Search Engines for OSINT and Recon

January 31st, 2014 2 comments

Based on the title to this post, you’re thinking, “Awesome, Dave! Welcome to 2006!” Well hang on there. There’s an amazing number of awesome search facilities that can be useful when doing OSINT and recon work for pen testing. I’ll list a lot of different sites that I have discovered and use regularly for both.

Google and Bing: These are the best known sites for these activities, and provide a lot of data. One cool feature many don’t use is the “Search Tools” in Google Search and Image Search. After you submit your search, click the “Search Tools” button in the upper right. You can hone in on date ranges for results, and for images you can choose only faces, clip art, and others, as well. Lots of good query tools out there for these two, but SearchDiggity from the Bishop Fox guys rocks.

GoogleSearchTools

 

 

 

 

 

 

 

The Wayback Machine: I think most folks are aware of this these days, too, but it deserves to be mentioned. If you’re looking for older versions of a site or data set, this is the place to grab it.

Google Groups or Yahoo GroupsSearching for gossip on companies or people posting stupid things that they shouldn’t may lead you to one of these sites. I’d say you’ll be surprised by what you find there, but…we all know that people just feel like they HAVE to share sometimes.

Bing vs. Google: For a comparison of the two search engines’ results, this is a great site, and may save you some time for quick keyword searches.

2LingualTo search using two different languages simultaneously on Google, consider 2Lingual. Great results sometimes, especially if you’re assessing an international organization or person who travels and works abroad.

2lingual

 

 

 

 

 

 

 

Carrot2Carrot2 is one of my new favorites. It provides some cool visualization options for searches, and also has great results.

carrot2

 

 

 

 

 

 

 

 

iSeek: iSeek is another of my favorites currently, primarily due to its categorization column on the left-hand side after searching. You can drill down into phone numbers, locations, and other keywords detected very quickly.

iseek

 

 

 

 

 

 

 

 

 

 

International Search with Yandex (Russian) and Baidu (Chinese): For international targets, these sites turn up some fascinating results, and both have good search delimiters, too.

GlobalFileSearch: A quick way to search for files scanned across FTP services. Similar to the “filetype:” or “ext:” queries with Google, but may prove useful…I’ve found a few excellent results there.

GlobalFileSearch

 

 

 

 

 

 

 

 

 

NerdyData: This site rocks, especially when I am doing recon for Web app tests. You can search for code snippets buried in site pages, JavaScript, etc. IMMENSELY USEFUL. You can look for code, patterns in code, look specifically for <meta> tags, look only for blog keywords, etc. Awesomesauce.

NerdyData

 

 

 

 

 

 

 

Qwant: Qwant sometimes has interesting info, as it aggregates across traditional search, social media, shopping sites, and more traditional news.

If anyone has different engines and sites they use for this, I’d love to hear about them, and I’m sure others would too. Any comments with new sites, I’ll vet and add to the post. Cheers!

Cool, a package! Oh noez! It’s from Attrition!

November 25th, 2013 Comments off

AttritionThis is a long overdue post, and has nothing to do with security, and everything to do with slow, simmering dementia and madness among us. I received a package from a certain “Brian Martin” a few months back. My schedule got a bit hectic, the package was set to the side, and I have finally gotten back in the US and cleaned up my office. What I found in this package, my friends, was nothing short of disturbing. I’ll list the contents, with my general impression of what they may mean.

  1. Numerous information security-related stickers: This is really the most “normal” thing in the shipment.
  2. An Attrition business card/thing and a wristband. Again, cool. No worries here.
  3. A Leonard Cohen CD. Now, undeniably, there’s something cool about Cohen. In fact, a lot cool. But…who would PART with such a thing? This is just the beginning of the insanity.
  4. Two wine cork/tops (one cork, one screw-off). Why was this still hanging around? Why were they saved to send on to me? Hmmm.
  5. Several small foam balls. Likely ripped mercilessly from the faces of stuffed clowns, which is creepy. Heading deeper into CrazyLand, for sure.
  6. Numerous keys from computers or other electronic equipment. Very likely ripped apart in a frenzied Mescaline-induced rage.
  7. Several small rubber discs. From what, I have no idea. Cryptic.
  8. Two plastic dinosaurs. Despite my intrinsic pleasure at receiving two small plastic dinosaurs, again I ask…who would PART with these?
  9. One shiny stone. Shiny.
  10. A discarded bank keychain. Junk.
  11. Most horrifying of all…a staggering stack of periodical renewal pullouts that span an awe-inspiring range of topics – science, history, geography, psychology, women’s anatomy, general nerdiness, and more. And going back to at least 2005. Where were these ACQUIRED? And why were they KEPT, in a long-term fiendish plot to send them on to an unsuspecting victim? This represents a deeply depraved character, without any doubt.

If you’ve read this far, you likely know that this is satire. I personally found this mixed bag o’ shit to be hilarious, and knowing that I have crazy-ass friends like Brian is oddly comforting. Isn’t that half the reason we’re in this business? To share in the crazy?

Cheers, folks, and happy Thanksgiving to all in the US.

Categories: Humor, Musings Tags:

Big Trouble in Little Infosec

October 29th, 2013 3 comments

big-trouble-little-china-thunder-explodesThe security “community” has been so incredibly drama-laden this year (largely due to media sensationalism and that wily A-P-T, yeah you know me!) that it’s been tough to stomach. That’s really not me being curmudgeonly, honest. I’ve had a fascinating year, done some amazing work with clients, and seen at least a good number of incredibly smart friends and colleagues at industry events and elsewhere. So, what’s got me wound up? Well, it’s that time of year, first of all. As a consultant who travels internationally a LOT, and stays busier than a rational human should be, I am reaching a point of exhaustion where I start reflecting on what I’ve seen and thinking a bit more philosophically about the state of the “industry”. Second, I’ve really had some big insights personally, just seeing things a bit more clearly for what they are.

You may have noticed that I surrounded the terms “community” and “industry” in quotes. That’s intentional. And directly related to concern #1:

If we’re a “community”, what are our values? And why do we qualify as an “industry”?

I’ll explain. From what I’ve seen, it might be time for us to work a little harder at helping the “normals” get secure. I know we THINK we all do. But ya know what? We’re NOT approachable. We are very quick to judge people not fit to compute. And that, my friends, is 99% of the world, in our eyes. We have to lower our bar, try to be a bit more understanding of Facebook people, and start solving the real problems of awareness and usage scenarios. And, uh, misogyny in IT. Or at least infosec. Really, being a bigot to women is pathetic these days. Especially if you are a fat, white and pasty nerdbot that doesn’t see much daylight.

As to the “industry” thing…please. Everything about infosec is a “feature”. We are not IT. We are not “risk”. We are a part of both. Yes, there’s money here. But we are NOT a strategic element. We’re a small piece of the business equation, no matter how important we think we are. Maybe, in some industries and situations. But not as “the norm”.

And so…problem #2: We think we’re more important than we are.

True, sadly. Especially the pompous CSO types who puff their chests out and talk about “metrics” and “governance” and “GRC” and “advanced threats”. We have a lot of the “let’s preen and act important” game going on, where people act very serious and try hard to dress nice and seem like they know what’s happening. Pffft. These folks are reacting just like everyone else, and the last fucking thing we need is more corporate politicians. Take your “GRC” and “dashboards” and go do something better suited, like create a colorful chart. UNLESS…you cover for the real team that actually does shit. And maybe once in a while, you enact some changes through your amazing PowerPoint skills of persuasion. Which leads me to #3:

We need a LOT less talkers. And a lot MORE “do-ers”.

Seriously. I’ve said this before. More than a few times, really. But what I see out there is concerning, folks. I see a lot of infosec professionals who, candidly, suck. Basic Windows skills and ability to fill out Word docs does NOT an infosec professional make. You need admin skills, network skills, DB skills, some code, and maybe more to be a well-rounded infosec person. Most are not. Some can learn, and want to. But many are in it for the perceived paycheck. If you are 20 years in and can’t use Linux, don’t expect me to give two fucks about you and your career. Because you don’t care. And neither do I. This isn’t a cushy 9-5, maybe we’ll get a pension someday, kind of gig. Keep learning, evolve or die. And if you DO care, and are trying to switch careers? I’m your biggest fan. I’ll help anyway possible.

And finally? Another topic I’ve harped on, at #4:

Bo don’t know code. And neither does infosec.

We need more people to code. Less click, more code. App issues are the now AND the future. If you can’t handle that…you’re on the way to dinosaur, sorry.

These are some harsh realizations. But really, we look at infosec and data breaches and wonder why things aren’t better. What if we’re a big part of the problem?

Categories: Information Security, Musings Tags:

Incentivizing “Makers”

August 14th, 2013 Comments off

buildThis post was directly inspired by @secmoose and I having a conversation over the last week, and was originally driven by my disappointment this year at DEF CON that, once again, we’re idolizing people that break things. To be clear, I break things. I have nothing against pen testers (I am one) or security researchers. But we show up in Vegas, listen to people talk about breaking stuff, try to break stuff, and then go home. Who builds anything? I know the DEF CON Kids program is doing a bit of this (awesome) and there’s certainly a handful of IR/intrusion analysis/monitoring/etc talks…but we are definitely skewed towards the “I broke this, look at me!” scene.

What to do? Well, here’s what I am NOT suggesting – let’s NOT stop what we’re doing. We are exposing some awesome issues, having better conversations than ever before (and with the NSA listening in to all of them, what could be wrong?), and slowly and steadily marching onward in this bizarre field. No, what I’d like to see, at least an initial dialogue on, is how we incentivize people who defend and build security versus find flaws in it. We all know that both are critical. So what can we do to get more “build” and “innovative defense” talks at cons, as well as activities that have a more dominant “build and defend” element?

@secmoose had some great thoughts on a more defense-oriented aspect of CTFs. CTFs are great for building and testing skills, but primarily for the offensive side. While there are definitely defense aspects included today (malware reversing, PCAP manipulations, “waterholing”, etc.), there could probably be a lot more. What about an entire campaign focused on “active defense” aggravating attackers using techniques and tools like those in the ADHD distro from @jstrand, @secureideas, and @pauldotcom? More “innovation” ideas on tools for defeating attacks, identifying malicious behavior and thwarting it? Just thinking out loud, really. Would love other ideas and thoughts you guys may have.

In fact, and this was one of my talk ideas for DEF CON this year (rejected) that we look at what the original spirit of a “hacking conference” was, and try to get back to those roots. Let’s invite more people that have nothing to do with breaking, building, *anything* in security, but have great ideas and do other work in science, robotics, engineering, etc. Let’s get some new blood and people outside our industry thinking about some of this and try to get back out of the box we’re in, creatively. Who knows? Could be fun.

Categories: Information Security, Musings Tags:

It is NOT time to “professionalize” information security.

May 24th, 2013 13 comments

AlDonaldsI recently read an article that was posted by my friend Brian Honan titled “Is it time to professionalize information security?” I know this debate’s been going on for a bit. I have a lot of respect for Brian (who supports licensing or “professionalizing” infosec), for a lot of reasons. If you’ve ever met the guy, and/or know of his accomplishments and track record, you likely do too. So to be clear, my opinions in this matter have nothing to do with Brian, and everything to do with what I see as a bad direction to take in our industry right now.

People – this is a “knee jerk” to the insanity that is information security. Things are chaotic, sure. Breaches, crime, national defense…all contributors to this mess. Top that off with a general distrust for vendors (with a perception of them selling “snake oil”), a disturbing number of “charlatans”, raging debates about certifications like the CISSP, drama at every turn, and constant cries of “we have to get better”. Sigh. I know, it sounds bad, right? But it really isn’t nearly as bad as it seems.

We are an “industry” in a very early stage, folks. I’ve said this before, I’ll say it again – we have a major, fundamental difference in infosec that makes it seem much worse – we have adversaries. They are working against us. When the Windows MCSE came out, it was a joke. Anybody could go learn a little about Windows, and become a “certified” Windows…, uh, person. But there was no diabolical Blofeld waiting in the wings to set Microsoft back, planning a global overthrow with Linux-wielding henchmen in an underground lair while he stroked his cat. Same for networking, whether Cisco or otherwise. Same for databases, CRM, enterprise middleware, and so on. Nope, only infosec has these shadowy lurkers who continually thwart our best efforts, stealing data and making the news.

We’re making progress. Really. Yeah, we have some idiots jumping on the bandwagon churning out Nessus reports as “pen tests”. So do we run to “certify” everyone so such an atrocity can never happen again? Really? You’d put us in a little box so that we can all feel safer? No. Here’s a better plan – those of us who are NOT clueless and DO provide quality work for clients or our businesses should work harder to educate people on this. That’s the problem. People are freaked out, they may not know any better, and they’re looking for solutions. Be it vendor or consultant or both, there’s ALWAYS a solution. Some are good, some are not. We’re falling prey to FUD, plain and simple. And if you get caught up in the daily whining on Twitter and elsewhere proclaiming that infosec is “so messed up” and that it “needs fixing”…well, you’re falling right into the drama-laden trap that plagues our industry.

The infosec industry needs creativity. It needs people who don’t fit the mold, who would rather set a kitten on fire than wear a tie, and who cannot help themselves from telling dick jokes, no matter when or where. Those people may not fit the “professionalization” scheme, but we would be SCREWED if we lose them. They think outside the box, they don’t look “corporate”, and they insist on wearing black T-shirts. I’m being purposefully stereotypical, of course. We’re a widely diverse crew these days, and we’re better for it. But thinking we’re failing so badly that we need to “professionalize” is silly. If that is the case, then why don’t we REALLY get to the heart of things, and professionalize programmers? It’s their shitty code that is causing a lot of the mess, there’s no denying this. While we’re at it, we should probably “professionalize” systems admins, network engineers, everyone. They screw up too, right? We should definitely “professionalize” project managers. Those people are a pain in the ass. Let’s make them certify!

C’mon. This isn’t the answer. Infosec is crazy, sure. But we’re not headed into doom and gloom as some would have you believe. We’re improving education programs all the time. I have met some of the college kids who are taking part in Red Team-Blue Team competitions, and some of them are crazy sharp. We’re trying to fix things like the CISSP, with guys like Wim Remes and Dave Lewis as our men on the inside. We’re having proper debates about “attacking back” and cyberwarfare (ugh), and so on. We’ll get there. But don’t react and put us in a little defined “program”. I don’t want to be a part of the Borg, not now and not ever. I have hundreds of happy clients who can attest to my work, and so do many of you. Let’s let folks like the Attrition crew smoke out the worst charlatans. And let’s try to keep our sense of humor AND reality along the way.

Categories: Information Security, Musings Tags:

Freaks and Geeks and Subcultures

March 20th, 2013 1 comment

In the last few days, there have been a flurry of stories about this supposedly sexist scenario at PyCon called Donglegate. Two dudes told some stupid dick jokes (referring to them as ‘dongles’) in the audience, a prominent female speaker heard them behind her, and she opted to make a big deal about it. Such a big deal, in fact, that they got fired from their jobs. I’m going to pull the “What the F***” card on this one. Lady – find somewhere else to make your soapbox stand, would you? This industry has REAL issues with sexism, but stupid dick jokes aren’t the problem, especially when they were obviously meant to be private conversation and not directed at anyone with malicious intent. Sheesh.

There’s been a lot of drama in the IT, and specifically the security, industries in the last few years. I think we’re experiencing a sort of cognitive dissonance, really. We keep being told that we need to be more professional and businesslike, so we are trying VERY hard to fit this ideal as an industry. I’ve come around on this thing, though. I am a product of a subculture, and I like that subculture. I like nose rings, tattoos, colored hair, stupid black T-shirts with juvenile and snarky slogans, and the idea that we still might be the smartest people in the room. And I don’t want to change ALL of it to fit an ideal someone else is creating for me.

I clean up well. I can wear business clothes and hang out in corporate environments with clients all day, and so do many of you. But I’m still the same tattooed geek who has been breaking shit since the 70′s. A lot of this drama, I think, is us feeling like we need to behave in a certain way to attain credibility…for SOME reason. We should stop this. I never want to hear this dumbass “getting a seat at the business table” crap anymore. If that is your goal in life, play the corporate politics and let the geeks do our thing. But do NOT deliberately create strife for others who are being nerds in their own culture, with their own peeps, and hurting no one in the process. If a crime is committed, do something. If someone offended you? FFS, get over yourself and adjust, or find your own damn subculture where you don’t need thick skin to hang with the people in the black T-shirts. Because we’ll be telling dick jokes. Awkwardly, granted, but…that’s us.

Categories: Musings, Rants Tags:

Watching the Watchers, 2013 Style

January 31st, 2013 Comments off

We’ve never really been adept at dealing with insider threats. Some organizations have internal detection and monitoring programs, usually aligned with anti-fraud efforts, and some also include more robust forensics programs to look for evidence after-the-fact, but we still have a problem with insiders. With the proliferation of virtualization and cloud computing, we have more trouble than ever. There are two trends I see that explain this.

First, let’s talk virtual environments. A number of things tend to happen in virtual infrastructure that can lead to poor privileged user management and monitoring practices. First, many shops hand virtualization over to an existing admin group, like say…the Windows team. Not a great move, for a lot of reasons. This team still has to manage their existing systems and infrastructure, like Active Directory, DNS, and other platforms and applications. This means they’re part-time virtualization admins, at least for a while. A lot of folks think virtualization is easy, and it is…to a point. But virt technologies can suffer from neglect just like any other systems and apps can, and missing patches and failing to implement configuration controls can have a devastating effect. But relative to the point of insider control and monitoring, this arrangement usually leads to shortcuts in the way that admins log in and manage the environment  Many use generic administrator logins, including the local Admin account on Windows systems running vCenter. AD integration is easy, and highly recommended, and this can help with audit trails, but the practices are still poor – often the full Admin role is assigned within management platforms, with little to no role assignment or separation of duties. Coupled with the minimal logging often done in these environments and potentially generic admin account IDs…a recipe for disaster. One disgruntled admin could take out the entire environment, at least for a while.

What to do about this? Well, the most effective way to approach this issue is to follow a simple regimen, none of which is really new at all:

  1. Before deploying virtualization, or even once you have it up and running, set time aside to carefully plan and assign roles for VM admins, cloud admins, network teams, dev and DBA teams, etc. The major vendors, certainly Microsoft and VMware (XenServer role granularity is a bit meh), offer plenty of features to properly create and manage roles.
  2. Ensure your management interfaces to all components, including integrated and 3rd-party pieces in vBlock (Cisco UCS, EMC Ionix and Symmetrix, etc) and private cloud (vCloud, System Center varieties, etc.) are on a separate segment that you control very tightly. Ensure you have monitoring in place for this segment (behavioral and traditional signature-based) and also logging on each management platform.
  3. Have all administrators manage systems via a bastion host or “jump box”, which can be anything ranging from a Windows server you RDP into to vSphere Management Appliance or commercial options like the HyTrust appliance. Better management control, better audit trails, more of a pain in the ass for admins, but…something you should do.

I see a lot of organizations where security teams aren’t really monitoring the virtualization and cloud admins. This should change, quickly. Speaking of monitoring virtualization and cloud admins, let’s talk about the second trend, which is moving resource to public/hybrid/community clouds. There’s really two ways to look at the insider scenario here. The first way, while pretty defeatist in nature, could certainly resonate with some folks – you’re f**ked. You are pretty much going to have to rely on the cloud provider to do internal monitoring and privileged user management. Well, THAT’s depressing. The other way to look at this is via the standard argument for auditing and assessing providers – via SSAE 16, ISO 27001, and CSA STAR or other questionnaires and responses like those in the CSA CCM and CAIQ. At the moment, there’s really no way to monitor cloud admins actively yourself, so you’re at their mercy technically. You’ll have to rely on what the provider tells you, and continually check to make sure they’re doing what they say they’re doing. A great guide to insider threats in cloud environments has recently been published by the folks at CERT, titled “Insider Threats to Cloud Computing“. It breaks down the different types of cloud admins, what data and systems/apps they have access to (typically), and what you should be looking for when talking to providers about this. I highly recommend reading it.

Hopefully, the insider threat in both virtual and cloud environments is on your radar. If it’s not, it definitely should be.

2012: Over and Done With.

December 31st, 2012 1 comment

Well, this is really more a footnote than anything. Did 2012 go the way you wanted it to? Here on New Years Eve, hanging with Karrie in Vegas, it’s a great time to look back and reflect on how the year went. Did I accomplish my personal and professional goals? Did I do anything interesting/unusual? Did I learn anything? These are the kinds of questions all of us should be asking, of course. A little introspection never hurts…right?

There’s been a lot of acrimonious discussion in the security community this year…and I found myself becoming completely and totally desensitized to much of it. Why? Not because I’m callous or don’t care. No, because I have progressively grown more focused on discourse that actually focuses on real-world issues or things we can do…I’m not interested in emotional diatribes, whiny passive-aggressive rants, or philosophical musings on why security is “broken”. I am all about action, pretty much all the time. And, my friends, so should you be. Get out of this sad bitching about what is broken, what is wrong, who is bad, why the “industry” or “community” is broken or messed up…none of this does a damn bit of good.

Get out more. Get some friends and hobbies outside infosec. I have said this a million times, but it bears repeating. If, at the end of your life, you can only look back and think about all the bullshit “Internet friendships” you’ve had (or not had), then you’ve failed. A life is supposed to be interesting, full of crazy experiences, travel, experiments (both failed and successful, doesn’t matter), and so on. Myopically dwelling on the “infosec community” does you, and likely the community, a disservice. There’s more to life. Go forth, solve problems, come up with outlandish goals and plans, enjoy your family and people you see IN PERSON, and most of all…HAVE FUN. Don’t sit around stewing about how we’re NOT doing this, vendors are bad, business doesn’t listen, etc. Useless. Focus on what you CAN do, SHOULD do, and then DO it. Be positive. And, perhaps most of all, don’t get all caught up in the politics or the silly rantiness of those who have nothing better to do than sit in front of their %&* computers and bitch. You don’t have to be one of those people. I’m going to get away from that crap as much as possible in 2013 and beyond. Hopefully you will too.

Happy New Years!

–Shack

Categories: Musings Tags:

Cyberpunk and Music, Community Style

November 3rd, 2012 1 comment

In the last few weeks, I put out a call to the infosec community on Twitter for some new ideas on electronic music and Sci Fi books in the “cyberpunk” genre. Tons of you responded, and I wanted to capture this in a blog post to share the feedback with anyone who might be interested in this. Little things like this remind me of just how awesome our community is – thanks a ton to everyone.

 

Music: Was looking for some new electronic music, NO DUBSTEP (because it sucks.) Here’s what came back:

  1. Polyfuse - http://www.polyfuse.net/- Awesome!
  2. Loscil – cool ambient stuff. http://www.loscil.ca/ but check his Bandcamp site for moar. http://loscil.bandcamp.com/
  3. Emancipator – cool, sort of mellow and lots of different instruments. http://www.emancipatormusic.com/ and http://emancipator.bandcamp.com/
  4. Welder – This is growing on me a LOT. Really environmental stuff. http://www.last.fm/music/Welder
  5. Biosphere - Holy….chilling, Batman. Really smooth and sort of spooky. http://www.biosphere.no/
  6. Kiln – Really cool and organic. Very interesting percussion. http://www.kilnaudio.com/
  7. Blue Sky Black Death – still listening, heard a few things I am digging. http://bsbdmusic.com/
  8. Big Gigantic – some of the better beats I heard, some of their stuff is a little shrill, though. http://biggigantic.net/
  9. Carbon Based Life Forms – Definitely some of the better ambient I’ve come across in a while. http://www.carbonbasedlifeforms.net/

Books: I asked what people’s favorite cyberpunk books were (besides “Neuromancer”), and got the following:

  1. “The Powers of the Earth” by Travis Corcoran: http://morlockpublishing.com/the-book/
  2. “Mrs. Frisby and the Rats of Nimh” by Robert C. O’Brien: Cool suggestion, Davi! http://www.amazon.com/Mrs-Frisby-Rats-Aladdin-Fantasy/dp/0689710682
  3. “The Shockwave Rider” by John Brunner: One of my favorites, too. http://www.amazon.com/Shockwave-Rider-John-Brunner/dp/0345467175
  4. “The Moon is a Harsh Mistress” by Robert Heinlein: http://www.amazon.com/Moon-Harsh-Mistress-Robert-Heinlein/dp/0312863551/
  5. “Schismatrix” by Bruce Sterling: http://www.amazon.com/Schismatrix-Plus-Complete-Shapers-Mechanists-Universe/dp/0441003702/
  6. “Diamond Age” by Neal Stephenson: http://www.amazon.com/Diamond-Age-Illustrated-Primer-Spectra/dp/0553380966/
  7. “Accelerando” by Charles Stross: http://www.amazon.com/Accelerando-Singularity-Charles-Stross/dp/0441014151
  8. “Feed” by M.T. Anderson: http://www.amazon.com/Feed-M-T-Anderson/dp/0763662623/
  9. “The Quantum Thief” by Hannu Rajaniemi: http://www.amazon.com/Quantum-Thief-Hannu-Rajaniemi/dp/B008W3CR8U/
  10. “Snowcrash” by Neal Stephenson: Of course. :) http://www.amazon.com/Snow-Crash-Bantam-Spectra-Book/dp/0553380958/
  11. “Count Zero” by William Gibson: http://www.amazon.com/Count-Zero-William-Gibson/dp/0441013678/
  12. “The Difference Engine” by William Gibson and Bruce Sterling: http://www.amazon.com/Difference-Engine-William-Gibson/dp/0440423627/
  13. “Burning Chrome” by William Gibson: http://www.amazon.com/Burning-Chrome-William-Gibson/dp/0060539828/
  14. “Ready Player One” by Ernest Cline: http://www.amazon.com/Ready-Player-One-Ernest-Cline/dp/0307887448/
  15. “Altered Carbon” by Richard Morgan: http://www.amazon.com/Altered-Carbon-Takeshi-Kovacs-Novels/dp/0345457692/
  16. “Everyone in Silico” by Jim Munroe: http://www.amazon.com/Everyone-Silico-Jim-Munroe/dp/1568582404/
  17. “Ender’s Game” by Orson Scott Card: Of course! http://www.amazon.com/Enders-Game-Ender-Book-1/dp/0812550706/
  18. “Cloud Atlas” by David Mitchell: http://www.amazon.com/Cloud-Atlas-Novel-David-Mitchell/dp/0375507256/

Kevin Riggins also pointed me to this list: http://en.wikipedia.org/wiki/List_of_cyberpunk_works

Anything else to add, please include in the Comments, and thanks again!

Categories: Musings Tags:

Infosec’s Most Dangerous Game: Groupthink

October 12th, 2012 3 comments

These days, I am very, very afraid for the future of CISOs. Over the past few years, and specifically the past 12 months, I have become increasingly alarmed at the level of “groupthink” and “synchronized nodding” going on with security executives. Here are some of the things I am seeing:

  1. Lots of talking about the same shit, with absolutely no innovation at all. Good examples include metrics (we need them! they’re IMPORTANT!) and talk about policy and governance that usually means absolutely nothing.
  2. A desperate need to find “the metrics” to report to “senior management” – there is no such thing. Your management, in all likelihood, does not want any tactical numbers on antivirus events, IDS alerts, or such blather. They want real risk advice on business goals and functions. Period.
  3. Managing by managing what everyone else is managing. You would not BELIEVE how many security products get purchased because other security executives are buying them.

Most CISOs are smart folks. You got to that spot because you’re competent, or maybe more politically astute, or ideally both. We need to break out of this. I remember a while back when everyone in infosec lamented that we “never communicated”. Now, I almost think we OVER-communicate. It’s easy to play it safe by following what others are doing – I hear this in SANS classes, IANS forums, and sporadically with consulting clients. Not overtly, but sort of “between the lines”. We need innovation, and that means getting outside the echo chamber of security. I give a talk at a few IANS forums that adapts the concepts from the book “The Lean Startup” into the world of enterprise security programs to try and kickstart this. I don’t know that I do a great job, but I’m going to keep trying. Here’s a few key pointers from that talk.

First, think of your security program like a startup, and the overall program and its performance as your product. Ask yourself a few questions, and answer them honestly every day:

  1. Do Consumers Recognize the Problem We Solve?
  2. If there’s a solution, will consumers buy it?
  3. Will consumers buy the solution from us?
  4. Can we build a solution for the problem?

Your “consumers”, of course, are your constituents, ranging from employees to senior leadership, to customers and partners. Think about how THEY look at security, why they care or don’t care about it, and you’ll be on the right track.

The next thing to do is leverage the “Entrepreneur Pyramid”, shown below:

Create a security program mission/vision statement, and make it realistic. Define a short and long-term strategy, and be willing to “pivot”, or change, that strategy often – maybe every 6 months or even more regularly. Look at your product today as the MVP – Minimum Viable Product. Then optimize and build. To do that, leverage the Feedback Loop:

Focus on the major phases:

  • Build from ideas: Get creative. Think about different ways to accomplish your goals, and get feedback and input from people, and NOT just security people.
  • Measure your product, often: How effective are you? Are you missing attacks? Are you educating the business? Are you facilitating business, and becoming more trusted by business unit leaders? This is metrics, perhaps, but ask yourself what success looks like…?
  • Learn from the data: Data should drive insights. If it isn’t, you’re wasting time collecting it in the first place.

My final concept to try is “The Five Whys”. For every brainstorming session or security meeting, when trying to solve problems, come up with new ideas, or determine a root cause, drill into each idea five times. Not to be annoying, like a 3-year old that won’t quit, but to see how deep you can get, and force that “out of the box” thinking. In many cases, by the 3rd or 4th “why”, you’ll be really digging for answers or more ideas. That’s OK! Just keep digging.

This isn’t a perfect science, but if we want to be real business leaders advising on risk, we need to start thinking of new ways to do it. I recommend reading Eric Ries’ book, too – it’s really good.

Categories: Information Security, Musings Tags: