BurntCoffeeSucks

Save the Data!

2017-08-08T07:57:00.002-07:00

Title - Save the Data!

· In this episode we're gonna cover 5OE Don't touch that dial!

· Intro

· Welcome back! This is episode 5 of The Insider Threat podcast, for the week of June 12th, 2017. With all the feedback I've received, I realized that we need a way to chat about these topics and share ideas. For that, I have created a subreddit on Reddit.com. That is where I will be putting the show notes for each episode, and I think we could all benefit if you contribute there as well. Please keep sending your stories. It lets me know of actual issues out there in your organizations and lets me use this as a medium to share the information to a large audience. As I said before, I'll be sure to anonymize the stories to keep everyone out of deep water.

· Infosec Question of the Week

· It's time for your Infosec Question of the Week, where Google is king and the prize is nonexistent!

· The question last week was "In 1997, a hacker group was angry about hackers being falsely accused of electronically stalking a Canadian family. They broke into the Canadian Broadcasting Corporation's web site and left a message saying: "The media are liars." The family's own 15-year-old son was eventually identified as the stalking culprit. What was the name of this group?"

· The answer was "The Brotherhood of Warez". I apologize to our Canadian listeners for the quick jab in last week's hashtag.

· Congratulations to:

o Elliot from Calgary

o Kelly from Houston

o Bruce from St. Paul

o Rubin from Glendale, Arizona

o And our first two-time winner, Isaac from Washington State, for getting the correct answer.

· Here's your question for this week: Guido van Rossum was born in the Netherlands, worked for several international tech organizations, and now works for Dropbox. While all these are great fetes, what is he most famous for?

· Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag "cherry pie".

· Insider Threat Month

· I recently learned that June is now "insider threat month". I'm not entirely sure what that means, and I've only seen it referenced by a few vendors, but it is nice to know that people are thinking about it. Even if it ends up just being a marketing ploy, only good things can come from in in my opinion.

o Articles

Our first article this week is actually the writeup for a show called "combating insider threat in government" from Federal News Radio

o https://federalnewsradio.com/insider-threat-month/2017/06/combating-insider-threat-in-government/slide/4/

o First I'll start with some stats that were presented (there were quite a few)

· 60 percent of all intrusions can be attributed to insider threat (IBM)

· 95 percent of all organizations have employees who seek to bypass security controls (Information Week)

§ Doesn't this highlight a problem with the security department and making sure that employees have access to the capabilities that they need for their job?

§ They didn't specify whether these were technical controls or policy controls

· 47 percent of organizations have more than 1000 files open to all employees (Varonis customer survey)

· 71 percent of all folders had stale data

§ I'm assuming this just means old files that aren't being used anymore. I'm not sure about this one. I often have to go back to historical files when referencing information, and that is a pretty key capability for just about anyone that works at a desk.

o The guest speaker, Brian Vecci, spoke about the importance of data, as well as the importance of protecting it.

o Specifically calls out user behavior analytics, machine learning, information classification, and file analysis.

· Just so happens that the company he works for, Varonis, sells products for each of these capabilities

o Good nugget that we should consider is "data should be seen as an organizational asset in the same way that money is"

o When first reading and listening to this, I assumed that they would skip awareness training altogether. I was pleasantly surprised however, to hear them highlight the need for it.

o The biggest thing I didn't really care for with this probably stems from my own understanding of what our role is as security professionals. They kept talking about the importance of protecting data, but in my mind it is actually our job to protect the key business functions and capabilities of the organization. Data is only one small part of that.

o With that said however, I have to remember the source of this one. In the federal government, there might be more weight on the protection of the data than anything else because the sensitivity of the data is higher than with most organizations.

· Eweek.com - Top 10 Tips on How to Avoid Damage From Insider Threats

o http://www.eweek.com/security/top-10-tips-on-how-to-avoid-damage-from-insider-threats

o 1 Identify sensitive data you want to protect

Figure out what data is most important to the organization

o 2 Monitor user activity

User behavior analytics

o 3 Encrypt data and enforce strict data policies

If you have sensitive data, you should be looking at ways to ensure that it is safe even after it is compromised

o 4 Train and educate employees about insider threat

Technology can only go so far. We can train our employees not only to keep from doing the wrong things, but also to report suspicious behaviors and events

o 5 Develop an employee risk-score system

I'm not so sure about this one. I suppose you could develop a risk profile for each employee based on the data provided by the user behavior analytics solution, which probably wouldn't be so hard. If you decided not to implement this solution though, it would be very difficult to develop a way to score employee risk.

o 6 Double authentication and privileged access controls

By double authentication, they mean multifactor. This could be used to ensure that employees aren't sharing credentials. Not only does this help with access control, but it also helps with nonrepudiation, which is an employee's ability to say they didn't do something that account and access logs say they did.

o 7 Focus on automated detection and prevention

This isn't necessarily talking about insider threat, as that is already covered with a few of the other tips. This is specifically talking about data exfiltration. We need to be able to find out when this is happening as well as have the mechanisms in place to stop it quickly.

o 8 Implement IT vendor monitoring tools

This might be the first time I've seen something suggesting this route, aside from when we discussed ObserveIT products. The recent NSA leak shows that we can never be too careful about third party product or service providers, no matter how much we trust them. In many cases, any vulnerability in their technology, processes, or the organization as a whole could impact your level of risk.

o 9 and 10 go together.

First you need to reassess the policies that are already implemented to make sure they are actually doing what you would like them to do. I addressed insider threat policies a few episodes back, but this should be extended to all existing security policies.
Next, you will want to either modify the existing policies or create new ones to bridge any gaps in your security strategy when it comes to insider threat.

o I think this list of tips is a very good starting point. It is important to remember however that you will need to cater all suggestions to fit your specific environment and the amount of risk that your organization is willing to tolerate. Not all organizations are the same and you don't want to stick entirely to a universal template.

· Vendor Segment

o CyberArk Privileged Account Security

o https://www.cyberark.com/solutions/security-risk-management/insider-threats/

o From the website - "CyberArk is the only security company laser-focused on striking down targeted cyber threats that make their way inside — undetected — to attack the heart of the enterprise. More than 3,200 global businesses trust CyberArk to protect their highest value assets, enabling them to master audit and IT compliance requirements."

o CyberArk has several products and solutions that support information security, but the one we are going to talk about is their Privileged Account Security solution

Enterprise Password Vault® fully protects privileged passwords based on privileged account security policies and controls who can access which passwords when.
SSH Key Manager™ secures, rotates and controls access to SSH keys in accordance with policy to prevent unauthorized access to privileged accounts.
Privileged Session Manager® isolates, controls, and monitors privileged user access as well as activities for critical Unix, Linux, and Windows-based systems, databases, and virtual machines.
Privileged Threat Analytics™ analyzes and alerts on previously undetectable malicious privileged user behavior enabling incident response teams to disrupt and quickly respond to an attack.
Application Identity Manager™-Conjur eliminates hard-coded passwords and locally stored SSH keys from applications, service accounts and scripts with no impact on application performance.
On-Demand Privileges Manager™ allows for control and continuous monitoring of the commands super-users run based on their role and task.
Endpoint Privilege Manager secures privileges on the endpoint and contains attacks early in their lifecycle.

o Key benefits

Ensure that only authorized users are able to access powerful privileged accounts
Prevent users from being able to gain unapproved elevated privileges
Establish strict accountability over the use of privileged accounts by tracking who accessed what accounts and what actions were taken
Improve forensic analysis by generating a detailed, tamper-proof audit trail of all privileged account activity
Rapidly detect and be alerted on anomalous activity that could signal an inside attack in-progress

· Thought of the Week Segment

o Our thought of the week comes from Mary Anne Evans, an English writer who went by the pen name "George Eliot". She said "It is a narrow mind which cannot look at a subject from various points of view."

· Outro

o Thank you for listening to episode 5 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

o You can contact me on twitter @stevehigdon or email me at theinsiderthreatpodcast@gmail.com. Please also consider joining our community and discussions at http://reddit.com/r/insiderthreat. That is where you will also find the show notes for this and all other episodes going forward, as well as links to the topics we've covered.

o Thanks again and I'll see you folks next time!

· Show Notes

· Please keep sending your stories! It lets me know of actual issues out there in your organizations and lets me use this as a medium to share the information to a large audience. As I said before, I'll be sure to anonymize the stories to keep everyone out of deep water.

· Infosec Question of the Week

· It's time for your Infosec Question of the Week, where Google is king and the prize is nonexistent!

· The answer was "The Brotherhood of Warez". I apologize to our Canadian listeners for the quick jab in last week's hashtag.

· Congratulations to:

o Elliot from Calgary

o Kelly from Houston

o Bruce from St. Paul

o Rubin from Glendale, Arizona

o And our first two-time winner, Isaac from Washington State, for getting the correct answer.

· Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag "cherry pie".

· Articles covered in this episode:

o https://federalnewsradio.com/insider-threat-month/2017/06/combating-insider-threat-in-government/slide/4/

o http://www.eweek.com/security/top-10-tips-on-how-to-avoid-damage-from-insider-threats

· Vendors covered in this episode

o https://www.cyberark.com/solutions/security-risk-management/insider-threats/

· Thought of the week

o "It is a narrow mind which cannot look at a subject from various points of view." - Mary Anne Evans as George Eliot

· Thank you for listening to episode 5 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.

· You can contact me on twitter @stevehigdon or email me at theinsiderthreatpodcast@gmail.com. Please also consider joining our community and discussions at http://reddit.com/r/insiderthreat. That is where you will also find the show notes for this and all other episodes going forward.

· Thanks again and I'll see you folks next time!

Creating an Effective Awareness Program

2017-08-08T07:54:00.002-07:00

Title - Creating an Effective Awareness Program

In this episode we're gonna cover security awareness programs, culture, insider threat training requirements for federal contractors, and more! Don't touch that dial!

Intro

Welcome back! This is episode 4 of The Insider Threat podcast, for the week of June 5th, 2017. As a quick update, I am working on a segment or two about unlikely insiders, which was inspired by a story that one of you gave me. Please keep those up. It lets me know of actual issues out there in your organizations and lets me use this as a medium to share the information to a large audience. As I said before, I'll be sure to anonymize the stories to keep everyone out of deep water.

Infosec Question of the Week

It's time for your Infosec Question of the Week, where Google is king and the prize is nonexistent!
The question last week was "In the early 1970s, John Draper discovered that he could make free long distance calls by sending a certain tone through the phone. What did he use and where did he get it?"
The answer was that he used a whistle that he found in a box of cereal. This later earned him the nickname "Captain Crunch".

Congratulations to:

Brady from Milwaukee
Harlan from the UK
Annetta from Jersey City
Isaac from Washington State
And Bob from Jacksonville for getting the correct answer.

Here's your question for this week: In 1997, a hacker group was angry about hackers being falsely accused of electronically stalking a Canadian family. They broke into the Canadian Broadcasting Corporation's web site and left a message saying: "The media are liars." The family's own 15-year-old son was eventually identified as the stalking culprit. What was the name of this group?
Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag "notreallybacon".

Articles

Our first article this week is related to an insider threat training requirement for federal contractors

https://www.scmagazine.com/insider-threat-training-deadline-here-for-federal-contractors/article/665358/
This isn't anything new, since the requirement took effect at the end of last November, but it essentially means that all cleared federal contractors had to go through insider threat training before the first of this month.
Seeing as how it is probably too late now, I hope you were able to get it done if this applies to you. I've heard those clearances aren't easy to get

Our next article comes from Kai Roer at Infosecurity-magazine.com A Culture of Security, Not of Blame

https://www.infosecurity-magazine.com/blogs/culture-security-not-blame/
I really liked the general idea of this one and there were some good nuggets to take from it
"Technology continuously introduces huge amounts of security challenges and risk factors, which we keep blaming employees for not handling correctly. Blaming people for not handling poor technology correctly is - in my opinion - simply wrong. In fact, by blaming the employee for clicking on a phishing link, or opening an attachment, is similar to building a car with poor brakes, and then blaming the driver when the car crashes. Guess what, with cars the manufacturer does not get away with blaming the weakest link or the stupid driver."
There are quite a few things I can agree with in here, to include the note about not blaming users for doing the wrong thing. I think he could have taken it further by saying that it is our fault - as security professionals - for not training them in a way that makes an impact. Instead of taking the time to do that, we write off our users as lost causes and invest in more technology to compensate.
The author appears to be anti-awareness and pro-culture. I guess my argument would be that awareness programs can be an instrumental part of building that culture.
What do you think? I'd love to get your opinion on this one in particular, so please let me know.

Instructional Segment

Speaking of awareness programs, today I want to try a segment that provides some actionable steps for improving your organization right away. I asked some folks on LinkedIn and Twitter some questions related to information security awareness programs, and this is a compilation of sorts of the responses that I received.

What goes into effective information security awareness training?

Purpose

Why does the organization have the program?
You can mention compliance requirements here, but I would make it subtle
What business functions and their associated systems need to be protected?

Do's and don'ts when using information systems, and why?

Acceptable Use Policy
Account Management Policy
Data Retention or Encryption Policies
Cater to the applicable policies for the audience

Description of the threat

Start with a question about the most important parts of their job and what IT assets are critical for their success in accomplishing them
Now talk about the critical systems for the organization as a whole, such as payroll, benefits, timekeeping, shipping, estimating, email and other communications, or whatever else the organization relies on for business
"If we didn't have <fill in the system>, the organization would come crumbling down"
The loss of those systems defines the threat, from stopping a single employee from being able to do their work to the entire organization being unable to accomplish its mission

Examples of the threat

Here you can talk about any stories you have, as well as anything that the audience members can share

Something like "that time that Tom got a virus and had to try to work without a computer for 3 days. He thought he would get fired"

Examples of real incidents

WannaCry
Popular breaches, like Target, Home Depot, and Chipotle
The suspicion that other countries are trying to impact election outcomes

Bring it home (both the family and the firm)

What if a hacker was able to get your bank account information?
What if they could see your children through your computer's webcam?
What if they were able to hack into your alarm system to break into your home without setting off any bells?

Responses to incidents

This is where you tie in your own organization's policies and procedures to actionable responses to suspected security events

The members of the audience are the ones that have to use these systems every day.
I had a user in the past that reported a suspected virus on their system…

Sent an email to them afterword expressly thanking them for their contribution to the security program

What makes an effective information security awareness program?

Relevance

Give them information that will actually apply to their work and home lives

One idea I had recently was to start at the very basics for securing their home networks. Even if employees don't care about the information security program for the company, they should be concerned about protecting their personal lives.
Maybe start with teaching them how to secure their social media accounts, and home wifi or computers and go from there
The basics are the same and it greases the wheels in a way that will let you segue to organizational security later

Engagement

Get them involved

This applies to any type of training. If you just stand at the front of the room and lecture them, they will fall asleep

Get them to ask and answer questions

Who knows, they might think of something that you didn't when you were putting your speaking points together

Break them up into groups for further discussion and exercises

You could give them some symptoms of a potential security issue and have them come up with the proper reporting procedures, based on how your organization does it

Timeliness

Frequency

Most are annual
Might be different for your organization, depending on any compliance requirements
One organization I heard of had a security question….

Even if they cheat, it still gets them talking
Their participation could even be used for annual performance evaluations or keep them from having to do the formal annual awareness exam

The key is to get them thinking about security all the time, not just the 20 minutes a year they are taking a test or sitting in a classroom

Support

Most important
Management support for the information security program

If the CEO or general manager walks into the class and just says something like "Pay attention to this. It's very important."

Bottom line: the most effective awareness program is one that works best for YOUR organization.

Thought of the Week Segment

Our thought of the week comes from Bruce Schneier, who said "if you think you can solve the security problems with technology, you don't know technology"

Outro

Thank you for listening to episode 4 of The Insider Threat podcast. Please remember to subscribe and review in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions.
You can contact me on twitter @stevehigdon or email me at theinsiderthreatpodcast@gmail.com.
Thanks again and I'll see you folks next time!

Policy, People, and Ninja Warriors!

2017-08-08T07:53:00.002-07:00

Title - Policy, People, and Ninja Warriors!

· In this episode we're gonna cover cloud impacts on insider threat, some ways to reduce insider risk, NINJIO Security Awareness, and more! Don't touch that dial!

· Intro

o Welcome back! This is episode 3 of The Insider Threat podcast, for the week of May 29th, 2017.

· Quick Announcements Segment

o The continued feedback has been really great, especially those of you in the Cybersecurity community on Reddit. The biggest complaint I've received isn't even really a complaint, which is that the podiant website doesn't have the ability to listen at 1.5 or 2x the speed over the web. I know exactly what you guys are talking about. With something like 8 or 9 weekly podcasts that I listen to in addition to this show, my job, and my fairly large family, I have to do the same thing. There are only so many episodes that I can cram into the time that I am washing the dishes after dinner. The only option there is to listen through your favorite podcast app, so subscribe through iTunes, Stitcher, Pocket Cast, the Google Play Store, Overcast, or whatever you use. If you find that your app doesn't have the show available, please let me know and I'll see what I can do about getting it added. Again, please continue to listen, subscribe, rate, and review. I've gotten far more streams and downloads than I thought possible with only 2 episodes out, which shows that there's a real need for information on this topic.

o In addition, I ask that you guys send any insider threat stories that you may have. I'll be sure to strip out any identifying details of course, but it would be nice to have some real world examples of some of the things we discuss.

· Infosec Question of the Week

o It's time for your Infosec Question of the Week, where Google is king and the prize is nonexistent!

o The question last week was "How did notorious hacker Kevin Mitnick know that federal agents were near his apartment?"

o The answer was that he compromised the local cellular network and created an alert to let him know when the cell phones belonging to the agents on his case communicated with the nearby cell tower. The hashtag was actually relevant to the story, as the only thing that the agents found when they got to his apartment was a box of donuts in the refrigerator labeled "FBI Donuts".

o Congratulations to:

o Pooran from Mumbai, India

o Jake from Norwalk, Connecticut

o Alyssa from Flagstaff, Arizona

o Rich from Bedford, England

o I'm going to mess this up. My French is as nonexistent as the prize… Rene'e from Chateauroux, France

o And Bernie from Chicago, Illinois for getting the correct answer.

o Here's your question for this week: In the early 1970s, John Draper discovered that he could make free long distance calls by sending a certain tone through the phone. What did he use and where did he get it?

o Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag "breakfast".

· Articles

· https://www.meritalk.com/articles/cloud-increases-insider-threat-risk-meritalk-survey-finds/

o The first article this week comes from Jessie Bur at MeriTalk and it claims that cloud integration actually increases insider threat risk

o This conclusion was drawn from a recent survey, where 59% of government employees that responded were concerned that migration to the cloud makes it more difficult to keep track of malicious or negligent users.

o What I find really interesting about this idea is that many, if not most, of the tools today for tracking user behavior are either solely in the cloud or have the option to be implemented either in the cloud or on premises. If the findings of this survey are true, would putting more applications and services in the cloud only add to the problem or would it make things easier? At some point we are going to have different cloud applications and providers talking to each other in our environments and I'm afraid we will completely lose control and oversight of what they are doing.

o This could become even worse, since President Trump is now pushing the federal government even more forcefully into the cloud with the new Cybersecurity executive order that was signed a few weeks ago. I'm not trying to be political or anything like that, but the push for cloud integration is strong. Vendors like Amazon, Microsoft, and others are making a good case for organizations to migrate their applications and services into the cloud, and those that don't might feel like they are falling behind when compared to their competitors or peers.

o The more complex we make our environments, the more risk we have. If we are adding complexity in order to minimize risk, that might be the wrong approach and what got us in whatever situation we are in to begin with. When you add more variables to the equation, the outcome will be harder to predict. Insurance companies and war strategists have been studying this concept for a really long time, so we have to assume that they are onto something.

· http://www.techrepublic.com/article/5-ways-to-reduce-insider-security-risks/

o Our next article comes from Scott Matteson at Tech Republic and lists 5 ways to reduce insider security risks

o Assess access needs and build policies to determine what rights users and administrators should have, and adjust according to changes or new circumstances.

· This is generally known as the concepts of least privilege and identity and access management, and it is a really important thing to do in our organizations. We need to ensure that users only have accesses and privileges needed for their current roles and this needs to be reviewed very regularly to make sure we stay on top of it. Another way to ensure this is being done is to integrate access review into onboarding and termination processes, but it also needs to be triggered when an employee changes roles. That is where most of us have the hardest time.

o IoT devices can place the organization at exceptional risk via embedded credentials. Use analytics on these to determine normal behavior and detect anomalies.

· In addition to extra oversight on these devices, we should also seriously consider network segmentation. The recent widespread malware infestation that we've had speaks to the fact that some organizations simply cannot get away from having vulnerable or outdated devices and operating systems in their environments. The best practice here is to isolate those devices so if they do become a problem, at least they won't be able to serve as staging areas for accessing the rest of the network devices.

o Use logging/alerting mechanisms to notify personnel about suspected attacks as early as possible to reduce risk.

· This one is key, especially when it comes to insider threat. If we know that a phishing campaign or other human hacking attempt is going on in our organizations, timely communication with the user base might be the only thing that keeps you out of deep water. It also shows the employees that information security is an important part of the business as a whole and tells them that they are an integral part of the program.

o Use separate accounts for administrators to perform routine tasks versus privileged operations.

· I'm pretty sure this is best practice no matter where you go. There is no reason that I can think of for a system, network, or security administrator to be able to access the internet or email with their privileged accounts. Doing so greatly increases the threat landscape because if one of those accounts got compromised, attackers get the keys to the kingdom. On top of that, those accounts generally get around security controls by default, so something as simple as a malicious advertisement loading on a screen could allow the code to run as administrator and have a higher likelihood of success.

o Background checks may provide some protection from malicious insiders (provided they have been caught in the past), but should not be seen as the end-all solution. Individuals with clean records can still be victimized via compromised accounts.

· This last risk reduction tip is interesting, and I suspect it is something that is not universally done and in my mind there are different approaches. While discovery of some past crimes should probably deny employment altogether, some others might not fall into that boat. There are several successful information security professionals and consultants today that have a dark history, yet they have been able to move on to very successful and upright careers in our industry. Maybe the best route to take would be to weigh each case independently and if there is any suspicion about a particular person applying for a job, their access can be tightened and we can keep a closer eye on their behavior. Instead of being a binary yes or no for hiring, we can use that information as we tailor our monitoring strategy.

· https://zonefox.com/news/provide-definition-protection-insider-threat-policy/?utm_content=54733205&utm_medium=social&utm_source=twitter

o The next article comes from James Graves at ZoneFox.com and centers on the importance of good policy when it comes to insider threat

o Security policy in general is viewed differently depending on who you ask. For this article, the author is specifically highlighting the need for an Insider Threat Policy.

o So with this one, we talk about different important steps or tips for having an effective Insider Threat Policy.

o The first one is defining the threat, as well as defining the policy.

· Now this seems like a no-brainer, especially because we have a good idea of what the threat is - we know that insiders either intentionally or unintentionally do things that increase risk. That isn't as easy to detail on paper though. An added note is that by taking the time to write or type out the definition of the threat for this policy, you get the added benefit of ensuring that you and everyone else in the organization has a standardized idea of what the insider threat is. You are identifying the problem in a public way, which will drastically help in the next step, which will be to find ways to solve that problem or at least minimize its impact on the organization.

o Now we get to the meat of the policy, which is spelling out the actual rules when it comes to insider threat. The next tip will help with that, since it tells you that you have probably already done some of the work through your other policy or training.

· You can look at places like the acceptable use policy, mobile device policy, access control policy, and so on. None of this has to be created on the spot, since it has likely been covered in other places in more detail. Another quick tip from me, and this goes for writing any security policy, is that you shouldn't be so detailed in these policy statements that you have to modify more than one policy when a single change is made. Instead of copying and pasting policy language from one document to the other, you can simply give an overview of the other policy and direct employees to look there for the details. These callouts for other documents will save you an incredible amount of time later.

o The next tip says that with context comes clarity.

· There is a sentence from this article that I feel needs to be quoted. It says, "Security policies, and therefore insider threat policies, are not created for the benefit of the cybersecurity team, they are created for the benefit of the organization as a whole, and anyone in it."

· That is huge and this idea should ring through all the policy you write. If you are able to communicate to the readers that the rules outlined in the policy aren't just some requirements from the security team, but instead that they are meant for everyone to be successful, that will help them to see the importance more clearly. Tell them how insider threat impacts not only their job as a whole, but their success in accomplishing the key components of their job.

o People will sometimes intentionally or unintentionally do things that they shouldn't. We are all human. This next tip, enforcing the policy with technology, is one way to either ensure that doesn't happen or give you the capability to discover and respond when it does.

· On top of your policy and various training programs, many organizations see the need to compensate their program with tools. When it comes to insider threat, the common technology used is user behavior analytics.

· Last week we spoke about Observe IT and their product that allows administrators to monitor user behavior and identify abnormalities. Think of this as the door locks and alarm systems of your home. Even though we have laws and cultural norms that dissuade people from breaking and entering while you are away or asleep, you need to have physical and technical barriers to keep people out that have chosen to disregard the law and morality in general. User behavior analytics solutions are a good way to do that for insider threat.

· When you highlight these technologies in your policy, it lets the people in your organization know that although we expect them to do the right thing, we are actively inspecting what we expect.

o Lastly, we have to integrate the policy compliance with the existing business compliance strategy. In order for policy to be effective, it must have teeth. I've heard it said that policy without teeth is just words on a page.

· If someone performs an act or exhibits a behavior that does not align with the policy, there has to be a way to reprimand or otherwise punish them. This serves as a deterrence just as much as it does a consequence. Aside from moral reasons, a major deterrence for breaking into a house is the knowledge that I will get in trouble if I get caught. If you are implementing a tool effectively, as mentioned in the last tip, they already know that they will probably get caught.

· Aligning insider threat policy enforcement with the more traditional enforcement strategy that the organization uses will make it easier to accomplish if an incident arises, and it also gives employees a mental reference point for unacceptable behavior. They can expect similar consequences for punching their boss in the face as they would violating a key security policy.

o One thing I would add to this list is something that I stress for all security policy, which is management support. When the executives are on your side, that means they understand the impacts of information security risk and its relationship to business risk. That is language they speak regularly, and they will probably do so very often. When the boss cares about it, everyone under them has no choice but to care as well.

· Vendors

· NINJIO https://ninjio.com

o Not a sponsor of the show

o From their website - NINJIO attacks end user Security Awareness in a different way. We don’t lecture your users. We entertain and educate them by telling stories about real life security breaches that have happened to real life companies. We do this using 3-4 minute long animated and gamified Episodes written by Hollywood writers, and we focus on one teachable moment around one specific type of attack. A new Episode is released every 30 days, so your users will never see the same Episode twice. It’s like “drip marketing” for Security Awareness.

o How it works is they create user accounts for your organization's employees in their online learning management system. Every 30 days they send emails to your employees letting them know that a new lesson is available, then they complete the video or lesson and get placed on a leaderboard for your organization. The lessons are specifically tailored to address current threats around the world.

o They have different deployment options available as well.

o I have been very excited about NINJIO for quite some time. I've chatted with their CEO once or twice and I really like the approach they're taking to help solve the insider threat problem.

o They have a few samples of the videos available on their website, and I strongly suggest that you go check 'em out. Even if you don't think you have a problem with your existing awareness program, it helps to see how others are finding creative ways to communicate the information. They're pretty entertaining, too.

o If you decide that you want to know more about their product, let them know. Everyone I've been in contact with at NINJIO has been really helpful and responsive.

o I've left a link to their website, as well as the articles covered in this episode in the show notes.

· Thought of the Week Segment

o Now it is time for our thought of the week. This one comes from Douglas Horton, who said "The art of simplicity is a puzzle of complexity"

· Outro

o Thank you for listening to episode 3 of The Insider Threat podcast. Please remember to review and subscribe in your favorite podcast app, and also share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions and constructive criticism.

o You can contact me on twitter @stevehigdon or email me at theinsiderthreatpodcast@gmail.com.

o Thanks again and I'll see you folks next time!

For the show notes: http://www.stephenhigdon.com/p/podcast-transcripts.html

Wanna Bring Down the Globe

2017-08-08T07:50:00.001-07:00

Title - Wanna Bring Down the Globe?

· In this episode we're gonna give a recap of the Wanna Cry ransomware, talk about insider threat in health IT security, Observe IT User Behavior Analytics, and more! Don't touch that dial!

· Intro

o Welcome back! This is episode 2 of The Insider Threat podcast, for the week of May 22nd, 2017.

· Quick Announcements Segment

o We have gotten some really great feedback from the first episode, and I urge you to keep it up. In the future, I plan on having some guest interviews, to include folks from the industry and vendors who have a solution for tackling insider threat. Please continue to provide as much feedback as possible, as this is your show and you should be helping to drive its direction for the future.

· Infosec Question of the Week

o It's time for your Infosec Question of the Week, where Google is king and the prize is nonexistent!

o Here's your question: How did notorious hacker Kevin Mitnick know that federal agents were near his apartment?

o Send your response to InfosecAnswer@gmail.com. Be sure to include your first name, location, and the hashtag "colddonuts".

· Articles

· https://www.symantec.com/security_response/writeup.jsp?docid=2017-051310-3522-99

o As a recap of the WannaCry ransomware attack that plagued the world and our news feeds over the past week, there are claims that the initial infection of the worm was carried out by a malicious email attachment

o An estimated 200,000 computer in 150 countries were infected

o At one point, there was a DDoS against the server that was being used by the attackers for the decryption process, so victims who had already paid the ransom were out the money and still couldn't access their files

o The spread of the attack was stopped when a security researcher that goes by the name MalwareTech registered the domain address that was being used as a kill switch. Basically when the malware infected the system, one of the first things it did was try to communicate with the unregistered domain name. As long as it wasn't active, it continued through the infection, propagation, and encryption. By the way - if you are in the media and you encounter someone in the security industry who wishes to remain nameless, please respect that.

o The reason this worm was so impactful to begin with was the high number of legacy operating systems being used throughout the world. In many cases it was people who were using unlicensed copies of windows and were too afraid to update their computers because they didn't feel like going through the steps to re-crack their windows version.

o Researchers who have reverse engineered the malware claim that it was probably a product purchased and modified by amateurs, as it was poorly designed and appeared to be comprised of bits of code from other malicious tools literally copied and pasted together.

o I've also included a link in the show notes to another piece of malware called Adylkuzz that is using the same vulnerability as WannaCry, but instead of encrypting your files it mines a cryptocurrency called "Monero". For those who don't follow cryptocurrency, Monero is a lesser known digital currency than bitcoin or ethereum. I wasn't able to find any indication that this malware used phishing for infection, but I wouldn't be surprised.

o This entire episode with both worms just goes to show that we need to be teaching our employees to verify senders, links, and attachments before opening things that they shouldn't. https://www.proofpoint.com/us/threat-insight/post/adylkuzz-cryptocurrency-mining-malware-spreading-for-weeks-via-eternalblue-doublepulsar

· http://www.information-age.com/insider-third-party-access-rank-top-cyber-threats-123466142/

o Information Age Website - Cyber security professionals "admit to paying ransom"

o Bromium, a security tool vendor that specializes in virtualization-based enterprise security that stops advanced malware attacks, announced the findings of their research conducted at the recent RSA Conference.

o During the research, they surveyed security professionals on their own behavior. According to that survey, about 10% of security professionals admit to paying ransoms and not disclosing the incident to their bosses or anyone else in their organizations.

o We have spoken about insider threat and ransomware already, but that typically involves users clicking on links or attachments. We haven't yet however covered the human factor of security professionals and their own motivations behind their actions.

o It is important here to remember that absolutely everyone involved in security - from the end users to executive management - is human. Just like everyone else, those of us in security are equally concerned about our own jobs. If you were to accidentally infect your corporate workstation with some sort of malware, would you go through the standard incident response procedures or would you find a way to take care of it yourself? This is an important question to ask, because the same fear of reprisal is what often drives the decisions of our users.

o The study also claims that about 35% of security professionals admit to bypassing their own corporate security settings, but that one isn't as much of a surprise to me. We often have to make configuration changes in the course of our day-to-day work and it isn't malicious in nature. On the other hand, if this is being done in order to circumvent security controls for reasons outside of their normal job scope, this can be a very bad thing and we should know better.

· http://healthitsecurity.com/news/67-of-security-teams-say-insiders-top-data-security-threat

o Health IT Security website - 67% of Security Teams Say Insiders Top Data Security Threat

o The author quoted findings from a survey conducted during the 2017 Secure Access Threat Report

o Over 2/3 of security professionals surveyed believed that either malicious or unintentional acts from insiders were the greatest security threat to organizations

o There were some other really good statistics in that article, so I will leave a link to it in the show notes. I won't swear to the accuracy of the survey, though. Between us, some of the math just doesn't seem to add up. But in all fairness, that could certainly be attributed to my own arithmetic deficiencies.

o So I heard from another information security professional this past week that during an internal phishing campaign, 80% of the users clicked on the link in the email. That said, I'm not sure if the source of the email was internal or external, but that’s a pretty high percentage, especially when you take into account that there were about 2000 users in the organization. What can we do differently to get the point across? If you were in the situation I just described, what would be your next step? Do you start including things like this in employee annual performance reviews? Do you repeat the process until you can identify habitual offenders and use that information to focus your oversight strategy? Just some thoughts.

· https://www.scmagazine.com/security-officer-faces-300k-fine-for-hacking-boss-after-caught-faking-overtime/article/661655/

o SC Magazine - Insider threat faces $300K fine for hacking former employer

o So Yovan Garcia was caught hacking his employer's website to adjust his overtime hours and they took him to court, claiming $318,661.70 worth of damages. The judge ruled in favor of the company, named Security Specialists, and he is going to have to work many extra overtime hours to pay up, that is if he is able to get a job after this.

o On top of all that, after Garcia was fired from his company, he started his own consulting firm and sold a knock-off version of the software that his old employer developed.

o When we trust our system, network, and even security administrators with privileged access to our environments, we can't just assume that they are the "good guys". Even people who should know better have the ability to make mistakes or cross the ethical line. It doesn't preclude them from the same stringent oversight and separation of duties strategies that every other employee must adhere to. Actually, we might want to pay even closer attention to those who have admin rights to the systems or network. In this case, he probably thought that he could get away with it because of an assumption that nobody was watching.

· http://blog.titania.com/human-vulnerabilities-become-technical-ones/

o Our last article today was written by Dr. Jessica Barker, who runs a security consultancy and, with a background in sociology, specializes in the human side of security.

o She says that we often fail to acknowledge that there is an excessive security burden placed on the people using technology and that we don't take the time to bridge the gap and see the overlaps between the human and technical vulnerabilities in our organizations.

o We spend quite a bit of time with the hardening of our software, hardware, and networks, but we don't spend nearly enough time hardening our people and culture and "the responsibility is on all of us to work towards the creation of a positive and empowering environment".

o I really like the approach that Dr. Barker uses when trying to address the human side of security, and one day I would really like to try to get her on the show to talk about it more. Sometimes we place too much emphasis on the security processes and technologies in our organizations as a band aide for the real problem, which is that users either don't understand the security impacts of their actions or they simply don't care.

o As always, the links to these articles will be placed in the show notes.

· Vendors

· Observe it http://observeit.com

o Not a sponsor of the show

o From their website - ObserveIT empowers organizations to precisely identify and proactively protect against malicious and negligent behavior of everyday users, privileged users and remote vendors. They significantly reduce security incidents by changing user behavior through real-time education and deterrence coupled with full-screen video capture of security policy violations. This cuts investigation time from days sifting through logs to minutes of playing back video.

o Some of the key features are session recording, alerting, risk dashboards, behavior management, shared account identification, and privacy protection.

o This solution can be used to observe and record user actions to ensure that they are not violating the organization's acceptable use policy during the course of their work day.

o We spoke earlier about trusting privileged users with elevated access without periodically verifying that they aren't doing the wrong thing. This tool can also be used for that purpose.

o When it comes to service contracts with vendors, Observe it can be used to remotely watch third-party personnel and ensure that they are doing what they are contracted to do and billing labor hours accurately.

o Finally, Observe it can be used for regular compliance requirements when it comes to auditing. It isn't just generating logs of user actions on systems and the network - it is recording everything they do. This capability will certainly help with providing evidence of wrongdoing after a malicious act has occurred.

o The first thing I was thinking about when researching this product was privacy. Well, they have thought of that, too. You can configure the system to require multiple unique passwords in order to play back the recorded sessions. In this case, you would have someone from Observe it enter their password, then a union representative or someone from legal enter theirs.

o What do you think? Could you use this tool in your environment in order to help combat the risks associated with insider threat? Would you use this as your go-to solution or pair it with your security awareness training program?

· Thought of the Week Segment

o Our thought of the week comes from Dr. Jessica Barker when she was speaking to Microsoft earlier this year - "If you engage in changing your culture, if you engage in empowering your staff… then people go from being the weakest link to the biggest part of defense"

· Outro

o Thank you for listening to episode 2 of The Insider Threat podcast. Please remember to subscribe, rate, and share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions and constructive criticism.

o You can contact us on twitter @stevehigdon or email us at theinsiderthreatpodcast@gmail.com.

o Thanks again and I'll see you folks next time!

Hello World

2017-08-08T07:47:00.000-07:00

o Welcome to episode 1 of The Insider Threat podcast.

o This is the week of May 15th, 2017.

o I'm your host, Steve Higdon.

· Quick Announcements Segment

o First episode

o This all started a long time ago when I began writing blog posts and articles centered on selling information security to business minded people. That got me going down the rabbit hole of how to influence the people that impact security.

o Then I started seeing headlines all over the place claiming that insider threats or the human factor was the weakest link in organizations.

o Heck, a quick google search right now shows headlines claiming that "insiders are today's biggest security threat", "insider threats responsible for 43% of data breaches", "58% of Information Security Incidents Attributed to Insider Threat", and the list goes on.

o I've heard the hosts of Paul's Security Weekly podcast (and by the way, if you don't listen to them and you are in this industry, you really need to. In fact, you have my permission. Pause this episode and subscribe to their shows right now. I'll wait.), so anyway, they said that when they go out on pentests they often suggest to their clients that they start with the assumption that they have already infiltrated the network because if they do a simple phishing campaign, one in ten employees is going to click on the link or open the attachment. Making this assumption would save everyone time and money.

o The topic of insider threat has almost become a marketing buzzphrase now. There are several new products on the market in the areas of user behavior analytics, data loss prevention, machine learning, and artificial intelligence. Now if any of you are working on your bingo cards, they should be just about filled up.

o On a serious note though, this certainly is a problem and there are multiple types of solutions on the market to address it. That is what this podcast is gonna be about.

o I really want your listener feedback on this. What are you doing in your organization to deal with the human factor? What do you wish you were able to do? Please leave comments at the link in the show notes or contact me directly on twitter or email. I'll give you that information at the end of the episode. Not only will your feedback give me more to talk about on the show, but it will also help others in the industry who are trying to tackle the same problem. Who knows, I may even be able to do some shout outs to you all if commentary becomes a regular thing.

· News Segment

o Articles

o https://www.scmagazineuk.com/hospitals-turn-patients-away-as-nhs-caught-up-in-global-ransomware-attack/article/658864/

· SC Magazine UK - Max Metzger - Hospitals turn patients away as NHS caught up in global ransomware attack

· WannaCrypt0r, one of the largest ransomware attacks ever occurred on Friday, May 12th, 2017, and is reported to have effected organizations in almost 99 different countries across the globe.

· The virus first hit headlines as it knocked computers offline at the National Health Service, which is the public health organization for England, Scotland, Wales, and Northern Ireland. On Friday, news agencies all over the UK were urging citizens to avoid the emergency room at all costs.

· There are also reports that the virus exploited known vulnerabilities that were recently leaked by the National Security Agency in the United States.

· The kicker here is that patches for those vulnerabilities were actually released by Microsoft in March, which means that any organizations that were impacted did not apply patches in just over two months.

· What does this have to do with insider threat? Well ransomware is often spread through email with malicious links or attachments. In fact, the article even mentions that initial thoughts were that the ransomware was being spread through an email that was labeled "Clinical Results".

· This just goes to show that risks associated with insider threat are real and current. International investigations related to this major incident are still underway.

o https://www.infosecurity-magazine.com/opinions/driving-a-culture-of-security-tips/

· Infosecurity Magazine - Driving a Culture of Security - Tips For The CIO by Julian Wragg VP at Pluralsight

· Pluralsight is an online technology learning platform. They aren't a sponsor or anything, I just wanted to give you all some background about the author.

· This article lists 5 ideas for improving security culture.

· Get with HR Write more effective policy that people will understand

· Invest in role specific training

· Invest in your team's skillset - internal penetration testing

· Create engaging content - make training more enjoyable

· Lead by example - executive management support and culture

· The thing that I found interesting is that none of these tips were focused on tools, which I suppose makes sense because it is based on improving the security culture of an organization. I will leave a link to this article in the show notes for anyone who wants to read it.

· So far this episode we have highlighted the two major philosophies for dealing with insider threat - technology and training. What do you think about this article? Do you agree?

· Feedback Segment

· Thought of the Week Segment

“

If you want to change the culture, you will have to start by changing the organization.

Mary Douglas

From <http://www.wiseoldsayings.com/culture-quotes/>

· Outro

o Thank you for listening to episode 1 of The Insider Threat podcast. Please remember to subscribe, rate, and share with everyone you know! Those reviews are key to building this out and improving for later episodes, so please feel free to leave suggestions and constructive criticism.

o You can contact us on twitter @stevehigdon or email us at theinsiderthreatpodcast@gmail.com.

o Thanks again and I'll see you folks next time!

(UPDATE) It Worked for Me: 20 Pounds in a Month

2016-02-19T08:00:00.004-08:00

Hey folks, I want to share with you something that I have been doing since the first week of this year. First though, I want to start by saying that I am not trying to sell anything. Likewise, I am not gaining any affiliate advertisement profits or anything like that from this post. The technique that I am sharing for rapid weight loss is free, easily accessible, and doesn't involve a personal trainer, gym membership, or supplements.

Each year, my company puts on a fitness competition. They allow employees to weigh in during the first week of the year and put $50 into the fitness challenge pot. They then have until the first week of April to lose 10% of their weight. If an employee is successful in this goal, they get their money back and an additional $50 from the CEO. If they do not lose 10% of their weight, they get nothing. Additionally, the person who loses the highest percentage of their weight gets the remainder of the money that is left in the pot after prizes have been distributed. This year, the pot was up to almost $1200.

On January 6th, I weighed in at 202.9 pounds - the most I have ever weighed. In order to get my money back, I would have to lose 20.2 pounds by April 8th. The challenge was on.

To start, I want to mention that this technique was discovered almost entirely by accident. I decided that I was going to do some sort of cardio three days per week, and the easiest form of cardio for me is running. Okay, I was going to run on Mondays, Wednesdays, and Fridays.

Now, I didn't know how far I was going to run, and my schedule was tight in the mornings. For that reason, I chose to run for 20, 25, or 30 minutes, depending on when I was able to start. I followed this routine religiously and without failure. Again, I focused on time alone, and not distance.

In addition to the running, I read somewhere that you should walk 10,000 steps per day. While my commute from the bus to the office each day is fairly significant, I knew that I would have to do a little bit extra in order to reach that number on my non-run days. For that, I decided to eat lunch at my desk and take a 20-30 minute walk afterward. Bingo - that put me over the daily 10,000 step requirement.

Next, I knew that I needed to change my eating habits. I downloaded the MyFitnessPal app for free, as I had used it before and I liked having the ability to update my stats from my work computer, where I don't have access to my phone. I plugged in my goal weight and it projected that I needed to have a caloric balance of around 1400 calories per day. Since I was serious about losing the weight and getting started, I lowered that to 1250 calories, which is just over the minimum that MyFitnessPal considers to be safe.

A caloric balance is fairly simple, and just represents the amount of calories you are taking in each day (to include beverages), minus the amount of calories you burn through exercise. MyFitnessPal did all the math for me, since it automatically kept track of my exercise and all I had to do was plug in everything I was eating and drinking. (As an added note, the app even has the capability to create nutritional information for homemade meals. All you have to do is enter the ingredients.)

Finally, and this might have been the most important part, I decided to try something very new. I like to watch Survivor, and I have often looked into something called the Survivor diet. In this diet, you are only allowed to have a certain amount of rice and/or beans for 39 days. To mix it up, you are allowed to eat anything that you can either catch or gather for yourself. This primarily consists of fish and "yard greens".

While that was not an option for me, it started me in the direction that I ended up taking. Have you ever searched YouTube for a video that was strictly functional (like how to repair something in your house) and 30 minutes later, you cant figure out how you ended up on Chinese dancing cat videos? A similar thing happened, here. I started reading different experiences on the Survivor diet and found that many people partake in brown rice fasts. These can range from one day to two weeks, and participants have seen significant changes in their physical and mental health. Two weeks sounded crazy to me, but maybe one or two days wouldn't be so bad.

Bam! Now I had something to occupy my Tuesdays and Thursdays, since I wasn't doing cardio on those weekdays. I had a cup of cooked brown rice for breakfast, a cup and a half for lunch, and a cup for dinner. Sometimes I would add a pinch (less than a quarter teaspoon) of butter to my morning portion, which actually made a huge difference in taste. (Note that only eating 3.5 cups of brown rice in a day is less than 900 calories and MyFitnessPal will be mad at you on those days.)

On the weekends, I didn't necessarily do anything special, except maintain my caloric balance. Shoveling snow (repeatedly) on two of the weekends really helped the balance.

To summarize, below is a brief reminder of all the steps in this program:

Run for 20-30 minutes three days per week
Walk for 20-30 minutes after lunch every day
Maintain a caloric balance every day that is lower than what is required for your goals
Eat nothing but cooked brown rice two days per week

At exactly one month (February 6th), I weighed in at 183.9 pounds, which is a difference of exactly 19 pounds. I weighed myself the next day and was at 182.1 pounds. I achieved my 4-month goal in just one month.

What am I doing now? Well I am no longer doing the brown rice. I told myself all along that I would cut that portion of my program as soon as I made my goal weight. Instead, I now do 15-20 minutes of swimming on Tuesdays and Thursdays, but other than that nothing has changed. This morning I weighed in at 180.4 pounds and I am still going. In the near future, I will likely switch to other ways to improve my fitness, such as weight training and high-intensity workouts.

Good luck with your journey to goal achievement. I know you can do it, because I did it. Just keep with the program (whatever that ends up being) at all costs. Let me know how it turns out!

UPDATE: Results

Hello, everyone! Well, the competition is over and I managed to pull ahead of the other participants. I "weighed out" last Friday (8 April), and after 12 weeks I lost a total of 34.7lbs. That came out to just over 17% of my body weight. I ended up getting back on the brown rice plan for the last two weeks of the competition, after being sidelined for a week due to an elective surgery that kept me out of the gym (or doing much of anything, really).

Now for the big question - now what? I have continued to go to the gym and run this week, but that is probably due to the habit I have built and a deep fear of breaking it. I have a fitness test next week for the Army Reserves, so right now I am working on my push-ups and sit-ups. After that, who knows.

The big thing I have come to realize though, is that I need a goal in order to keep going. I just haven't figured out what it is yet.

Finally, thank you for reading. I just hope that you can take away a little bit of my accidental method and apply it to your own fitness goals. Even if you are not as regimented as I have been, they key is to continuously make small steps forward. "Baby steps to better" has become my mantra, as I have come to realize that absolutely nothing worth while happens in a day.

Keep going and good luck!

Education Reform that Might Actually Work!

2014-09-16T08:37:00.003-07:00

There is quite a bit of attention put on the Federal government when it comes to education reform. It is a hot topic for every Presidential and Congressional debate, yet less than 10% of education funding that reaches the schools actually comes from the Federal government.

image from peoriapublicradio.org

The highest contributor to public education is the state government, which provides anywhere between 48% and 70%, depending on who is doing the arithmetic. Next is the local government, which gives between 20% and 40%. The biggest sources for state funding are sales and income taxes. Local governments derive their funding from property tax.

The more money that the citizens in a state make, the more they are paying in income and sales tax and the more money the local governments get from their property tax (assuming that people with more money buy nicer houses). The problem is that education is a catalyst for future income. If schools have low performance, their local citizens will likely grow up and have lower-income jobs. This means that they will not pay as much in income tax and will likely not be able to afford to buy a mansion, adding to local property tax revenue. Thus, it is all an endless cycle of education success or education failure, which is directly tied to the local community and culture (if you want to dig that deep). This is why education should be of great concern to everyone.

Although the Federal and local governments have their hands tied in approaches to education reform, the state governments are in perfect position to effect positive change. The biggest driver in the system I am proposing is standardized test scores. Before I get a stream of public outcry over standardized tests, hear me out. Standardized test scores should not be used to determine who gets the money in a particular state, or how much. Instead, all state money should be divided equally between schools and test scores should be used as a tool to determine where the bulk of that money will go. In other words, if an elementary school has substandard test scores for reading, they should be required to prove that a good portion of their annual budget goes directly into the English department.

If schools want to purchase a new gymnasium, auditorium, or other “niceties”, they have to make sure that their test scores stay above the minimum for all areas of study.

What do you guys think?

New Blog

2014-04-28T08:26:00.001-07:00

Hello there, followers!

I am starting a new blog that focuses more on information security. Please check it out! junksec.blogspot.com

I have also migrated to @stevehigdon for Twitter and +SteveHigdon for Google+. Please update your contacts lists.

2014-01-18T13:26:00.002-08:00

wallet.dat backup

bitcoin

download

4 Ways to Sell Security Expenses to Business Executives

2013-12-11T13:01:00.000-08:00

image from: corporatementors.in

One of the most challenging parts of being a security administrator is asking for more money, especially when it appears as though everything is working fine. The old adage comes to mind, "If it's not broken, don't fix it."

Unfortunately, this philosophy can be disastrous in the security world. New technology acquisition is often much easier for the CIO than for the CISO for one simple reason: business executives like new, shiny toys. They don't however, like to invest in technology that they are unable to see and play with.

For this reason, you must always address new security capability procurements in business terms that executive management understands. In other words, you have to show them the money. The following are 4 ways of getting business minded people to see the benefit of making security expenses that they do not fully understand.

1. Create a "What If" Scenario: This suggestion is often the easiest, especially since the most of the associated research is has already been performed if you are an active and aware security professional. Compile a list of the most recent vulnerabilities and exploits, whether they pertain to your organization or not. Then, take the data from your business continuity and disaster recovery plans (hopefully they are up to date and accurate) to calculate the amount of money lost each day when information and information assets are not available. Many times this kind of scare is enough to continue the conversation.

2. Capitalize on Competition: Business executives are always trying to compare their business with similar organizations because they do not want to be driven out of the market. On that same note, they often enjoy a good story about their competition's shortfalls. Find some similar organizations around the world that have suffered from security incidents, especially those that have lost a considerable amount of money. When you give this presentation and provide a solution, it can easily be seen as a win/win. Not only does it look like you are a better security professional than what the "other guys" have because it did not happen to your organization, but it also gives the executives an opportunity to make a decision that will give them a leg up on other members of the industry. Business people like to think that their company is an industry leader. All you have to do is give them an opportunity.

To put a cherry on top, it might be a good idea to reference the same profit loss data as in the previous suggestion when comparing against the competition.

3. Do Your Research: Nothing turns business people off more than speaking with someone who has no business sense. If you are unable to show a positive return on investment (ROI) for the procurement, they can feel like you have wasted their time. For this, make sure that you don't just research solution capabilities, but also the associated costs. Another tip is to only suggest solutions that fulfill the current need, along with projected organizational growth and near-term future requirements. It is fine to go up a size or two when buying a winter coat for your child, but it might be a waste of money to splurge on an adult large that they will never grow into.

Make sure you do research and find the best return on investment

4. Role Identification: When all else fails and you are sure you are absolutely right, it might be a good idea to remind your executives that ultimately they are the information owners. You are doing your job by identifying the problems and presenting solutions, but it is their responsibility to approve or disapprove the security measures. It is also their responsibility to protect their information. If a security incident occurs that would have been avoided if they chose to approve your suggested investments, it won't be your picture on the front page of the newspaper.

This is a bold step, but it has the possibility getting your recommendation funded AND changing the way they look at the security of their organization's information.

These 4 ways to sell security expenses to business executives could help you make your organization more secure, avoid security incidents, and ultimately keep your job. If you have any suggestions or additional tips for performing this task, please let me know in the comments section down below and I might add them to the list.

Read, Love, Comment, Share!

20 Thoughts of an American Who Cares

2013-11-10T06:40:00.001-08:00

1. I think hard work and responsibility should be rewarded.

2. I think that there should be fewer programs for helping people without insurance, jobs, or homes because more likely than not it was their own poor life choices that put them in whatever situation they are in to begin with.

Rob Davies, http://www.redbubble.com

3. I think that if we eliminated or suspended these programs, it would force members of the next generation to make better decisions and plans for their lives.

4. I think the biggest problem in our country is not our government, but our national culture.

5. I think the jealousy that many lower and middle class Americans have for the “Rich” is absurd and discourages ambition.

6. I am not a Republican.

7. I am not a Democrat.

8. I think the two party system of government in our country causes much more harm than any one person ever could.

9. I want to see political candidates who are options because of their leadership abilities, not simply because their party thinks they are most likely to win.

10. I could certainly be wrong, and I welcome that possibility with the hope that whoever is right will succeed.

11. I think social programs should exist, but only after our culture has changed for the better. Otherwise, they will continue to be abused.

12. I think all government benefits should require voter registration, if not also participation.

13. I want change that works and I think that involves a swift kick in the rear for most Americans.

14. I think it is sad that many Americans don’t understand how percentages work when it comes to taxes.

15. I think “facts” I learn on TV are spin until proven to be truth through actual research.

16. I don’t tell my kids that everything will be okay because that won’t be the case if they make poor choices.

17. I don’t like that I am supposed to feel empowered by the fact that I went to public school and my parents didn’t pay for my education, yet my kids will likely be criticized for “having better opportunities”. Whatever happened to creating your own opportunities, like I was forced to do?

18. I am hopeful for my children’s future because I focus on teaching them how to be good, hardworking people. They will automatically have a leg up on their peers.

19. I am not raising good kids. I am creating responsible, successful adults who (with any luck) will care about their community, their country, their children, and the future enough to stay informed.

20. I am afraid that there aren’t many other Americans like me.

Congressional Lesson: Case for a Third Party

2013-10-10T04:50:00.002-07:00

image from politico.com

During the last presidential election, I tried to spread a single point across my personal social circle as well as social media. Everyone seemed to be focused on reelecting President Obama or Governor Romney, but almost nobody was looking at the alternatives. I said it then, and I still say that the two party system of government in our country has the capability of doing far more harm than any one man ever could.

Now we find ourselves in a government shutdown and on the path to “falling off the fiscal cliff.” We want to blame our federal government, but what could we have done differently? Did we not vote our leaders into office?

People are often afraid to commit to any third party often because the simply doubt a third party could ever be as popular or powerful as the Republican or Democrat parties. That is the beauty behind this concept.

Third parties never have to be the majority in order to be effective. They simply have to be strong enough to make sure no single party has over 50% of the House of Representatives or the Senate.

This scenario would help to eliminate the deadlock that is often associated with party line voting in Congress. It is up to us. We have the ability to change the future for our children and grandchildren.

What do you guys think?

6 Steps to Building a Better Tomorrow

2013-08-20T08:54:00.000-07:00

To everyone that actually cares:

I saw a video on a blog this morning that identified a liberal city councilwoman in Denver who was trying to change the behavior of the city’s citizens. That was the point of the video anyway. It was really a 15 second clip of a woman that said she wanted to put a small tax on plastic grocery bags so people will start using reusable ones instead.

The sad thing is that people actually responded to that message. People get caught up with the petty things in our politics and fail to see the things that actually matter. They let the media tell them what their feelings are because they are too lazy to figure it out for themselves. They think they are too far outside and do not have the wisdom to have an original opinion.

As most of you know, I am conservative. I am only mentioning this to express my lack of bias in this particular case. I am getting sick of the country that I love. I have been a public servant for almost as long as I have been of the age to do so and I think we need a change. This change isn’t going to come from politicians on any side, but from the people.

Change. The word reminds me of President Obama’s 2008 campaign for election. The reason it was successful is because all Americans have a deep desire for something different. He tapped into that beautifully, but the execution has been horrible.

Our forefathers created this “Great Experiment” in hopes that things would be different. They even wanted a change back then, and it was unforeseeably successful. They created a nation that could rule itself with structure.

The President is not supposed to be the most important governing position in our country. When President George Washington designed our nation’s capital, there is a reason that he put Congress on the hill and the White house off to the side. There is a reason that the capital building is the tallest in the district. There is a reason that the President is sworn in on the Capital steps. Our legislature is what was designed to set our country apart from the rest of the world. It has also had a hand in making things how they are today.

The biggest problem is with the political parties. I’ve said it before, and I will continue to say it. No one person can really cause that much trouble for our country. Even so, we are at the mercy of the two main parties for our choice. These days, we aren’t picking the best person possible for any political office. We are only picking out of the two that their respective parties think would be most likely to win. So many of our history’s great leaders wouldn’t even be options today. Instead, we get cookie-cutter candidates who are puppets to the polls and political parties.

The power to make a change has always been with the citizens, but we have either been too afraid or too ignorant to do so. I challenge all of you with this:

1. Demand that your respective political party give you better representatives for your needs.

2. Demand that your peers stop focusing on silly little jabs at the opposition.

3. Tell Fox News and MSNBC to start giving you unbiased news that actually matters to you.

4. If any of the above is unsuccessful, have the courage to look for alternatives.

5. Encourage the people you care about to do the same.

6. Encourage your children to become hard working, self-sustaining adults that are true to their word and their families.

We can make the changes that we have been looking to our political leaders to make. After all, we are the ones who put them there. The power is ours. We need to stop complaining and do something about our situation. They might be the board of directors, but we are certainly the shareholders in this organization.

Simple and Juicy Roast Chicken

2013-08-15T20:16:00.001-07:00

Hey there guys!

Today I want to share with you a very simple and juicy roast chicken recipe that has become a staple in our house. If I can do this, anyone can!

What you will need:

- Whole Chicken (Innards Removed)
- Large Baking Dish
- 1/2 Stick of Unsalted Butter
- Salt
- Black Pepper
- Garlic Powder
- Paprika
- 2 Carrots or Celery Stalks
- Medium-sized Onion

Preheat to 350 Degrees Fahrenheit
Cook for 80-90 minutes
Safe temperature is 170 Degrees Fahrenheit when fully cooked

Please let me know what you think in the comments below. I look forward to getting your feedback and suggestions!

How to Make the Absolute Best Popcorn on the Stove!

2013-08-15T08:29:00.003-07:00

How to Make the Absolute Best Popcorn on the Stove!

Anyone who knows me personally is aware of my dedication to the dream of making the best possible popcorn. This recipe and method may not be the easiest, and certainly isn’t the healthiest, but if you follow these steps I can virtually guarantee that you and your guests will keep talking about this stovetop popcorn again and again. I do not claim to be a chef and I have never been formally educated in the culinary arts. My popcorn is the product of years of trial, error, and experience.

Without further adieu, I want to tell you all how to make Steve’s Famous Stove-top Popcorn!

First, we should probably go over the ingredients:

1 Tbsp Bacon Grease (I usually save mine in the fridge after I make bacon for breakfast)

½ Stick of Real Unsalted Butter

1 Large Pot with Lid

Popcorn Kernels (I usually keep them refrigerated, but I don’t know why)

Nutritional Yeast (Found in most health food stores)

Garlic Salt

Large Bowl (Big enough to fit the popcorn and shake without spilling too much)

Instructions:

1. Start off by putting the bacon grease in the pan and heat until it is fully melted. Then turn it off.

2. Add just enough popcorn kernels to cover the bottom of the pot without piling up.

3. Cut the butter into thin slices and scatter them on top of the kernels.

4. Add a few shakes of garlic salt.

5. Turn stove on to Medium heat and cover the pot.

6. As soon as the popcorn starts popping, start shaking the pot slightly every few seconds to keep it from burning.

7. Keep this up until you hear the popping slow to a rate of one or two seconds per pop.

8. Remove from stove and transfer to large bowl.

9. Add garlic salt and nutritional yeast to taste*, shake to mix, and serve!

*Most people are nervous about the yeast at first. It is completely inactive (not the kind used for baking) and is used by many people as a substitute for cheese. Don’t be scared! The yeast is probably the best part!

As long as you didn’t burn the house down, you should have a very tasty snack in your possession!

Please let me know what you guys think in the comments section below. I am constantly trying to improve on my recipe, so I am open to any suggestions you may have as well. Let me know how to make your favorite popcorn on the stove.

Secret to Life Success

2013-08-12T05:19:00.001-07:00

Today I want to talk to you about the secret to success in life!

Work hard to create options, and then pick the best one. That’s it.

When I first think about options, buying a car comes to mind. You start off with the base model, and then add all the little dew-dads that make the minivan you are settling on seem more bearable. The options I am talking about however are like intersections or "forks" in the road. This may sound cliché, but it is the best way to explain the very simple concept.

Let's start off with a story on this one. Jon is very good at bagging groceries at the local store. He has a job and he is content. Ben is also a bagger at the same store. After he has mastered the art of avoiding smashed eggs or the accidental combination of meat and bug spray in the same bag, he asks if he can get trained at stocking the shelves during slow days.

Jon may be the best grocery bagger in the business, but when times get tough at the store, he will likely be without a job because he isn't worth as much. Not only that, but he might have a hard time finding new work because he only has experience doing one thing. Jon's road is a one-lane trail without any turnoffs, where any obstacle in his path will likely leave him stuck. He doesn’t have options because he didn’t take the time to create them.

Ben on the other hand has shown potential for versatility. His store will keep him because he has shown that he has the ability and desire to learn. Ben took advantage of his down time to make himself better and more marketable. For some reason, people today seem to have forgotten the entire concept that if you work hard early in life, you won’t have to work as hard later. When Ben eventually learns all the functions of the grocery store, he will likely become a supervisor. He has created an interstate highway system for himself so he can decide for himself where he wants to go.

The great secret to success and happiness in life is to work hard and create options. Ask anyone who is without and they will tell you that having to make a difficult decision between choices is a good problem to have. Many people want to know what rich parents teach their children. I never had the opportunity to get that particular lecture, but I can’t help but assume that it is this simple concept.

I experience this same thing all the time. People find out that I work full time, go to school full time, and still make time to read books to my four children before they go to bed at night and they actually feel sorry for me, which is surprising. They feel pity that I am actively trying to make my family’s life better.

Really?

Is that where our society is today? We used to be defined by two things in life – our occupation and our word. Now it seems like those two characteristics aren’t even important, much less viewed as defining qualities. Some would argue that not everyone has the same opportunities that I have had. They are absolutely correct. I went to public school and barely graduated. I went to work after that because I “decided” to start a family very early. Later, I put myself through college. Stop using opportunities as an excuse for being lazy. You create your own opportunities. Stop saying things aren’t fair because you have to work for them.

That is my challenge to all of you. Don’t sit still. Don’t get comfortable. Set goals and build options. Take pride in your work ethic. Instill this habit into your kids. I know my children will be fine simply because I teach them work ethic. That alone will put them ahead of most of their peers.

There you go. That is the big secret to being successful. Spread the word.

George Zimmerman: Not Guilty In Trayvon Martin Case

2013-07-14T05:03:00.000-07:00

As the old adage says, the jury is out. George Zimmerman was found not guilty for murdering Trayvon Martin in a case that we have been force-fed by the media for the past year. During that time, an estimated 16 thousand or more other people were killed in the United States and there were about 2 million emergency room visits due to assault, according to homicide statistics from cdc.org.

Why are we hearing more about this case? Some would say it is due to the possible race or racial profiling implications that may have been involved. Do I think it was about race? I have no clue, but that really doesn’t matter. If the media says it could be about race, people watch it, ratings increase, and the networks drag it on until the horse is dead, buried, and in horsey heaven.

It may very well have been about racial profiling, but it could also have been about someone dressed like they were up to no good and physically assaulting an armed neighborhood watchman. I don’t care what color you are. If you beat me up while I am volunteering to protect my block from bad guys, I might shoot you.

mediamatters.org

In even greater news, Geraldo Rivera was looking especially authoritative in his report on the verdict this morning. I have also received confirmation that his legendary mustache is indeed controlled by the strings attached to his eye brows and disheveled hair – thus adding to the suspicion that Geraldo’s mustache is actually the real television personality and the rest of his face is just a necessary vehicle for success. Another fun fact: Geraldo is 70 years old! Who knew?

-BCS

(Trayvon Martin, George Zimmerman, Murder, Not Guilty, Acquitted, Geraldo Rivera)

Make them Legal! Why not?

2013-06-25T16:12:00.002-07:00

wilsoncenter.org

Many of you have been following the “gang of eight” and the new immigration bill that is making its way through Congress right now. I have been trying to read the details of the bill from both sides, just to make sure I am getting as much of the information as possible. I find that I have to do that these days in order to cut through the political bias that the media pours on us.

Getting back to the topic, I want to provide a little bit of my personal back story on this issue. As many of you know, I am conservative. That said, my initial reaction shouldn’t be too much of a shock to anyone. I was completely appalled by the idea of making all the illegal immigrants legal, which was the main focus of the bill from the start.

Eventually, I took the time to really think about what that would mean. The biggest argument for immigration reform is that the illegal immigrants weren’t paying taxes, yet were draining from our budget through social programs and the prison system. Don’t get excited at that last remark. I didn’t come up with the idea.

So it finally dawned on me – the illegal immigrants would become legal and have to pay taxes. Isn’t that a success story? Doesn’t that solve the biggest problem? The only other major issue I can think of is the sudden saturation in the market when it comes to low income jobs. I am no economist by any means, but if more people are making more money and putting it back into the economy, isn’t that a good thing?

If the illegal immigrants become legal and have the ability to make more money for their skills, couldn’t that bring the trades back? That is an issue that I have been passionate about for years.

What do you guys think? This is only my analysis of the bill when it comes to the legalization process. As I find time, I will try to pick through the other parts of the bill.

- BCS

4 Proven Ways to Make Money Online

2013-06-07T00:16:00.000-07:00

Many people who read my blog have asked me about making money online (other than blogging). I have done quite a bit of research on this topic over the years, and I have found 4 proven ways to make money online.

1. Do you have any skills that others may be looking for? Elance is a wonderful website for selling your talents to others, to include writing, bookkeeping, secretarial work, music, web design, and even voice acting. If you have any gifts or skills at all, Elance has a way for you to market them. Check out my article on easily and quickly writing research papers here.

2. Do you have old junk around the house? Maybe you like to frequent garage sales, thrift stores, or flea markets. Put you treasure hunting skills to good use by selling those great finds on Ebay. Another thing that many people do is buy store items by the truckload or pallet to sell individually on Ebay. There are plenty of websites that offer pallet or truckload purchases, but one that I have used is Merchandize Liquidators.

3. Are you crafty? Do you make jewelry, clothes, or other knickknacks? If so, Etsy is the place for you. On Etsy, if you can make it, you can sell it. I have personally seen people start selling their little creations (in this case, personalized aprons) on Etsy and turn it into a booming online business.

4. Finally, there is a whole lot of money on the internet for gurus of any sort. If you know how to do something, make an instructional video on YouTube or post your knowledge on the web with a blog.

If you haven’t already, check out my other posts on 12 Steps to Make Money Online Easily by Blogging and 9 Reasons to Use Google for All Your Blogging Needs to learn more. They go in-depth about blogging with Google's Blogger, marketing with Google+ (and other tips for SEO), and Adsense.

Thank you all for reading my 4 proven ways to make money online. As always, if you have any suggestions, questions, or comments, please feel free to use the comments section down below.

Oklahoma Tornadoes: What THEY Want You to Feel

2013-05-25T17:36:00.000-07:00

news.yahoo.com

First, I want to say that I feel deeply sorry for all of those people who lost their loved ones in this horrible tragedy. I have and will continue to pray for the comfort and resolution needed to deal with that sort of loss.

I have been watching the news quite a bit lately (as always), and I have been very surprised by some of the ways that the media has tried to spin public interest. When did we get to the point that we needed the media to tell us how to feel about a devastating tornado or other tragedies?

When I was watching CNN about two days ago, I saw a woman come on and complain about FEMA. She said that the money that people would be getting from FEMA would be better used to build storm shelters for each home. She at least pretended to think it was wrong that the organization would help people rebuild their houses without providing them the added benefit of something they didn’t have before. Would insurance cover it? Why should FEMA be responsible for upgrading your home? Is it their fault that you didn’t build some sort of shelter the last time a tornado hit? Is it the tax payers’ fault? If I were involved in something that catastrophic, I would hope to think that I would be grateful for anything I got.

Another thing that the media has forgotten to talk about is insurance. If you live in a place that constantly has natural disasters, you should probably invest in it. I don’t want to sound cold, but if you decided not to cover yourself with homeowner or rental insurance in order to save a little bit of money, I consider that irresponsible and I have a very hard time feeling sorry for your material losses.

Later on another broadcast, the anchors were talking to an expert of some sort (probably simply survived a natural disaster at some point in their lives) and asked why the state or local governments did not require storm shelters or storm cellars to be built for every home. Really? Now you want the government telling you another criterion for living your own life? Just take your FEMA money or insurance claim and build one yourself. That is what I would do (aside from moving). If you feel like your insurance company is trying to cheat you out of money after filing a claim, you should probably get a good attorney (they already did).

Why is it that during and directly after the tornadoes, the major cable networks were pretending to be talking to the actual people on the ground during the coverage? They said things like, “Please take cover and protect your families” and “Do not go outside for any reason.” Did anyone else recognize the false show of support that the news anchors were showing toward people without working electricity to power their televisions? Some people didn’t even have natural gas to warm water or anything. They did the same thing with the flooding that happened the next day. We see what you are doing there, news guys.

What do you guys think about it? Am I going overboard here? Does anybody else notice that the media capitalizes on tragedies in order to increase ratings? Let me know in the comments section down below.

9 Reasons to Use Google for All Your Blogging Needs

2013-05-21T08:30:00.000-07:00

If you are thinking about starting a blog, it is very important to research and plan your product. There are many vendors and platforms out there that offer blog hosting, but none can match everything that Google is willing to offer. Keep reading for 9 reasons to use Google for all your blogging needs.

1. Blogger: Google’s Blogger is very easy to set up for beginners. The step-by-step wizard makes the initial layout a snap. The best part is, it is also powerful and flexible enough for the advanced bloggers, which can save you future migration headaches. There are also many add-ins available to make your blog more unique and gain traffic.

2. Adsense: If you have done any research on blogging for profit, you already know that Google’s Adsense is a must. Setting up Adsense to work with Blogger is easy by design to encourage new bloggers to use as many of Google’s features as possible.

3. Google+: One of the easiest ways to gain traffic on your blog is to incorporate social media into your marketing and promotion plan. The good news – Google has that covered as well with Google+, which is constantly gaining popularity. Similarly to how Facebook was considered the “mature alternative to MySpace” at one time, Google+ is becoming the more mature and professional alternative to Facebook. Additionally, Googe+ already has many communities for research, discussion, and collaboration purposes.

4. Gmail: Almost everyone already has a Gmail account. When used with other Google applications, Gmail gives you the ability to have an email account that is directly tied to your blog, advertisement platform, and social media outlet. It gives you the professional appearance of having a specific account for your blog as well.

5. Hangouts: Google’s Hangouts is a new feature of Google+ that allows you to collaborate with other bloggers or even your readers through text, voice, and video chat. Just imagine having the capability to hold chat sessions with your audience to discuss issues, let them know more about you, or even make suggestions about your content. Google Hangouts is the ultimate way to stay connected to your fans.

6. YouTube: If you are anything like me, you might also be interested in trying out a video blog (vlog). With YouTube, you can set up your own channel to talk about whatever you desire. If you are smart, you will also use YouTube (with Adsense) to promote your blog and use your blog to host links to your YouTube videos.

7. Cross-Authentication: One of the biggest advantages to using Google applications is the cross-authentication. When you log into one Google product, your credentials pass on to the next application. This saves you time and effort associated with creating, maintaining, and remembering multiple user accounts.

8. Search Engine Optimization: Many bloggers and webmasters spend so much of their time trying to figure out creative ways to get their blog to the first page of Google. Luckily for you, your blog is already hosted by them! In other words, they already see your blog – something that can be difficult to initiate, otherwise.

9. Cost: What is the absolute best reason to use Google applications for your blogging endeavors? You probably guessed it already. Google applications are free. You can’t beat that with a stick.

As you can see, there are quite a few reasons to use Google for all your blogging needs. If you have any questions, comments, or suggestions about getting started or making the switch, please feel free to use the “comments” section below.

-BCS

5 Simple Steps to Get the New iPhone for FREE! (Seriously)

2013-05-20T06:43:00.002-07:00

original photo

What do you guys do with your old iPhones? What if I told you that I have always had the newest iPhone and I only paid for the first one? If you have AT&T, you could upgrade to a new iPhone for FREE by following the 5 simple steps below (and maybe even get a good case for it, too)!

1. Check to make sure that you are eligible for an upgrade by logging into your AT&T account or calling customer service.

2. Look on eBay to make sure a FACTORY UNLOCKED version of your current iPhone is selling for $200 or more.

3. Go to the AT&T or Apple Store and upgrade to the new iPhone.

4. As soon as you get home from the store (don’t talk and drive), call AT&T and tell them you would like your old iPhone UNLOCKED. They might give you a link to a website that doesn’t work and takes weeks. Tell them, “I have tried to use the website many times before and it has never worked for me. The last time I tried to do this, the person told me to just call from now on.” They should do it for you the same day and give you instructions on how to unlock it. If not, you may have to do the website thing and wait a week. (Note: AT&T will not unlock your iPhone if it is currently being used on your account. You have to upgrade first.)

ebay.com

5. When your phone is unlocked, sell it on eBay (if you have never done this before, CLICK HERE to learn how!). I always say free shipping and avoid international buyers, but that’s just what works for me. I also set the reserve to just under what you expect to get ($200 or $250 in this case. Try not to get greedy). The key is to get the payment for your old iPhone as quickly as possible. Since you already spent the money on the upgrade, think of it as a 100% rebate! (Note: If you plan on doing this again, SAVE YOUR BOX! iPhones sell faster, easier, and for much more if you include the original box and accessories, especially close to holidays.)

That’s it. I have done these 5 simple steps to get the newest iPhone for free for every version of the iPhone (except the iPhone 3GS, which I never owned) and it has worked for me every time. A few years ago, AT&T made this process much easier when they started unlocking phones. Before that, we had to jailbreak and unlock them ourselves.

If you have any questions or other methods of performing this awesome process, please let me know in the comments section below!

- BCS

Link Between IRS "Scandal" and Obamacare... Really Guys?

2013-05-18T05:58:00.001-07:00

photo from netrightdaily.com

Until now, I haven’t said anything about the Internal Revenue Service issue going on right now because I haven’t really had an opinion. What they were doing was clearly wrong and someone should be punished. Obviously, the key leadership who really ordered or influenced the headache that was served to Tea Party political groups will not be tried or punished. We have scapegoats for all that. Unless the people being questioned have real political ambitions, I seriously doubt they would take it upon themselves to play in the political game of thrones.

Now we have conservatives like the Minnesotan representative, Michelle Bachman, trying to tie the IRS issue with Obamacare. Suddenly, I have an opinion on the matter.

First, I want to apologize to the Associated Press about my comment on their Twitter post “GOP hoping scandal over IRS will grow to include Obama's health care law”, where I claimed that it was the most ridiculous thing that they said yesterday. I thought at the time that it was just a liberal political stunt, aimed at making the members of the GOP look silly. Thank you, Ms. Bachman for stepping up and taking that responsibility head on.

If any of you didn’t know, my political views sway to the left.

I don’t like Obamacare. That said, the supposed tie between the IRS “scandal” and Obamacare is Sarah Ingram, who used to be the commissioner of the tax-exemption department of the IRS. In December 2010, she was laterally transferred to head the Affordable Care Act office, but has openly indicated that she worked both positions until 2012.

photo from riehlworldview.com

I did some research on the topic because I didn’t understand what the IRS had to do with Obamacare. I found out that the IRS is responsible for collecting income information from their tax activities and forwards that information to the people who enforce Obamacare.

I really don’t see that much of a link, other than she now collects income information and forwards it. I think this tie is a stretch, at best. So far as I can see, the position she holds doesn’t have much influence on Obamacare legislation. She was simply in charge of formulating and executing a plan to deal with the legislation.

This example comes to mind: I am in charge of an organization’s computer helpdesk. Corporate releases a new information security policy that states all systems will be scanned weekly for personal photographs and my supervisor asks me to find a feasible way to make the requirement happen.

Later on down the road, it is suspected that someone on the helpdesk has been stealing company-owned computer keyboards and an investigation ensues. Someone who doesn’t like the corporate security manager or their new security policy sees that I was in charge of the helpdesk and also worked to make sure that the corporate security policy was executed as ordered. They try to formulate a link between the stolen equipment and the security manager in order to attack them.

photo from georgiapoliticalreview.com

Am I getting this all wrong? Even though I find value in following politics, sometimes it just makes me sick.

Now the Tea Party is suing the IRS for maltreatment. I’m not surprised about this and I don’t think it is really a story. The only reason I am mentioning it is because the media thinks it adds more drama to the situation. If anyone else was put through the ringer in this way, they would probably sue as well. I would if I could afford the legal fees.

Let me know what you guys think. I always welcome feedback, even if it contradicts my opinion.

- BCS

Force Feeding and Hunger Strike at Guantanamo Bay (GITMO)

2013-05-17T12:27:00.001-07:00

One of the biggest stories right now has to do with the prisoners at Guantanamo Bay, Cuba. According to an article in the Miami Herald, the prisoners are striking due to mistreatment by the guards.

Some examples of this mistreatment provided are the confiscation of personal items (such as Religious CDs, personal letters, blankets, and hygiene items), and disruption or disrespect during prayer times. Their books and Qur’ans have been searched for paraphernalia and their exercise times have been reduced significantly.

At the time of this writing, there are currently over 100 prisoners participating in the hunger strike and 30 who are being force-fed.

An attorney for some of the prisoners has described the situation as being “barbaric” and says the prisoners are being treated unfairly and that these innocent men are being denied the right to die (instead of continue to endure the conditions).

Dr. Gerald Thomson, former president of the American College of Physicians goes on to describe the force-feeding as a form of torture.

I am just trying to sum this up for any of you that aren’t already following the story. Let’s take a minute to talk about the history of force-feeding:

- In the United States, people being treated for psychiatric or eating disorders are often force-fed. When this happens, everyone just calls it sustaining life.

- Hunger strikes throughout history (all over the world) have resulted in force-feeding.

- On December 6^th, 2006, the United Nations War Crimes Tribunal approved the force-feeding of Vojislav Šešelj, a Serbian politician who was being held and refusing to eat. In their statement, they said it is not “torture, inhuman or degrading treatment if there is a medical necessity to do so...and if the manner in which the detainee is force-fed is not inhuman or degrading.”

- The Connecticut Supreme Court authorized force-feeding for a prisoner who refused to eat voluntarily in the 2009 case, Lantz vs. Coleman.

- The “shoe bomber” terrorist, Richard Reid attempted to perform a hunger strike in 2009 and was force-fed.

My first reaction to this story was simple – offer them food three times a day and if they don’t eat it, that’s their problem. Then I saw the political issues behind that idea. As soon as someone died or word got out that prisoners were going hungry, there would be a public uprising.

Here is how I see it now: if someone is refusing to eat, they are probably suffering from some sort of mental issue (psychosis, an eating disorder, dementia, retardation, etc.). In that case, the only responsible thing to do would be force-feeding them. That is how the medical world treats these issues, and I stand behind their judgment.

When it comes to the confiscation of their personal items or limitation of exercise times, I have one thing to say. They are prisoners. They are there because they are either being detained or punished for their participation in terrorist activities. These aren’t purse snatchers or money launderers here – they are terrorists. Stop trying to give them rights that they don’t deserve.

Let me know what you guys think. If you are influential enough, you might change my mind (but I doubt it).

- BCS

References:
One Hundred Days of Hunger Striking at Guantanamo http://dissenter.firedoglake.com/2013/05/17/one-hundred-days-of-hunger-striking-at-guantanamo/
Force-Feeding Facts http://en.wikipedia.org/wiki/Force-feeding

Case of the Missing Mayan Pyramid

2013-05-15T07:19:00.000-07:00

It sounds like a Nancy Drew title, but in case you haven’t heard, this really happened in Belize this week. According to reports, a road building company demolished the pyramid named “Nohmul” to use the material for filling roads. Historic and tourism communities are “outraged” by the episode, but apparently it isn’t the first time this has happened.

Imagine that you are on vacation in one of the most beautiful parts of the world. You are taking in the sites and doing your very best job pretending to be fluent in the native tongue. Suddenly while posing next to a historic landmark, bulldozers and backhoes drive up and start tearing it apart. That would be quite an experience.

The fact that they are using the remnants of the pyramid for road construction seems like something out of a bad novel or political cartoon. Could you see something like this happening in the United States? The Statue of Liberty is made of about 62,000 pounds of copper. In today’s market, that would go for a little over $225,000US and the steel would add about $30,000US to that(Valia Blogs). Wouldn’t it be crazy if some random construction contracting company scrapped the statue for its building materials without any warning or coordination?

I just thought this was an interesting story and I don’t know how it could have happened. You would think that someone who lived in an area with so many Mayan sites would have either the intelligence to know the difference between a random hill in the middle of flat landscape and a pyramid. Either that, or they would have some sort of pride in their history..

What do you guys think? Let me know in the comments section down below.

Photo from cbsnews.com