOps April 28 â The Verizon DBIR April 14 â Three for Five March 24 â The End of Full Disclosure Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too. The Security Proâs Guide to Cloud File Storage and Collaboration Core Security Features Overview and Baseline Security Introduction Leveraging Threat Intelligence in Incident Response/Management Quick Wins The (New) Incident Response & Management Process Model Threat Intelligence + Data Collect = Responding Better Really Responding Faster Introduction Trends in Data Centric Security Deployment Models Tools Introduction Use Cases Understanding Role-based Access Control Advanced Concepts Introduction NoSQL Security 2.0 Understanding NoSQL Platforms Introduction Newly Published Papers The 2015 Endpoint and Mobile Security Buyerâs Guide Open Source Development and Application Security Analysis Advanced Endpoint and Server Protection Defending Against Network-based DDoS Attacks Reducing Attack Surface with Application Control Leveraging Threat Intelligence in Security Monitoring The Future of Security Security Management 2.5: Replacing Your SIEM Yet? Defending Data on iOS 7 Incite 4 U The Imprudence of Clouds: The SNL skit âCommon Knowledgeâ was a game show where the ârightâ answer to a question was not the factual answer, but whatever popular answer the studio audience thought was right. Thatâs what ran through my mind when Robert Graham pointed out that the fact that Some in cybersec keep claiming that open-source is inherently more secure or trustworthy than closed-source does not make it true. Robâs good like that â poking at so-called âcommon knowledgeâ. And based on Sonatypeâs just-completed open source survey, clearly developers believes this as well. I would not yet call it a cliche â only a couple years ago enterprises prohibited open source as untrustworthy â but Rob has a good point. In many cases open source code is not being reviewed, and while I see some open source code scanning, open code can be just as bad as commercial software: poor usability, bugs, and vulnerabilities. There is crap software all over the place. Whether you pay for it or not. â AL DDoS: Coming soon to an amateur near you: It was only a matter of time. But it looks like DDoS is about to hit the masses. Between folks using fake Googlebots to blast a site, packaged DDoS kits available for $500, and DDoS bots on Amazon taking advantage of a defect in ElasticSearch, DDoS attacks are becoming more accessible to hackers