Sometimes a short memory is very helpful. Of course as you get older, it may not be a choice. But old guy issues aside, there are times you need to forget what just happened and move on to the next thing. Maybe it’s a deal you lost, or a project you couldn’t get funded, or a bungled response to an incident. If you live to fight another day then you need to learn, put it in the past, and move forward.

The Boy learned that lesson a few weeks back playing tennis. He’s a decent player and was teamed with his friend in a doubles match. The other kids were pretty good but our team sprinted out to a 7-2 lead. The first to 8 wins. He has it in the bag, right? They dropped the next game, so it was 7-3. Not a problem. Then it was 7-5 and the Boy started to panic. I could see it. He was on the verge of breaking down.

And the thing about tennis is that coaches (and parents) cannot get involved during the match. So besides a few hand signals I sent his way to calm down, there wasn’t anything I could do other than see him come apart at the seams. His partner was panicking as well, especially as the score went to 7-6, and then ultimately 7-7. You could see the Boy and his partner were broken. They dropped 5 games in a row and lost their confidence.

It was hard to watch. Really hard. For a guy used to controlling most of his environment, it was brutal to be so powerless. But this wasn’t about me. It’s about him. The Boy served in that next game and held serve. He hit a couple of winners and got his mojo back. You could see the confidence return. They dropped the next game and went into a tiebreaker. The first to 7 would win the match.

They split the first two points on the opponents’ serve, so that was a mini break. The Boy then held their serve, so it was 3-1. Then they broke again. 5-1. The other team scrapped and they had a few good rallies, but the Boy and his partner prevailed 7-3. He was happy but could only shake his head about blowing such a huge lead.

I pulled him aside and said this illustrates a number of very important lessons. First about fighting through. They didn’t give up, and they persevered to get the win. I was very proud of them for that. But the real lesson I wanted to communicate was the importance of having a short memory. The fact that he hit a bad shot doesn’t mean he’s a bad player. He needs to trust his training and the work he put in. He can’t lose confidence, and needs to just move on to the next thing. It is not productive to get lost in his own head – he needs to understand the battle is less important than the war, and to know the difference.

Of course the lesson wasn’t about tennis. It was about life. But I don’t need to tell him that. Not yet, anyway…

–Mike

Photo credit: “The Bryan Brothers” originally uploaded by Boss Tweed

The fine folks at the RSA Conference posted the talk Jennifer Minella and I did on mindfulness at the conference this year. You can check it out on YouTube. Take an hour and check it out. Your emails, alerts and Twitter timeline will be there when you get back.

Securosis Firestarter

Have you checked out our new video podcast? Rich, Adrian, and Mike get into a Google Hangout and.. hang out. We talk a bit about security as well. We try to keep these to 15 minutes or less, and usually fail.

Heavy Research

We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, with our content in all its unabridged glory. And you can get all our research papers too.

Building an Enterprise Application Security Program

Security and Privacy on the Encrypted Network

Secure Agile Development

Newly Published Papers

Incite 4 U

  1. Card of the Sith: Thanks to Chris Pepper for pointing out CurrentC Is The Big Retailers’ Clunky Attempt To Kill Apple Pay And Credit Card Fees. In a nutshell, a large group of merchants – including Rite Aid, CVS, Walmart, Target, K-Mart, and Kohl’s – are putting together a “mobile payment” app to avoid paying credit card processing fees. Rather than extend a small loan like a credit card, CurrentC will pull money directly and immediately from your bank account. Yes, those very same firms who vigorously market your personal data – and keep getting breached by hackers – now want to build their own payment system and on top of direct access to your bank account. What could possibly go wrong? The biggest issue is one of the very real benefits of credit cards: limited liability in case of fraud. If someone gets hold of your credit card or breaches the payment system, your liability is sharply limited. Your bank account has no such protection, would likely be drained, and you’d be out the money. Debit cards are somewhere in the middle – they have protections but not nearly as strong as real credit cards. The icing on this steaming pile of customer unfriendliness is that these merchants won’t accept ApplePay – essentially a secure way to use your credit card, which is exactly what the merchants want to get away from. CurrentC promises to deliver the merchants from credit card transaction fees, PCI-DSS security requirements, and liability – all with direct access to your money. Customers get all the liability, most of the hassle (the checkout process promises to be painful for both purchases and clerks), and less security. Somewhere Darth Sidious is laughing at the fiendish genius of it all. – AL
  2. It’s about the relationships: Just in case you were still under the misapprehension that the CISO job is about technical chips, it’s not. Dark Reading has a good profile of RSA’s new CISO, Janet Levesque. Her path was similar to mine, starting as a COBOL programmer (old school!). But I went into networking and then security. She became an auditor and then ended up doing security. She also did a dotcom and turned off the lights (been there, done that). But here is the killer quote: “Levesque says the company was most interested in hiring her because of her relationship-building skills – something that has become more important for RSA as it expands its hosting services business, and for CISOs across the board as companies outsource more of their IT functions.” As you climb the ladder on the security team, understand that your success criteria and skills must evolve as well. – MR
  3. Security wisdom? Where can I buy that? Martin McKeay has a good point in The Knowledge Pyramid on securityintelligence.com. He starts with “The marketing treadmill around security intelligence and big data the last few years really annoys me.” Yes! It bugs me too! Martin begins building the pyramid with data, placing information (analysis of that data) next. Above that is intelligence, which provides context of what that information means to you. On top Martin places wisdom, which connects disparate information – mostly via experience. That’s why SkyNet is not going to displace your SOC staff any time soon. Sure, there are things you can analyze in a more automated fashion, but even very qualified alerts need to triage and validate. But here’s the issue: wisdom, in the form of experienced security practitioners, is hard to come by. That’s why every conversation reminds me of the security skills gap, which continues to grow. – MR
  4. Driving business: Amazon has opened a new data center in Germany, and it appears likely they picked it as their second EU location because of stronger data protection laws in Germany. It’s not that Amazon’s security is driving customers to them, but firms that want cloud services need a provider who can guarantee their data will remain local and secure from foreign governments (specifically the US). Some EU nations won’t allow citizen data to travel across national boundaries – encrypted or not – due to fear that keys will be compromised. This constrains many companies to doing business with local cloud providers, and Amazon appears to be stepping into a market with pent-up demand. Couple that with allowing customers to manage their own encryption keys, and it won’t matter if a secret court orders Amazon to divulge data archives – they can simply (and honestly) explain that the information is encrypted, and Amazon cannot decrypt it. Security concerns over spying will continue to drive IT buying decisions for a long time. – AL
  5. Analyst 101: There is nothing like a former analyst teaching folks how to deal with analysts. Being out of the machine provides some perspective on how it can be done better. In his first post for a new series, Aneel Lakhani provides an introduction to the types of analysts and what they do. It’s close enough to provide a feel for how the business works. I caution you not to draw conclusions about firms due to their funding model. Or perhaps you can, but be ready to make exceptions – there are firms which cannot be bought (like us), even though we advise and license content to vendors. Aneel offers a good description: “Fundamentally, what analysts do is information arbitrage.” That’s about right. I prefer the term “information broker”, but it’s the same thing. I’ll follow the series and mention it again if there is anything else of value in there. – MR
Share: