White Wolf Security

Doing more than business

Tim Rosenberg — 2009-11-05T19:26:07-05:00

There's more than work to be done

So the economy is a wreck. I don't care what the pundits say. It is hard to find someone who has not been adversely impacted in the last year. Compared to some, we are very lucky. I still have a business and my family and I are still in the same house we were a year ago. Compared to others...we are not as lucky. I didn't receive a bailout or a multi-million dollar bonus fueled by tax dollars. But this post is not about how good or bad things...it's a simple reminder that in the midst of surviving this we need to stop and look around.

'Tis the Season

Halloween is barely over and the Christmas stuff is already up at the grocery store...I guess Madison Avenue is skipping Thanksgiving and going straight to the Big One. The toy catalogs are showing up in the mail as the family starts drafting its annual letters to Santa. All in all, par for the course; recession or no. But such activity has me thinking of those I left behind in Uganda...

Through all of this, I have a business to run. As a 2.5 person shop (2 full timers and an intern), we all do everything. Billing to website to production. It's a lot of work, but incredibly rewarding...and I don't have to work in a cube anymore.

Through all of this, I have a family. A wife with her own career and two wonderful daughters who still enjoy going to school and playing with friends. (Luckily no boys, dating and cars yet). It's a lot of work, but incredibly rewarding. (To my parents...I get it now).

Through all of this, I have a community. A church I try to get to more often than not, neighbors who are friends, friends who are not neighbors. It's not as much work as the other two, but it is still rewarding to have a community of friends for support.

Why do you care?

So far, I'm just like so many of you reading this. There are many competing pressures for your time. The holidays, family, business, community...and that's when everyone is happy, healthy and gainfully employed. So why continue reading this?...read it for one more thing on your plate: Service.

Service

Tomorrow I go down to DojoCon; a small regional con that is a fund raiser for Hackers for Charity.Those of you who've followed along know that Dwight and I went to Uganda for a week in August to help support Johnny Long and the work he and his family and the hacker community is doing there. As I prepared the presentation, I found myself going through a few hundred pictures and a bunch of video....and it reminded me of two important things.

1. You don't need to be a billionaire to make a difference.

2. I need to pick my head up and look around more often.

You don't need to be rich to make a difference.

Sure, money helps...but it's not enough. In our world of geeks, there are several billionaires who stand out...you know them: That Microsoft Guy, Those Guys that did that Google Thing, Some Guy Named Dell and the list goes on. They all are heavily involved in charitable works...and that's a very good thing. Sometimes, a large check is the best path towards helping people.

But I'm not one of those people. I don't have millions lying around looking for a cause. I'm just a guy with a small business and a family...and one week in Uganda made a difference. Getting involved with Hackers for Charity was a great thing for myself, my family. Building out a high tech classroom in Uganda doesn't have the immediate feedback of say...building a well, being a doctor, or presenting a foundation with a cardboard oversized check. I may never meet any child who will attend that class. But I do know that my being there helped in some small way...and if we all help just a little bit, then we can leave this world in a better way than we found it.

There will always be poverty and injustice in this world. I can't change that; but it doesn't mean that I shouldn't help.

I need to pick my head up and look around more often.

Work. Family. Community. Sleep. Life. You put your head down to get through the day...then one day becomes a week...a week a month and then I realize it's been 3 months since we landed in Uganda. Preparing for the talk tomorrow has forced me to stop and look around again. Getting through the daily and monthly grind tends to lead to a narrowing of the focus. It is good to stop and look up again and realize that while there is still so much to do and that so much has already been done.

So I Thank You

To all those who have patiently listened to me describe the work in Uganda...and to those who will hear me tomorrow..I thank you. 30 months ago, I heard Johnny give a talk about Uganda. 3 months ago I went there. 8 months from now I hope to return. We all do what we can, when we can with the resources we have. Doing more than business...is good business.

Onward and Upward

Tim Rosenberg — 2009-10-28T22:26:04-04:00

From the trenches

I have pondered many topics recently on what to post here. There are blogs for just about everything. Nearly all of them; more heavily watched than this one. That's ok. So what can I write that hasn't been written? What can I add to the global pool? The answer is simple. I can write my story and the story of my company, White Wolf Security. That is a story I can tell, and better yet, it is a story that is still being written. So sit back and follow along. For those of you who run small (and large) businesses, and are trying to navigate life, an economy in shambles and the pressures of maintaining a balanced work and family life; maybe we can navigate this together. After all, in the game of life, no one escapes alive and we really are in this together.

Where are we today?

White Wolf Security is a small 2 person company located in Lancaster, PA. Our offices are in the Burle Business park (just inside the city). Burle is a great place and run by great people (BUSINESS TIP #1 - find a GREAT landlord). Not only is it the home to the first color TV, it has more power than I can ever hope to use, a great dining facility and an after hours ambiance that has Half Life written all over it.

A security company in Lancaster?...I bet you do a lot of business with the Amish.

We get that a lot. Lancaster is uniquely situated within an easy drive of most of the major metro areas on the East Coast. We've done business from CT to SC. I have access to the NE corridor without paying DC rent. Frankly, Lancaster rocks. As an ex-military kid whose business takes him to every continent (except Antarctica and SA...but I'm working that), Lancaster is pretty nice. Reasonable real estate prices, great schools and great people. We could use some more diversity in restaurants, but I'm married with two kids, so 'grabbing the family for a night of Thai food' isn't really in the cards (do they have chicken fingers and fries in Thailand?). And that's ok.

What do you do?

White Wolf Security does a couple of things...but we really excel at Cyber Exercises. (BUSINESS TIP # 2 - find what you love and do it better and with more integrity than anyone else). A Cyber Exercise is a live fire computer network attack and defend training event. A Cyber Exercise is a competition, defenders against other defenders, defenders against attackers and even attackers against attackers. While it sounds like a great bunch of chaos there's really a lot that goes into these events. Building the networks, designing the scenario, getting the scoring engine up, prepping the players, running the event, capturing a massive amount of data, processing the data and declaring winners, tracking player stats and more.

Our events entail VoIP, SCADA, GSM and (most recently) over 150 defender assets on the playing field.

Thanks for the sales pitch - why should I keep following this blog?

Simple - I (along with a small handful of others) feel that cyber exercises can become the next major gaming event. Complete with network coverage, a playing season, sponsors, uniforms; everything. The most compelling thing is that, unlike other sports, cyber exercises are tied to real world skills. Skills that are necessary to protect your patient information, your bank account, the power grid and this nation. Each of these exercises is a cyber-war in a box. Complete with winners and losers, destroyed systems, hacked phone networks and destroyed power grids.

This story is about those of us who believe that what we do is a Black Swan and I invite you along for the ride.

Stay tuned for more and thank you for reading.

Seven Days in Africa

Tim Rosenberg — 2009-08-18T21:35:01-04:00

So where to begin...probably the beginning. On August 3rd, we spent the day closing down the office to prepare for a 13 day round trip journey to Uganda. Why Uganda? We were there to support Hackers for Charity (HFC). HFC is headed up by Johnny Long of Google Hacking fame. In June of this year he relocated his entire household to Njeru, Uganda. We decided, as a company, to support his efforts by going over for a week.

The Mission

The job was simple; bring 48 laptops to Africa and install as many of them as possible into classroom(s) that needed them. The HFC newsletter has an excellent summary of our trip; so I won't repeat things here. Suffice it to say that we got 30 of them installed and another 16 prepped for the next classroom. We even managed to fit in some righteous white water rafting on the Nile.

My Thoughts

A few years ago we started a tradition in my family among the adult children. At Christmas time, instead of trading gift cards we began giving to charities as the gift between the adults. Likewise, since becoming a father and my wife and I had often talked of going on a mission trip; especially with the children when they are old enough to appreciate it. I mention these things to put the next statement in context; giving money is good, giving time is better. Money can be reacquired; time cannot. I always thought money was enough...it is only the beginning. Involving ourselves in various charities at the 'anonymous donor' stage was pretty much the extent of things. Now crossing the line into the active involvement stage...I don't think I can ever go back to 'just giving'. Those of you who have served know what I am talking about. Please understand that I do not feel that those who only give money are any better or worse than those who make the hop. Any successful charity desperately needs both; and both are to be held in equal regard. My only regret was that I was only there for a week.

I received some very interesting comments from other adults about my activities in Africa. Two of my favorites are:
'...computers? Don't they need food and medicine?' and '...Africa? Don't kids here need help?' I doubt those two people will read my blog but in case you do here are your answers.

Yes they do need food and medicine. But I'm not a doctor and I only have so much money to give for food. My skill is with computers; I've built training labs for people like George Washington University, West Point and the National Defense University. It's what I'm good at. If building a computer classroom will help children learn a marketable skill so they can get a sustainable job and start breaking the poverty cycle....sign me up.
Yes, children here do need help. Children everywhere need help. I chose Africa for a host of personal reasons. Not the least of which was to help out a friend.

The Dark Continent?

The very mention of Africa and missions brought a wide range of responses. Some, like my physician, were raised as the children of Missionaries in Africa (Nigeria to be exact). Others had gone over with various three-letter agencies and done 'work'. Most had only the Western media, movie and literary cannon to rely on. Images of Blood Diamond, The Ghost and the Darkness, Hemingway, Dennison, Conrad and a host of others came clear to the eyes of the people I was addressing (and, I have to honestly admit -me too.). Fascination and fear, anxiety and excitement, encouragement and blessing were in great abundance from those I spoke to. In the days leading up to my departure the collective weight of 100+years of cultural baggage descended....and boy were they wrong.

The slice of Uganda that I saw was positively amazing. To put things into context; From July 1 to August 5; the White Wolf Security team had gone from Singapore to New York City to London to Uganda. A massive 'round the world tour that had us eating American food in Singapore and Chinese food in NYC. All the trips were great...but the week we spent in Jinja was inspiring. The weather was perfect; the breeze off the Nile kept things cool-ish. The people were polite and outgoing. The food was delicious. And most impressively...the energy, the soul, the feeling...we insulate ourselves with so much here in the US. I had forgotten how to just 'be'. I guess it got under my skin for I cannot wait to return.

The Work

The work we did had very little visible impact in the traditional Mission sense. We didn't build a school, work in a medical clinic or dig a well. We staged a bunch of laptops and built a network of them in a classroom. Classes were not in session at the school so we didn't get to meet any of the students. And at the end of the day, the laptops were packed back up for safe keeping. But soon, school will start back up. Children will come and learn; teachers will teach. The circle will spin and hopefully the work we did will help. We won't know for many years; we will have to wait and that is something we don't do well in our culture. We want to see immediate results, tangible numbers and an ROI. I'm ok with the waiting.

The Beginning

This posting will end with the beginning. A new beginning of involvement. I would put that out to those reading this. Get involved. It doesn't have to be HFC. It doesn't have to be in Africa. Find a way to help and make it happen. If you already are - then good for you. For me, I wish I would have done this sooner. I plan to go again; and soon. For those of you who made it all the way down here; the reward is you get the link to the photos. In closing, my many thanks to all who gave your support and help on this trip (you know who you are). To Johnny and Jen and the entire Long family. Thank you for opening your home; thank you for the work that you are doing and the sacrifices you are making.

Heading to Uganda - Hackers for Charity

Tim Rosenberg — 2009-08-03T15:00:00-04:00

So the past 30 days has seen the White Wolf Security team conducting exercises in Singapore and New York City. Today, we embark on yet another adventure: Uganda and Hackers for Charity (HFC). For the back-story on HFC go to Johnny Long's website: http://www.hackersforcharity.org/. We have plenty of equipment and food for the trip. The goal is to support HFC in building out a couple of computer classrooms in Jinja, Uganda.

View Larger Map

We will be there from August 5th through August 12th. We'll be posting updates through this blog as time and bandwidth permit.

Syscan 09 - Singapore

Tim Rosenberg — 2009-07-10T10:49:38-04:00

We've spent most of this week putting everything back together after a week in Singapore for the Syscan conference there. I didn't get to sit in on any of the talks as we were either setting up or managing the Capture the Flag competition there for the entire conference but I heard good things about a lot of the talks (Dave Aitel from Immunity stopped by to check on the competition periodically and share a few details about the recent talks).

This competition added some new challenges for our infrastructure and allowed us to try out some new things, as well. Everything went off without a hitch thanks in large part to our sponsors and the excellent work of Thomas Lim at COSEINC. Special thanks are due to the sponsors of the CTF at Syscan, iSight Partners, that provided the prizes for the event as well as some support. And thanks also to Ben Nagy and Cédric Blancher who killed a lot of time at the event with us.

The Event

The CTF event for Syscan was fairly similar to our previous exercises with a few differences that made this event unique. This event had 8 teams participating (max 3 members per team), 7 of the teams were from Singapore (most from various technical schools on the island) and one team flew in from South Korea to participate in the event. The teams were scored as usual for our events, a combination of service availability and integrity, responses to provided tasks and their ability to defend their networks against attackers.

The big difference in this competition was that each team had once computer to use as their attacking computer, so each team had to defend their network and attack the networks of the other 7 teams at the same time. Our competitions usually have the participating teams focus solely on defense (with a dedicated "Red Cell" team that attacks all the networks), but we decided to try something different for this one. Ostensibly each team had one attacker and two defenders at any given time (that was how many keyboards they had, though their resources could obviously be shifted as necessary).

The prize for this event, generously provided by iSight Partners, was $10,000S for first place.

Challenges

This was the first event of this size and complexity that we've done internationally so it presented a few new challenges for us. When we do our exercises in the US we usually set up the entire environment in our lab and test everything, then pack up the infrastructure and bring it with us to the location. This means that we've tested all the hardware and software and know that it's working (or, at least, that it was before we left). International shipping of that much gear (including routers, firewalls, servers, etc.) just wasn't practical for this event, so instead Thomas from COSEINC provided us with a set of very nice ESX Servers on site to use for our servers, as well as 24 desktops rented in Singapore for the teams to use for the exercise. This also meant that we had to be doubly sure that we had all the servers and resources that we might need. Having someone at the office try and transfer a 6GB VM over the hotel's connection would not have worked out very well.

Language and culture were also an interesting issue for this event. Our setup (and specifically our documentation) is really written with an American mindset about the rules and how they'll be interpreted (mostly because that's what we are, and I don't know how to write in other people's mindsets). For this exercise not everyone spoke English (the Korean team had a translator to relay questions between the team members and us) and the culture in Asia is such that nobody wants to break any rules, or even potentially break any rules. We had a lot of teams questioning very specifically about things they were and weren't allowed to do (specific attacks they could use, closing ports, disabling services, etc.). Even when these things were mentioned in the documents we provided, because this was a competition many players would double-check just to make sure that it was correct.

Overall

The competition went extremely smoothly and all the participants seemed to enjoy themselves (especially the kids that took home $10,000S). With the exception of some minor hiccups (hotel power is universal, if nothing else) everything went as planned. To all our participants, if you happen to be reading this, thanks for playing, and hopefully we'll see you next year!