securityjones

securityjones.com: Picking the POTUS #1.1-Republican Debate No. 2

Thu, 17 Sep 2015 20:00:00 +0000

This is a quick follow-up to my first post on Election 2016, Picking the POTUS #1–A Voter’s View on Election 2016, to capture my reaction to the Second Republican Debate that was held last night.

On of the great things about the debate for me is that both my 17 year old and my 10 year old joined to watch and stayed pretty engaged (at least until bed time). Going from memory, I’m going to describe my reaction and takeaways for each of the candidates in roughly the order of impact they had on my opinion. I will to try to capture my impression first in a single word, then expand a bit. READ MORE

SFF Tales Review–Parley

Tue, 09 Dec 2014 23:11:57 +0000

Parley by Jamie McFarlane
My rating: 4 of 5 stars

Great example of the type of books that self-publishing has enabled for new authors. I can tell Jamie is a newish author, but really enjoyed the story and look forward to reading future books and seeing him develop further as an author!

Description: (Amazon synopsis, modified by me) After fighting space pirates and rescuing a damsel in distress, Liam and Nick want nothing more than shore leave at Puskar Stellar. But neither their newest crew member, Marny, nor the Mars Protectorate Navy is ready for them to spend much time relaxing. Their old nemesis, Harry Flark, has found a new mining station to pillage and this could be the perfect opportunity for them to finally take Flark down.

Read the full review details on SFF Tales: Book Review–Parley (Privateer Tales #3) by Jamie McFarlane

SFF Tales Review–Dragon Defender

Fri, 05 Dec 2014 15:01:07 +0000

Dragon Defender by J.A. Blackburn
My rating: 5 of 5 stars

I enjoyed this book and look forward to reading the next in the series. If you have a Middle Grade reader that like fantasy, dragons or adventures, this is a good series to start. Either way, unless you just don’t read books targeted at younger readers, I think fantasy enthusiasts will enjoy Dragon Defender.

A note about how I discovered this book since it didn’t come up in my recommendations. I saw J.A. Blackburn speak on a panel in Seattle (at the Central Library), where she talked about lessons she learned from writing and publishing her book. As part of that, she shared her “before” and “after” synopsis – the after is what is currently on Amazon and below – and I thought the book sounded like one I’d enjoy. I did.

Read the full review details on SFF Tales: Book Review–Dragon Defender by J.A. Blackburn.

Office Lens #MyFavoriteApp

Fri, 14 Nov 2014 16:11:44 +0000

It is sad that sometimes I don’t know about all of the cool stuff at Microsoft, even though I work here. This week, I was lamenting the need to scan receipts and mail them to myself when a friend say “why don’t you use Office Lens?” I said “what?” (snappy repartee is my thing).

Anyway, here is a blog that talks all about it on the Office blog: http://blogs.office.com/2014/03/17/office-lens-a-onenote-scanner-for-your-pocket/

And here is a quick video that demos it …

Unfortunately for Android and IOS users, it is only available on Windows Phone for now.

~ @securityjones

New Car Buying Tips – Lower Price, Don’t Pay MSRP

Thu, 30 Oct 2014 16:53:11 +0000

Recently, my wife and I decided it was finally time to say goodbye to the minivan and get a different family vehicle. I’m happy to say we were successful – my wife and I are very happy with our new vehicle.

Having bought several new and used cars over the past thirty years, I’ve had a range of negative experiences. Each time, I learned a small lesson and promised myself I would never make that particular mistake again. I thought it might be useful to share the step-by-step actions that I found useful.

In my previous post, “New Car Buying Tips – Pick Specific Models and Features,” I discussed the importance of knowing exactly which features were available and which were requirements for you.

Assuming you’ve done that and know which model and features you want – and preferably have some acceptable alternates in mind as well – then, the next step is trimming off as much cost as you can from the manufacturer’s suggested retail price (MSRP).

The least you need to know:

Do not go to a dealership before you have negotiated an acceptable price. If you don't want to negotiate for even more savings, at least go to truecar.com to get their negotiated prices for your local dealers.

Continue reading for all the details and analysis.

The Honda CR-V was recently ranked #1 for affordable compact SUVs, so on the assumption that this makes the CR-V interesting to many people, I will use it in my examples and discussions. I also strongly recommend that you have 2 or 3 alternate models in mind, so that you can negotiate between different manufacturers and leverage potentially better incentives since they are constantly competing with each other. For compact SUVs as ranked in the link above, for example, I like the look of the Honda, Mazda, Ford and Toyota options.

For purposes of this article, when I want to compare a second vehicle, I will use the Ford Escape, simply because I like the styling a bit more than the others.

In my first post, I identified my requirements for all wheel drive, leather seats and heated seats and found models that met them: Honda CR-V EX-L AWD (MSRP $29,950) and Ford Escape models SE 4WD (MSRP $30,295) and Titanium (MSRP$31,255). In a follow up post, I looked at the issue of dealer inventory, so I’ll use the Honda CR-V EX-L AWD and the Ford Escape Titanium as I look to find lower prices.

Truecar.com Guaranteed Savings

Truecar is a great repository of information, plus they develop relationships with your dealerships which enables them to give you a guaranteed savings off the MSRP from dealers near you.

NOTE: Guaranteed Savings represents the amount that a TrueCar Certified Dealer selected by you guarantees that you will save off the Manufacturer's Suggested Retail Price ("MSRP") on any in-stock vehicle that is the same make, model, and trim as your Ideal Vehicle. The Guaranteed Savings is based on a vehicle without factory or dealer installed options and includes generally available manufacturer incentives. Guaranteed Savings currently not available in all states. In these instances, a "Target Price" is presented, which is not an advertised price, but an example of what you can reasonably expect to pay for a vehicle with your preferred options. SOURCE: www.truecar.com

Let’s see how it works for our models. Go to truecar.com and click on “Select a Vehicle.” We’ll pick Honda and then the CR-V and enter the zip code. At this point, we have to work through a wizard to choose the features we want: all wheel drive, no package, then select EX-L to match the build we identified previously. Here is the sales charts for a local area and nationwide sales.

The Truecar price for the CR-V is $28,347 (this varies week to week), which saves you over $1600 off of MSRP and is under factory invoice price.

NOTE: These savings will also vary from area to area. I checked the Seattle area and it was $1200 saving and in Huntingburg, Indiana it was $1600 savings.

If you click one of the several “Next” buttons and register on the site, Truecar will create price “certificates” (click on thumbnail to the right to see a sample) specific to your local dealers and those dealers will be given your contact information and start contacting you almost immediately.

If you are going to negotiate beyond the Truecar price, then I strongly recommend that you get the Truecar certificates for your alternate vehicle as well so you have more prices and dealers to negotiate with.

truecar certificate sample

Here are the Truecar charts for the Ford Escape Titanium 4WD.

Interesting that though the Escape MSRP is quite a bit higher than the CR-V, the Truecar price guarantee puts them much closer due to higher savings on the Escape. This is great, especially if you prefer the Escape but didn’t like the higher price.

Looking at the average sales price history for both vehicles (below), I can see that the Truecar prices for the both cars take them from MSRP down to just under factory invoice price. I also note that the average buyer pays about halfway between MSRP and invoice for the CR-V – don’t be that buyer!

Honda CR-V average price paid and Truecar price

Ford Escape Titanium average price paid

In summary, do not go to a dealership before you have negotiated an acceptable price. If you don't want to negotiate for even more savings, at least go to truecar.com to get their negotiated prices for your local dealers.

If, on the other hand, you want even more savings, then you may want to watch for my next post, here I describe how I used the Truecar price as a starting point to save even more.

~ @securityjones

Sci-fi & Fantasy reading list-September 2014

Thu, 23 Oct 2014 21:28:00 +0000

Image background from wallpaperup.com

September was another great reading month, with a new release in a series I’ve been anticipating, a pseudonym series discovery of an author I’ve already read and a couple of new books discovered via Bookbub.

The @bookbub team replied on one of my reading lists tweets last month and I ended up following them and discovering some free book offers that benefitted both me and my wife, so I want to give a shout out to them – thanks!

Also, as a quick summary to my ongoing kindleunlimited analysis, after an August reading list where kindleunlimited would have saved me $10, September would have cost me $9.99 without covering any of the books I read at all. That makes the value net zero across the past two months.

If you like my reading lists, then I encourage you to (a) leave a comment, (b) share this post, and (c) share your own recent discoveries!

Best regards, Jeff

You may also want to look at my August 2014 Sci-fi & Fantasy reading list.

Hidden (Alex Verus #5)

Benedict Jacka

I like the Alex Verus series - an urban fantasy set in an alternate modern United Kingdom - so I was happy to start my September reading with the latest book. This book focuses around Anne Walker, an apprentice Life mage that doesn't trust Alex after events in previous books. I recommend this series, but you should start with the first book if you are just discovering it.

Fortune's Pawn (Paradox #1)

Rachel Bach (aka Rachel Aaron), $9.99

In the process of reading Rachel Aaron's book on fiction writing, I discovered that she had also written and published a series under the name Rachel Bach. Fortune's Pawn is the first of the series and I really loved it. One of my favorite things about the main character Devi is her over-the-top obsession with her armor. It is an obsession that nobody can identify with, and yet you do (yours just probably isn't battle armor!)

Fortune's Pawn (Paradox #1)

Rachel Bach (aka Rachel Aaron), $9.99

Honor's Knight is the second of the series and I really loved it.

Fortune's Pawn (Paradox #1)

Rachel Bach (aka Rachel Aaron), $9.99

Heaven's Queen is the third and final book of the series. Pretty much everyone in the universe is after Devi, but as long as she has her armor, she's ready for them to bring it!

Personal (Jack Reacher #19)

Lee Child, $10.99

Someone has taken a shot at the president of France. The bullet was American. The distance between the gunman and the target was exceptional. How many snipers can shoot from three-quarters of a mile with total confidence? Very few, but John Kott—an American marksman gone bad, who has a personal grudge against Reacher —is one of them.

Shadowborn (Light & Shadow #1)

Moira Katson, $0.00

This was well written, but almost nothing good happened to the protagonist. It was testament to the writing that with an almost constant beatdown on our heroine, I still had to finish it. However, I have delayed reading the sequel even though I already bought it because I need a break with something a bit more lighthearted.

A Soul for Trouble (Soulbearer #1)

Crista McHugh, $0.00

This series had a few more rough edges in the plot, but I still found it entertaining and read through all three books. As a tip, you can read the first one for free (currently), then if you decide to continue the series, it is a bit cheaper to by the trilogy edition, which includes all three books.

A Soul for Trouble (Soulbearer #1)

Crista McHugh, $4.99

Book 2 in the series continues the story of Trouble, Loku, Dev and Kell.

A Soul for Trouble (Soulbearer #1)

Crista McHugh, $4.99

This third book in the series is the one where the plot gave me the most heartburn. I don't want to give any spoilers, but I simply couldn't buy the "misunderstanding" that jolts Trouble into her next stupidity, and had to work to ignore it and continue the book.

You may also want to look at my August 2014 Sci-fi & Fantasy reading list.

New Car Buying Tips – Models and Dealer Inventory

Tue, 14 Oct 2014 19:59:33 +0000

In my previous post, “New Car Buying Tips – Pick Specific Models and Features,” I discussed the importance of knowing exactly which features were available and which were requirements for you. In that post, I identified three models that met my requirements:

Honda CR-V EX-L AWD	$29,950
Ford Escape SE 4WD (+options)	$30,295
Ford Escape Titanium	$31,255

On the face of it, we would proceed forward looking to negotiate on Honda CR-V EX-L and Ford Escape SE models, adding the features we want.

However, it isn’t quite that simple. If you visit a dealership in your area, what are the chances you will find each of these models? Can you find exactly the models you want with the options you want? If not, then the dealer is going to want you to pay for the options that are included that you may not want.

It is easy to imagine as scenario like this. You go to a Ford dealership near you and tell them you are looking for a Ford Escape SE 4WD, but it has to have leather seats. They have several Ford Escape SEs, but all the ones on the lot also have the foot-activated lift gate – a very popular feature – and the SE Chrome package, which together adds $2000 to the price.

So, doing a bit of searching in my local area inventory, this is what I found.

Honda CR-V EX-L AWD	Edmunds.com says there are 108 base vehicles of this model with no additional options in my area.
Ford Escape SE 4WD (+options)	None in my area with just the options I want. 15 with fewer options. 12 with the options I want, but also have power lift gate and other additional options.
Ford Escape Titanium	Found 11 in my area with just the base options I want (and a bunch more that had a lot of added options!)

So, what is the takeaway? Don’t set yourself up for failure by defining a set of options you won’t be able to find.

With that in mind, in my subsequent posts, I’ll be looking at the Honda CR-V EX-L AWD and the Ford Escape Titanium for comparisons, since it looks like I would be able to actually find the base models in inventory at the dealership.

Watch for my next post on this topic where I will share my tips for negotiating the MSRP we identified above down to save you thousands of dollars.

Best regards ~ @securityjones

2014 Sci-fi and Superhero TV Guide

Mon, 22 Sep 2014 15:33:02 +0000

This is the big week for Fall TV, with several shows returning and some great new shows starting as well. I recently went through the Fall 2014 grid to research shows for Parker (my 9yo son) and I, so I thought I should share my thoughts and recommendations.

Acknowledgement: Fall TV grid information and some synopsis text from epguides.com and tvrage.com. I wholeheartedly endorse, thank and recommend them!

Shows below are listed in roughly the order of my interest (not by when they come on).

Mondays

	Gotham. (Sep 22, 8:00PM, Fox) Batman’s main city, before there was a Batman. The show focuses on a young detective Gordon (long before he becomes commissioner) paired with Harvey Bullock to solve a high-profile case: the murder of Thomas and Martha Wayne. Expect to see many future super villains this season in their pre-crazy identities (e.g. Selena Kyle, Oswald Cobblepot).
	The Blacklist. (Sep 22, 10:00PM, NBC) Red continues to battle Berlin and faces a new threat from a man named Lord Baltimore. An important person comes back from the past into Red's world. Meanwhile, Liz tries to move forward with her life after her showdown with Tom.
	Sleepy Hollow. (Sep 22, 9:00PM, Fox) We didn’t watch season one, but since it was renewed, I think we might go back and catch up, so we can continue with this season. If you watched it, please leave a comment and let me know your thoughts.
	Ascension. (Nov 24, 9:00PM, Syfy) Not sure about this one, but plan to check to the first few episodes and decide. Synopsis: A young woman's murder causes the passengers of a starship on a secret century-long mission to populate a new planet to question the project's true purpose as they approach the halfway point in their journey.

Tuesdays

	Agents of S.H.I.E.L.D. (Sep 23, 9:00PM, ABC) Okay, it took a while to get rolling in the first season, but it finished up strong, leaving a lot of questions after the confrontation (and crossover to Captain America : the Winter Soldier) with Hydra. Coulson and his team are now wanted fugitives with limited resources -- but that's not stopping them from keeping the world safe from powerful and unseen threats everywhere. However, with new members they hardly know, will S.H.I.E.L.D. ever be trusted again?
	Forever (Sep 23, 10:00PM, ABC) This is a good one. Parker and I watched the pilot online and really liked it. Somehow 200 years ago, Dr. Henry Morgan became immortal and has since became an expert on ways to die – so he is particularly useful in solving crimes.
	The Flash (Oct 7, 8:00PM, CW) A freak accident causes a forensic scientist to become a superhero after he gains the ability to move at incredible speed. A spin-off of Arrow, originally based on the DC Comics series. Honestly, I don’t expect this series to make it to season two, but one can hope!
	Person of Interest (Oct 7, 10:00PM, CBS) Looking forward to season four. If you haven’t watched this series, you should check out the previous seasons on Netflix, especially with all of the bleed over into political reality this past year with the NSA, Snowden and privacy issues.

Wednesdays

Arrow (Oct 8, 8:00PM, CW) Season 3. With crime in Starling City at an all-time low thanks to the Arrow and his team, Oliver thinks he can finally balance being both the Arrow and Oliver Queen and asks Felicity out on a date. However, when a new villain emerges, who has claimed the name Vertigo from the recently deceased Count, Oliver is caught off-guard and someone close to him is hurt. Oliver and a newly suited up Roy take on the Count.

The 100 (Oct 22, 9:00PM, CW) I have to admit I’ve never watched this, but included since it is clearly sci-fi. 97 years after a nuclear war, leaders of the survivors living on a cluster of space stations in orbit around the Earth secretly send a group of a hundred teenage delinquents down to the surface to test whether it has recovered enough to become habitable again.

NOTE: Updated to include Mon, Tue & Wed shows before they started, so I’ll come back and update this post for other nights.

Happy viewing and please post a comment if you have thoughts on any of these shows!

~ @securityjones

New Car Buying Tips – Pick Specific Models and Features

Thu, 18 Sep 2014 17:25:00 +0000

Recently, my wife and I decided it was finally time to say goodbye to the minivan and get a different family vehicle – immediately causing a constant feeling of low-level stress.

So, this time, I was determined to do my homework, be patient, buy a car and drive away without kicking myself or experiencing buyer’s remorse. I’m happy to say I was successful – my wife and I are very happy with our new vehicle, so I thought it might be useful to share the step-by-step actions that I found most useful.

The least you need to know:

Do not go to a dealership without doing your homework on what features you want and – equally important - what features you aren’t willing to pay extra for. Use manufacturer build and price tools to fully understand your choices.

Continue reading for all the details and analysis.

In subsequent articles, I will detail the different aspects of buying a new car, but will start with the basics of choosing what sort of vehicle you want and with what features.

The Honda CR-V was recently ranked #1 for affordable compact SUVs, so on the assumption that this makes the CR-V interesting to many people, I will use it in my examples and discussions. I also strongly recommend that you have 2 or 3 alternate models in mind, so that you can eventually negotiate between different manufacturers or leverage potentially better incentives since they are constantly competing with each other. For compact SUVs as ranked in the link above, for example, I like the look of the Honda, Mazda, Ford and Toyota options.

For purposes of this article, when I want to compare a second vehicle, I will use the Ford Escape, simply because I like the styling a bit more than the others.

“Special Offers”

I’ve always found TV and print advertisements for great deals on cars to be pretty misleading. The largest reason for this is that the price quoted is sure to be the lowest-end version of a particular model, without any of the features I would consider minimum. Let’s take a look at Honda incentives and Ford incentives as examples. (It is probably a total coincidence that the monthly cost is exactly the same for both, don’t you think?)

“Look honey, we can get a new Honda CR-V or Ford Escape for only $209 per month!” I’m pretty sure I heard that or similar statements from my wife several times when we started thinking about replacing our mini-van.

These offers sound like great deals – and I’ll come back to these offers in other posts when I look at cost and financing, but for now, let’s look at the specific model features that are identified:

All wheel drive (AWD) or Two wheel drive (2WD). I personally want all wheel drive, so that during the winter, we can get around even when it gets icy or snows.
LX version on CR-V and SE version on the Escape. What does that mean in terms of features?
Total due at signing. $1,999 for the CR-V and $3109 for the Escape. Hmm, makes me think I might get some more features on the CR-V if I paid more at signing.

At the end of the day, the monthly payment or lease is determined by what price you negotiate and how much money you pay at signing, so one key step is selecting just the features you want.

Define Your Required Features

The starting point is to know your own requirements. Do you want AWD? What about a foot activated lift gate? Do the exercise for yourself and try to be honest on what is required versus just nice to have.

For me, if I was buying a compact SUV, I have only a few must have features (two of these may or may not have been identified by my wife – but that just makes it more of a requirement.)

AWD. I definitely want all wheel drive.
Leather seats. Personal preference, but we want leather seats and are not willing to compromise.
Heated seats. Again, personal preference.

That is really about it. I want an FM stereo, but am not willing to pay extra for CD or Satellite. I’d take other features, but really don’t want to pay for them. I might be willing to pay extra for a back-up camera, but I’ll have to see what cost it adds.

Identify the Lowest Cost Model that Meets Your Requirements

So, the next step is to go to the vendor sites and do a bit of research to see which model has your features. Most of the vendors have the ability to Build and Price models that lets you select available features. Keep in mind that this is not the price you should pay, but is the starting point for negotiation.

Honda CR-V. Honda CR-V web page includes a build and price link.
Ford Escape. Ford Escape web page includes a build and price link.

Doing a few builds, here is what I found out for my requirements. Note that I skipped models (e.g. 2WD) that obviously didn’t meet my AWD requirement.

Model	AWD	Leather	Heated seats	Build MSRP (base)
Honda CR-V LX AWD	Yes	No	No	$24,370
Honda CR-V EX AWD	Yes	No	No	$27,300
Honda CR-V EX-L AWD	Yes	Yes (included)	Yes (included)	$29,950
Honda CR-V EX-L AWD (fully loaded)	Yes	Yes	Yes	$36,935
Ford Escape S	No (FWD only)	No	No	$22,005
Ford Escape SE	4WD ($1750)	Available ($2590)	Available (with leather)	$30,295
Ford Escape Titanium	4WD	Yes (included)	Yes (included)	$31,255
Ford Escape Titanium (fully loaded)	4WD 2.0L	Yes	Yes	$39,938

These results are interesting. Though these vehicles are similar, the MSRP for the Ford Escape models are a bit more expensive than the CR-V models. I also know any deals for the LX are not going to work me, since I can’t get leather seats in the LX.

This took a bit of work, but what was it worth to me? Based upon this research, I can now say with 100% confidence that I will not pay more than $29,950 to get the model and features I want. I might still get a Ford Escape, but only if they are willing and able to match the lower price – I’ll cover more on that in an upcoming post.

Beware of Pre-built Models at Dealerships

Above, I also built “fully loaded” configurations for each vehicle to illustrate how a dealership MSRP can really climb when other options are included. The best reason to do your prep work is to understand the features that you do not want to pay for.

Many pre-built vehicles will include features that you don’t want, but you will have to pay for if you don’t know what you want. A dealer will very reasonably quote you a price that includes door guards, satellite radio, mud flaps, tow bars because those features are already included for that vehicle. Know what you want, so you can refuse to pay for any feature you don’t want.

True story, when I was at the dealership negotiating for our new vehicle this spring, the dealer had a model with the color and features I wanted, but they had already added things like “Door Edge Guards” and “Wheel locks” which they included in the quote, adding about $1350 in “value” and cost. The result to me was that they simply added $1350 to the vehicle price for things I did not require. I told them I was happy if they wanted to throw that all in for free in order to sweeten the pot and close the deal immediately, but I was not willing to pay for features I did not want.

By doing your homework in terms of model and features, you will be able to set boundaries for yourself and the dealer and be confident in a position of power.

Watch for my next post on this topic where I will share my tips for negotiating the MSRP we identified above down to save you thousands of dollars.

Best regards ~ @securityjones

Sci-fi & Fantasy reading list–August 2014

Fri, 05 Sep 2014 23:17:43 +0000

Image background from wallpaperup.com

August was a great reading month for me, with nearly every book coming with 3.5 stars or more and – excitingly – including several completely new authors for me!

Also, as a follow-up to my post, “Review : Is Kindle Unlimited Worth It?”, I’m now indicating whether the books I read are in the kindle unlimited program or not. This month 5 of the books I read were in kindleunlimited, totaling $19.95 in purchase price. So, for August 2014, kindleunlimited

would have saved me $10 had I been a subscriber. You can see which books below are or are not part of the program at the time of this post.

Best regards, Jeff

You may also want to look at my July 2014 Sci-fi & Fantasy reading list.

Nice Dragons Finish Last (Heartstrikers #1)

Rachel Aaron, $4.99

Loved this book and am happy that it is a new series. I had read Rachel's Eli Monpress series and was recently reminded of her when I read through 2k to 10k: Writing Faster, Better, and Writing More of What You Love, so I looked to see what else she had written. Fortuitously, Nice Dragons Finish Last had just published in July.

Basically, this is the story of Julius, a dragon-in-human-form that is completely un-dragon-like. A contemporary setting, so it looks to be a good new Urban Fantasy series.

Poor Man's Fight

Elliott Kay, $2.99

Story set in a future space empire where corporations have rigged everything in their favor so that the costs of compulsory education effectively makes everyone a debt slave. Faced with overwhelming debt, Tanner Malone enlists in his home planet's military just as the planet decides to start pushing back on corporations a bit.

Rich Man’s War

Elliott Kay, $3.99

In this sequel to Poor Man's Fight, Tanner is right on the front lines of a cold war between his home system of Archangel and the Big Three corporations that have so much influence across the Union of Humanity.

The Thin Blue Line (Empire’s Corps #9)

Christopher Nuttall, $3.99

As I mentioned in my June reading list when I reviewed Lessons in Etiquette, Christopher Nuttall is one of my favorite and prolific authors. I honestly think he has a bunch of elves helping him write because he seems to publish new books so frequently. This book is the 9th in the Empire's Corps series, and continues the story of Belinda Lawton, the main character from book #3 in the series. If you are going to read this book, I recommend going back and starting with book #1.

Study in Slaughter (Schooled in Magic #3)

Christopher Nuttall, $3.99

Case in point – two new Nuttall books in my reading list this month, with the second one taking place in the fantasy world, where a teenage girl from Earth has been pulled by an evil sorcerer. This book continues the story of Emily as she returns to Whitehall School for her Second Year.

Tarah Woodblade (Bowl of Souls #6)

Trevor H. Cooley, $3.99

This is the first book of a series within a series called 'The Jarro Grove Saga.' It had been a while since I read the previous books (Eye of the Moonrat series), but it quickly came back to me and I definitely enjoyed this new story. Tarah is a nicely conflicted character who *thinks* she's pretending to be our hero, while really doing heroic stuff to support her 'pretending.'

Protector of the Grove (The Bowl of Souls #7)

Trevor H. Cooley, $4.99

Second book of a series within a series called 'The Jarro Grove Saga.' This book splits time between Tarah as she tries to rescue Esmine and our old friends Justan (Sir Edge) & Jhonate, who face troubles of their own when they have to go meet the in-laws, who happen to be fierce warriors who hate Justan for 'stealing' Jhonate from them.

Dreamer’s Curse (Artifactor #2)

Honor Raconteur, $4.99

This book is a sequel to The Child Prince and is a light hearted fantasy about Sevana, a super powerful Artifactor, who simply wants to be left alone - and is very definitely not "huggable", in her opinion - in spite of the fact that people keep hugging her.

Defender of the Empire (Cadet #1)

Catherine Beery, $2.99

Welcome to the Spectral Empire - which is a little different for a space empire. This book just published in April and I can't wait for the next in the series. Our hero is from a under privileged background, but just might turn out to be a princess in disguise - a pretty classic hero plot, but done in an interesting way.

Not a Drill: A Jack Reacher Short Story

Lee Child, $1.99

Hey, it's Jack Reacher, what more do you need to know? A 44-page novella, fyi, but it's good to visit with Reacher a bit before Personal comes out.

The Shaman’s Curse (Dual Magics #1)

Meredith Mansfield, $2.99

Coming of age (magician) story about a boy with one foot in each of two worlds - the plains and the city. An accident causes him to lose a best friend and gain an implacable enemy, setting him on a path that could set both communities against him. Looking forward to the sequel

Telekinetic (Hyllis family #1)

Laurence Dahners, $2.99

Relatively short novel (217 pages) about a (post-apocalyptic) frontier family that inherits some small telekinetic powers. Got this because of how much I enjoy the Ell Donsaii series by the same author. I enjoyed this new series as well and look forward to the next one.

Inception (Catherine Kimbridge Chronicles #1)

Andrew Beery, $2.99

Because I liked Defender of the Empire above, I looked to see what else the author writes and it turned out she’s been a co-author on a few books with her dad (not this one, but later in the series). Good book, though I didn’t like it quite as much as the first book in the Cadet series.

Super Villain Dad (Cape High #1)

R.J. Ross, $0.99

Really a Young Adult novel and only 152 pages, but it was okay. Will probably check out the next in the series whenever I need another change of pace.

You may also want to look at my July 2014 Sci-fi & Fantasy reading list.

Topics from Cybersecurity Bootcamp #1 – Cyber Hygiene

Fri, 29 Aug 2014 17:33:50 +0000

This past week I was privileged to attend Stanford’s inaugural cybersecurity boot camp, where two dozen congressional staffers joined academic and industry experts to discuss ways to protect he government, the public and industry from cyber threats.

For me, it was encouraging to see congressional staff members deeply engaged in security and threat discussions on a range of cybersecurity topics and it was a good reminder of how broad a topic it really is. With that in mind, I thought it would be interesting to extract a few of the topics from the boot camp and discuss them more deeply here on the security blog.

Dr. Jane Holl Lute on Cyber Hygiene

The opening session for the boot camp was led by Dr. Jane Holl Lute, a former deputy secretary of Homeland Security, current president of the Council on CyberSecurity (CCS), and a consulting professor at Stanford's Center for International Security and Cooperation.

Dr. Lute told the bootcamp participants that the Internet is about the power to connect, not to protect, and stressed the importance of cyber hygiene in mitigating threats.

She emphasized the idea that industry and government can do better – that we know a lot, but we're just not doing it. When asked questions about the path forward, Dr. Lute repeatedly evangelized the need for companies to carry out basic cyber hygiene and promoted the core priorities launched in a Cyber Hygiene Campaign earlier this year by the CCS and the Center for Internet Security (CIS), working with the National Governors Association Governors Homeland Security Advisors Council.

Council on Cybersecurity’s Critical Security Controls

Dr. Lute, in her work with the Council on Cybersecurity, has worked on defining, publishing and updating guidance in the area of security controls since 2009. The latest publication is “The Critical Security Controls for Effective Cyber Defense v5”, available for download http://www.counciloncybersecurity.org/critical-controls/. The publication is key to the first phase of their Cyber Hygiene Campaign, which prioritizes the top five actions that address the most critical areas - which the campaign asserts can prevent 80 percent of all known attacks.

NOTE: I've searched for a reference or study that establishes the 80 percent claim and haven't found anything related to the CCS security controls. I speculate that the number and associated claim may be derived from the correlation with the Australian DSD4 controls - see below for more details on this.

The prioritized controls identified by the campaign are:

Inventory authorized and unauthorized devices
Inventory authorized and unauthorized software
Develop and manage secure configurations for all devices
Conduct continuous (automated) vulnerability assessment and remediation
Actively manage and control the use of administrative privileges

In my personal opinion, these are easy to articulate, but relatively high level in terms of putting into operation. Because of that, I call out the “First Five Quick Wins” recommended in the Critical Security Controls document. The document recommends these five sub-controls as having the most immediate impact in mitigating attacks:

application whitelisting (CSC 2)
use of standard, secure system configurations (found in CSC 3)
patch application software within 48 hours (found in CSC 4)
patch system software within 48 hours (found in CSC 4)
reduce number of users with administrative privilege (CSC 3 and CSC 12)

Coincidentally, these align closely with the top 4 mitigation strategies for which the Australian Signals Directorate won the 2011 U.S. National Cybersecurity Innovation Award.

Australian Signals Directorate Strategies to Mitigate Targeted Cyber Intrusions

In February 2010, the Australian Defence Signals Directorate (DSD) published a list of 35 strategies to mitigate against targeted cyber intrusions they had analyzed in 2009. They found (archived copy of 2010 report) that at least 70% of intrusions that the DSD responded to in 2009 could have been prevented if organizations had implemented their first four controls. In July 2011, the DSD published an updated report (archived copy of 2011 report) that found that the top four strategies would have prevented at least 85% of the intrusions the DSD responded to during 2010.

The latest report (February 2014) now generally asserts that the effectiveness of the top four strategies remains high and would have, if implemented as a package, mitigated at least 85% of cyber intrusions which the Australian Signals Directorate (ASD) responds to. The top four strategies are:

application whitelisting of permitted/trusted programs
patch applications. patch/mitigate “extreme risk” vulnerabilities within two days. use the latest versions.
patch operating system vulnerabilities. patch/mitigate “extreme risk” vulnerabilities within two days. use the latest suitable operating system.
restrict administrative privileges to operating systems and applications based upon user duties. users should use a separate unprivileged account for email and browsing.

Final Thoughts and Considerations

Whether we are talking about the Council on Cybersecurity security controls or the DSD mitigation strategies, there is clearly some industry alignment on the best practices for threat mitigation that organizations should be prioritizing. I agree and endorse these “cyber-hygiene” basic steps.

But … what about individual users?

The security controls and mitigation strategies are all targeted at organizations. Government departments or private sector enterprises can and should implement them and yes, that does have a cumulative beneficial effect on the ecosystem, but it doesn’t really provide actionable guidance for individual users.

Would similar cyber hygiene steps help with home users? Everyone loves to talk about the threat from zero-days, but when my colleagues and I analyzed real world exploits in our 2011 Security Intelligence Report, we found that less than 1 percent of exploits in the first half of 2011 were against zero-day vulnerabilities — software vulnerabilities that are successfully exploited before the vendor has published a security update or “patch.” In contrast, 99 percent of all attacks during the same period distributed malware through familiar techniques, such as social engineering and unpatched vulnerabilities. Basically, we found that the most common threats can be mitigated through good security practices by individuals too.

So, in closing, let me translate the “DSD top 4” into some cyber hygiene guidance that individual users can apply:

Only install applications from reputable sources, such as the official device Stores or boxed product from known, reputable vendors. Avoid “alternative app stores” and untrusted download sites and especially avoid “cracked” software, as they are frequently compromised with malware.
Accept application updates when available, especially from official app stores. Do not accept offered updates from web sites, instead initiate updates yourself using official updaters or at the vendor web site.
Turn on operating system auto-updates and accept them when notified. Make sure you shut down and reboot on any day when you are notified of an update to ensure they are applied.
Use a standard user account for all day-to-day computing. Have a separate dedicated admin account for performing administrative tasks and only use it for that.

Just like the DSD has 35 mitigation strategies and not just the top 4, there are other things that individuals can do beyond these four (e.g. antivirus software), but these would be a great start for individual cyber-hygiene.

Best regards, Jeff (@securityjones)

Cross-posted from the original on the Microsoft Security Blog.

Sci-fi & Fantasy reading list–July 2014

Tue, 05 Aug 2014 23:39:26 +0000

Image background from wallpaperup.com

July was a mixed reading month for me, some great and not-so-great. For the first time in a couple of years, I stopped reading a book in the middle and don't plan on finishing it. It was also the 3rd book in a series with sequels yet-to-be-read, so that made it even worse. On the other hand, I also discovered a new series at the end of the month that I really liked, leaving me with a few books to look forward to in August already.

July 2014 is also the month that Amazon announced and launched the kindle unlimited service, described by some as a "Netflix for ebooks." If you haven't read my post, “Review : Is Kindle Unlimited Worth It?” check out the analysis of how the cost of my wife's and my reading list for April through June would have been different with Kindle Unlimited.

As a caveat on my reviews, enjoying the story is my highest order value, above complicated, nuanced storytelling or even the mechanics of writing. If I am entertained and pulled into the story, I can easily overlook a few grammatical errors. I do welcome different comments and would love to get to know other sff readers, so if you read one of these and have a different perspective, please share it!

Best regards, Jeff

You may also want to look at my June 2014 Sci-fi & Fantasy reading list.

Dead Things

Stephen Blackmoore

Dead Things is the first in an urban fantasy series about Eric Carter, a necromantic magic-user and trouble shooter who gets lured back to his origins of Los Angeles and drawn into a complicated plot involving old friends and enemies. Great start to a new series and I'll be starting book #2 immediately.

Scrapyard Ship

Mark Wayne McGinnis

The book opens with a space battle and then shifts to our hero, Navy Seal Jason Reynolds, who is under house arrest in the family homestead, which also happens to be a scrapyard and coincidentally the hiding place for an advanced spaceship. In spite of how that sounds, I liked the characters and enjoyed the book.

Scrapyard Ship

Mark Wayne McGinnis

To be honest, I took a break after reading #1 and only came back to read #2 a couple of weeks later. Once I started it, it was a good read, but I'd like to see Mark spend less pages throwing in new technology and more pages on character development - I ike Molly, Nan and Dira but they're all pretty shallow still.

Blades of Magic (Crown Service #1)

Terah Edun

This was the first book I read in July and I liked it well enough to give Edun's previous series a try. Sara is a magical sword duelist (Battle Mage) with a chip on her shoulder with respect to defending her family's honor. Her father was accused of desertion, but she soon learns there is more going on that she has been told and takes action to find out the truth.

Honor Crowned (The Spare Heir #3)

Michael G. Southwick

Good news and bad news on this one. I loved the Spare Heir series and would pretty much give this book a 4 rating right up until the ending, which seemed like it was written be completely different writer just to finish the series. Sad, because the story had great potential.

Rookie Privateer (Privateer Tales #1)

Jamie McFarlane

Great example of the type of books that Amazon self-publishing has enabled for new authors. I can tell Jamie is a newish author, but really enjoyed the story and look forward reading future books and seeing him develop further as an author!

Fool Me Once (Privateer Tales #1)

Jamie McFarlane

Immediately bought the second book in the series and enjoyed it too. My only pause was that I wanted to continue the story of Liam, but this book was the story of a very minor character introduced near the end of book one. Once I got past that, it was all good and I now how future book bring the characters from both books back.

Claimed (Flash Gold #4)

Lindsey Buroker

I love these characters, the setting (frontier gold rush), and the writing style. My only caveat is that each of the books in this series is very short - this one is only 100 pages or so. Feedback to Lindsey - this is considered a cardinal sin by my wife, she'd never buy the book!

Disenchanged & Co.

Lynn Viehl

Frontier steampunk, so what's not to like? I like the main characters - especially Kit, who's real power seems to be denial. Takes place in a USA-alternate, Toriana, where the British stamped on the revolution. I will say that the "magic system" is not my favorite, just because it is a little too Deus Ex Machina, but without the machine.

The Clockwork Wolf (Disenchanted & Co. #2)

Lynn Viehl

Pretty much continues on from the previous book - a good read. I especially like the elements of the plot dealing with the differences in Kit's and Lucien's experience (intentially vague to avoid spoilers, fyi).

The Telastrian Song (Society of the Sword #3)

Duncan M. Hamilton

Enjoyed this whole series and this third book does an okay job of wrapping things up, but to me, didn't quite measure up to the previous two books. One of my main complaints is simply that characters I really like didn't have major parts in this one. Still, I can strongly recommend the series.

Sworn To Raise (Courtlight #1)

Terah Edun

Ciardis has grown up in poverty, a cleaner in a small vale on the outskirts of the empire. But beneath her empire's seemingly idyllic surface lies a hidden secret. When opportunity comes her way, she grabs it and sets off to become a Court Companion.

Sworn To Transfer (Courtlight #2)

Terah Edun

Book continues from Sworn to Raise. Ciardis gets a new mentor and mission to the Ameles forest to help find and stop a new threat.

Sworn To Conflict (Courtlight #3)

Terah Edun

I just couldn't finish this one. Ciardis' reaction to revalations was just too shallow and unrealistic to me and I stopped reading. Without giving in spoilers, if I found out someone had lied that deeply and long to me, I would have a much bigger, more emotional and lasting reaction to it. And I sure wouldn't follow their lead anywhere.

You may also want to look at my June 2014 Sci-fi & Fantasy reading list.

Microsoft Black Hat Party 2014

Wed, 30 Jul 2014 20:37:32 +0000

You are invited! Microsoft is again hosting a researcher appreciation party during Black Hat USA 2014 and we hope you can join us.

The party will be on Thursday, August 7, 2014, at Hakkasan, located in the MGM – just diagonally across the street from Mandalay Bay, where the Black Hat conference is being held this year.

The least you need to know:

1. Stop by Black Hat booth 111 on Wed or Thu and pick up a Microsoft Party challenge coin

2. Bring the coin to Hakkasan to gain entry between 9:30 p.m. and 12:30 a.m. on Thursday

Continue reading for all the details.

We have updated our format a bit this year to incorporate feedback and make the party better than ever:

Early and VIP entry. We will have early entry to the club for our guests starting at 9:30PM and will continue to have a VIP entrance to allow you to go to the front of the line once the club opens to the public at 10PM, which brings me to the next point.
Integrated with the public. What good is being a VIP unless you get to bypass the huge normal lines waiting to get into the club? Once inside, you can mingle, dance and enjoy the ambiance of one of the top nightlife destinations in Las Vegas!
The party never stops. Well, actually it does, but it doesn’t have to stop for you. When the Microsoft portion of the evening ends at 12:30 a.m., all of our guests can stay and keep the party going until the wee hours of the morning.

One thing that has not changed is that you can not simply show up at the club and get it – you need to stop by the Microsoft booth 111 at Black Hat and pick up a Microsoft Black Hat 2014 challenge coin. Supplies are limited and it is first come, first serve, so I advise you to visit the booth early! Bring the coin to Hakkasan on the night of the party to gain entry via our VIP entrance.

Best regards ~ Jeff (@securityjones)

Review : Is Kindle Unlimited Worth It?

Mon, 21 Jul 2014 19:17:16 +0000

UPDATE: I am now noting kindle unlimited availability, by book, in my monthly reading lists and providing ongoing analysis of whether kindle unlimited would have saved me $ that month. For my Sci-fi & Fantasy reading list–August 2014, kindle unlimited would have saved me $10, so the value has improved for me in the past month. Will keep you posted, @securityjones.

This past week, Amazon introduced kindleunlimited, a service available for $9.99 a month, which offers a library of more than 600,000 e-books and thousands of audiobooks. In this post, I look at whether that subscription is worth it for most readers.

The least you need to know:

The kindleunlimited subscription, as launched, provides little value for the vast majority of people.

Continue reading for all the details and analysis.

The Washington Post has asked Is Kindle Unlimited worth it? in one article and I want to address the same question here, since I found their answer unsatisfying in terms of specifics. Their main criteria came out to be how many books you read per year:

Kindle Unlimited is $9.99 per month. So you'll be paying Amazon, whose chief executive Jeffrey Bezos owns The Washington Post, around $120 per year for the unfettered e-book access. If you're habitually spending money on more than one book per month, then it's a service to think about. It has its perks for big book buyers -- namely that don't have to worry about spending money on a book you end up hating.

According to the research highlighted by the Washington Post, the average person doesn’t read enough to make kindle unlimited worthwhile, but it may be worth a look if you read more than one book per month.

This simple analysis really only makes sense if you are someone who primarily reads paperback or hardback books and are making the jump to ebooks. Realistically, if you are reading ebooks on a Kindle or Nook or your iPad already, then you are already reaping large savings over your peers who still buy “real” (non-electronic) books. My wife, for example, reads 3-4 books a month, but it is not at all clear to me that she’d benefit from this new service. On one hand, when she’s looking through the Amazon library, she gives preference to books she sees that she can “borrow for free”, but on the other hand is equally willing to spend 11.99 to pre-order the latest from a known and well-loved author.

How many books do you read?

So, let’s start where the Washington Post did with the question of how many books we read. I looked back at the actual digital orders for my wife and I from the beginning of April to July 20. Note that Jacki largely reads romance/romantic suspense/romantic comedy and I primarily read science fiction & fantasy.

	April	May	June	July
Jacki	4	3	4	1 (so far)
Jeff	8	6	13	10 (so far)

So, using the rough guideline from Washington Post, it looks like kindle unlimited could be a good fit for both Jacki and me. Let’s continue looking at a second question.

How much do you spend on books each month?

I made a spreadsheet of all of the ebooks that Jacki and I purchased and read since April and divided the total by the number of days. It turns out that Jacki has spent about $0.75/day and I’ve spent about $1.50/day – but let’s look at that by month (rounded values).

	April	May	June	July
Jacki	$42	$16	$20	$3 (so far)
Jeff	$30	$45	$63	$25 (so far)

Again, it looks like kindle unlimited could be a good fit for both of us. Even though Jacki hasn’t spent $9.99 yet in July, it seems likely she’ll buy another book or two. Even if she doesn’t, the potential saving from the other months make a subscription look potentially valuable. So, if all of the books we’ve read could be acquired under kindle unlimited, it would clearly be a deal of us.

So far, though, we’ve been ignoring one huge question – how many of the books we buy would be offered as part of kindle unlimited?

How many books did we read that were covered by kindle unlimited?

In this table, I captured how many books we actually read that are covered by kindle unlimited and then put the $cost next to it.

	April	May	June	July
Jacki	0 / $0	0 / $0	0 / $0	0 / $0
Jeff	1 / $4.33	1 / $3.25	2 / $7.60	3 / $8.66

This puts in solid numbers and it is clear that kindle unlimited would not have been a value for either Jacki or me. In fact, if we wanted to read the same set of books, we would have ended increasing our costs by more than $55 over the time period. (representing the difference between the monthly totals in the table and $9.99)

For another data point, I did a forward analysis looking at books on my “Recommended for you > Books on Kindle” and found that only 49 of the 150 books (~ 30%) on the list were covered by the subscription. My average book cost was $4.42 [note: these costs include tax since we live in Washington] and I read an average 9 books/month in the table above, so let’s call it 10 books per month since July is not over.

In theory, it looks close for me if I read 3 subscriptions books each month of an average value of $4.42. Again though, the value isn’t quite that high, since the average cost of my books covered by the subscription were only $3.40. Another issue would be the variance – I’m not going to get a refund on months where I read less than 3, while I would have to read 4 or greater to really accrue any savings in a given month.

Would it be valuable if you only read self-published books?

To be succinct, no.

To be honest, when I started this analysis, I sort of expected that kindle unlimited would be of value to us because we tend to read a lot of self-published books from Amazon.

I’m a huge supporter of self-published books on Amazon, which has opened up a vast new set of science fiction and fantasy series that I otherwise wouldn’t have had access to. I’d estimate that 80% of my ebook purchases now fall into that category thanks to awesome stories from Christopher Nuttall, Lindsey Buroker, Jamie McFarlane, Michael G. Southwick and many, many others. These authors, given a fighting chance, are creating some great stories to entertain us – and becoming better writers with each book they release!

On the other hand, these books are cheaper anyway. Out of 37 books since April, only 6 cost me over $7. Over half of the books cost me less than $3.50 including tax.

Contrary to what I expected though, when I look through these authors’ books on Amazon, many of them are not covered by kindle unlimited. School in Magic, for example, and Bookworm by Chris Nuttall and I don’t see any of Buroker’s books are in the subscription, nor Chris Hechtl’s books.

So, in spite of speculation by myself and media, even folks who focus exclusively on the emerging self-publishing genres on Amazon aren’t necessarily getting enough value to justify the monthly subscription.

When would kindle unlimited makes sense?

Assuming you are a pretty frequent reader, there are two scenarios where kindle unlimited could be worthwhile:

Scenario 1: It would be worthwhile if enough of the books read are covered by kindle unlimited which consistently cost more than $9.99 total, per month. As demonstrated above, this is not the case for us with the current set of books covered by kindle unlimited.

Scenario 2: It would be worthwhile if one was willing tailor their choices to what is covered by kindle unlimited.

Honestly, scenario 2 seems very unlikely for any dedicated reader. Are you not going to read the latest from your favorite author if it isn’t in the subscription? Unlikely, so that means you’ll pay for books above and beyond the subscription while still needing to read enough volume from kindle unlimited to make it worthwhile.

And while having some high profiles book series like the Hunger Games, Lord of the Rings and Harry Potter makes it seem more valuable and interesting, I suspect avid readers have already read all of these. I know I have. To make it valuable to me, there are a few things that will have to happen:

Known and loved authors for key genres will have to join the program. Think of the books you read that show up on Amazon and allow you to place an advance order. I’m not holding my breath on this one, but this would seriously increase the $ value of the subscription.
If all self-published fiction (at least for key genres) was included. I suspect it is heading this way, so I’ll have to do a reassessment in 3-6 months to see how things have changed. I will still be buying books outside of the subscription for ‘big’ authors/books, but this sort of change could represent a bigger savings to me.
A change in the business model. I can’t anticipate what this would be, but in my opinion, the current business model is almost completely unsustainable because the value to customers is so low. It must be a loss leader or forcing function for Amazon towards some other future objective because it is hard to imagine very many readers for which the subscription is worthwhile.

Other Considerations

I don’t leverage the audiobooks, so I didn’t really assess the value of the “more than 2,000 digital audio titles,” but at least one of my colleagues was very interested in that.

Also, I didn’t look at a scenario for youth or children readers – and this could be more appealing for newer readers since they won’t necessarily have read Harry Potter or whatever. I did spot check my 9yo sons three favorite book series and none of them were covered by kindle unlimited, so that is a data point.

Another thing that I didn’t explore was leveraging one account for the family. My wife and I use separate accounts for our book purchases because of the recommendations, so I did my analysis that way. Eyeballing the final table makes it obvious that even if we worked from a single account, kindle unlimited would add cost for us, rather than saving us anything, but your mileage may vary.

Finally, I’m a bit of a collector. One thing I love about my kindle/Amazon experience is that I can go back through 2010 and see exactly what books I read, when I read them and potentially read them again. I don’t know how that changes with kindle unlimited. Is it like Netflix in that I could read a book, but potentially lose access to it later when a contract expires? I don’t like that idea, especially when we’re talking about books that only cost $2.99.

Conclusion – Kindle Unlimited is Not a Value for Most People

As an avid reader, the idea of a “Netflix for books” is one that appeals to me, but in my analysis, the kindle unlimited service as it is currently implemented would simply increase the amount of money I’m paying for my books.

#TBT : Be Safer–Run as Standard User

Thu, 10 Jul 2014 21:30:35 +0000

For #ThrowBackThursday, I thought it would be good to pull out an oldie but goodie. The original post was on the “Jeff Jones Security Blog” back before the blog evolved into the Microsoft Security Blog.

I’m including the full original text below, but this guidance applies today to whatever PC you are running. I hope you enjoy and welcome any comments you might have here or on @securityjones.

Best regards, Jeff

Be Safer - Run as Standard User

I do my work as standard user on Windows 7, just as I did with Windows Vista. It is not a burden. When I need to do an admin task, I put on my “admin” hat by switching to my admin account specifically and doing my admin thing and then logging off. I don’t browse, I don’t download stuff, and beyond the first week or so when I set up a new machine, I don’t really need to do it that often. I think it is a best practice. Combine it with the improvements in Win7 and IE8 and we’ve come a long way from where we started…

Here is a news story that provides some supporting evidence for my best practice.

(Dark Reading) Taking away the administrative rights from Microsoft Windows 7 users will lessen the risk posed by 90 percent of the critical Windows 7 vulnerabilities reported to date and 100 percent of the Microsoft Office vulnerabilities reported last year.

It will also mitigate the risk of 94 percent of vulnerabilities reported in all versions of Internet Explorer in 2009 and 100 percent of the vulnerabilities reported in Internet Explorer 8 during the same time period.

Finally, it will reduce the danger posed by 64 percent of all Microsoft vulnerabilities reported last year.

These findings come from a study conducted by BeyondTrust, which perhaps unsurprisingly sells software that restricts administrative privileges.

The company argues that companies need its software to protect themselves, particularly during the time between Microsoft's publication of vulnerability information and the application of Microsoft's fixes.

[read the full article from Dark Reading, Windows 7 Less Vulnerable Without Admin Rights]

Cross-posted to the Microsoft Security Blog (link)

@IrishOberon of The Iron Druid Chronicles

Wed, 02 Jul 2014 16:11:09 +0000

I mentioned in my June reading list that @kevinhearne’s The Iron Druid Chronicles is my #1 favorite urban fantasy series – a series which features my favorite character, Oberon, who describes himself thusly: “I am the best friend of Atticus O'Sullivan. Meet me on the Mongolian steppes and we will ride to glory! Also, I like sausage and bitches. “

I loved the series from the first book and all of the main characters, but Atticus’ wolf hound, Oberon, is so memorable that in the latest book, Shattered (Iron Druid #7), I found myself looking forward to the next scene in which we would appear.

Let me give you a few examples that illustrate why Oberon is my favorite character.

First, he has a particular world view and is both enthusiastic and authentic. He has his own voice. Here is a good example from Tricked (Iron Druid #4):

“Hey, Oberon,” I called, filling up the tub for him, “it’s time for your bath!”
<It is?> He sounded doubtful. <Do you have a decent story?> Oberon wouldn’t sit still for baths unless I told him a story—a real story about historical figures. He never settled for faerie tales.
“I’m going to tell you the true story of a man named Francis Bacon.”
<BACON?> He came running so fast that he couldn’t negotiate the sharp turn into the bathroom very well, and he slammed into the door awkwardly and then splashed into the tub, soaking me after I’d just finished drying off.
<Oh, this is going to be great! I can tell I’m going to like this man already. He had to have been a genius with a name like that. Was he a genius?>
“Yes, he was.”
<I knew it! I have an instinct for that kind of thing. But I hope this story doesn’t end with him chopped into bits and sprinkled on a salad. That would be tragic, and a story about bacon should be uplifting.>

And of course Oberon has come clear opinions about squirrels, as demonstrated in Trapped (Iron Druid #5):

How did you ever think to look for this? I asked Oberon.
<I didn’t think of it, to be honest. Finding it was a happy accident. You see, there was a squirrel on that pine tree, giving me some lip as I was passing down by the stream. He said some bawdy things about my mom—>
Oberon, come on.
<Well, all right, I don’t know what he said, but he definitely had an attitude, just like all squirrels, and he deserved to be chased up to the top and kept there for a while. I wouldn’t have come up here otherwise.>
Well, this is perfect. We owe that squirrel for leading you here.
<Wait a second! How come the squirrel gets all the credit?>
I was thinking he’d get all the credit and you’d get all the sausage.
<Oh! That sounds completely fair, Atticus; I really can’t argue with that.>

And finally, since I don’t want to spoil any major plot elements of the latest book, let me share this small bit of conversation about India:

<What’s it like in India?>
“Oh, that’s right, you’ve never been there at all. Well, brace yourself, buddy. More than a billion people live there, and the majority of them are vegetarians.”
<Ha-ha, very funny.>
“I’m serious, Oberon. Cows are sacred. Nobody eats them.”
<Are you trying to scare me?>
I grinned at him. “Sounds like a harrowing adventure, doesn’t it? Come on, Oberon. Paws on the tree.”
<Wait, Atticus, I think we should talk about this—>

Let me share some other key links related to this series and the author, Kevin Hearne, who is very involved with his fans and social media.

Kevin Hearne’s web site: http://kevinhearne.com/
Kevin Hearne’s facebook: https://www.facebook.com/authorkevin
Kevin Hearne’s twitter: @kevinhearne

Also, a few of The Iron Druid characters engage directly on twitter as well:

@IrishOberon – I am the best friend of Atticus O'Sullivan. Meet me on the Mongolian steppes and we will ride to glory! Also, I like sausage and bitches.
@IronDruid – Tea maker. Druid. I am not Kevin Hearne; we are not one and the same. I'm just the guy he gets his stories from.
@ArchdruidOwen – A man out of his time. Trying not to get killed by Siodhachan and his fecking hound. Me story is in the Iron Druid Chronicles by Kevin Hearne.

So if you haven't already discovered this awesome series, I wholeheartedly recommend you get Hounded (Iron Druid #1) and start it today!

Sci-fi & Fantasy reading list - June 2014

Tue, 01 Jul 2014 16:35:14 +0000

Image background from wallpaperup.com

I love to read science fiction & fantasy novels and the past several years have been fantastic as the industry and I have both shifted to ebook readers. I always appreciate a good book recommendation, so perhaps other readers will be interested in what I'm reading and I what I like. The below list is what I read over the month of June.

As a caveat, enjoying the story is my highest order value, above complicated, nuanced storytelling or even the mechanics of writing. If I am entertained and pulled into the story, I can easily overlook a few grammatical errors. I do welcome different comments, so if you read one of these and have a different perspective, please share it and we can discuss.

Best regards, Jeff

You may also want to look at my May 2014 Sci-fi & Fantasy reading list.

Shattered (Iron Druid #7)

Kevin Hearne

Iron Druid is my favorite urban fantasy series, having edged out the Dresden Files over the past few books. This series has my favorite fantasy character of all time - Oberon the wolfhound - which is blogworthy, so I'll expand upon that in a new post soon. 4.5 is my top rating for a book upon first reading. If you haven't discovered Kevin Hearne, I strongly recommend you go out and get the first book in the series - Hounded - and make it the next book you read.

Lessons in Etiquette (Schooled in Magic #2)

Christopher Nuttall

Christopher Nuttall is one of my new favorite authors and the good news is that he is prolific. I first discovered him when he self-published The Empire's Corps and I'm now to the point where I'll buy any of his books on faith, even if it is in a new world. I'm going to do a separate post on him soon, but you should give him a try.

Rescue (Ell Donsaii #11)

Laurence E Dahners

This series is one of those that is sort of a secret indulgence. While most heroes struggle against disasters and deal with angst, Ell Donsaii is super smart, billionaire inventor, Olympic athlete who overcomes all obstacles. Start with book one and you'll either hate it or it will become your secret indulgence too.

Clean (Mindspace Investigations #1)

Alex Hughes

This series affirms that the Amazon recommendations does a poor job in that I'm not sure how I've never found this series earlier. It is hard not to compare this series with the Dresden Files, so I won't try. This is Dresden Files, but with telepathy instead of magic. Oh, and instead of Karen, you have Isabella Cherabino. I recommend it.

Payoff (Mindspace Investigations #1.5)

Alex Hughes

A novella in the Mindspace Investigations series which bridges between the 1st and 2nd novels.

Sharp (Mindspace Investigations #2)

Alex Hughes

Second in the Mindspace Investigations series, I immediately got it and read it as a follow up to Clean and Payoff.

Marked (Mindspace Investigations #3)

Alex Hughes

Third in the Mindspace Investigations series, I like how the series is maturing and am looking forward to the next installment. I now have Vacant on my wish list, which is supposed to release in December

The Black Guard

C. R. Daems

I liked this one, but I gave it a 3.5 instead of a 4 because it was a bit straightforward, with the hero easily surpassing each challenge. I like the characters and the universe, though, and would look forward to reading a sequel.

The Final Formula (The Final Formula #1)

Becca Andre

I like this one too, but it took a while to hit its stride. It is an Urban Fantasy with the central character being an Alchemist. One of the early challenges was that I kept forgetting that the setting was an alternate to modern times, rather than (say) the 1700s.

The Element of Death (The Final Formula #1.5)

Becca Andre

This novella focuses on James and Rowen for a bit of male-bonding and ghost busting between books 1 and 2. I enjoyed it, but from a plot point-of-view, it is strictly optional.

The Blood Alchemist (The Final Formula #2)

Becca Andre

Reading The Blood Alchemist, I was already familiar and 'hooked' by the characters in The Final Formula, so I enjoyed the sequel more.

The Sea Without a Shore (Lt Leary #10)

David Drake & Stephen Hickman

The Lt Leary series is a solid space opera and continues to deliver. I recently went back and read #8 and #9 again just to refresh the story in my mind and I enjoyed them the second time as well. As usual Daniel and Adele have related, but different, missions and manage to make it all work out.

Belated Farewell to My Yahoo! Home Page

Fri, 27 Jun 2014 20:09:21 +0000

Today, I’m bidding a belated farewell to my Yahoo! home page (my.yahoo.com), which has been my browser home page for over 16 years. I say belated because I really haven’t visited it much since Yahoo! forced the new my.yahoo.com home page format on me and reduced the key capabilities I’d been using for so long. Though I tried other home pages over the years, I always came back because my.yahoo, you were the best at giving me what I wanted in a home page … but I have to face reality.

Farewell, old friend, we’ve been through a lot together, but we need to both recognize and acknowledge that we’ve grown apart and you are simply not meeting my needs anymore. I can’t really blame you, it’s not your fault - I blame it on your new friends and what they’ve been telling you. When you had your makeover, cnn.com told you that it was “… a good first step” and called you “… more ‘intuitive and personal’”, so I understand why you’ve embraced your changes.

I have a different perspective. I miss the days when you were useful and when the information I needed was right there and easy to find. Superficially, you seem similar – but beneath the skin, where it counts, you’ve lost that special something in order to fit in and be part of the cool crowd.

I hope your new “friends” are worth it, because you’re going to have to get along with out your old set of friends, who’ve tried desperately to get you to see reason. Strangely, this webpro story had a positive tone and key message pick-up for Yahoo! (similar to the cnn one I mentioned above), but I couldn’t find a comment on the article that was positive – not a single one. Here is a small sampling from (probably now former) users of my.yahoo.com:

I absolutely hate the look and lack of functionality of the "new" yahoo homepage. What garbage.
The new version is crap. Not user friendly AT ALL
The new Yahoo homepage has been a royal pain in the butt.....it has no new features, adds not one iota of new information and after having spent hours fiddling with it, still doesn't work.
Been a my yahoo user since the 90s. It baffles me how poor the new site is. How something like this happens is beyond me. Is it really possible that the peeps in charge at yahoo are that clueless? Have they ever used the page? Did they even get an ounce of feedback from regular users?
Can't believe what a step backwards this is. Loss of functionality and poorly functioning links have me searching for alternatives. To still use some remnant of the old my yahoo page I'm using http://ca.my.yahoo.com instead. I know that will disappear too so I'm leaving as soon as I can.
Anybody remember the "New Coke" some years back??
Similar screw-up here. Yahoo had a good thing going, but now they are pushing users away in droves. I wonder how long until they offer a Yahoo Classic ??

Similarly, users provide pretty clear feedback on the positive cnn “step in the right direction” article – again, I could not find a single comment in support of your makeover:

If it's not broke, DONT FIX IT! Please bring back the old format. This one looks looks like 12 year old did this
Sorry, Yahoo. The new page gets a failing grade. It is not intuitive and is actually clumsy to use. The "Infinite Scroll" is a huge waste of bandwidth, RAM and CPU. It does not fit well on a smaller monitor.
I agree with everyone , HATE IT !!!!!!!! Thought something wrong w hubby computer then came to mine and everything has changed !!!!
I think that the new homepage sucks! All my favorites are gone. If there are going to make changes then Yahoo should give users the option to choose a "classic" version. My opinion is "if it's not broke then don't fix it"!
Along with everyone else, I hate it. I can't find my favorite sections any more. It is too busy and not intuitive. I also hate the new Mail format. Both take too long to load even on faster computers. I wasn't given an option to stay on classic for either.
It beggars the imagination that the designers who designed the new home page and the corporate executives who approved this change could make such an egregious error in judgement. If anyone goes to the Yahoo news page where Yahoo users are discussing this change you will find over 4800 comments of which the overwhelming majority are voicing negative opinions of the change.

These voices … say it better than I can. Remember how I used to always keep a portfolio of companies – not because I owned the stock – but so I could click through and look at the news headlines related to all of them for the day? I could click on my “Open Source” portfolio of companies or “Software leaders” portfolio and see all of the related news and quickly get to what I wanted to know. Now, if I click on the portfolio, it collapse the list – seriously, I feel deflated.

So, goodbye and best of luck! I want to say that we can still be friends, but really, you know that never works out very well. I’ll smile fondly when some other web site mentions you name once in a while, and I can honestly say I wish only the best for you, but I’ve already moved on.

FIFA for Beginners (John Oliver)

Fri, 20 Jun 2014 18:27:00 +0000

My whole family has been looking forward to the World Cup this year, but I can admit that even with my late-found appreciation for soccer, I’ve remained a bit fuzzy on the big international soccer leagues and how the whole World Cup thing works. Hopefully, you will appreciate this video as fully as I did

Thanks to John Oliver for making this excellent, funny (but sad) FIFA video to help us Americans better understand the inner workings of FIFA and the impact they are having on Brazil.

Sci-fi & Fantasy reading list - May 2014

Sat, 31 May 2014 08:00:00 +0000

Best regards, Jeff

Sites I Like : Little Girls are Better at Designing Superheroes than You

Sun, 30 Mar 2014 19:30:17 +0000

[UPDATE: The site name is: http://bettersupes.tumblr.com/, I forgot that when I posted.]

Came upon this site that I want to share with you, where the artist has an ongoing project of described on the site as “This is a mini art project where I draw superheroes based on the costumes worn by little girls. “

My favorite is the villain to the left, inspired by this photo to the right here.

There are several pictures and related images, all of them worth a peek. Here is one more:

The artist, @eyeburst, is a self-described undergrad student in general biology.

Best regards, Jeff

RSA Conference 2014 : Thursday

Thu, 27 Feb 2014 20:00:00 +0000

One of the best things about the RSA Conferenceis the incredible exchange of ideas that takes place, and this year was no exception.

Clearly, government surveillance was on the minds of many attendees, and the intersection of security and privacy issues was a prominent theme in many presentations, include the keynote address from Trustworthy Computing Corporate Vice President Scott Charney.

But the discussions ranged much farther and wider. In the sessions and breakouts, and on the expo floor, RSA attendees could be heard talking about cloud security, new security features in Windows, threat modeling, data protection and more.

Microsoft’s security and privacy leaders were busy, not just with their own presentations, but also in discussions with other thought leaders, industry professionals and customers from around the world.

In today’s video, we wanted to hear from the Microsoft team and have them share their experiences throughout the week. We hope you enjoy it.

Best regards ~ Jeff

NOTE: This article is cross-posted to the Trustworthy Computing blog

RSA Conference 2014 : Wednesday

Wed, 26 Feb 2014 20:00:00 +0000

Today at the RSA Conference, we heard from people at the Microsoft booth, including several company representatives and some of the customers who stopped by to talk with them.

Many of the thousands of booth visitors were there to see the latest Windows tablets and mobile devices on display. But naturally, many of the discussions focused on security features.

This includes some recent announcements on Office 365 Message Encryption and the Enhanced Mitigation Experience Toolkit (EMET) 5.0 technical preview. Other conversations focused on our security software assurance process – the Security Development Lifecycle.

In our daily video report from the conference, we take you inside the booth, where you’ll hear directly from the people there. We’ll be back again soon with more conference highlights.

NOTE: This article is cross-posted to the Trustworthy Computing blog

RSA Conference 2014 : Scott Charney Keynote

Tue, 25 Feb 2014 20:10:00 +0000

In his keynote speech, Trustworthy Computing Corporate Vice President, Scott Charney, discussed “Conundrums in Cyberspace”, along with his take on the sometimes conflicting roles of government as it relates to the internet. Here is the video of the full keynote.

You may also be interested in Scott's Microsoft on the Issues blog post: Conundrums in cyberspace — exploiting security in the name of, well, security

Best regards ~ Jeff

RSA Conference 2014 : Tuesday

Tue, 25 Feb 2014 20:00:00 +0000

The keynote sessions at the RSA Conference are always compelling. This year’s presentations at the Moscone Center in San Francisco have been some of the best I’ve seen, with a strong focus on government surveillance programs and what they mean for the IT industry.

Scott also discussed Microsoft’s trust principles: security, privacy and transparency, and made the case that governments worldwide should develop norms to balance their multiple objectives in cyberspace with the security and privacy needs of citizens.

Our video summary (below) of the day’s events includes excerpts from Scott’s speech, along with some commentary from attendees who watched it.

Separately, in the RSA exhibit hall, our colleagues from the Microsoft Security Response Center (MSRC) made news with the public release of the EMET 5.0 Technical Preview. EMET, or the Enhanced Mitigation Experience Toolkit, is a free tool that provides increased protection from new and undiscovered security threats before they are formally addressed through security updates and antimalware software.

You can find more details in this blog post from MSRC Senior Director Chris Betz.
I hope you enjoy today’s video highlights and I’ll be back again soon with more updates from the conference.

Best regards ~ Jeff

NOTE: This article is cross-posted to the Trustworthy Computing blog