Wednesday, March 08, 2006

The Day's Notebook, 03/08/2006

Daily Chuck Norris Fact:

Chuck Norris'’ hand is the only hand that can beat a Royal Flush.

------------------------------------------------

So we're getting a bit of snow today, and it actually doesn't stink. That's because God has decided to bless us with the only sort of snow I can tolerate in any amount. Basically, it's been falling all day, but instead of accumulating, it is melting immediately when it hits the ground. The warm weather we've been having lately is keeping it from becoming the usual road-freezing, sidewalk-shoveling nightmare that we get with a March snowstorm. So today's snow is about the only kind of snow we get here in the Denver metro that I can actually appreciate. It's almost as good as rain.

------------------------------------------------

All those church burnings down in Alabama were a "PRANK THAT GOT OUT OF HAND"??? God knows some good pranks, too, and they ALSO involve fire...like when he sends your soul to Hell. LOTS of fire there. Sometimes I wonder if He looks at some human beings and thinks, "I sent my ONLY SON to die for these people???" He probably never thinks that, but this sort of thing must make Him terribly, terribly sad.

Seriously, look at the pics that Fox News puts up of these guys with the article. Guys like these will be running the world someday, folks.

------------------------------------------------

I was talking with Heidi just today about the sort of folks I have to deal with in the tech industry. The ones I dislike the most are the ones who are convinced that the world (or the universe or the Internet or civilized society or their company) will fall apart without them. Those people are unrealistic, dangerous, and consequently difficult to deal with. I've had to deal with far too many of that sort of person since I got into IT nearly 9 years ago. Also, we have some real nutjobs who work in IT. For example, there are lots of people who play World of Warcraft, a massively-multiplayer online role-playing game based on a universe similar to that in Lord of the Rings. Many of those who play prefer that life to their real life. Others will actually want to fight you if you say something like, "I think Windows is better than Mac" or "I think Linux is the worst operating system of all time." Seriously, some of them will want to punch you. I think there are a few too many of us who walk too closely to the line that separates genius from insanity.

--------------------------------------------------

A few things about information security that continue to bother me:

1. Why there are so many people out there who believe that security is a technological problem. It's not, it never has been, and it never will be. Just astechnologyy is not the problem, technology is not the solution. Security is a PEOPLE problem, plain and simple, and until we can make that the primary point of view, we will never get any closer to real security

2. How few women there still are in information security or in the tech industry in general. Last February when I was at RSA, I commented on this phenomenon, especially in light of how the viewpoint of women and their relationship to the stereotypical "computer geek" is used by marketing types in the tech industry. Today, over a year later, I went to the monthly meeting for the Information Systems Security Association, Denver chapter. There were about 30 people in the room...three of them were women. I don't know if it's a good-ol'-boy thing, or a problem with women's perception of tech jobs, or the whole women-can't-do-engineering mindset on both sides, but it needs to change.

3. Last week I came across the following worst-case-scenario story in the SANS NewsBites e-newsletter I get twice a week:
--IT System Auditor Pleads Guilty to Computer Break-in
(2 March 2006)
Kenneth Kwak has pleaded guilty to unauthorized access to a protected
computer in furtherance of a criminal or tortuous act, according to the
US Department of Justice. Kwak was working as a system auditor
performing Federal Information Security Management Act (FISMA) audits
for the Department of Education's Office of Inspector General. He
allegedly placed software on his supervisor's computer that allowed him
to view the supervisor's email and Internet usage. If convicted of all
charges against him, Kwak could face up to five years in prison and a
US$250,000 fine.
http://www.computerworld.com.au/pp.php?id=1689984712&fp=2&fpid=1
[Editor's Note (Schultz): This incident in many respects comprises a
worst case scenario because IT auditors are highly trusted within the
organizations that they serve. Whenever insider threats are considered,
IT auditors are almost never considered to be one of them. One of the
"lessons learned" from this ugly incident may thus be that IT auditors'
activities need to be considered a potential major security-related
threat--organizations' risk estimates may need to be revised
accordingly. Additionally, auditors themselves may need to be more
carefully watched; in order words, auditors of auditors may be needed.]
At first I was outraged, as any moral, ethical information security professional would be. The editor's note at the end really makes the huge point that comes from this. It just goes to show you how difficult information security really is, and the sort of thing I spend my days fighting. I want to find this guy and slap him, because it's guys like this that make the good people's jobs that much more difficult. I hope they put him away for a long time.

Then again, any information security professional worth his or her salt will ALWAYS tell you, insiders are ALWAYS your greatest security threat. We shouldn't be too surprised that this happened.

---------------------------------------------

I should've guessed...that snow that was hitting the ground and disappearing? It's starting to accumulate now. And it's supposed to keep going until around 9 PM tonight. Oh well, I should've known it was too good to be true.

---------------------------------------------

People like this deserve to be cheered. She showed true teamwork and determination. This young lady will do well in whatever she does.

---------------------------------------------

It seems that suddenly, identity theft is at center stage again. One of the local news channels here in Denver ran stories on identity theft all last week, and this article on Slashdot is the third such I've seen in various places in the last few days. It's not like this is new; are people FINALLY starting to understand the danger? There's obviously a market for these stories, else they wouldn't be coming in such a huge push. Either someone's pushing it again, or a bunch of people out there are just now coming to realize that identity theft is a serious problem. Either way, I guess people need the refresher, and raising folks' awareness on this sort of thing is always good, even if it is overdue.

---------------------------------------------

By the way, as most of you may have noticed, I'm going to a little different format on my blog. I hadn't even noticed the change myself until someone brought it up to me. The feedback I've received (from the person who commented on it) has been positive. I hope you like it...at least it's not the long, rambling rants I had in the past. There will still be a few of those, but I'm going to try to keep those to a minimum. To be honest, I like it better in this new format, anyway.

Thanks for reading along.

No comments: