Lance Cottrell has a blog “The Why and How of High ROI Security Advisory Boards” over at the Ntrepid blog.
I’m pleased to be a part of the board he’s discussing, and will quibble slightly — I don’t think it’s easy to maximize the value of the board. It’s taken effort on the part of both Ntrepid staff and executives and also the board, and the result is clearly high value.
SANS has announced a new boardgame, “Pivots and Payloads,” that “takes you through pen test methodology, tactics, and tools with many possible setbacks that defenders can utilize to hinder forward progress for a pen tester or attacker. The game helps you learn while you play. It’s also a great way to showcase to others what pen testers do and how they do it.”
If you register for their webinar, which is on Wednesday the 19th, they’ll send you some posters versions that convert to boardgames.
If you’re interested in serious games for security, I maintain a list at https://adam.shostack.org/games.html.
Through the investigation, the Committee reviewed over 122,000 pages of documents, conducted transcribed interviews with three former Equifax employees directly involved with IT, and met with numerous current and former Equifax employees, in addition to Mandiant, the forensic firm hired to conduct an investigation of the breach.
I haven’t had time to review the report in detail, but I don’t think it answers questions I had reading the GAO report. Four of their give key findings are about what happened before the breach, but the fifth, “unprepared to support affected consumers,” goes to a point I’ve made consistently over nearly a dozen years: “
It’s Not The Crime, It’s The Coverup or the Chaos.”
J.E. Gordon’s Structures, or Why Things Don’t Fall Down is a fascinating and accessible book. Why don’t things fall down? It turns out this is a simple question with some very deep answers. Buildings don’t fall down because they’re engineered from a set of materials to meet the goals of carrying appropriate loads. Those materials have very different properties than the ways you, me, and everything from grass to trees have evolved to keep standing. Some of these structures are rigid, while others, like tires, are flexible.
The meat of the book, that is, the part that animates the structural elements, really starts with Robert Hooke, and an example of a simple suspension structure, a brick hanging by a string. Gordon provides lively and entertaining explanations of what’s happening, and progresses fluidly through the reality of distortion, stress and strain. From there he discusses theories of safety including the delightful dualism of factors of safety versus factors of ignorance, and the dangers (both physical and economic) of the approach.
Structures is entertaining, educational and a fine read that is worth your time. But it’s not really the subject of this post.
To introduce the real subject, I shall quote:
We cannot get away from the fact that every branch of technology must be concerned, to a greater or lesser extent, with questions of strength and deflection.
The ‘design’ of plants and animals and of the traditional artefacts did not just happen. As a rule, both the shape and the materials of any structure which has evolved over a long period of time in a competitive world represent an optimization with regard to the loads which it has to carry and to the financial and metabolic cost. We should like to achieve this sort of optimization in modern technology; but we are not always very good at it.
The real subject of this post is engineering cybersecurity. If every branch of technology includes cybersecurity, and if one takes the author seriously, then we ought to be concerned with questions of strength and deflection, and to the second quote, we are not very good at it.
We might take some solace from the fact that descriptions of laws of nature took from Hooke, in the 1600s, until today. Or far longer, if we include the troubles that the ancient Greeks had in making roofs that didn’t collapse.
But our troubles in describing the forces at work in security, or the nature or measure of the defenses that we seek to employ, are fundamental. If we really wish to optimize defenses, we cannot layer this on that, and hope that our safety factor, or factor of ignorance, will suffice. We need ways to measure stress or strain. How cracks develop and spread. Our technological systems are like ancient Greek roofs — we know that they are fragile, we cannot describe why, and we do not know what to do.
Perhaps it will take us hundreds of years, and software will continue to fail in surprising ways. Perhaps we will learn from our engineering peers and get better at it faster.
The journey to an understanding of structures, or why they do not fall down, is inspiring, instructive, and depressing. Nevertheless, recommended.
- The Brothers: John Foster Dulles, Allen Dulles, and Their Secret World War is a fascinating biography of the Dulles brothers, and how the world changed through their lives and actions. One ran the State department, the other the CIA.
- Weapons of Math Destruction by Cathy O’Neil is an interesting overview of problems with machine learning and the ways in which it is often mis-applied. Sometimes verges towards the polemical, and readers with a statistical bent may want more. Still, interesting and worth your time.
- Angel: How to Invest In Technology Startups is a bit of a breathless business book, but is an excellent overview of how to be a helpful angel investor.
- The Great Bridge and Engineers of Dreams. I make no secret of my admiration for Petroski, and this history of the great bridge builders and the men and woman who built them is excellent. However, I think McCullough’s The Great Bridge: The Epic Story of the Building of the Brooklyn Bridge does a better job of deeply illustrating Emily Warren Roebling’s place in the history of that bridge.
- Driverless is a highly readable introduction to how driverless cars are coming to function. It also made a strong case that the right bar we should set and expect for driverless cars is not perfection, but killing and injuring fewer people than are killed by drunk, distracted, or otherwise non-competent drivers.
- Postmodern Wine Making is a memoir, a history and a bit of a manifesto about Clark Smith’s time as a winemaker and what he’s learned.
- Void Star, Zachary Mason. The best William Gibson novel in a while. The one with 51 reviews has 3.9 stars, while the one with 26 only gets 3.7. Other than their Amazon ratings, I am unsure of the difference. Ms. O’Neil would be appalled, or perhaps amused.
What have you read lately that’s worthwhile?
- A remote Hawaiian island, East Island, was destroyed by Hurricane Walaka. East Island was 11 acres. It was also a key refuge for turtles and seals. Read more in The Guardian.
- Maersk has sent a ship, the Venta Maersk, through the Northern Passage. The journey and its significance were outlined by the Washington Post, with predictions of 23 days (versus 34 to sail via Suez). In reality, it took 37 days, according to the press release, “without incident.” The idea that there’s a sailable Northern Passage is astounding, even if a first sailing took longer than expected.