Treating the symptom

Today in the car I heard a credit card debt consolidation commercial that sort of drove me crazy. While there is a place for those companies the last line got to me - “If credit card debt is the problem, we are the solution.” Heads up there high speed - the real problem is you can't stop buying stuff you can't afford! Your credit card debt is just the visible symptom. Treating the symptom instead of the problem only lands you back in the same spot. This goes hand in hand with the diet pills that basically say take this magical pill to lose weight and that you don't even have to change your daily habits....like over eating and getting no exercise...which is what got you where you are.

News flash – IP addresses aren’t computers

Crazy thought I know but it isn’t hard not to get caught up in that mentality. I was trying to think of a way to tell the story of resources/logs needed to be able to be able to identify sources of badness in incident response of one flavor or another. Visually I was drawing that out somewhat like IP ~ Computer Name ~ User Name all at the top level and branching under that you have various logs like DNS, DHCP, asset management, authentication, etc. All of which play a part in being able to answer questions related to what computers are infected and which users are doing ‘bad things.’ Anyway, it wasn’t until I put that down on the whiteboard that the thought hit me in that IP addresses are a supporting factor in identifying a particular computer and not equal to it. Funny what tool limitations will do to your thinking.

If none of that makes sense to anyone other than me I blame the Nyquil.

The unrecognized APT story....

2 hobbits sneaking into Mordor.


Somehow I don't see me using that analogy in the executive boardroom though.

What's in a name?.....Strategy

Follow me for a moment on a random thought. If vision begets strategy and strategy begets roadmaps and on down we go; wouldn’t common language and labels be a byproduct of that activity? If that is true, would it be somewhat safe to say if you don’t have common language and labels for groups or efforts it indicates a breakdown further up the chain?

The trick is identifying where the chain is broken....and fixing it.

International Conference on Cyber Security 2012 and "hunters"

Overall impression….meh. It was decent for a first year conference. Oh wait this is its 3rd. That there was a Cyber Security Tutorial before the first actual day of the conference should have been a little telling. Presenters were also only given 30 minutes so not much ability to dive deeply. I think there was more of a focus on law enforcement cyber concepts and general cyber research than anything else which absolutely has a place…..but not for where I am and what I’m doing. If it required a clearance it would probably be a conference I’d like to have happen twice a year given the areas the speakers came from. Ah well. I also hate to knock presenters as on some level it takes some stones to stand up before folks and speak. At one point I did see someone take their iPad, take a picture of one of the presenters as they droned on and on and used some movie special effects app to blow them up. Indeed sir, indeed.

One thing I did find myself thinking about at the airport was the idea of a Cyber Warfighter