A couple years ago, when I decided to lose weight and change my eating habits, I did it with a view to living until I was at least 90. That was the number I envisioned, and given my family history, it should be achievable. So as I celebrated my 45th birthday this week, it was strange to realize that I’m close to halfway done. WTF? How did that happen? It seems just like yesterday I was loading up the U-Haul for the trek to relocate to DC after college to start my adult life. That yesterday was 24 years ago. I drove that speed limited truck (it wouldn’t go faster than 60) with all my worldly possessions down the 95 with all these expectations. I was going to do this, and do that, and achieve this, and basically become the master of all I survey. No plan survives contact with the enemy, and mine was no exception. I certainly had the energy and the drive, but I didn’t understand the game. I was too young to have any perspective. All I wanted to be was an adult, and have my own money and buy my own stuff and be responsible for myself. It took 24+ years of screwing things up to finally appreciate how the old saying: “Youth is wasted on the young” is absolutely correct. The young don’t know how to harness their capabilities. They don’t know what they don’t know. Which is obvious every time I chat with kids just entering the job markets. I love their energy and idealism, but I shake my head at their sense of entitlement. Mostly I’m excited for them to learn stuff the way I learned it – the hard way. That’s really the only way to learn, and these kids will do great things in the few instances when they aren’t screwing up. But 24+ years later, I can appreciate that process and understand that I had to go through the good, the bad, and the ugly to end up where I am today. Which is right where I should be. So as I enter the second half of my life, I am thankful for the first half. It gave me an opportunity to figure some things out, especially about myself and what’s important to me. I don’t worry so much any more about fitting in or living up to others’ expectations. I’m young enough to still do a lot of stuff, but old enough to kind of know what I’m doing. And that’s a good place to be. –Mike Photo credit: Youth on the Move in Volos 12, originally uploaded by EU Social Heavy Research We are back at work on a variety of blog series, so here is a list of the research currently underway. Remember you can get our Heavy Feed via RSS, where you can get all our content in its unabridged glory. And you can get all our research papers too. Defending Against Application Denial of Service Introduction Firewall Management Essentials Quick Wins Managing Access Risk Optimizing Rules Change Management Introduction Newly Published Papers Continuous Security Monitoring API Gateways Threat Intelligence for Ecosystem Risk Management Dealing with Database Denial of Service Identity and Access Management for Cloud Services The 2014 Endpoint Security Buyer’s Guide The CISO’s Guide to Advanced Attackers Incite 4 U Keep it simple, get it right: I am often highly critical of Poneman Institute reports because their methodology is often flawed, especially using surveys to estimate losses for intellectual assets that can’t really be quantified. But their latest Cost of Cybercrime report moves in the right direction. This time it only counts direct costs related to incident response, not some wild-ass guess at the value of stolen files. I do believe these costs can be quantified, although the odds are many organizations lack the maturity and tracking to really be consistent about what it really costs to clean up a mess. But Ponemon kept a tight scope, with clear definitions, and noted that costs rose 18% (total, not per incident). One reason cited may be the increasing numbers and sophistication of attacks, but I suspect better detection incidents is a larger factor. – RM Down the river of payments: The card brands very publicly announced a global tokenization proposal to make shopping “simpler and safer”, which they promise to release real soon now. But, with significantly less press coverage, on-line retailer Amazon went one step better – by extending Amazon’s existing payment infrastructure to other retail sites. Amazon customers will leverage their Amazon account, including payment and shipping preferences, when they buy from participating retailers. That is Payment as a Service (PAYaaS), people! Participating merchants will no longer need to manage and secure the payment process, or user accounts and passwords, so they will not need to slog through PCI requirements. Amazon makes money on each transaction. Users benefit from a single account and password, and only need to trust Amazon (who already provides a very good user experience) with their account & payment information. – AL 3 Keys to security survival: Great overview in Dark Reading of how the core imperatives of a CISO continue to change given the Inevitability of Attacks. The article covers an Interop presentation by Blackstone’s CISO, Jay Leek, and describes three mindset and strategic shifts. The first is to get better visibility into threats and attacks. You also need better intelligence about attacks and attackers. And finally you need a planned response rather than just reacting to the latest attack du jour. It is right on the money so check out the article when you can. And keep in mind that this doesn’t mean you need to dump all your preventative controls. It just means you need to do a better job of being prepared to respond. – MR Assume the worst: We have been saying for years that you should assume your environment has been breached, or will be, and define your defensive controls around that.
