I was a little burnt out when the start of this year rolled around. Not “security burnout” – just one of the regular downs that hit everyone in life from time to time. Some of it was due to our weird year with the company, a bunch of it was due to travel and impending deadlines, plus there was all the extra stress of trying to train for a marathon while injured (and working a ton).
Oh yeah, and I have kids. Two of whom are in school. With homework. And I thought being a paramedic or infosec professional was stressful?!?
Even finishing the marathon (did I mention that enough?) didn’t pull me out of my funk. Even starting the planning for Securosis 2.0 only mildly engaged my enthusiasm. I wasn’t depressed by any means – my life is too awesome for that – but I think many of you know what I mean. Just a… temporary lack of motivation.
But last week it all faded away. All it took was a break from airplanes, putting some new tech skills into practice, and rebuilding the entire company.
A break from work travel is kind of like the reverse of a vacation. The best vacations are a month long – a week to clear the head, two weeks to enjoy the vacation, a week to let the real world back in. A gap in work travel does the same thing, except instead of enjoying vacation you get to enjoy hitting deadlines. It’s kind of the same.
Then I spent time on a pet technical project and built the code to show how event-driven security can work. I had to re-learn Python while learning two new Amazon services. It was a cool challenge, and rewarding to build something that worked like I hoped. At the same time I was picking up other new skills for my other RSA Conference demos.
The best part was starting to rebuild the company itself. We’re pretty serious about calling this our “Securosis 2.0 pivot”. The past couple weeks we have been planning the structure and products, building out initial collateral, and redesigning the website (don’t worry – with our design firm). I’ve been working with our contractors to build new infrastructure, evaluating new products and platforms, and firming up some partnerships. Not alone – Mike and Adrian are also hard at work – but I think my pieces are a lot more fun because I get the technical parts.
It’s one thing to build a demo or write a technical blog post, but it’s totally different to be building your future. And that was the final nail in the blah’s coffin.
A month home. Learning new technical skills to build new things. Rebuilding the company to redefine my future. It turns out all that is a pretty motivating combination, especially with some good beer and workouts in the mix, and another trip to see Star Wars (3D IMAX with the kids this time).
Now the real challenge: seeing if it can survive the homeowner’s association meeting I need to attend tonight. If I can make it through that, I can survive anything.
Photo credit: Blah from pinterest
And now on to the Summary:
Webcasts, Podcasts, Outside Writing, and Conferences
- Adrian quoted in CSO Online: Credit card security has no silver bullet
- Mort quoted on container security: Containers: Security Minefield – or Channel Goldmine?
- Me on ridiculous travel security: Podcast 492: How to travel like an international superspy
- A piece I wrote over at TidBITS on government, encryption, and back doors. Also relevant to the Securosis audience: Why Apple Defends Encryption.
- Incite 2/3/2016: Courage.
- Event-Driven AWS Security: A Practical Example.
- Securing Hadoop: Architectural Security Issues.
- Securing Hadoop: Architecture and Composition.
- Securing Hadoop: Security Recommendations for NoSQL platforms [New Series].
- The EIGHTH Annual Disaster Recovery Breakfast: Clouds Ahead.
- Security is Changing. So is Securosis.
- Incite 1/20/2016 – Ch-ch-ch-ch-changes.
Research Reports and Presentations
- Threat Detection Evolution.
- Pragmatic Security for Cloud and Hybrid Networks.
- EMV Migration and the Changing Payments Landscape.
- Network-based Threat Detection.
- Applied Threat Intelligence.
- Endpoint Defense: Essential Practices.
- Cracking the Confusion: Encryption and Tokenization for Data Centers, Servers, and Applications.
- Security and Privacy on the Encrypted Network.
- Monitoring the Hybrid Cloud: Evolving to the CloudSOC.
- Security Best Practices for Amazon Web Services.
Top News and Posts
- Why lost phones keep pointing at this Atlanta couple’s house
- This is a really important case: Security firm sued for filing “woefully inadequate” forensics report
- Chromodo browser disables key web security. Note to security vendors: put your customers first, not marketing.
- Severe and unpatched eBay vulnerability allows attackers to distribute malware. Not going to be patched, seriously?
- Software Security Ideas Ahead of Their Time
- New Technologies Give Government Ample Means to Track Suspects, Study Finds
- Friendly Fire. This is a really great post on the role of red teams.
- Congress to investigate US involvement in Juniper’s backdoor.
Blog Comment of the Week
This week’s best comment goes to Andy, in response to Event-Driven AWS Security: A Practical Example.
Cool post. We could consider the above as a solution to an out of band modification of a security group. If the creation and modification of all security groups is via Cloudformation scripts, a DevOps SDLC could be implemented to ensure only approved changes are pushed through in the first place. Another question is how does the above trigger know the modification is unwanted?! It’s a wee bugbear I have with AWS that there’s not currently a mechanism to reference rule functions or change controls.
I actually have some techniques to handle out of band approvals, but it gets more advanced pretty quickly (plan is to throw some of them into Trinity once we start letting anyone use it).
One quick example… build a workflow that kicks off a notification for approval, then the approval modifies something in Dynamo or S3, then that is one of the conditionals to check. E.g. have your change management system save down a token in S3 in a different account, then the Lambda function checks that.
You get to use cross-account access for separation of duties. Gets complicated quickly, which is why we figure we need a platform to manage it all.