Coke's Security Blabber, Political Lies and Extra Cheese

NFL HOF Inductions

noreply@blogger.com (MCoke) — Sun, 08 Aug 2010 00:31:00 +0000

Just a couple interesting stories to link to. The first, if you are not an avid NFL fan (more specifically a Cowboys or Giants fan) you won't remember this game and the demonstration of toughness on the field. More amazingly was the ability to actually play with such an injury AND play at an all-pro level. Snce Emmitt Smith is going into the HOF this weekend, I thought I'd post the link to this story. Dallas Morning News story: http://bit.ly/cisrKU

And being a Cowboy's fan, I still give big ups to Russ Grimm and the Hogs. You can tell how good a team/someone is when your favorite team is one of their big rivals. Their greatness is in direct contrast to how much you scream at the television. The more you scream; the better the player and team is. The Redskins, Grimm and the Hogs had me screaming a lot back in the day. Washington post story: http://bit.ly/bFtmQb

A great HOF class this year with Jerry Rice, Floyd Little, John Randle, Rickey Jackson and Dick LeBeau.

Overheard

noreply@blogger.com (MCoke) — Thu, 24 Jun 2010 23:23:00 +0000

Sometimes you innocently overhear the darnedest things...

Today I was standing in line at one of the nationwide chains of office services and supplies, that will OBVIOUSLY remain nameless, when I hear the lady in front of me ask the cashier if the company "deletes all of the documents" form their printers, faxes and copiers.

Well, it seems the one asking the question, though a great question, did not really understand what they were asking anymore than the cashier knew how to answer it. The cashier's answer was that they (the nationwide retailer) were on a network and that they could delete what they print from the printers through the network.

The customer then asked if the actually do delete the documents as she was worried in case they disposed of the printers or sold them.

The cashier stated that yes, she deletes things that she prints all of the time when she is printing.

Customer is satisfied and walks away happy with the answer!

Okay, so many of you get the picture. The customer must have heard form a friend or in reading something that data can be stored on various peripherals after the copies are made, faxes transmitted or the print job has been picked up. This is true of many devices and I have found many documents available to me as I scanned, prodded and poked these devices at various places of employment and engagements. I have seen sensitive documents that no one had a clue remained on the devices. Many of these were personal in nature (I never read them fully as I get embarrassed for the person and feel once I have determined that the doc probably should not be stored there that I am finished with the document). I can tell you I have seen bank statements, various attorney/client private docs and personal budgets. Not to mention the files of the employers that may be of a sensitive nature.

It was always interesting trying to convince the admin responsible for the printer administration that the documents are actually stored there and that in most of these cases there was also an underlying default install of an operating system with a web, ftp and tftp server just for starters. A couple times I dropped netcat/cryptcat or a port scanner on the devices so that I could then begin to scan the admins box or create some other traffic so that when I approached the admin and had him/her look at the network traffic coming to his box and the source IP address I really got to have a moment of good humor when the realization struck their face. Forensically, you can be certain that data is there for a long time!

I will add more on this later this week; I know it is an old subject; but given that I heard that short conversation today, I just had to share quickly and will need to pull out some of my old "do's and don'ts". To state the moral rather succinctly; "beware from where you print and copy!".

A Few February Thoughts

noreply@blogger.com (MCoke) — Tue, 02 Feb 2010 18:46:00 +0000

Haiti. Wow, I cannot even say anything there after all this time. Do what you can for them, give whatever you are comfortable giving and pray a lot.

I am a conservative "USA" type of guy; but when the world bleeds, we all do in these tragic situations. We mourn their losses. This one is not far from the US shores either, so logistically, we as a nation can help as much as anyone. Things are still a mess down there trying to get aid to the right places and help the right people; those with the most need. In talking with people lately I agree, there is an opportunity here to replace a lot of the infrastructure there to modernize it, and also give jobs to the people of Haiti in planning, designing and doing the work. This could make a lasting economic impact leaving a road open for further economic development and opportunities that were not present prior to the terrible earthquake.

Also, here is the link for the Red Cross on Facebook. Quite a lot of information flow from Haiti. Oh, I should say that is the "American Red Cross", just so I am accurate.

Well, the answer to the question here in the US is "Saints by Six". If Freeney were even 80% I might go the other way; but he is that much of an impact player that I am afraid the Saint's offense will be far from neutralized. Brees will just have too much time. I do think Peton Manning will find his share of success as well--no great prediction there as he always does. I guess the next question for Sunday night is regarding which company will have the best/funniest commercial. That question remains for now. Good luck in your office pools.

I guess in the Six Nations, France and Ireland are the favorites; but I will pull for Scotland anyway as my long-shot bet on the rugby pitch. The big match is 13 February as Ireland and France meet-up.

That is all for today. With playing Mr. Mom while the wife is in the hospital and me not feeling great the past couple weeks--keeping this brief. I will write a new post covering disaster preparedness in the next couple weeks. I just wanted to finally get the thoughts on Haiti posted . Will pick my winner for the best Super Bowl commercial in my next post.

Happy New Year to All - Popular Resolutions

noreply@blogger.com (MCoke) — Sat, 02 Jan 2010 18:13:00 +0000

I am trying to think about what the most popular resolutions are that people make at New Year's. I figured I'd try to take a crack at a Top 10 List. So, here is my shot. The Top 10 Resolutions for '10! Oh, one thing that came to mind in regards to this; but was not a resolution is that people qualify things as "lifestyle changes" as opposed to resolutions. I am not sure why they think that aids in the success.

Top 10 Resolutions

Loose weight - eat healthier
Get into an exercise routine
Be a better spouse/parent/sibling/child
Attend church more regularly
Start a stamp collection (Okay, actually start a hobby)
See a doc about that embarrassing "problem" (or finally see a doctor in general)
Lay off the booze. This one is normally made on New Year's morning.
Get to work earlier/Get home earlier
Travel more/less
donate or volunteer money, time, blood...whatever it takes.

Of course my suggestions of a few worthwhile places to find out how you can help are:

The American Red Cross
Hackers for Charity
Angelus Academy
Wounded Warrior Project

So, does anyone have suggestions for other common resolutions; or even off-beat ones they have heard.

Happy New Year!

Sometimes These Are the Good Ole Days

noreply@blogger.com (MCoke) — Sat, 13 Jun 2009 21:01:00 +0000

With all the articles the last couple days on security and social media (web 2.0, or whatever!) I thought I'd pass this along.

I was thinking back to a couple nights ago and having a chat as I watched the NBA finals game 3. I was chatting with my brother-in-law Mike (who is on Afghanistan) and he was watching it as well-though it was well before breakfast for him). It was as though we were watching the game together.

'Wow, what a shot!' 'Where was the call!!!!' Instant back and forth between us.

Having Jeff over in Iraq call his father's cell at the hospital just about the same time Gillian was delivering Lliam was great, and then to get to talk to her and hear his newborn son making noises--pretty awesome. And Jeff gets to talk to Gill very frequently as well. I can recall as a kid when my father was in Vietnam, we did not hear from him too regularly except through a tape now and then and a letter (sometimes frequent and sometimes sporadic).

So, I thought to myself, 'self, tech is really cool'. These are really small examples of the social media and of course, tech has made many more advances in other areas that are leaps and bounds beyond these. All-in-all, today is a good time to be alive.

Oh, and Mike, thanks for watching the game with me.

Social media benefits trump security fears

noreply@blogger.com (MCoke) — Thu, 11 Jun 2009 19:59:00 +0000

Social media benefits trump security fears

Posted using ShareThis

A Usefule Site...That is My Opinion Anyway.

noreply@blogger.com (MCoke) — Sat, 06 Jun 2009 17:40:00 +0000

TECH

Just an opinion for folks that read this (thanks mom), and have not discovered this site.

Here is my favorite website of the last year or so; LifeHacker. Mostly tech oriented; but a lot of it is a collection of things to help you on a daily basis in life. An example would be a current post on "Ditch Crunches for Push Ups and Save Your Back".

For Windows users, they did just put out a download for their Lifehacker Pack 2009 collection of useful "FREE" utilities. Make sure to read the comments because there are lot of great thoughts added by the reader.

Oh, and one for us OS Xers with Macs lying around as well as Windows & nix: Virtualize AND Dual-Boot the Same Windows on Your Mac. Here is an oldie; but still a goodie, BONUS! Free Up Hard Drive Space on Your Mac

Cheers all!

And a HUGE "Thank You"!

noreply@blogger.com (MCoke) — Sat, 06 Jun 2009 15:52:00 +0000

D-DAY

A big "Thank You", to all the men and women of our military and their families.

Thank you today for the job you do in keeping us out of harm's way. Thank those that served before you with special remembrance of those that 60 years ago today landed on beaches in Normandy with codenames such as "Utah" and "Omaha". Thanks to those that also parachuted in behind.

Thank those that have served from Valley Forge to Gettysburg, from Tripoli to Germany, Italy and places unknown and unmentioned. Thanks to those that serve in the middle of the deepest oceans keeping our submarines on task 24/7/365 to deliver their mission when needed. Those that kept a plane inm the air at all times during the Cold War. Thank those from DaNang, BenHoa, the frozen Korean peninsula and the deserts of the Iraq and Kuwait and the mountains of Afganistan. And those that serve back in the states and those that did not make it back to the USA.

Please thank your families for us as well. I saw my mother and other families deal with the separation and worry back in the Viet Nam era.

Prepare Your Home and Family

noreply@blogger.com (MCoke) — Sat, 06 Jun 2009 08:03:00 +0000

DISASTER

Prepare Your Home and Family

Shared via AddThis

And Now One More Time for 2009!

noreply@blogger.com (MCoke) — Mon, 01 Jun 2009 14:34:00 +0000

DISASTER

It seems appropriate that after a long period of down-time, that I would follow my last posting on "Tornado Preparedness" with one one regarding Hurricanes. Yes, it is that time of year again. It is the official beginning of hurricane season in the northern hemisphere. So this is my annual message/reminder on the topic.

Below are some resources to help you be and stay prepared. First is a link to the American Red Cross site for the start of the season and how to be prepared:

http://tinyurl.com/ljj962

More preparedness tips on ready.gov:

http://tinyurl.com/5rjd7b

For more info on hurricanes themselves, check out the howstuffworks site:

http://tinyurl.com/bqpbn

So, keeping this somewhat brief, I have given you a few sites that should cover most of your preparedness needs and provide checklists so please check them or similar resources.

TIP: Make certain you have an emergency AM/FM radio and plenty of water! (This from the little bit of experience my family had.) Oh, and gather-up plenty of things to occupy your young children's time. Anything to keep young ones minds and hands busy so they can take their minds off of things for a moment and not be too bored either.

Stay ready!

Happy St. Tornado Preparedness Day!

noreply@blogger.com (MCoke) — Tue, 17 Mar 2009 13:40:00 +0000

Seriously, to those of you celebrating St. Patrick's Day:

"Sláinte chuig na fir, agus go mairfidh na mná go deo!"

or, "health to the men, and may the women live forever"

(I do have a dog named Guinness and there is a picture of me somewhere on the internet by now under the likely title of "Guinness Fairy", so I was obliged to get that out there.) Well, on to the original purpose here. It is American Red Cross month and today is Tornado Preparedness Day here in Virginia. Disaster Preparedness season never ends or takes a holiday. Take a moment to go through the checklists to make certain your family or business is prepared or you have prepared your family. Look at the Red Cross site and the FEMA sites as well. Find the resources beyond tornadoes for disasters that may suit the geographic region for the dangers you face. Earthquakes, hurricanes, floods, fires (home and brush/forest), theft, crazy third-world dictatorships, you get my drift.

Do not forget for your home and business to make certain you have properly identified your critical assets, updated all critical disaster response processes and policies for data backup and restore. Perform a business impact analysis, defined business continuity and contingencies. For getting a risk assessment initiated at a business enterprise level, the Carnegie Mellon CERT's OCTAVE approach to Risk Assessment may assist you quite a bit. There are courses offered as well (I get no kick-back!. I have taken the course and find it very-worthwhile, so I am suggesting it as an option).

Again, the Red Cross has some links and documents that can help pull all this together as well.

We could go on about this stuff for weeks; but I have given you some important resources at least. You can always shoot me a comment to further discussion. I may get motivated and add a checklist of my own, or two! Send ideas. And least I forget, I know the good folks over at SANS have papers and checklists on the subject of DR/BIA/COOP on their sites as well, so check them out (Again, I get no kick-back; but they do have classes, and I have taken many of them that are absolutely first-class - excuse the pun!).

Sláinte!

Pesky Malicious Antivirus Under the Scope

noreply@blogger.com (MCoke) — Mon, 16 Mar 2009 17:59:00 +0000

I just wanted to point to another nice piece of reporting and analysis today by Washington Post columnist Brian Krebs. Having had to scrub this malware (or virus) from children's and 'friend's' computers alike, it is a story about something I find interesting as well. Please check out the link. (Photo credit: www.polyvore.com)

Massive Profits Fueling Rogue Antivirus Market

In the cyber underworld, more and more individuals are generating six-figure paychecks each month by tricking unknowing computer users into installing rogue anti-virus and security products, new data suggests.

One service, that exemplifies a very easy way these bad guys can make this kind of money is TrafficConverter.biz, one of the leading "affiliate programs" that pays people to distribute relatively worthless security software. Affiliates are given a range of links and Javascript snippets they can use to embed the software in hacked and malicious Web sites, or tainted banner advertisements online...

Full Story

Common Sense has Left the Building

noreply@blogger.com (MCoke) — Mon, 09 Mar 2009 14:27:00 +0000

There is a rule in the Virginia High School League that states basically a player cannot move within a school year from one place to another and be eligible to play sports. (I am going to at the end, bring this into a perspective from my job in information security and policy and former work in law enforcement and even accounting.)

Well, I understand all the cheating that has gone on for years and why the rule was put in place. Somehow the "spirit" of the rule was lost long ago. History in case you did not know: that it is to prevent a student/athlete from going to one school to play football and another to play baseball or for switching schools because of being recruited by coaches. I have through the years heard the stories of the "Aunt" having a house rented for her and the nephew coming to live with her in the new school district that just happens to need a defensive lineman. 'What, this boy plays DE and is 6'5", 270 and runs a 4.5 as a sophomore!!! And he just happens to move into the neighborhood. What great fortune!' ;-) We can see these issues and know why this rule was written:

"Transfer Rule – You must sit out of VHSL activities for 365 calendar days following a transfer to the school unless the transfer corresponded with a family move into the school attendance zone."

There is a bit more regarding Freshmen and the like; but it is not pertinent here. In the case of our son (my step-son) my wife had some medical issues and my son thought he'd like to go stay with his dad for a little while (in another school district about 15 miles away--not possible to drive him to the same school as his father also commutes to work about 50 miles in the other direction). So, at the beginning of the school year, he was enrolled at a different school in the same county of Virginia for what ended up being five weeks. He moved back to our house as his mom's condition stabilized, he was missing his family, his friends and his old school. He never participated in any sports or even meetings at the other school.

Now, keep in mind, the whole purpose of the rule is to keep schools from gaining an unfair advantage and recruiting players, etc. The rule is strictly to keep sports at level playing fields. Also, it is to the benefit of the child that they not be bounced around and used, obviously.

So, I submitted a couple letters, my wife presented a short letter, we gave two doctor's letters, a detailed account of one hospital stay (just in case some proof was ever asked I wanted to head it off), the guidance counselor at the current high school wrote a letter and I have had numerous conversations with the VHSL as has the student activities director and the principal. OH, AND, the Region in which my son plays in and both schools are located OK'd the transfer and have no problem with his participation on the team. No coaches at other schools have a problem. He was not recruited nor did he play any sports or have contact with coaches at either school during his time at away from the current school.

With all of this, they still want documentation that goes more in depth into the wife's medical issues and the home conditions and frame of mind of my son. My point is the VHSL rules basically have no room for any kind of looking at the spirit of the rule and seeing that this does not violate the reason which the rule was put in place. There are twelve exceptions spelled out. We only have wiggle room under the HARDSHIP exemption. That being the home life was a hardship on my son and he had to move. And then, somehow prove why he came back is still ambiguous. I am sure that will be the hammer to drop next. You are allowed one "free move" That was when he basically went to stay at his father's. So, we show that was due to hardship and show that was relieved five weeks later. Not certain how we prove why he came back.

I am dealing with the decision maker. For the life of me, why they do not have the discretion to simply say "I see your son is not one of the people this rule was put in place for, so I will grant an exception". (Remember; he did not even play sports at the other school! He was not an all-star last Spring. He played JV ball. He is still my favorite player.) As it stands now, because his mother was ill and basically he decided to spend time at his dad's to have a bit more stable home while attending school, he will lose a year of being able to play a high school sport. Nothing like being punished because your mother was sick. But let us take it a step further and move beyond my son. This is where I want to go. Why is it that if a child and parents decide he/she should go stay with one parent and for any reason to move back (with the same parties agreeing it is the best thing for the child) that the child should be penalized?

Why, if it just did not work out for whatever reason, should things be up to a state sports board to decide the future of a child. Missing a year of eligibility in a sport may mean missing some scholarship money or even just getting into a college. Let alone just penalizing the child for no real reason. One can clearly look at the facts and see that a child moved from one parent to the other parent. The child participated in no sports at the other school; nor did he participate in any organizational meetings. The child moved back and will be playing lacrosse at the school he played for the prior year.

So, I have been in courtrooms enough to hear a judge say, 'So, you ran the stop sign but there was a bee in your car and you were only distracted trying to get the bee out the window because you are allergic and panicked. Dismissed.' (True story. Though paraphrasing.) We took an inmate to court fro sentencing one time who was a walk-away from a minimum security prison who stayed out nearly a year. As I recall he faced an additional seven year sentence. While in prison originally before walking-away after transfer to the minimum security facility, he had learned to read, gotten his GED, apparently kicked drugs and alcohol and for all I remember brought peace to all the gangs in the prison (not).

In any event, he walked-away just before Christmas and his mother had fallen ill. He got a job actually somewhere in his old neighborhood making some cash in a store. Stayed out of trouble that year until he was final found and brought back in. Well, the judge gave him two years and six months with two years suspended (or close to that) credit for his time served on the six months which was running concurrent to the time he was serving anyway finishing the original sentence. Really, I think you have a high school student who has done nothing wrong held to a higher standard than an escaped convict. Not that I disagree with the judges decision.

I can go on and on with these types of stories most of which come down to an officer or judge's discretion and judgment.

In accounting, I do recall back when I did that for a living in the old days, if we were taking a conservative approach to something and could show why and justify it, then even if it was not to the letter of the regulation, we could still be justified in our approach. I never had an auditor disagree. You might have to walk them through it a couple times to understand; but as ling as they understood there was no advantage gained or to be gained (hey, you did not even play a sport at the other school); then there was not a problem.

In information security we deal with policies. The Information Security Policy states certain things where the business will come to you and ask that an exception be granted. Let us generically talk about a firewall policy stating that only http/https (web and secure web traffic) is allowed directly outbound to the internet from workstations. The business states that there is a workstation that requires the ability to transmit encrypted data over a specific encrypted TCP port to the insurance companies new program. The business group asks for an exception to policy. You gather your information to make certain the connection will be secure as well as the data. And, you likely go ahead and approve the exception. These are fairly common situations. We do not go into who the vendor is and why are we using them. Why are we not using this insurance company because we used them before, etc. (Hopefully we had a little due diligence along the way with selection and with the software upgrade requirements). This is way beyond the scope of our job and the need for a policy exception.

So, I am moving to start or be a member of the "Common Damn Sense Political Party" or the "Start Making Sense Political Party". Something like that. Some of this stuff is just absurd. If my party gets elected to party; if you do not make sense, I am bringing back the public square and dunk tanks, stocks, floggings and cotton candy! Funny I mention politics; because we all know that enters into some of these decisions too!

They said it; I didn't

noreply@blogger.com (MCoke) — Sun, 08 Mar 2009 17:28:00 +0000

How many times have we had similar thoughts:

http://sports.espn.go.com/espn/page2/story?page=simmons/090306

Q: My office is having a blood donation drive. All blood donors get two free tickets to an upcoming Clippers game. Do you think we should make clear to people that they DON'T have to actually go watch the Clips play? I would hate it if the Red Cross lost blood donors -- and innocent people died -- because they were threatened with going to see the Clippers.
-- Mike Wilner, Los Angeles

SG: Ladies and gentlemen, one more time, your 2009 Los Angeles Clippers!

A drum roll please.

A Real Trojan For You

noreply@blogger.com (MCoke) — Sat, 14 Feb 2009 23:19:00 +0000

Security Kabuki. Or as Bruce Schneier would likely label it, "Security Theater", so I will pay homage to Mr. Schneier as I further that theatrical theme. I say Kabuki as it is highly dramatized and the outfits (uniforms in many cases) are usually something to die for...or at least something that will scare you to death.

I have all the respect in the world for law enforcement, the Armed Forces, Coast Guard, anyone in public safety or service. Big ups. God Bless them. However, some of the processes appear to be more laughable than laudable. I witnessed something a couple weeks ago that brought a memory rushing back. Have been going to drop a blog about it as it brought back memories and kind of stewed and simmered in my cavernous skull. I'll likely break this into several posts so as not to make it too lengthy and sleep inducing.

I drove onto a secure government facility where I had official business during one of our periods of heightened alert. This means there were more people out front with more and bigger guns than normal. More vehicle searches, etc. So, here I come in my wife's minivan. Wearing the credentials of the group with which I am affiliated that has a building on the complex. I would be known as a semi-regular at the time I suppose. As I pull up in line for the semi-permanent checkpoint I am in one of two lanes behind several vehicles. I am out of coffee and becoming upset at that or myself for not filling a second mug.

So, bored and out of java, I begin to watch the folks in uniform and automatic weapons and their searching of the vehicles. I notice something interesting. Large trucks with lots of boxes in the back. The "Routine" after watching a couple trucks, seems to equal = man in uniform with weapon opens rear door, stares at boxes for ten seconds, pulls door down and secures. Sends driver on his/her way.

Okay, so, that is not the most secure process to witness (having worked in a prison early in my days and having had to get up in the back of trucks, open and move boxes for vehicles coming and going, I have an idea of how the process is suppose to go-not that prisons are all that secure; but more on that another time).

Next up, comes Sally Soccermom in her Volvo station wagon, well, certainly they are going to wave her through or only do the cursory review like with the trucks. Hmmm, they have Sally out of the vehicle. They are opening all doors. Opening hood and inspecting engine compartment. Well, where did that K-9 come from--he must have been in the German Shepard Port-o-John when the trucks were out here. Out of the back seat of the car come the two baby-seats onto the asphalt. German Shepard does a once through. And then another pass. Luckily no rubber gloves, hoses, etc. are used on Sally nor are any soccer moms harmed in the retelling of this event.

I witnessed about eight different vehicles with the same results. Being a security guy (and/or having watched a Holiday Inn Express commercial last night to gain some expertise), I begin to think the obvious; which is the bigger threat? Trucks filled with boxes - or a false-front of boxes; or the Volvo with baby seats. I just would not want the bigger delivery vehicle coming to the inner sanctum with just a wave. It is like the guys drinking the baby formula before getting on the plane to prove it isn't explosive; while lax security surrounds the physical access to the plane itself on the ground for maintenance. Maybe the process was correct and it is a people issue. How to motivate people to do the hard work and get their butts up into a truck where the real threats may present themselves. I am a big guy and I could have hidden a dozen of me behind the first row of boxes in each of the trucks. Or worse.

I could see doing everyone the same and that would not cause me to throw the penalty flag. K-9s and Volvo's and minivans?

Believe it or not, that one morning watching the trucks get the wave through has been repeated several times as I have watched security at other places. This fits with Johnny Long's book or No-Tech Hacking presentation from DefCon or Shmoo (Google if the link is dead). Perfect example of where to just sit and watch to find the weaknesses in systems to later exploit them for a penetration test. Only, it is a bit scary how many places you can observe this. And at banks. And at. Well, I'll stop. For now. It is late here. 00:45 (UTC -4:00).

It's Beginning to Look a Lot Like ...

noreply@blogger.com (MCoke) — Thu, 04 Dec 2008 02:23:00 +0000

...Okay, you got me. I was going to say "Christmas" as the song from Bing Crosby (WHO?) goes; but I stopped. Not because I was getting all PC and didn't want to offend or anything. More like I was thinking about President-elect Obama's cabinet announcements. It is all beginning to look a lot like the past. Don't know if that is good or bad truthfully. Just an observation that I have seen these folks before here in DC. I think change is maybe shuffling offices. That could work.

Of course they do say, 'the devil you know is better than the devil you don't' or something near that. Well folks; we are about to find out. The shake-up in Washington is to see if these ego's can all play nice together and accomplish something good. For the U.S. And for the sake of the World. My prayers go out to all of those who lost someone or had someone injured in the Mumbai attacks. Man the world is a tough place..

May we all not grow too tough dealing with it that we lose our sense of compassion for one another.

FEMA Releases On-Line Training Course For The National Response Framework

noreply@blogger.com (MCoke) — Sat, 15 Nov 2008 04:34:00 +0000

This was so worthwhile and I meant to mention it before. Now I needed to make a second post in the same day. Blasphemy I tell you! Good materials in here to help you prepare. I see that Californian's were busy preparing for a big shake just yesterday. Good on 'em!

FEMA Releases On-Line Training Course For The National Response Framework
Tue, 04 Nov 2008 23:00:00 -0600

WASHINGTON, D.C. -- The Department of Homeland Security's (DHS) Federal Emergency Management Agency (FEMA) today released the on-line IS-800.B National Response Framework (NRF), An Introduction training course. The NRF, which focuses on response and short-term recovery, articulates the doctrine, principles and architecture by which our nation prepares for and responds to all-hazard disasters across all levels of government and all sectors of communities.

This is a good jumping off point for getting involved in disaster response in your community. The Red Cross has others which may be more appealing to you and have a different approach. You may locate your local chapter of the American Red Cross at: http://www.redcross.org/donate/volunteer/ and then find disaster preparedness training resources at http://www.redcross.org/flash/course01_v01/.

Just Between Us, I think The Billion is the New Million

noreply@blogger.com (MCoke) — Fri, 14 Nov 2008 22:55:00 +0000

...Or maybe that is the Trillion is the new million. I have lost track. Heck, I have so much to rant about. I am a conservative. Yes, that means I am for peace through strength, smaller government, power to the states, drill here/drill now, judges who do not make law and good old fashion capitalism at its finest. Sink, swim, float or get out of the water. Or, maybe take a nice dip in a heated pool at an AIG exec recommended resort. After, maybe a massage with a happy ending--if you are throwing around the kind of dollars we have given them, I hope they are at least getting that. We are sure being jerked around.

I thought McCain taking off from the campaign to concentrate on the financial woes was going to be a winner. What did he accomplish? It was as soon as he caught a little flak from Obama about multi-tasking, he got all flustered and did not concentrate on the debate prep or the financial package. I guess he did not have his pork cutters with him for that package. Maybe Maverick needed to call Goose to bring them in. I think Joe the Plumber would have crafted a better package; and that is no slam on him-rather on congress.

Too much, okay. Sorry, I feel better. Not trying to be too political. I actually did not want to write while the election was going on as too many thoughts were in my head and I would have done nothing but had hands to keyboard.

Enough political blather for now, though I am sure that listening to the Russians will soon bring on some more form me at some point.

Maybe a little InfoSec in my next posting.

Let's be careful out there.

Been Down; but not Out

noreply@blogger.com (MCoke) — Tue, 12 Aug 2008 11:22:00 +0000

So, been a while. Just had some medical issues and have left my new, lame, little blog unattended. Many apologies to all of those who read this (um, I guess that would be you mom).

Been good though. Finished up coaching the youth rugby club. Having coached a range of ages at different levels of competitiveness, this season coaching one of my daughters U9 rugby squad was one of the most enjoyable. Seeing little kids running around with a rugby ball and learning how to scrum, etc. is just cool! Next up, lacrosse board meetings, etc. What a couple of great sports. Rarely do I see a youth who starts out playing either leave the sports.

So, an information security matter of sorts. I am polishing up my resume so I can apply to take the CISSP-ISSMP concentration exam. Man, let me tell you, there are just no resources out there for studying. I know it is no tthe most popular exam or credential in the world; but I figured after several years, someone had to write a book on preparing. I checked out cccure.org and isc2.org; but nada (as in nada darned thing!).

The exam is a management concentration and focuses on five of the ten domains:

The five domains of the CISSP-ISSMP CBK^® are:

Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) and Continuity of Operations Planning (COOP)
Enterprise Security Management Practices
Enterprise-wide System Development Security
Law, Investigations, Forensics, and Ethics
Overseeing Compliance of Operations Security

Now really, having passed the CISSP exam, I assume their to be more depth in these domains than was on the CISSP, as this is a "concentration" exam. My assumption is it was set up to delve more than an inch deep and maybe go a foot or a fathom! My point in all of this is simply that I would expect ISC2 to at least publish a book since they are the exam/credentialing organization. A little odd to me that there is nothing available.

Anyone knowing of a good resource for ISSMP preparation; please pass it along. Also, looking for any opinions of how the CISSP/CISSP-ISSMP and CISM all differ in your opinions.

Thanks. I will do better next time now that I am upright and breathing again.

Cheers.

Father's Day Ramblings from a Tired Father

noreply@blogger.com (MCoke) — Sun, 15 Jun 2008 21:26:00 +0000

Well, still not politics, or strictly InfoSec. This article in the Washington times made me ponder on a couple things.

One, the nature of securing the beast that is the mobile workforce. Where I work, I will not name explicitly (many who read this, both of you, will know anyway) - but is a large organization concerned with disaster preparedness, response and providing blood has some special concern around this. We must be flexible enough to provide connectivity away from the office and perhaps in the middle of a disaster. We also are required to protect the data and the biomedical computing environment. I will write more on the twists of these challenges in a later post. Suffice it to say, thinking about the needs of workers to connect while on travel or late night from home bring has a seismic shift over the years to the old castle/moat theory of a perimeter.

From a business standpoint I looked at the article below and thought, well, my boss does a great job of supporting these type of situations; but does everyone. I am a father of six, so I qualify as one of those people who have kids and special events during the workday to run to and finish my work day later in the evening. However, I have a memory from back in the old days where three of my friends, Bobby, Ellen and Dave, worked for the DoD. We were all young then and all single.

While my friends worked in this particular defense department division, as unmarried and childless, the threesome were tasked with near continual travel and time away from home. You could say they were burning out from it rather quickly. It was overtly noted (again, long ago - in a time when these things could be said) others in the office could not travel on the same heavy rotation because they were married or had children. 'You are single; enjoy your five weeks in Rock Island!' Hmmm...thanks. Many in the office were the same grade, but my three amigos were saddled with the burden of being gone six of eight weeks most of the time. I remember two of them at different times remarking to me that 'if we are always away from home, how are we to find someone to marry so we can slow our business travel'?

Enough of my meanderings, I just found the traveling of the unmarried friends running in parallel to the story in the Washington Times. I believe the story also is applicable to mothers as well as fathers. But if workers are allowed a bit of flexibility for their family events; are there any folks who are childless and finding themselves stuck at the office continually and not able to get in touch with co-workers during business hours? Just food for thought. Nothing meaty - just some extra cheese. Let me know if you have any stories.

Fathers finding work-life balance

Spending more time with their children

by Whitney Stewart

THE WASHINGTON TIMES
Sunday, June 15, 2008

On a sunny Friday afternoon, a tall man wearing a baseball cap and sunglasses skirted around a construction zone with his daughter as they headed to the Hard Rock Cafe for lunch.

Brian Kelleher, a Seattle resident, stays busy working as a self-employed recruiter for engineers, but last week he closed down shop to bring his 11-year-old daughter to the nation's capital for a leadership conference. He said he makes a habit of spending time with his three children - even when that means putting work on hold.

Read the full story:

http://www.washingtontimes.com/news/2008/jun/15/fathers-take-advantage-of-flexible-workplaces/

We Are in to June and That Means Hurricane Season (and politicians with another type of hot air)

noreply@blogger.com (MCoke) — Fri, 13 Jun 2008 03:00:00 +0000

Here in the U.S. June brings the beginning of the Hurricane Season. As something which I have an interest in from a personal and professional prospective, I encourage you to check out some of the links under my "Disaster Preparedness" heading. "Get a kit; Make a plan, Be informed"-- right? Get dry ice for the Guinness as well. Pizza place on iPhone speed dial. And more Guinness.

Heck, I speak of hurricanes here in the U.S.; but we are already seeing devastating tornadoes, floods and wildfires. People on the other side of the globe from my family have had to go through cyclones and earthquakes themselves of late.

If you get a chance, drop a donation to a worthy organization, volunteer in some way to help those in need even in your own community. There are many opportunities and ways to assist. (Begin Soapbox) Even if you can teach a class, fix a computer at a charity or senior center, coach a sport in your community or serve a meal in a free kitchen it WILL help in many ways. Your volunteering can free up others so they may volunteer somewhere their skills may be needed--possibly putting out a wildfire or helping disaster victims. Everything you do to help; HELPS! Every amount of money or time you can contribute helps incredibly. Just check out Charity Navigator if you are going to donate some hard-earned cash (End Soapbox).

So, that said, I urge you again to make certain you, your family, friends and business is prepared for whatever disasters might come your way. June, I thought was a good time to bring this up.

Let's be careful out there. Be safe and well.

-Coke