Infographic - The Web of the National Rifle Association

The NRA operates 144 distinct websites, by my count. You can learn a lot about the NRA just from their site hostnames. For example, who knew that the NRA sells hearing aids? Yep, www.nrahearingbenfits.com. And apparently they are in the prescription drug business too! www.nrarx.com. Other more well known facts include that the NRA does not like Obama (www.gunbanobama.com), and they aren't fond of Michael Bloomberg either (www.meetbloomberg.com).

Here is a visualization I created of the NRA's sites and their inter-relationships. I created this using Gephi with the Force Atlas 2 module.

King of the Forest....in my yard

Three moose have taken up residence in my yard - a bull and two females. Some quick facts about these beautiful creatures:

- top speed: 35 mph (55 km/h)

- weight: up to 1500 lbs (700 kg)

- height: up to 6'9" (2.1 m)

Moose are beautiful, but they will kill you if they want to. One of my scarier experiences was being chased by an angry mother moose down a mountain trail while riding my mountain bike.

Advice for Getting into the Information Security Profession

Each Fall I am a guest speaker for Brigham Young University's Information Security graduate program. Much of the time is spent fielding questions of students. Last week, one student asked, "What should I be doing to ensure I can land a good technical job in Information Security?" Rather than answer right then, I asked if I could answer through a blog post. So here it is.

Assess the security of networks, systems and web apps.  Information Security is about protecting assets from unauthorized access and destruction. To be a good security practitioner you have to be familiar with the tactics and techniques for compromising systems. This will enable you to assess your own systems for vulnerabilities, as well as improve your ability to design and operate preventative and detective security controls. Get going on web application hacking with the OWASP WebGoat application, an intentionally insecure web application. Scan your own network and others you can get permission to assess using mmap, nessus, and other tools.

SecTools.org has a good listing of security software for assessing networks. Get familiar with these tools. Use them.

Code. Pick a language - whichever you prefer. And learn to code reasonably well. I am strongly of the opinion that you have to know how to code in order to know how computers work and how to secure them. Learn by building something. Pick a project and code it up, preferably something with network communication involved. Code a port scanner. Code a web application security scanner. There are a hundred out there, but by building your own you will develop expertise in that security domain.

Resources for learning to code: Codeacademy for getting going on the basics, Google searches and stackoverflow for when you get stuck.

Stand up and operate a small network that is Internet accessible. You have to know networking and you have to know what happens to networks on the Internet. Get a used  Cisco switch and use its capabilities to log and control access. Fire up Wireshark and learn the networking protocols.

Resources for networking: Cisco documentation. The Cisco Certified Network Associate (CCNA) material is pretty decent. Wireshark network protocol analyzer. Read TCP/IP Illustrated Volume 1 while you are analyzing network traffic.

Run a network IDS on your network. This will open your eyes to the attacks occurring on the Internet and get you into intrusion detection and response. Use Suricata or Snort.

Wrangle and analyze data. Data collection and analytics is increasingly important in Information Security. Know how to work your way around relational databases, NoSQL databases, and stretch for Hadoop if you have time. I recommend getting going with MySQL or PostGreSQL and Mongo. Use one of these databases in your coding project. Also, use a database to store and analyze traffic from your network.

Read. Set up an RSS reader such as Feedly and load it with Information Security research and general news sources. Also, stay up on the industry or industries you are interested in practicing information security. InfoSec doesn't exist in a vacuum. Know the context in which you want to practice Information Security well. Reading will also help you shape an increasingly integral picture of Information Security trends and inter-relationships.

Some of the better books on my shelf include Practical Unix and Internet Security, Applied Cryptography, Programming Ruby, Building Secure Software, TCP/IP Illustrated Volumes 1 and 2, all the Neal Stephenson books :), Security Engineering, Exploiting Software, Hadoop the Definitive Guide, and Network Security Assessment.

Write. Your ability to communicate well will determine the scope of responsibility you take on in your career. Write up your research. Post it to a blog. Present it at a conference. Be a student of writing well. If you have only one book on writing, get The Elements of Style by Strunk and White. Essential. 

Today's View of the Tetons

Why I Love Cycling

The silent speed of a bike.
The bike is what I need it to be - a place of peace, a place of pain, a place of peace through pain.
It moves me.
There is something about the act of balancing on two wheels that brings about a sense of well being.
It is the most elegant machine man ever made.
It takes me places I wouldn't otherwise go.
Cyclists are just good people.
The rhythm of riding.
Drafting a car down 224 at 48 mph.
The easy access to endorphins a bike provides.
It gets me close to nature.
It makes me feel good.
The camaraderie of riding with friends.
The speed of a good pace line.
The climb up Wolf Creek Pass on an August evening.
The absolute heavenly feeling of coasting down an empty road with no hands and eyes closed.
The youthful, playful feeling it evokes.
The pain.
The peace.
The joy.

Help Wanted: Top-Notch Security Professionals (a manifesto...kind of)

My thoughts on what a top-notch security professional looks like. Contact me if you think you are this professional, or you want to become this professional :-)

Is expert in the field of threat intelligence and response, deeply knowledgable of a wide range of technologies and methods for collecting and acting on threat intelligence. Is expert in networking protocols. Is capable of rapidly crafting custom detection signatures to detect attacks for which no signatures exist. Is capable of creating custom threat intelligence and response systems to fill gaps where commercial systems are sub-optimal or non-existent. Is expert in identifying attacks within network traffic, effectively filtering signal from noise such that false positives and false negatives are very low. Expert in navigating complex enterprise computing and network environments. Is able to discern the magnitude of threats. Is competent in analyzing large amounts of data and building software to automate analysis.

Is self-motivated, requiring only high-level strategic direction.  Does not require day-to-day instruction. Knows what needs to be done based on the strategic objectives and actions of the threat actors and changes occurring in the environment. Initiates projects to progress the effectiveness of the threat intelligence program, inventing and enhancing threat intelligence systems and methods. These systems and methods serve as the foundation through which others fulfill collection, detection, analysis, and response work. Is a source of strong program and technical influence to others in the team. Mentors others in the team in the craft of threat intelligence and response. Has strong connections in the financial threat intelligence industry and leverages those connections to gain better intelligence and to learn better methods of threat intelligence and response. Is an effective communicator, both verbal and written.

Is highly productive in detecting and responding to threats and in creating frameworks that improve the effectiveness and efficiency in which others detect and respond to threats. Capability to rapidly context switch a must.

Typically has 10+ years in information security, with a three or more years in threat intelligence and response. Is highly competent in skills necessary for effective threat intelligence, including network routing, network protocols, system engineering, protocol analysis, attack signature development, coding, and data analysis. 

Time for InfoSec to Use the Right Definition of Risk

Information Security professionals commonly define risk in one of two ways:

• The expected loss over a given period of time
• Risk = threat * vulnerability * impact

Compare this to the way risk is explained in Wikipedia. "Risk is the potential of losing something of value, weighed against the potential to gain something of value." It is the old adage "nothing ventured, nothing gained." Andy Ellis, the CSO of Akamai Technologies, describes it this way. "Our businesses are in the business of taking risks. That's what we do for a living. We spend money in hopes of making more money." 

Do you see the problem with the InfoSec risk definition? InfoSec risk is focused on loss - analyzing and minimizing bad outcomes. Real risk is focused on the difference between expected gain and the expected loss. Too often Information Security minimizes bad outcome potential to the extent that it causes greater harm to the gain potential.  Have you heard this before? "We can't move to the cloud. Too many unknowns. Too risky." I've heard the same said about SaaS, outsourcing, mobile applications, employee mobility, web services.  Really? Were these the same people who said that we can't use email a couple decades ago or that we can't offer online banking?

If Information Security truly internalized a new risk definition that properly balanced the loss potential and the gain potential, we would be more effective in supporting our businesses. Maybe it would cause us to shift to being enablers of rapid adoption of better / faster / cheaper business technology models. Yes, there is profit to be made by properly reducing loss potential. There is also profit to be made on maximizing upside potential. Let's be a proper voice for that equation. If we do, then we'll probably see ourselves march in to some unknowns faster and probably see some traditionally moderate and high residual risk systems go in to production because the gain possibility is so great. 

So lets adopt the wikipedia risk definition. Besides, it is what everyone else is using anyway.

"Risk is the potential of losing something of value, weighed against the potential to gain something of value."

And hey, who wants to work at a shop that doesn't run email or a web site anyway?

BTW - I took the risk of jumping off a cliff into the Pacific Ocean today and the reward was great.