A recent Tweet from Shack was pretty jarring.

Old friend from college died today. Got some insane rare lung disease out of nowhere, destroyed them. Terrifying. 37 years old. :/

Here today. Gone tomorrow. It’s been a while since I have ranted about the importance of enjoying (most) every day. About spending time with the people who matter to you. People who make you better, not break you down. Working at something you like, not something you tolerate. Basically making the most of each day, which most of us don’t do very well. Myself included.

This requires a change in perspective. Enjoying not just the good days but also the bad ones. I know the idea of enjoying a bad day sounds weird. It’s kind of like sales. Great sales folks have convinced themselves that every no is one step closer to a yes. Are they right? Inevitably, at some point they will sell something to someone, so they are in fact closer to a ‘yes’ with every ‘no’. So a bad day means you are closer to a good day. That little change in perspective can have a huge impact on your morale.

The challenge is that you have to live through bad days to appreciate good days. It takes a few cycles thorugh the ebbs and flows to realize that this too shall pass. Whatever it is. It’s hard to have that patience when you are young. Everything is magnified. The highs are really high. And the lows, well, you know. You tend to remember the lows a lot longer than the highs. So a decade passes and you wonder what happened? You question all the time you wasted. The decisions you made. The decisions you didn’t. How did you turn 30? Where did the time go?

The time is gone. And it gets worse. My 30s were a blur. 3 kids. Multiple jobs. A relocation. I was so busy chasing things I didn’t have, I forgot to enjoy the things I did. I’m only now starting to appreciate the path I’m on. To realize I needed the hard times. And to enjoy the small victories and have a short memory about the minor defeats.

I was a guest speaker at Kennesaw State yesterday, talking to a bunch of students studying security. There were some older folks there. You know, like 30. But mostly I saw kids, just starting out. I didn’t spend a lot of time talking about perspective because kids don’t appreciate experience. They still think they know it all. Most kids anyway. These kids need to screw up a lot of things. And soon. They need to get on with bungling anything and everything. I didn’t say that, but I should have. Because actually all these kids have is time. Time to gain the experience they’ll need to realize they don’t know everything.

Dave’s college friend doesn’t have any more time. He’s gone. If you are reading this you are not. Enjoy today, even if it’s a crappy day. Because the crappy days make you appreciate the good days to come.

–Mike

Photo credits: “Free Beer Tomorrow Neon Sign” originally uploaded by Lore SR

Heavy Research

We’re back at work on a variety of our blog series. So here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can access all of our content in it’s unabridged glory.

Defending iOS Data

Watching the Watchers (Privileged User Management)

Understanding and Selecting DSP

Incite 4 U

  1. This sounds strangely familiar… It seems our friend Richard Bejtlich spent some time on Capital Hill recently, and had a Groundhog Day experience. You know, the new regime asking him questions he answered back in 2007. Like politicians are going to remember anything from 2007. Ha! They can’t even remember their campaign promises from two years ago (yup, I’ll be here all week). So he went back into the archives to remind everyone what he’s been saying for years. You know, reduce attack surface by identifying all egress points and figure out which ones need to be protected. And monitor both those egress paths and allegedly friendly networks. Though I think over the past 5 years we have learned that no networks are friendly. Not for long, anyway. Finally, Richard also recommended a Federal I/R team be established. All novel ideas. None really implemented. But on the good news front, the US Government spends a lot of money each year on security products. – MR
  2. Perverse economics: I’m going to go out on a limb and make a statement about vulnerability disclosure. After years of watching, and sometimes participating, in the debate, I finally think I have the answer. There is only one kind of responsible disclosure, and the economics are so screwed up that it might as well be a cruddy plot device in a bad science fiction novel. Researchers should disclose vulnerabilities privately to vendors. Vendors are then responsible for creating timely patches. Users are then responsible for patching their systems within a reasonable period. Pretty much anything else screws at minimum users, and likely plenty of other folks. (And this doesn’t apply if something is already in the wild). But as Dennis Fisher highlights, the real world never works that way. Today it’s more economically viable for researchers to sell their exploits to governments, which will use them against some other country, if not their own citizens. It’s more economically viable for vendors to keep vulnerabilities quiet so they don’t have to patch. And users? Well, no one seems to care much about them, but scrambling to patch sure isn’t in their economic interest. It seems ‘responsible’ means ‘altruistic’, and we all know where human nature takes us from there. – RM
  3. Scoring credit: Hackers have been stealing credit reports and financial data from – where else? – credit scoring agencies and selling the data to the highest bidder. Shocking, I know. Seems they are abusing the sooper-secure credit score user validation system; asking “which bank holds your home mortgage” with multiple choice answers provided. Yeah. Which is doubly ironic if you believe that credit score monitoring helps stop fraud. Honestly, the level of security is commensurate with the value of the data, and there is not much danger of increased identity theft to most people. But these clever “security features” are very funny! If by ‘funny’ you mean sad and predictable. – AL
  4. And you thought you were a data whore: If you look long enough you can find collectors for pretty much anything. Some tech guys collect all sorts of physical data about their diet, activity, and sleep patterns. Others collect pcap data from wherever they travel. But Stephen Wolfram beats you all. He has every email he sent since 1989. And every keystroke he has typed. Seriously. He also has every event he’s scheduled since 2000. Throw in all of his phone calls and the number of steps he’s taken. And he spends time analyzing those things. Anyhow, the data is interesting, and shows how he’s moved from a largely solitary working environment to a more collaborative one. He think most people will collect data like this in the future because you can learn about your activities and track the trends of your existence. That wouldn’t work for me, but maybe other folks are (or will be) interested. If the data teaches us anything about Stephen Wolfram, is that he’s very consistent. Dare I say, regular. Which makes me wonder if he tracks his bowel movements. Sorry, I couldn’t resist. – MR
  5. Not all hypberbole is equal: There is no shortage of outlandish statements in the press. Take this one from Richard Clarke that claims all major US companies have been hacked by China. Pretty insane, yes? Or is it? I don’t have numbers to back this up, because this isn’t the sort of information people are willing to share. I do know I have talked with many major companies that admit they have been hacked from IP addresses linked to China. Every specialty incident response firm has a major backlog (think 4+ months) for dealing with APT attacks. We have many public admissions of China-based attacks, and even a few court cases. Now maybe not all 500 of the Fortune 500 have been hit, but there sure is a lot of smoke. And why wouldn’t China hack everything they can? There aren’t really any legal consequences, and nothing more than some stern dialogue on the political front. Like they care. Until companies or governments change the dynamic and make it actually painful for a government to assist or commit espionage, don’t expect anything to change. It’s just human nature. – RM
  6. No more lo mein for Symantec: This isn’t exactly news – it was announced last year – but within a few weeks, Symantec will sell off its share of its joint venture with Huawei. I guess it seemed like a good idea for Symantec at the time. You know, selling its network security business to Juniper and then partnering with Huawei. China is a huge market and they probably weren’t going to buy many Big Yellow UTMs. But the Chinese would by a bunch of boxes from the home team with some Big Yellow innards, right? They’d surely be able to penetrate US markets too, right? Apparently they didn’t learn much when the Feds blew up Check Point’s attempt to buy SourceFire in 2006. And the Israelis are our friends. It’s not like the US Government scuttled Huawei’s attempt to buy 3Com. Oh right, they did in 2008. It seems DC regards Huawei as more radioactive than uranium. Potentially more damaging is the perception that the Big Yellow mothership has been tainted by its association with the foreign company. Especially when every security company needs both US government business and data. Though you have to wonder if this isn’t just a little misplaced xenophobia. Given the number of tech products built in China and their alleged cyber-espionage penetrating every large company (as Rich mentions above), they probably get the classified data before most US agencies anyway. – MR
Share: