The Ashimmy Blog

I Am The New Sponsorship Coordinator For BSides Las Vegas – Why?

Few will have the greatness to bend history itself; but each of us can work to change a small portion of events, and in the total; of all those acts will be written the history of this generation. - Robert Kennedy

I joined up yesterday to become the sponsorship coordinator for the BSides Las Vegas 2012 event this summer.  So far everyone I have interacted with has been very positive and eager to have me join in. I have gotten more than several notes of people pledging to donate funds to the event and help me raise the over 100k we will need. I am truly grateful for the support and will need all the help I can get. But I wanted to give you the why I joined.

As readers of my blog know, the recent “drama” around BSides has moved me to write about what I didn’t like about what was going on with BSides. But I also came to a conclusion in my life several years ago.  There are two types of people in life; one type forever sits on the sidelines, bitching and moaning about why things aren’t better. The other type of person says they will make it better. I spent too much time in my life being a moaner and bitcher on the sidelines. I realized that to effect change, you need to roll up your sleeves and make change. 

Maybe it is a result of growing up and believing all of that stuff that people like Robert Kennedy used to say, like the quote above. Maybe I am just getting old.  But if you want things to be better, you don’t wait for someone else to make them better. Also it is easier to effect change from within than from without. So if I was not happy with what I saw coming out of BSides, I could bitch and moan or I could get involved. Here I am.

I also want to state that with the completion of the financial review, appointment of a formal board of directors and filing of the non-profit corporation, I think and hope that the drama around BSides in general is behind us. We shouldn’t let these events cloud the tremendous progress the BSides movement made in a very short time. Of course any organization with broad roots will have discussion and differences of opinion. But that is part of growing. BSides is I think back in drive and moving forward.

The BSidesLV team is solid, dedicated and focused. Through everything, they kept moving forward with their event which is in my mind anyway one of the premier BSides events year after year. I am honored to be part of the team along with Jack Daniel , Joshua Marpet, Genevieve Southwick and several others. I look forward to meeting most of the others in person in a few weeks as we are all out at RSA Conference and BSidesSF. .

In the meantime, I need help raising sponsorship funds for this event.  So many of the security vendors I speak with lament the fact that they don’t know how to reach real, live security professionals. They recognize that many trade shows and conferences are not where their target audience “hangs out”. They are business development fests with great parties thrown in.

Well if you want to reach the rare and elusive security pro, BSides is a great place to find them! Mind you no hunting or shooting is allowed, pictures only. But seriously, if you want to make real live security folks aware of you, this is a great chance.Hitching your brand to the BSides engine will get you mindshare with the people you are trying to influence and reach. Sponsorships are a fraction of what a comparable event of this size and magnitude would be otherwise. 

I will have an updated sponsor kit ready shortly. But if you have some marketing dollars, want to earn buko good will in the security community, be part of something really good and cool, consider being a BSides sponsor.  I will be following up with each of you shortly

Thanks and wish me luck on this new amazing adventure.

Related articles

• Security BSides San Francisco, and RSA conference (uncommonsensesecurity.com)

Marketing Security

No this is not about a new VP of marketing at some security vendor. I was reading an article today about a presentation at RSA Europe by Lee Parrish, VP and CISO of construction firm Parsons Corporation. At a time when most of the departments and budgets in his company where shrinking, Parsons nearly doubled his security budget and was hiring more people. 

I know you think they must have had a really poor security department, suffered a breach and so finally security got the attention it deserved.  You would be wrong.  How did Parrish accomplish this feat?  Easily, he “marketed security” internally to the board and stakeholders at his company.

This is a topic I have written about over the years before.  Too many times we hear security folks lament the fact that they just can’t get management to take the threats seriously. They just don’t care enough to approve the budget and resources needed to do security right.

Usually these same people will turn their nose up at marketing types. The marketing and sales people are as reptilian as Queen Anna was in the V series to these folks.  Whether it be security vendors or not, often times security admins will want to take a long hot shower after spending time with marketing and sales types.  What a mistake!

The point Parrish makes is that you need to market security. In the case of security admins you have to market to your own buyers. The decision makers and purse holders at your own company.

Parrish gives a great example of seeing that apps were being downloaded that were not approved and presented a security issue.  But these rogue apps also were driving help desk call numbers through the roof.  So instead of talking about the security threat of these rogue apps he talked about buying technology that would thwart the downloading of rogue apps which would drive help desk calls down by X% saving Y$ per year.  That is the kind of message the business managers understood and they gladly approved the budget.

If you are going to sell (and as I have said before we are all sales people in one way or another) you have to understand your customer. What is it that keeps him up at night, what are his buttons.  So start thinking of your stakeholders internally as your customers and you have to sell them. Before the sale, you have to market to them.  Think like a marketing person and you just might get the security budget you need to make your job fun again.

Related articles

• RSA Europe, day one (roer.com)
• RSA Europe conference - a waste of time? (roer.com)
• Security on a Shoestring Budget (pcworld.com)

Steve Jobs: It can happen to you

Image via Wikipedia

First of all let me wish my condolences and sympathies to the family, friends and colleagues of Steve Jobs.  To say he was a visionary with a profound effect on the technology world for years to come, somehow comes up short to truly describe the genius of the man.

While I was never a big Apple fan, you have to admire what he accomplished in two different stints at the company. You also have to admire his vision in buying Pixar from George Lucas and turning into yet another multi-billion dollar property.

While there are no shortage of tributes and homages to Jobs being written tonight. I wanted to go on a slightly different path. That path is to challenge the next Steve Jobs out there to go out and grab greatness.

That is right, there might be more than one next Steve Jobs out there, there are even a few not Steve Jobs out there. But take the lessons of Job’s life and his advice, go out and make it happen.

This country, this world, humanity needs more Steve Jobs. We need them to imagine, create and give us ideas and products which will make the world better. To advance the human experience in ways that make us all better.

With all of the heartfelt sympathy pouring out about Steve Jobs now, I hope it does inspire others to be the next Steve Jobs.

There is also another lesson in this all to early death of Steve Jobs. That is at the end of the day, death is the great equalizer. It makes no difference how much money you have, how much of a genius you are or even how much good you did for your fellow man.  We are all here at the grace of God. When he decides it is time to go, we have no say, we obey. That is at the end of the day the ultimate human condition that not even Steve Jobs could avoid.

Related articles

• Rest in Peace Steve Jobs (shopify.com)
• Steve Job Passed On (it-sideways.com)
• Pixar Issues Statement on Steve Jobs' Passing (pixartimes.com)
• Celebs React to Steve Jobs' Death (justjared.buzznet.com)
• Steve Jobs Passed Away: Lessons Learned (dailyblogtips.com)
• Steve Jobs Dies At 56 (justjared.buzznet.com)
• Steve Jobs of Apple dies at 56 (workplacepsychology.net)
• Live Blog: Steve Jobs, 1955-2011: Share Your Thoughts (fool.com)
• Disney CEO: "Jobs Was Such an Original" (mashable.com)

Alert Logic CAPP Service

As I have written before I do some writing and consulting for several companies. One of them is Alert Logic, who offer a great line up of cloud-based, Security-as-a-Service solutions. 

Today Alert Logic announced their new CAPP program which allows most any security vendor to leverage the AL cloud based platform, turning their security solution into a cloud based managed security service. 

I wrote about over on SecureCloudReview.com, but wanted to mention it on here as well. Here is the article from over on SCR:

Today Alert Logic announced a significant new program that they are calling CAPP (Cloud Acceleration Partner Program). CAPP allows just about any security solution to plug into the Alert Logic Security-as-a-Service, cloud based architecture and become a cloud-based managed service.

This should be a huge development in the security marketplace.  Using the rich APIs developed for the CAPP program, security vendors seeking to integrate into the Alert Logic Security-as-a-Service offering can allow the cloud based platform to “ingest, correlate and analyze security data from individual security tools”.

The first CAPP partner announced for the program is Rapid7, the company behind the Nexpose VM solution and the Metasploit pen testing suite (Rapid7 is also hosting an exciting new conference called UNITED next week). Utilizing the CAPP API’s Alert Logic and Rapid7 now offer ASV PCI scanning as a service.  Other partners should be announced soon.

The CAPP program means that security solution providers don’t have to invest in developing a cloud-based delivery and management solution. They can concentrate on making their own solutions better, yet still enjoy a managed, cloud based option.

From the Alert Logic point of view it allows them to build on their strengths. They have invested millions of dollars and years of time developing their cloud-based Security-as-a-Service platform.  Now in addition to the solutions they already offered via this platform, a new wide range of solutions will be available as well.

It should be very interesting to see what new solutions come via the cloud as a result of CAPP.  It is certainly a program and technology whose time has come.

Related articles

• Is "as-a-Service" Code for the Cloud? Should it be? (securecloudreview.com)

10 Years After, Anger

I was going to rerun the 9/11 post I wrote 5 years ago to commemorate the 10th anniversary of that terrible terrorist attack that took my wife’s beautiful older sister from her family. But I am not going to post that, you can read it here if you like.

Instead I want to write about a change of my world view with the passing of 10 years since that attack on our country and our way of life. Watching all of the 10 year anniversary stuff these past few days had a cumulative effect on me.  With each passing story of someone’s tragedy on 9/11, I grew more dark, more angry, more resentful.

On top of this I look around our world and realize that after 10 years of more families losing loved ones as they fight far from our own shores, what do we have to show for it? Yes we killed OBL.  We have even killed a decent amount of the leaders of the terrorists. But what have we really accomplished?

The system that spawned these monsters still exists. We have seen an “Arab Spring” overthrowing dictators in several Arab states. But what are they replaced with? We delude ourselves if we think pro-Western regimes are springing up in the MidEast.  Even Iraq where we have spent trillions of dollars and thousands of lives, is not a stable democracy.  As soon as we leave there, Iran will exert even more influence.  Egypt, that takes billions of dollars in aid from us every year is ruled by mobs that rape female journalists. Saudi Arabia, “our friend” in the Arab world buys off their people with the oil money they suck from our veins, but the kings of Arabia have a short horizon and are themselves radically out of line with our world view.

Afghanistan will be as twisted as it ever was on the day we finally leave there.  The fact is we have few if any friends in that part of the world. Lets stop spending our money trying to change an unchangeable fact. Lets not spill any more of our blood trying to make them “safe for democracy”.  We are going to be fighting a war against these anti-American, anti-Western foes for a long time. 

The Hamas, Hezbollah and the rest are not going to be made over, they are what they are.  We need to treat them as such. They are our enemies and we need to destroy our enemies. 

Let them build the next memorials to their dead and grieve for loved ones. I don’t want any more sacred memorials to our innocent dead here.

Is that harsh? Is that just? Frankly I don’t care, it is what we need to do.

Related articles

• Why They Hate Us (lewrockwell.com)
• Saudi Arabia's 9/11 legacy (salon.com)

The Night the USA Got Its Groove Back

Image via Wikipedia

Like everyone else I was surprised and elated to hear that Osama Bin Laden was killed. To hear that it was American troops who tracked this piece of garbage down and shot him dead gave me such a feeling of pride that I can’t describe. 

To hear that he was living in in Islamabad, living in a mansion upsets me. It reinforces that we cannot trust our “friends” in that part of the world.

But more important than all of this, I didn’t realize what a load would be lifted off my chest with this news.How it makes me hold my chin up. The demonstrations outside the White House, a feeling of pride in who and what we are. A feeling of once again that we are the USA and don’t f^@k with us.

I never realized that for all of these 10 years how it really had effected our psyche that we were unable to revenge 9/11 against the head of the real evil empire.

I hope that now once again we can walk around, heads held high, proud to be Americans. That our country can get “our groove” back. That the days of us seeming to accept a slip into decline will be over. We are still a great country, the light of world and I hope we will remember that and act like it. Let this be the spark that ignites this county and lets us move onward and upward.  

God bless our service people and the Americans who carried out this mission. Most of all finally rest in peace to my sister-in-law Myrna and the other 3,000 people that this deranged madman murdered.

Related articles

• Report: Osama bin Laden Is Dead; U.S. Has The Body (mediaite.com)
• President Obama To Announce That Osama Bin Laden Dead - They have the Body (kymkemp.com)
• White House: Osama Bin Laden is Like a Ghost and We Just Cannot Get Him! (socyberty.com)
• Osama Bin Laden's Black Mistress (mrsmadbiz.wordpress.com)
• Is Osama Bin laden worse then Adolf Hitler (wiki.answers.com)

Who the F#^k is Epsilon and why do they have my information?

We are reminded again today of the far flung risks we are exposed to when our vendors outsource any functions to 3rd parties.  I received an email from Best Buy that my rapid rewards email address may have been compromised (I love how all of these breach notifications always say maybe) due to an incident at Epsilon.

My first reaction was “who is Epsilon and why did they have my email?  Reading further it seems that Epsilon managed mass emailing for Best Buy and they may have had an incident. At this point they are confident (I am not so sure I am so confident) that it was only the email address and no other data was stolen.

Unfortunately, I get so many data breach notifications (Cord Blood Registry was last weeks) that I am desensitized to the them. Then a few moments later I received a similar email from my bank.  When I get a breach notification from my bank, I get worked up. So now I am thinking why is my bank using Epsilon too?

I dig around and see how many companies are sending out breach notifications due the Epsilon mess.  It is pretty wide spread.

Lets hope it is really just email addresses that were obtained and nothing more. But even if it is just email addresses, customers of the affected organizations should be doubly vigilant for phishing scam. Any email asking you for personal information should be immediately deleted.

Another lesson to learn here is remember when you do business with a company and give them any personal information, you are doing business with every supplier, vendor and 3rd party that they do business with as well

Related articles

• Epsilon Data Breach Bigger Than Just Kroger Customers' Data (yro.slashdot.org)
• Epsilon informs of TiVo email database breach (ubergizmo.com)
• Breach at Epsilon Exposes Emails (online.wsj.com)
• Email Provider Epsilon Responsible For Gigantic Security Breach (mashable.com)
• Largest Email Marketing Firm, Epsilon Hacked. Big Name Customers Exposed. (securityweek.com)

NASA - It’s a science thing

I was reading my friend Bill Brenner’s Salted Hash blog today on the disclosures of vulnerabilities in the NASA systems that could have endangered the space shuttle missions.

Bill remembers having discussions with a NASA official years ago that set off red flags with him regarding policies and processes (or rather the lack of them) on the NASA network.

I also had a chance to speak with folks from NASA a few years back. Actually I was not interviewing them for a press opp, but instead was looking at potential security business for StillSecure.  Also back then I spent a lot of time speaking to folks at the DOE Labs like Los Alamos and some of the people from DOI and US Geological Survey.

All of these folks had somewhat of a common view towards information security and data security. They viewed themselves and what they do as scientists doing science.  In their mind science is best done by sharing.  Therefore the idea of “locking up” the data and making it hard for people to access was anathema to them.

If they think the whole idea of restricting access to the data is wrong, you can imagine how they feel about security. Why do they need it? They want people to be able to share and help advance the science.

While it is a noble view and I understand how they feel, obviously it does not take into account how some people in the world operate.  The folks from NASA would never think that someone would actually want to blow up a shuttle.  The USGS wants everyone to see the data from the seismic monitors they have on the bottom of the ocean. The scientists at Los Alamos, well lets leave that alone for now.

So I am not surprised to hear about NASA’s vulnerabilities either. It is a cultural thing in an agency with a scientific culture.  It is up to the security folks there though to put the controls in place that will keep it all safe or science be damned.

Related articles

• Houston, We Have a Problem: Critical NASA Systems Vulnerable (pcworld.com)
• Security fails could put NASA missions at risk (zdnet.com)
• NASA spacecraft vulnerable to cyber-attack (blogs.nature.com)

DirecTV Blood Sucking Scoundrels

Image via Wikipedia

No company delivering services to consumers are perfect. But some are worse than others. Joining the list of companies that don’t deserve your business is DirecTV.  I guess they are really getting squeezed by the phone and cable companies because they are getting pretty cheap.

They came to my house and set up a new HD dish around Dec 1.  They charged me $199 for the HD DVR on top of the lease amount I pay every month for it (if I am leasing it, what was the $199 for anyway?).  Then around Feb 1 when I bought a new TV in another room in the house, they told me they would “save” me the install fee and just charge me another $199 fee for another box, that I could hook up myself. Again I pay a lease fee every month for that one too.

Now less than 60 days after I received the box I am getting an error that it is the wrong the satellite dish. Only in checking with them on the phone it is not the wrong satellite dish.  There might be something wrong with a switch they installed or the HD DVR themselves. They can’t fix it over the phone, they have to send someone out.

I told them sure send someone out. That’s when they hit you with the service fee.  So after paying a $199 for the box, a monthly rental plus the outrageous fees I pay for TV service, I should pay for them to fix their own equipment why?

I think it is time for cable. In speaking to the first rep she told me that DirecTV is better than AT&T and Comcast, “because after all those two are owned by the same company”. Is it any wonder they couldn’t fix my problem? 

The the supervisor Scott ID#41487 got on the phone and said here is my ultimatum: I could pay for the service or not have TV. Ultimatum? Really?  When I asked for his supervisor he says he works for the office of the President. Really? 

Well if anyone from the office of the President of DirecTV reads this, know this. The people you have manning your support lines only know how to read from a script and are obviously not very sharp, good customer support does not give customers ultimatums and you just lost a customer of 8+ years.  Way to go!

What do you hear about Comcast Xfinnity?

Related articles

• DirecTV (mfjs2210.wordpress.com)
• DirecTV to add a few HD channels from HBO next week (hd.engadget.com)
• DirecTV's H25 satellite receivers enter the wild (hd.engadget.com)
• DirecTV Loses AT&T Safety Net (online.wsj.com)

Uh, AT&T DSL – Buh Bye

As much as I hate to admit we are big AT&T users in my house. We use Ma Bell for local and long distance, all of our cell phones, our internet DSL connection and even get a discount on DirecTV with the bundle deal.  I rant and rave mostly about my cell phone service, but on the other stuff, generally they are no better or worse than other providers.

For years we have been getting AT&T “Extreme DSL”.  It was so extreme that I was getting a whopping 1.6 or 1.7 mbps download and about 375 kbps upload speeds all this time. When I would call AT&T and complain they would tell me they would be upgrading soon and would let me know. In the meantime they would lower my fee for DSL, since it really wasn’t worth the $37 dollars a month they were charging me at the time. Eventually they were charging me like 21 or 22 dollars a month for the DSL service.

Since at home we mostly only do email and some web browsing, it really wasn’t critical. But now we have new TVs, wireless Blueray, and on demand video.  The only thing extreme about the AT&T DSL was that it was extremely slow. We could barely watch 720p movies over the net, let alone 1080p.  With both boys on line and occasionally my wife, my web experience was a crawl too. It felt like I was back on dial up.

In spite of all this, I stuck with AT&T. I just didn’t want to bother with a change. That all changed this week when we received the following email from my friends at AT&T:

Dear AT&T Internet Service Customer:

We are updating the AT&T High Speed Internet Terms of Service. We are making these changes to provide greater clarity around the terms of your service and to help us deliver a consistent, high-quality service experience for all of our customers.
We’ve reinforced this notice with additional links providing answers to frequently asked questions. Of course, we are ready and available to answer any questions you may have and to discuss individual account needs or concerns.
Here's a summary of the updates:

•  Introduction Revision: We have added email as a separate service because
    we now offer customers without our high speed Internet service the ability to have
    an att.net email.
•  Changes to this Agreement: We have changed the acceptance provision so that
    you are now deemed to have accepted the changes to the agreement after the
    30 day notice has passed, rather than immediately after receipt.
•  AT&T High Speed Internet Service: We have moved the speed tiers to a link
    within the agreement, www.att.com/speedtiers for easy reference.
•  Service Availability: We have added language to clarify that service is not
    available in all areas, and may not be available at certain speeds (or at all) at
    some locations.
•  Service/Site Changes: We have added language stating that AT&T may need to
    modify or discontinue your service, either temporarily or permanently.
•  Conversion from DSL to U-verse High Speed Internet: We have added
    language to this agreement that will allow us to convert customers from our DSL
    network to the AT&T U-verse High Speed network, where available.
•  Usage: We've added a link at www.att.com/internet-usage where customers can
    go to get information about AT&T's data usage policy and managing their data
    usage.
•  Dial-up Access Options and Toll Charges: We have added language to clarify
    specific charges that may be incurred. Such charges are your responsibility to pay.
•  Collection Agency Fees: We have added language that you are responsible for
    paying collection agency fees AT&T incurs when recovering any money owed to us.
•  Email and Termination or Cancellation of Service: We have added language
    explaining that you will keep your email address if you choose to terminate service.
•  Abusive Treatment: We have added language that allows AT&T to terminate the
    service of customers who repeatedly harass or abuse our employees.
•  Equipment & Software: We have added language to address U-verse equipment
    that is not owned by the customer, and needs to be returned after termination of
    service.
•  Restrictions on Use & Network Management: We have added language
    to make clear that the AT&T Acceptable Use Policy is incorporated into the terms
    of service. Also, to protect our network from harm and to help us ensure a high
    quality Internet experience for all of our customers, we have added language
    about reasonable network management practices that AT&T may adopt. We will
    provide you with advance notice and details if we implement new network
    management practices that directly impact your service.
•  Content: We have added language about mobile data charges for forwarding
    content from the att.net web site to a mobile device.

We encourage you to review the revised terms and acceptable use policy. Please visit:

•  www.att.com/tos2011
•  www.corp.att.com/aup

Please note, that by continuing to use the Service, you are agreeing to the terms and conditions set forth in the Terms of Service document.

When I looked up the bandwidth limits, I saw that if we watched about 10 movies a month, that alone would put us over the bandwidth limits.  The good news was that our connection was so slow it would probably be very tedious to watch 10 movies a month.  But with my kids, it was certainly possible.  I was not about to pay bandwidth overage charges. They were only signing up to deliver about 1.56 mbps to my house and were going to add mobile data charges for forwarding content to a mobile device.

So I went to Comcast, my cable provider. We get basic cable from our HOA. We were eligible for the new Xfinity service. I would get 12 mbps minimum, $19.99 a month for 6 months and then $39.99 a month.  I set up a service call for Friday, but went out and bought my own modem and router (my AT&T DSL modem/router wouldn’t work).

Today I called Comcast, told them I had my own equipment and asked to just plug it in and set it up.  Inside of 15 minutes I was up and running.  My speed tests show me downloading at about 21 mbps, uploading at about 4 mbps.

Everything is all hooked up and working great!

I just hung up with AT&T DSL customer service and told them Buh, BYE.  Maybe they will get a clue.

Related articles

• AT&T will cap DSL and U-Verse internet, impose overage fees (update) (engadget.com)
• Drilling Through the Caps (corp.sonic.net)
• AT&T's U-Verse and DSL Data Caps: Good Deal, Bad Precedent (pcworld.com)
• Understanding the AT&T Takeover of T-Mobile (alternet.org)