No Shortcuts for Security: "Cyberwar, Cyberterror, Cybercrime and Cyberactivism" (2nd Edition) by Julie Mehan

Published 2014 (2nd Edition)

“No Shortcuts for Security”.

That’s always been my motto in terms of security. I’ve been working in consulting for some years. I’ve almost seen and done it all…Nope. Just kidding… Security-wise I’ve run across lots of situations: some bad, some so-and-so, and some really bad. After more than 2 decades working in IS/IT my list of things to look out for in terms of security is a bit extensive…

To Wit:

-          Although long in the tooth, there are attacks that keep on working in this day and age. Phishing comes to mind;

-      IT departments still have an historical approach when dealing with (IT) Security, i.e., they always think all security issues can be dealt with by buying more tools. Nope. That’s not the way to go. The Way to deal with security is by using a bottom-up approach, meaning we have to start from scratch (empowerment, processes, etc.);

-          The bigger the number of tools being introduced in an IT department, the greater the complexity to be tackled by the organizations;

-          Security is not a commodity. I know lots of companies think that way, but believe me when I say it’s a dead end. For sure. Nothing good will come of it. The approach must be based on sound principles and know-how. Some Security departments I’ve seen are “adaptions” coming from traditional IS/IT departments. It means we “convert” some people coming from a purely IT background, give them one or two courses in security, and voilá, we are in the presence of a security engineer…risible, don’t you think?

-          Tools only go so far. To prevent the kind of attacks not coming in standardized form, Security departments need something more in their toolkit…;

-          Anti-virus tools are the computer plague of the 21st century. I’ve seen it time and again the bad it does to a company…What I mean is the anti-virus, in its inception, brings along security problems when they are not implemented by security professionals;

-          In some of our organizations the gap between the technical areas and management is still too great;

-          Security in an organization must come from management and not from the technical areas. Security departments need empowerment…;

-          In an organization, having to deal with private data not in use (from third parties) must be  handled extra carefully. I call this kind of information a liability, because in case of a security breach, this same organization may be subject to civil as well as criminal sanctions under the applicable laws;

-          In Portuguese organizations there’s not an ingrained culture of running security exercises, crisis responses and real-world operations. In all of the major software houses it’s common practice to implement red and blue teams, in a process called “red teaming”. The objective of this kind of internal security exercises is to assess the readiness to fend off “perimeter” breaches (I’ll explain later the reason why perimeter is between quotes). The “red teams” are made of security professionals coming from within an organization. Their objective is to access private information as if they were coming from the outside and inside…I emphasize “inside”;

-          All organizations should have professionals possessing an attacking mindset. It goes without saying we’ll be needing several iterations until Nirvana is reached, as far as it’s humanly possible;

-          “Hackers” are internet’s immune system. I don’t know who said it, but I take it as gospel truth;

-          Organizations should change their paradigm in terms of tools. Forget about anti-this-and-that. Every security department should instead be addressing issues coming from monitoring services. They are the ones that allow us to gather information of what’s happening in our corporate network and on top of it (in the application layer). Only then are we equipped to deal with threats;

-          In every organization the concept of perimeter is nonsense. Some of the major and most corrosive attacks come from within…

The above points are not in this book, but I quite agree with Julie Mehan’s take on security: “Cyber security is much more than technology” (one of the phrases I jotted down as well was the following: “security is about three things: people, process and technology”).

If you read it, even you are not a security professional, you’ll learn a thing or two…

What you’ll find in the book:

Technology Is a Double-Edged Sword; 2. Cyberattack: It's A Dangerous World for Information Systems; 3. The Human Factor: The Underrated Threat; 4. Transition from an Environment of "FUD" to a Standards-Based Environment; 5. Establishing a Culture of Cyber Security; 6. Increasing Internationalism: Governance, Laws, and Ethics; 7. Standards: What are They and Why Should We Care; 8. From Reaction to Proaction: Applying Standards in an Environment of Change and Danger; 9. Conclusion: Where Do We Go From Here?; Appendix 1: Gap Analysis Areas of Interest; Appendix 2: Standards Crosswalk

(Chapters 5 and 8 are really good; they’re full of meaty details.)

Life Would Be So Much Easier If We Only Had the Source Code: "Mr. Robot" - A Sort of Review

“Sometimes I dream of saving the world. Saving everyone from the invisible hand, one that brands us with an employee badge. The one that force us to work for them… The one that control us every day without us knowing it. But I can’t stop it. I’m not that special. I’m just anonymous. I’m just alone…”       

                                                                                         Elliot - Mr. Robot

Wouldn't we all like to have a Security Engineer day job, and being a hacker by night? It reminds me of my BBS days...

Problems I had with two of the episodes I've seen so far.

Elliot sends a large amount of MMS files to Gideon’s phone to drain his battery. WTF! Everyone who owns an Android phone knows that while playing large multimedia files the process drains the battery quicker, but the impact wouldn't be in minutes or seconds!!!

We also all know that there are programs to bomb phones via SMS or MMS. We also know that these tools literally cause lots of text messages to pop up. In real life, Gideon would have noticed that and get suspicious.

In the next scene, as soon as Gideon puts down his phone, FSociety distracts the entire office with a largely unexplained SmartTV hack. I've been using SmartTV functionalities since I can remember and I don't think the vulnerability depicted is so trivial that FSociety could force a video and lock the remote as easily as they did in this episode.  It bothered me that I didn't see what goes into the SmartTV hack. I'd would have loved to have more information...

In another episode Darlene guesses the password on her first try! Again WTF! The idea that a hacker can guess a password on the first try is just such a clichéd Hollywood plot device that I can’t stand it when I see it on TV. She could have tried at least three or four times. I know it may be boring to watch someone spend hours trying different combinations, but that’s the price we pay for accurate TV “hacking”…(*smile*)

I loved the way the script writers portrayed hacking as a means to allow Elliot to connect with others; breaking into email, social media to better communicate with the world around him is also a clever trick. Like a modern Robin Hood, Elliot also uses his abilities for good, taking down the unlawful and cruel along the way...Instead of arrows he uses source code. lol

And now for the really bad stuff. The show is riddled with clichéd characters and situations. First of all, the nasty corporate evil CTO really ruins it for me. Am I really supposed to like watching a clownish CTO fart around for several episodes? Not my cup of tea. Secondly Christian Slater as the psycho mentor...They both look like a pair of villains coming from a 60's SF show!!! Neither character brings anything new I haven't already seen before. Thirdly, the unexpected sex scenes, thrown regularly into the narrative to the point of making no sense at all.

I've just finished a few more episodes, and they were not very promising for the rest of the show, the 4th episode in particular puts emphasis on Elliot’s not very intriguing personal “demons” and also on the very unlikely plan against E(vil) Corp.  While watching these last episodes I felt as If I was streaming a great film and all of a sudden the internet connection suddenly buffered. That's how I began to feel.

Despite all this, the show on the whole is still watchable. The way hacking issues around privacy and a networked society are filtered down make it believable all the more. In one of the scenes, Elliot, explains how by just looking at source code on a website we can understand lots of stuff. TV-wise it's a clever bit of writing that works due to the voice over. The information given is so well written that I got an elementary tutorial on webpages without really noticing it. In SF terms that's what we call an infodump. Bad SF is full of them. Good SF has a few of them, but we don’t really noticed them because they are deeply interwoven into the narrative. I learned later on that there was a reason for this “lesson” (i.e., the infodump about “webpages”), because Elliot muses how good it'd be if one could see the human's source code, and, in a very clever bit of filming, I saw people at his office wearing various signs that revealed their secrets. Kudos to the script writer.

Due to all the reasons above, I'm still waiting for the Story to start. At the end of the day, I'd still recommend this show to others as the good parts clearly outshine the bad (so far).

I know I'm nit-picking, but in a show of this calibre, I was expecting to have taken more out of it, but so far I wasn’t able to.

NB: "Ex-Machina" is a much better SFional media, although on a totally different computer aspect (AI).

SF = Speculative Fiction.

How to be fluent in Snobbish: " Computer Hacking - A beginners guide to computer hacking, how to hack, internet skills, hacking techniques, and more" by Joe Benton

Published 2015.

I’ve always been a book snob. I’m also not afraid to admit it. Now you’re thinking: “What? But you read SF, for God’s sake!!! How can you be a book snob?” It doesn’t matter what one reads. It’s what you do with what you read that counts. It goes without saying that I can tell you that not all reading is equal in merit, be it SF, Mainstream, Crime Fiction, Computer Science or Shakespeare. That goes without saying. Not every book is going be a masterpiece. That’s a given. Unfortunately more and more, I find myself devoting more time to the reading material that is useless. I hate it when having just finished reading something, the feeling that remains is to have frittered away my time! Learning what to read and what not to read is as much a craft as writing itself. I get extra-frustrated and pissed off by these state of affairs. When that happens out goes a “0” star rating (or a “1” for that matter). There are days (and nights) where I pledge to only read something worthwhile. I actively work to challenge my beliefs by reading outside of my comfort zone, but that takes work. To start with, I must build my A-list of books to read, i.e., books I know will have at least a minimum of quality and that I’ll read no matter what, because there is only so much time in my live. Unfortunately much of it will be wasted on reading crap. I’ve read the old clunker too many times and later on I find myself coming out of a stupor 2 hours later with zip to show for it. Like the crap I’ve just finished reading. Even for beginners it’s a total waste of time.

The (implicit) blurb: “The author explains all the tips and techniques that will help you to begin developing your own computer hacking skills.” I can safely say that if your life depended on being hooked on hacking just by reading this book, you’d die the horrible death, i.e., being stranded on a desert island with a Kindle with only Stephanie Meyer’s books on it, never mind the fact that there are no electric outlets out there! What did I expect for a book with 23 pages! That serves me right.

NB: I hope the one minute it took you to read this review was (not) a (total) waste of your time…

SF = Speculative Fiction