Get over yourself

The late, great Richard Carlson once said:

"Humility and inner peace go hand in hand. The less compelled you are to try to prove yourself to others, the easier it is to feel peaceful inside."

I believe this theory explains why so many people in IT and information security are so stressed out. I'm also convinced that this concept is the basis for all the bad choices and negative behavior we've seen in the world of IT and information security as of late.

Moral of the story: Don't be this guy...That is if you want to have inner peace and you want to go places in your career.

Read More

The value of partial code scanning, now

Check out my new piece on the business value of partial code scanning where I outline why it's better to start your source code analysis now instead of waiting around until certain milestones of your development projects are reached or your software applications are completed altogether.

It's kind of funny and ironic that we humans are all about instant gratification, yet with information risk issues such as source code analysis, we tend to want to wait until everything's perfect (and way more costly) before we get started. This reminds me of the Mark Victor Hansen quote:

“Don't wait until everything is just right. It will never be perfect. There will always be challenges, obstacles and less than perfect conditions. So what. Get started now. With each step you take, you will grow stronger and stronger, more and more skilled, more and more self-confident and more and more successful.”

I wrote this article in conjunction with the nice folks at Checkmarx who happen to produce the best static source code analysis tool I've used...especially given its price compared to the competition - it's not even in the same galaxy as some of the others out there. Definitely worth checking out.

Read More

Dropbox "bug" = why the cloud cannot be blindly trusted

I've been ranting about "the cloud" (what a tired term) for a couple of years now. As if we haven't seen enough examples lately of why we cannot put all our eggs in the cloud basket, here's one more with the "code bug" that impacted Dropbox's authentication mechanism over the weekend.

Sure, Dropbox isn't an enterprise cloud app per se but I'll guarantee you it's impacting your enterprise this very moment. Think data backups, intellectual property, PII, password safes and whatever else your users are syncing across their multiple systems.

How do you explain such exposures to management or to your board when something like this happens. Do you say "Well, our cloud provider said their system was secure because they use SSL and, furthermore, have a SAS 70 Type II audit report to prove it." or "Our legal team approved of the contract and the SLA and gave us the go-ahead."??

I don't know that management will ever get on board the way they need to but cloud insecurities will certainly work themselves out in the marketplace - and in the courts - and eventually get on the radar of the people that matter.

This Dropbox dilemma is a relatively small and insignificant example of what happens when you completely rely on others for information security. I'm not saying don't use the cloud. I'm saying get your arms around the cloud before it impacts your business in a negative way. Odds are it's going to somehow and everyone will be looking at you for a well thought out response.

Read More

Exchange incident response, ASLR & common Windows security mistakes

From Exchange to Windows Server to Windows at the desktop, here are some new pieces I've written about Microsoft security that you may be interested in:

Six commonly overlooked Exchange security vulnerabilities

Solidify Your Exchange Server Incident Response Plan

10 most common security mistakes people are still making

Why you need address space layout randomization in Windows Server 2008 R2

Enjoy!

As always, be sure to check out www.principlelogic.com/resources.html for links to my 500+ articles, whitepapers, podcasts, webcasts, books and more.

Read More

I'm a speaker at the Gartner Infosec show this week

For those of you who happen to be attending the Gartner Security and Risk Management Summit in DC this week, I'd love it if you could check out my session or at least stop by to say hello. I'll be serving as a panelist on mobile security at the following session:

Protect Your Identity, Mobile PC and Data
Session Code SPS13 - Potomac Ballroom 1
9:30-10:30am

Cheers!

Read More

When's political correctness going to impact infosec?

Witnessing the Thought Police's handling of the Tracy Morgan debacle I can't help but wonder if political correctness is not the beginning of dictatorships, Communism, etc. where the population is not allowed to speak up or out against anything.

Don't get me wrong. Being a libertarian, I'm pro-choice on everything...To each his own. As long as you're not affecting the life, liberty or property of someone else, then say what you need to say and do what you need to do. Sure, I know we need to be sensitive in certain situations. The problem is that political correctness leads to the legislation of our thoughts and feelings...Tell me, just how different is that from dictatorships and Communism in parts of the world where, ironically, people cry out for "human rights" because of the oppression brought on by, well, ourselves?

It'll be interesting to see how political correctness invades the very fiber of information security and privacy in businesses down the road. Will we eventually reach a point in the not so distant future where it'll be politically incorrect (esp. here in the U.S.) to tell people what websites they can or cannot use or what applications they can load on their endpoint devices connected to the business network? Will it be demeaning to others when we suggest strong passwords or we point out how security oversights brought on by people making poor choices are bringing the business down?

I'm just saying...People are complex and these are things that are impacting us personally now and likely in our work down the road. How are you going to handle it?

Read More

Proud to be a speaker on the TechTarget roadshow

I just completed two seminars this past week for TechTarget and CDW...One was in Minneapolis, which by the way, was probably the friendliest city I've EVER visited. Great bunch of folks...thanks for the great Midwestern turnout and hospitality!

Our second stop was San Francisco...one of my most favorite cities to visit. I also had the opportunity to visit the nice folks at one of my publishers: Realtimepublishers.com (publisher of my latest book that I'll be posting about soon) and one of the websites where I serve as an IT security expert: Focus.com. Just meeting these people for the first time made the trip worthwhile.

If you're not familiar with it, you should check out these security seminars we're doing...lot's of good discussions around what it takes to really get your arms around the security beast. We may be coming to a town hear you between now and year's end. Here's the website:

Predictive Security: Plan Ahead to Stay Ahead of the Next Threat

Read More