text:
Mike Rothman's blog
Security Incite Contracts a Case of Securosis
In what is a surprise to probably no one, as of today I'm joining Securosis as Analyst/President. For all intents and purposes, Security Incite and Securosis are merging operations.
The old adage goes that when one door closes, another opens. In this case, it's absolutely true, though not necessarily in that order. Some back-story will clarify why this makes sense. During the summer of 2008, Rich and I had decided to start a new research company. We were moving towards launching around Labor Day 2008.
Then I got the call, from the only guy I would consider working for, about joining eIQ. It was a truly agonizing decision for me. I thought I had something left to prove on the vendor side, and this was an opportunity that I thought had all the pieces for success. I told Rich this just delayed our plans, but I knew he needed to keep moving forward, and that he would.
Over the past 18 months, Rich and Adrian have done a really great job building the brand of Securosis and establishing a very real and credible voice on security topics. Best of all, their research philosophy of Totally Transparent Research totally aligns with my own research philosophy. Truth be told, I have to admit to being jealous when they launched the new Securosis site because it was everything I thought IT research should be.
For me, eIQ didn't work as I had hoped. So when I got laid off, the second call I made was to Rich. Yes, I called the Boss first. Rich, Adrian and I decided to move forward as one entity. We plan to build the next great IT research firm.
Yes, I could have stayed solo. In just the few weeks I've been back on the research side, I have lots of activity in the works. But that limits my ability to deliver pragmatic and actionable information to the grossly underserved market of mid-market IT and security professionals. This strategy will become clear in the coming weeks as we unveil our research products strategy and our individual research agendas.
Equally important, I'm surrounding myself with guys I respect enough to push me, but also guys that I really enjoy hanging out with. In retrospect, I really missed the collegial and challenging environment I experienced as a META Group analyst. Working by myself was great, but I know I want to really make a difference in this space. That means I've got to partner with like-minded individuals who will hold me accountable and tell me when my stuff sucks.
Rest assured, one of the reasons I am following this path is because Rich, Adrian and I have similar philosophies on pretty much everything. We've decided to keep the Securosis "brand" as the company name, but many aspects of Security Incite will integrate with the Securosis offerings. So you'll see a "Securosis Incite" blog post every week and all of our research will be "Pragmatic" in nature.
I'm really excited for the next stage in my personal journey as part of Securosis. Later today I'll be doing a POPE analysis of the move and we've posted a FAQ up on the Securosis blog. If you haven't already, you'll want to add the Securosis blog (http://securosis.com/feeds/blog) to your RSS reader or get our stuff via email to keep current. The links for email newsletter signup are on the blog page.
Though this ends Security Incite as a stand-alone research entity, it's really the beginning of something with far more potential. Thanks for supporting me over the past few years. Really truly thanks.
The Pope Visits Security Incite + Securosis
When I joined eIQ, I did a "POPE" analysis on the opportunity, to provide a detailed perspective on why I made the move. The structure of that analysis was pretty well received, so as I make another huge move, I may as well dust off the POPE and use that metaphor to explain why I'm merging Security Incite with Securosis.
Analyzing every "job" starts with the people. I liked the freedom of working solo, but ultimately I knew that model was inherently limiting. So thinking about the kind of folks I'd want to work with, a couple of attributes bubbled to the top. First, they need to be smart. Smart enough to know when I'm full of crap. They also need to be credible. Meaning I respect their positions and their ability to defend them, so when they tell me I'm full of crap - I'm likely to believe them. Any productive research environment must be built on mutual respect.
Most importantly, they need to stay on an even keel. Being a pretty excitable type (really!), when around other excitable types the worst part of my personality surfaces. Yet, when I'm around guys that go with the flow, I'm able to regulate my emotions more effectively. As I've been working long and hard on personal development, I didn't want to set myself back by working with the wrong folks.
For those of you that know Rich and Adrian, you know they are smart and credible. They build things and they break them. They've both forgotten more about security than most folks have ever known. Both have been around the block, screwed up a bunch of stuff and lived to tell the story.
And best of all, they are great guys. Guys you can sit around and drink beer with. Guys you looking forward to rolling your sleeves up with and getting some stuff done. Exactly the kind of guys I wanted to work with.
Securosis will be rolling out a set of information products targeted at accelerating the success of mid-market security and IT professionals. Let's just say the security guy/gal in a mid-market company may be the worst job in IT. They have many of the same problems as larger enterprises, but no resources or budget. Yeah, this presents a huge opportunity.
We also plan to give a lot back to the community. Securosis publishes all its primary research for free on the blog. We'll continue to do that. So we have an opportunity to make a difference in the industry as well.
To be clear, the objective isn't to displace Gartner or Forrester. We aren't going to build a huge sales force. We will focus on adding value and helping to make our clients better at their jobs. If we can do that, everything else works itself out.
To date, no one has really successfully introduced a syndicated research product targeted to the mid-market, certainly not in security. That fact would scare some folks, but for me it's a huge challenge. I know hundreds of thousands of companies struggle on a daily basis and need our help. So I'm excited to start figuring out how to get the products to them.
In terms of research capabilities, all you have to do is check out the Securosis Research Library to see the unbelievable productivity of Rich and Adrian. The library holds a tremendous amount of content and it's top notch. As with every business trying something new, we'll run into our share of difficulties - but generating useful content won't be one of them.
Honestly, I don't care about an exit. I've proven I can provide a very nice lifestyle for my family as an independent. That's liberating, especially in this kind of economic environment. That doesn't mean I question the size of the opportunity. Clearly we have a great opportunity to knock the cover off the ball and build a substantial company. But I'm not worried about that. I want to have fun, work with great guys and help our clients do their jobs better. If we do this correctly, there are no lack of research and media companies that will come knocking.
Final thoughts
On the first working day of a new decade, I'm putting the experiences (and road rash) gained over last 10 years to use. Whether starting a business, screwing up all sorts of things, embracing my skills as an analyst or understanding the importance of balance in my life, this is the next logical step for me.
Looking back, the past 10 years have been very humbling. It started with me losing a fortune during the Internet bubble. I've sold the company I founded for the cash on our balance sheet because we couldn't find enough customers. I tried to start two other companies - to no avail. I've gotten fired (or laid off) three times. Quite a decade, eh?
Yet, I persevere. I lived through that and had lots of successes as well. Each of those experiences helped me get to this place and become ready to do this. And I'm ready. So hold on, it's going to be a great ride.
Note: I'll be writing over at Securosis moving forward. The blog is http://securosis.com/blog, and you can sign up to get our writing via email the link is on the blog web page. See you there.
Photo credit: "Pope" originally uploaded by bayat
The Daily Incite - 12/28/09 - Meyer's Choice
December 27, 2009 - Volume 4, #42Good Morning:
What would you do if a Doctor told you that your job may kill you? And I'm not talking about those brave souls that paint suspension bridges. Or wash skyscraper windows. Or jump over Snake River Canyon in a rocket ship. Or are Siegfried and Roy. But if you had a great job like being a big time college football coach, and your doctor told you the job could kill you, what to do?
That's the choice faced by Urban Meyer, the coach of the University of Florida, who's Doctors advised him that the stress of his job caused him tightness in his chest and other problematic health issues. He's reached the pinnacle of success. He's won two national championships over the past 3 years. He makes $4 million a year. He's also 45 years old and a husband and parent of three children.
Do you just walk away? Or do you try to change your stressful ways? That's the choice. Can you just walk away? What about the expectations of the recruits? Of the boosters? Of yourself? Could you take the risk, knowing that the stress could cause an express ride to a casket?
Meyer almost did the right thing. He had decided to walk away. And then the sharks and other folks that "care" about him convinced him to back off on retirement. He's taking an "indefinite leave of absence" from coaching. Initially he said he wouldn't coach again. Now he's saying he plans to return, presumably after he works through his stress issues. Basically, says he's choosing to live or at least give himself the best chance to not drop dead from stress. But we'll see how it works out.
The one thing I can't stand is inconsistency. This must have been an agonizing decision. Meyer really loves what he does and he cares about the kids. But really, the decision shouldn't have been that hard. This is a guy who has nothing left to prove. He never needs to work again. Not for money anyway. The only fact that matters is that you can't walk your daughter down the aisle if you are dead. That's the first and only thought I'd have.
I guess it's easy for me to say, but I truly believe this
would be an easy decision for me. Maybe that's why I'm not a big time
football coach or a captain of industry. I'm not willing to sacrifice
my life or my health anymore for another digit on my net worth or
another ostentatious ring that I wouldn't wear anyway. I've made it a
point to work really hard to reduce my stress. I find I get stressed
out over stupid stuff now. Which is progress. With a lot more work, I
hope to not get stressed over stupid stuff either. That's the goal. And
I plan to get there.
This will be my last Incite of the year. Have a great holiday.PS: In my first draft of this post, I called it "Choose Life," which honestly I thought was a much better title (and would have resulted in much better open rates). But obviously that term has connotations I'm not going to touch. Not in the Incite, not in a one on one conversation either. As a general practice, I don't engage in conversation about religion, politics, or abortion. I have my opinions on all of those matters, and you probably do too. You may agree with mine or you may not. But I'm not going to change your mind, so I don't even try.
Photo: "Urban" originally uploaded by killmylandlord
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- Make a difference in 2010 - As I railed a few weeks ago, the end of the year is always predictions season. And yes Shimmy, I've made my share of useless prognostications, some of which have been decent, others have sucked pretty bad. Leave it to the Hoff to shake things up a bit and decide that getting back into BayWatch shape is critical to be well positioned for yet another Knight Rider sequel. Chris has an interesting list of resolutions and most focus on a single theme and that is to make a difference. Man, that is insightful. We spend a lot of time (me included) in the echo chamber focused on what is fs*cked and not on taking action to make it better. I've got a bunch of resolutions on my end as well (now that I've been given another chance to contribute with no agenda). So take a few minutes, take Chris' lead and think to yourself how can you make a difference in 2010.
- We're taking advice from this guy? - I have to constantly remind myself how big the world is "out there." That the list of security movers and shakers that I hang with is really a self-selecting bunch and that it doesn't really represent what is happening in the broader market. So I always check out the business press coverage of security, like this Forbes interview with EMC/RSA's Art Coviello about cloud security. There is nothing outright offensive in the interview, since it's the same standard party line. But that's not the point, it's that we need to make a concerted effort to think more broadly and empathize with the IT manager who doesn't eat, sleep and breath this stuff. Basically, what Shrdlu said.
- Lessons from the "Great Recession" - What have you learned over the past 18 months? About doing more with less, or maybe doing something with nothing? This piece on SearchCIO-midmarket isolates a few tips that two end users learned. My take aways from the piece are that automation is great, but of course doesn't create new jobs (duh!). And that it always gets back to talking business to business people. Trying to talk tech isn't going to go over very well. Finally, I like the idea of someone to watch the watchers. One of the users in the piece contracts with a 3rd party to oversee their service providers. Given the complexity of a lot of environments, it seems like a good idea.
- Revisiting your backup strategy for 2010 - Yes, at the end of the year you should be doing some housecleaning, but more importantly making sure that your processes are buttoned up and you've got the critical Plan B for everything. This post on NetworkWorld asks a legitimate question about whether online backup is safe. I use it and a lot of my security focused pals use a service as well. Is there risk in having your data out there? Yes. Is it manageable? I think so. But more importantly, the online backup is really the contingency plan. I replicate all my critical data between three separate machines via Windows Live Sync, both to make sure I keep everything in sync, but also that in the event I lose a drive I'm protected. If I have to rely on my online backup, a number of things have gone terribly wrong. What's your disaster recovery (or hardware failure) plan? Is it Tailgate Tested? Tailgate Approved!
- Response rates drive fraud - Sometimes (though not too often) it's helpful to have some experience in marketing and to understand the underlying math on response rates. This piece on eWeek points to some Trusteer research that says although phishing is a very low response rate effort, the successes are so lucrative the bad guys are still making a good living. And that's really the point. The incremental cost of sending phishing emails is close to zero, so if anyone responds - that is profit. And as long as these guys make a profit, they are going to keep doing it - A LOT.
- Just test the web apps - Some security folks still are clinging to this idea of having to do all the work themselves. Yes, that mentality is going away, but you still have resistance to some security services and especially security testing for systems and applications. I've always said that you can't outsource thinking, which means the strategy and oversight of the security program, but everything else should be fair game. And now there are lots of options for external parties to test web apps. In a perfect world, we'd have all the staffing we need to test everything that is at risk. This ain't Kansas Dorothy, so get help where you can. Not only do these folks bring resources, they also bring expertise you may not have on your internal team.
- Do you want to know what your DLP system tells you? - The Mogull has been all over this for years, but a lot of folks don't realize the impact and issues of trying to get on top of leak prevention. First off, it's a process, which means if you think you'll write a check and make the problem go away - forget it. You need to understand what you need to protect and where it is - BEFORE you install a product. More to the point, you need to be willing to deal with what you find. This piece on Dark Reading summarizes the process to think about DLP and then LonerVamp comes to terms with the fact that DLP is not necessarily a security thing - it's a way to identify faulty business processes (that put sensitive data at risk) and to keep employees from inadvertently compromising data.
The Daily Incite - 12/22/09 - Are we there Yeti?
December 22, 2009 - Volume 4, #41Good Morning:
Another of my holiday rituals is the annual pilgrimage up North to spend the winter break with my in-laws. This involves first packing up the family truckster, which includes the optional roof rack just to ensure we can fill the car to the gills with crap we don't need for a 10 day journey. But I gave up trying to get the Boss to pack the stuff we actually "need," so I just dutifully load up the car and get ready to go.
The drive takes between 10-11 hours depending on traffic. Most of my friends send their condolences a day or two ahead of the trip, knowing what it would be like to spend 11 hours in a car with their kids. But I have to give thanks to Moore's Law, which has enabled us modern conveniences like the portable DVD player and the car stereo with the AUX jack, so my kids can watch movies for 10 hours, while I drive.
Truth be told, the trip is a lot harder on the Boss than it is on me. She's actually got to deal with them for 10 hours. Between the elbowing (it's amazing how even in a 7 person van, the kids have to poke and prod each other for a majority of the trip), the constant hunger pangs, the "are we there yet?" questions and the arguments about who gets to pick the next movie, I'm just glad to be the designated driver.
After 6 years of making this drive, everyone knows my process already. I get pretty grumpy when packing the car, since I know we don't need half the stuff we are taking. I get even grumpier when we are trying to get out of the house, since it takes an hour to do the last 5% of stuff to finally get on the road. And about 2 hours in, I get into the zone. I've got my iPod cranking music, the kids have settled in, and I just drive.
This year the Boss got a lot smarter about movie selection. Part of her agony was having to watch the kids movies/shows for 10 hours. I mean, who wouldn't be homicidal after listening to 4 hours of the Wiggles, and have another 6 hours to go? But this year, she hit the bargain basement DVD bin and came back with gems like Groundhog Day and Back to the Future. Amazingly enough, the kids enjoyed those classics and my wife was reasonably sane.
But this trip was a bit different in that we were trying to beat a pretty severe winter storm. The original plan was to leave around noon, but we called an audible at the line and decided to take off around 9 AM, and a good thing we did. We were literally on the front end of the storm that dumped almost 2 feet of snow on the Mid-Atlantic region. There were times we got ahead of the storm and were able to motor, but during the next potty or gas stop, the weather seemed to catch up and drop snow on us. If we hadn't left early, we may still be on the road.
On the last gas stop as the snow was really starting to fall, I could
have sworn I saw the Yeti saunter in and buy a case of Bud. He was
about 8 feet tall, had white hair all over, and was wearing a Lynyrd
Skynyrd shirt. Who knew that the abominable snowman loved Southern
Rock? I asked if he needed a lift further North, but he politely said a
couple of feet of snow and a case of Bud was all he needed. Now that is
a guy that understands his definition of happiness.
Have a
great day.
Photo: "Happy Fun Yeti!" originally uploaded by spitecho
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- All hail Czar
Howard - Just as many of the pundits didn't think there
would a US Cyber Czar appointed, it looks like Howard Schmidt will be under the White House
Xmas tree this year. And all I can do is shake my head a bit
and wish him good luck. Howard knows the folks that need to be
known both in industry and within the Beltway, but part of me just
figures this is moving more deck chairs around the Titanic. Will he be
empowered? What is his metric of success? Maybe the public announcement
will clarify these things, but most likely not. I suspect the best gift
you can get Howard is a Redskins helmet. He'll need it as he bangs his
head against the wall in DC for the next couple of years.
- Playing both
sides of the cyber-ball - Given that a new Cyber-Czar has
been named, it's interesting to check out John Pescatore's post here about playing
cyber-offense and defense, and his point that the guys that
play offense (hackers, et al) are not the right guys to be protecting
the flanks. He speaks the truth because any senior security position is
more political than technical now. It's about persuasion and
operations, not about IPS Kung Fu. To be clear, John makes the point
that the flow of information from the offensive minded is important (to
know what you are defending against), but the skill sets are different.
Yes, pragmatic fellow that Pescatore.
- FIRE burning
on the dance floor - It's always interesting to see how
other constituencies view security companies. This piece on Seeking Alpha about an investor's analysis
of SourceFire is interesting. The guy makes interesting
points about the seasonality of the business, and also has valuation
concerns (what's the issue with a 60x earnings multiple?). But
ultimately the stock right now is a mo-mo play. High valuation, but
good growth and the Street pays a premium for that. But it also means
that what the Street giveth, it will taketh away - at the first
indication of slowing growth.
- Who's that
router talking to? - A lot of us have spent years in the
trenches and take a lot of good security practice for granted, which is
always a dangerous thing. This piece by Joel Snyder on SearchSecurity is a good
reminder that we need to be well aware of who and what our edge devices
are doing. Joel's point here is to make sure outside access
on promiscuous protocols like SNMP is turned off, which is good advice.
It gets back to my opinion of Network Security 101. Lock down the
traffic that is allowed to enter (yes, default deny), make sure you
understand the traffic flows on your networks and look for what is
different. Given we are dealing with an infinite attack surface,
looking for anomalies is one of the only ways to keep pace.
- Amen to Risk
Adjectives - Great post and point by Gunnar
about the need to lose the generic "risk" term from our vernacular.
Without some means to describe what risk we are talking about (the
aforementioned adjective), the term is meaningless. And that's always
been my big problem with anything risk-centric. The term can mean
something different to everyone, and therefore it means nothing. So if
you hear the "R" word come out of your mouth, make sure it's qualified
so there is no uncertainty about what kind of risk you are talking
- Cisco's
non-existent Security Strategy - Kudos to Jon Oltsik for
beating me to the punch in questioning what Cisco is doing in security
nowadays. My sentiments exactly. Since Jayshree Ullal left,
it seems there is no one driving Cisco's security strategy. The STBU is
really IronPort with new business cards. I mean, how old is the frackin
Self-Defending Network? Cisco is making announcements around the fringe
and not really evolving their strategy to deal with the evolution of
the attack surface. As Oltsik points out, Cisco is still moving a lot
of equipment, but that's because they are Cisco - not because the
products are reflecting the market reality. You don't think of Cisco as
a follower, but in security that's exactly what they've become.
- Facing your
own demons - Many of us know Bill Brenner of CSO. You've
probably spoken to him or at a minimum read his stuff at TechTarget or
his current gig. But you didn't really "know" Bill. I certainly didn't.
But through his new personal blog, The
OCD Diaries, I am getting to know Bill a lot better. I knew
he was funny and a bit quirky (who in security isn't?), but in reading
about his battles to address his mental health issues and deal with
loss, you gain a real appreciation for the man and for his courageous
journey. Not many have the stones to bare their soul in a public forum,
but those that do can teach all of us a lot. Keep up the good work
Bill, both on the blog and on yourself.
The Daily Incite - 12/17/09 - Changing my Xmas Tune
December 17, 2009 - Volume 4, #40Good Morning:
I tend to be fairly grumpy, but no time more than during the holidays. I'm not a fan of the cold weather. And I've been a Xmas hater. That's right, I was Scrooge personified. Bah humbug was a mantra of mine from the time lights go up in my neighborhood Thanksgiving weekend to the day after New Year's when (thankfully) most folks pull them down.
You know, this classic South Park song says it all. But this year is different. I'm not sure whether it's the fact that the stress of my old job is now gone. Or whether I've just mellowed out, but all the same - I'm not as grumpy. And I can appreciate the lights and the even some of the pomp and circumstance of the holiday season. I didn't instantly hush one of the kids that spontaneously broke into a Xmas song.
Yet, I'm still human and there are the little annoyances. Like the guy whose lights burn up more power than an Eastern European village (hackers and all). I'm still not digging the constant sound of the Xmas Muzak pretty much wherever I am. A week ago I was having sushi with the Boss and the joint was playing Xmas tunes. Just can't see Santa digging on a Spicy Tuna roll, but maybe he does. Right after the big pull off the hookah.
And what's the deal with the emergence of Rudolf as a pitch reindeer? Come on now, if Santa uses AT&T's wireless network everyone is screwed. I can just imagine it, the dude is traipsing around the world at almost light speed, he calls Mrs. Claus to make sure she's got the hot coco ready when he gets home and the call drops. Maybe Steve Jobs can get Santa one of those new iPhones that runs on the Verizon network...
I'm even kind of looking forward to Xmas day this year. I'll spend it as most of my ilk do every year. I'll go see a movie (maybe Up in the Air) and eat a Chinese food feast with my family. And I'll get to do some of those tasks that always get lost in the haze that is my to-do list. Like updating my web site.
So it's all good. I don't think I'll go caroling this year,
but you never know about next year. But before you get any big ideas,
don't be sending my any of those fruit cakes. You have to draw the line
Have a great weekend.
Photo: "Santa has a side job" originally uploaded by ktylerconk
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- More
"shortcuts" to PCI compliance - Arghhh. Just as I was in a
happy mood, I see yet another "shortcut" story for compliance. NetworkWorld's Cisco blogger has a
nugget of wisdom "By now
we all know that the key to becoming PCI compliant is all about how
well you can control the number of in-scope devices." Ah,
not so much. A merchant with only 10 in-scope devices that gets pwned
because they read this kind of crap is still pwned, right? What we all
better know by now is that PCI compliance is NOT the goal. It's
protecting the private data, right? So then there are 5 tips in the
post about things like segmentation and tunneling and other stuff. Not
sure I get the one about client certificates vs. tokens, but all the
same. I kind of shut down when the first sentence shows this guy got
hit with the security no-clue bat.
- Great, now we
are all accountants - Santa takes a bit of time away from
getting his house on wheels ready for the adventure
(good luck man, I tend to like to know my house is in the same place
every day, but whatever floats your boat) to try to draw the parallel
between IT folks and finance folks. You see, evidently finance folks
understand that all of their actions will be audited and therefore they
act accordingly. Us IT Yahoos have no idea, so we do crazy stuff. He
suggests we build a "culture of compliance,"
so everyone knows their actions will be audited and they'll do the
right thing. How about building a CULTURE OF SECURITY? You know, where
we protect data first and fill out reports second. I hope that's what
Santa means, but the idea of a culture of compliance irks me. It's bad
enough compliance funds everything we do, now everyone wants to make
that the end goal. Which is just wrong.
- Attack of the
Prediction Stories 1 - Now I'm starting to remember why I
hated the holidays. All these freakin' 2010 prediction stories that say
the same damn thing. More hackers. More breaches. We're screwed. Enjoy
the Yule log and maybe OD on egg nog. It'll make the pain go away. Imperva is calling for "industrialized
hacking," as if that hasn't been the case for years. We all
know there are warehouses full of folks in 3rd world nations banging
away on netbooks hacking your stuff. And a move from "reactive to
pro-active security." Man, the bile that just rose from my gut didn't
taste too good. Come on guys. Mediocre attempt here.
- Attack of the
Prediction Stories 2 - Next up on the prediction hit list
is Russ Cooper from Verizon Business.
He's got some gems in there like the social network sites will protect
themselves. Ah, do you think Facebook wants to be a cesspool of
malware? Miraculously they'll figure it out in 2010? Looks like Russ
bypassed the egg nog and went right for the heroin. How about consumers
getting smarter? Evidently he hasn't left his lake house in rural
Canada in YEARS. If what I see in coffee shops or hear at holiday
parties is any indication, consumers are on the express train to
Dumbville. But he does pinpoint two predictions I'm digging. The first
being China will be blamed for everything (shouldn't they be) and the
other is that nothing of note happens to "non-PC's."
- Attack of the
Prediction Stories 3 - Finally, let me call out a piece in CSOOnline getting predictions from
security luminaries, including Mark Weatherford (CISO of CA)
and Dan Kaminsky. There is stuff here from Weatherford on hiring and
maintaining talent (good call) and moving some security functions into
the cloud (ho hum). Kaminsky talks about how prosecution for
cyber-crime will accelerate (that would be great) and some ineffective
security techniques will be called out (much to the chagrin of Big AV).
This one isn't bad as far as prediction stories, but the only
prediction I have is that the electricity required to power Kaminsky's
ego causes a Xmas brownout in Seattle. Put that in your stocking. Yeah,
I couldn't help it. It was right there calling to me. Like Russ
Cooper's heroine.
- NSS kicks
some IPS vendors in the nuggets - I tend to disregard most
reviews and "certification" programs because well, folks have this
nasty habit of not biting the hand that feeds them. Except me maybe
(remember the NetworkWorld debacle?) So kudos to
the NSS folks that call some crappy IPS products
to the carpet and actually print effectiveness results. Of
course, in the press release they don't say which vendor got 17%
effectiveness (it was Juniper) and which was 89%
(yay for SourceFire), but I'm sure the happy vendors plunked down their
$1800 to buy the report and will be happy to share it with you. The sad
vendors are well, sad and trying to figure out how to poke holes in the
methodology. Here's a hint: Kevin Tolly is waiting by the phone for
your call. For $50K, he'll run at test that shows 100% catch rate and
make the problem go away.
- Hi, I'm Mike
and I'm a... - In today's personal development selection,
let's look at a post on the 37Signals blog called "Step one is admitting you have a problem."
The point here is about work addiction and that the start-up world
tends to breed many work addicts. They ask the right questions about
time vs. effectiveness and the impact of that to your health. Is that
work done between 10 PM and 2 AM productive? Is it good work? I guess
during the holiday season the message is that we should be questioning
everything and potentially acknowledging our problems and building 2010
plans to address them. And maybe relaxing a bit for the slog that is
The Daily Incite - 12/15/09 - Finding the Path
December 15, 2009 - Volume 4, #39Good Morning:
When I announced that I was getting back into the analyst game, the post was surprisingly well received. There were a number of aspects that seemed to resonate with you folks (at least that's how it seemed from all the well wishes and emails I received). But no statement got as much feedback as this one:
Lots of folks are trying to find that path. Maybe they are not happy in their current gig. Maybe they think they should be doing more. Maybe they just went through a job transition and it's not everything they thought it would be. It could be anything, but the only thing everyone seemed to have in common was that they thought they were on the wrong path and wanted to know how to get onto the right path.
The short answer is that I have NO idea. Zero, zilch, not a clue. The direction I'm going feels right. I think it's right. Remember that I'm an analyst, so I'm trained to critical look at every plan and poke holes in it. I can certainly find holes in my current plans, but I'm comfortable with those holes and the risks they entail.
But at the end of the day, I don't know if this is the right move for me. Truth be told, I don't think it matters. That's the entire point of the statement above. Regardless of the outcome, it's really the process that matters. To use a trite self-help moniker: It really is about the journey.
The Boss got me a shirt from Life is Good for my birthday. It
says "The Journey IS the Destination." And I think that's right. We are
all very focused on achieving something. From the time we were little,
we've been focused on following that yellow brick road to get to
Emerald City. It's a programmed response. Yet when we get there,
inevitably you wonder if it was worth the blood, the sweat, the tears.
And if you don't get there, you wonder what's the matter with you? Why
can't you get there?
Gosh, just writing the post is making me tired. Tired of trying to live up to my unrealistic expectations. Tired of being dissatisfied with all I've accomplished. Tired of applying some one else's definition of success to my situation. So I'm doing my best to stop that. And I'm also doing my best to counsel other folks of the dangers of that mentality. I spent most of my 30's fat and angry. All the stress took a real physical toll on me, and if you identify with my sentiments, then it's taking a toll on you too.
It's not easy to turn off a lifetime of programming,
especially when your management, mentors, family, and most everyone
else expects you to do something. To achieve something. To make them
proud. That's why blazing my own trail makes the most sense right now.
I'm only gated by my own expectations, not everyone else's. I know that
not an option for everyone, but beating to your own drum certainly is.
And to be honest, I like the sound of my own drum. Have a great day.
Photo: "follow the yellow brick road" originally uploaded by ittybittiesforyou
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- WAF hits the clouds - Akamai introduced the first of the "cloud-based" WAF offerings yesterday. OK, maybe the first. Basically it's a managed web application firewall (WAF) service. I suspect there are other service providers that will provision and manage a WAF for customers. But this is the first that is pushing the "cloud" halo and thus will get the press benefits of announcing a shiny object. The service is based on ModSecurity and it's interesting how Akamai is talking about "instantaneous scaling of defenses," which is good for whatever hardware vendor they are using to build out the service.
- FISMA metrics, vendors start your engines - Looks like the Feds are getting more serious about cyber-security. That is, if you think spending a bunch of money on a bunch of products that likely will have little impact on true security is getting more serious. There is a set of "FISMA metrics" in process include mostly yes/no answers and then some level of detail on things like asset management, connection management, incident management, etc. Most interesting is the need to provide "real time security status and management," which is basically SIEM. But here's the rub: There is a difference between having data and USING DATA. I guess you can't really use data until you have it, but I just worry a lot of agencies will spend a lot of money and be in exactly the same spot 3 years from now. But at least a bunch of security vendors will make a lot of money.
- Know what you're looking for... - David Mortman has an interesting post on the New School site pushing us to realize that Less is More. In this case, he's talking about IPS signatures, in that if you have a good understanding of your network, then you should be able to put rules in place to focus on abnormal activity (as opposed to checking for everything). I've always been a big fan of anomaly-based security techniques and positive security models (like default deny on perimeter defenses) because it forces you to really understand how the network and technology assets are being used. Not just letting everything happen and hoping that you figure it out before the card brands inform you of the breach.
- Learning from someone else's pain - The folks that screwed up the FAA network a few weeks ago are in a world of hurt. Yeah, when you knock down the network that controls flights for half the country, that is a bad day. But what can we learn to make sure this kind of thing doesn't happen to you. That's what the SearchSecurity folks did in this post and the tips are useful. Remember, usually it's the physical layer, but a lot goes back to change management as well. Ultimately, things are going to happen (Murphy's Law guarantees that), so you need to have better fault isolation and response mechanisms in place. If the system goes down for 15 minutes, that is bad. When it goes down for 5 hours, heads roll. Make sure it's not your head.
- Monitoring the cloud is not up to us - Get ready for a lot of folks talking about how they will provide "visibility in the cloud." The folks at LogLogic are talking about this, but I'm not specifically picking on them since they aren't the only one. Here's the issue, the cloud provider doesn't want you to know what is going on. They don't want you monitoring networks or systems and will make it hard, if not impossible for you to do that. So the idea of visibility at the lower levels of the cloud-resident stack is a load of crap. It's really about understanding and monitoring the stuff you DO control, and that's the application stack. So we are going to need to see some instrumentation and interesting correlation happening with application information (logs, performance, etc.) to have any chance of seeing into the cloud.
- Network Security getting smarter? - McAfee just made a series of announcements upgrading their network security devices with the underlying theme being increased intelligence. The idea is that Little Red sees a lot of stuff at the endpoint, device and network layer and can make sense of it to make each of their products "smarter." In concept it's interesting, but realistically my jury is still out until there are demonstrable results that show protection is enhanced. More tactically, they've finally rebranded the Securify stuff as the T-series to provide some level of flow-based analysis and security. To be clear, folks like Sourcefire have had these pieces for quite a while. But the trend is the trend, intelligence is definitely making it's way into all parts of the security stack.
- Life Management, Drucker-style - As you may have noticed, I've tried to find one interesting personal development post to add to each Incite. Today's comes courtesy of WebWorkerDaily, who highlight a new book that delves into the great Peter Drucker's thoughts on life management. We all knew he was a corporate management guru, but evidently has some good stuff to say about managing your live as well. In a nutshell it's about finding balance. That balance involves understanding your strengths, but also diversifying a bit. So the idea of having a parallel "career" or serious hobby is a good one. All work and no play makes Mikey a dull boy. I also like the idea of giving back and teaching/mentoring. If you are anything like me, you've screwed up a whole bunch of stuff through the years and other can benefit from that "experience."
The Daily Incite - 12/11/09 - Starbucks Seat Lottery
December 11, 2009 - Volume 4, #38Good Morning:
Nowadays I face very tough decision on a daily basis. You know, when should I work out? Do I get the Veggie Patty at Subway or is it the one day a week I indulge with a burrito? Should I shave? You know I shave once a week, whether I need to or not. These are serious, tough decisions. And I'm the kind of guy that can face these decisions.
But no decision is more
important than where I work in the afternoon. You see, being a work at
home vagabond, I need to get out of the house. Every day. Personal
hygiene is an issue to begin with, so without the excuse that I have to
primp up to get my Venti Pike - it wouldn't be pretty.
So around my house I have the choice of maybe 4-6 different coffee shops. To minimize my impact on the environment, I try to select a shop in proximity to my lunch spot. I'm thinking of buying some carbon offsets to make up for those indecisive days when I drive the extra 10 minutes to a different coffee shop.
I also go to different coffee shops in no set pattern. I wouldn't want the folks tailing me to be able to profile my habits. You know, when the assassins come, I want to make it at least challenging to find me.
Yet lately I've been choosing wrong. I liken the coffee shop
decision to playing the lottery. It's the Starbuck's seating lottery.
If you don't get a good seat, you may as well just write off the entire
day. Have you ever tried writing snark from one of those cushy purple
chairs? This ain't Passover folks, I can't be inciteful when I'm
reclining. I need to be focused. I need to have a hard wooden chair.
Yesterday I got to my selected shop and there were no seats. Crap. It was like 40 degrees outside, so it's not like I could sit on the patio and pound away at my trusty MBP and snark. The nerve of these folks. First of all, don't they know it's my friggin' office. I pay rent. At the rate of about $2.25 per day. Of course it's a good deal, and some folks pay more rent than me (they splurge on the $4.50 pumpkin latte), but all the same, these folks have to go.
So what to do? I guess I could ask someone if I could share
the table, but man that's weird. I saw some guy do that a few weeks
ago. He just plops down and then starts some inane conversation about
what he does, and where he lives and all sorts of other things.
Surprisingly enough, the kind woman who let this interloper sit down
actually engaged him in conversation. I guess maybe that is what humans
do. I wouldn't know much about that.
So basically I did what most other vagabonds do. I went to the struggling cafe down the street, and hoped they haven't gone out of business already.
Photo: "Second (office) Cup" originally uploaded by sylvaincarle
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- Data is cool, analysis is better - The folks at Verizon Business released their DBIR supplemental report this week and it's got some good stuff in there. Read. It. Now. I like the report because it's not just a listing of data designed to generate PR clips. Most of the data out there is used to ensure that lazy tech writers always have something they can crank out on deadline. Survey this, survey that. 85% of hackers take cream in their coffee. 42% use an pwned netbook in a crowded coffee shop to social engineer 17% of the grandmothers in a local old age community. You know, data. But what the VZ guys do with the data is very cool. Mort highlights a few things, but I think we are getting to the point where this data is not only statistically reliable, but it's also representative of the broader market. And that means we are pretty much screwed, but at least we can quantify the screw.
- Redefining security success - Bejtlich does an interesting thought experiment in his "Let a Hundred Flowers Blossom" post. Basically, the idea is to stop worrying about controls and start focusing on outcomes. Meaning, an organization can do as much or as little security as they want, as long as it takes longer than X for an attack team to successfully penetrate the defenses, it's all good. It's an interesting idea, but is counter to the childish way we do security today. Basically it's like nursery school. You get a check list and you do the checklist. No one cares about success or even outcomes, as long as the check list is filled out. This will create issues of documenting compliance, but from a philosophy standpoint I think this could work in a company. But probably not for every company.
- Budget time, yay! - It's that time of year, budget time. This is when we all fight for our share of a declining pie and the grumble about what an ass the CFO is and how does he/she expect us to be able to do anything with that amount of money. And then you get calls from analysts that want to know how big your budget is. And we get surveys that say 70% of companies will boost tech spending and security is a priority. Maybe it's 1 or 2 on the wish lists of people buying things. But to be clear, no one has any idea how budgets will shake out. You see, there is a pot of money and through 2010 that pot may be smaller or it may get bigger. It may be used for Project A or maybe be reallocated to Project B. The folks that answer these surveys have no idea. Overall it feels like things are getting a bit better, but who knows. I'm still saving for a rainy day because there is a good likelihood it'll keep raining in 2010.
- Actually buying something with that budget - Pretty entertaining post on Cassandra Security about the real process of buying and selling security stuff. Part of this is the black magic that you never learn until you work for a vendor. Things like the unnatural acts to get a deal closed in a quarter (as opposed to when the customer needs to buy). But also from the customer's perspective, how to play the game, not only to squeeze the vendor, but to make sure the deal gets done. There are checklists for sales folks and also for the end users. As Brian says, a lot of this is common sense, but we all know that common sense is in short supply.
- Are there any security "software" companies left? - Yes, that title was a bit of a red herring, but it underscores the realization that customers tend to be right, and the vendors need to adapt to meet the needs of the customer. So the idea of a pure-play security software company probably doesn't make a lot of sense moving forward. Maybe not today, but by 2011 I'd say any security company of size will have to have a hybrid model. Where their software is PACKAGED as something a customer can implement, can run in someone's data center or probably can run in a private or public cloud. If you look at a company like Fortify, they are moving in this direction by rolling their own services capability, but also by partnering with a services shop like White Hat to fill the gaps. Of course, the underlying life blood of any of these companies is still software, but it won't necessarily be sold as software.
- Microsoft, the silent but deadly security competitor - Given I talked about plungers last time, I had to throw some flatulence references into today's piece. But that's the thing about Microsoft. They don't really talk too much about their security products, since most of the PR effort is spent spinning the issues around Patch Tuesday and their SDL efforts. But to be clear, Microsoft keeps clicking along, targeting their markets and rolling products. Like their recent announcements of enhanced security gateway functionality. Sure looks like a UTM type thing to me, which is perfect for their sweet spot in the mid-market. And they also acquired Sentillion, which does IAM and single-sign on for healthcare companies. So although most of the big security companies don't say Microsoft is a competitor, it's always dangerous to disregard them.
- The Happiness Genie - Very interesting thought experiment from Scott Adams on the Dilbert blog. Man, it must be a good gig to write comics because he seems to have plenty of time to think of weird scenarios and post them to his blog. The general idea is whether you would be happier if a happiness genie gave you $10 million, but a lot of folks you know would get $20 million. Or if you get (only) $5 million, but no one else gets anything. Hmmm. I'd like to think $10 big is enough for me, even if my friends get double that. But if I'm being honest, who knows? And that's really the key, be honest. The answer is OK, even if you are a greedy bastard that would be happier keeping their friends in a life of squalor.
The Daily Incite - 12/09/09 - Plunger Tales
December 9, 2009 - Volume 4, #37Good Morning:
Like many of you, I've got some friends that are pretty hardcore geeks. They measure not just aggregate number of computers in their house, but also the ratio of computers to people. Some are in the 1.5-2 range, and others have embraced personal virtualization, so their ratio is off the charts.
But that isn't a relevant measure for me. I've got my share of devices and I'll be building a lab over the next few months, so my ratio will dramatically "improve," in the eyes of my geeky friends anyway. But I was reading an interview with Tom Petty in Rolling Stone last night, and he made a statement like "it's really was better back then."
Now, to be clear, lots of
things are better today then they were. Connectivity, computing power,
content have all improved. One place where we've taken a huge step back
in flushing power. That's right, I've got angst this morning about the
current state of toilets. Don't laugh, this is a serious problem.
You see, I eat a lot of roughage. Being a vegetarian, there isn't much else for me to eat, but it's also good for my digestive system and helps keep my mass in control. But there is a downside to all that roughage. I don't just drop the kids off at the pool, I drop a village.
Today's low flow toilets are not built for guys like me, who are not small and eat a mostly green diet. With a clog rate hovering around 75-80%, which means I need to have plungers. EVERYWHERE. I basically have close to a 1.5x plunger to bathroom ratio in my house. Well, for most clogs the mini-plunger will do and each bathroom is outfitted with one as standard equipment. But sometimes you need specialized tools, like the plunger with flanges. Or maybe the orange plastic one that looks like an accordion. I've also got 2 different snakes when plunging doesn't get it done.
Yet, sometimes even a toilet snake doesn't work. About once a year (usually corresponding to one of the kids trying to "hide" an entire roll of toilet paper in the toilet) I have to get out the heavy artillery. I have a device that uses compressed air to pretty much blow anything stuck in my toilet clear to the treatment plant. Now that is cool, but I have to remember to wear my Intel bunny suit to keep clean.
Thankfully my kids haven't figured out the meanest thing they
can do to me is to hide the plungers. And I'm counting on all of you to
keep my secret. I guess that's kind of like my Kryponite.
I think maybe the Europeans have this one right. They don't worry about low or high flow. They just figure if it can be solved with a toilet brush, it's not really a problem.
Photo: "Poopy the Plunger" originally uploaded by zoomar
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- Cloud security is overblown - Sometimes I just have to laugh at some of the stuff I see in the trade rags. I dug this InformationWeek blog post from Alexander Wolfe out of the archives because after baring my soul about my plunger issues, I figured I needed to take someone else to task for a good dose of idiocy. This guy's position is that cloud security may be overblown because we already have an answer - encryption. That's the answer to everything. We've already got the architecture, and if we'd just encrypt everything it doesn't matter where it resides, right? Uh huh. I guess Hoff needs to find something else to do now, since all the thinking he's been doing about cloud security isn't relevant. Having barely survived the PKI wars in the late 90's, I can't say much besides that encryption isn't a panacea to anything.
- Next year's PCI emerges - Many in the security industry are looking for what's next. What's going to be the next attack, regulation, widget, etc to spur sales of products that no one needs. I think I found it, it's the HiTrust CSF. Neil Roiter does a bit of work to describe the opportunity to security resellers. Now to be clear, the concept of a framework to protect healthcare information is valuable. I've got no issue with that, but I'm already playing out the fiesta driven by the industry parasites to make whatever widget they are selling today a "key" part of the HiTrust CSF. Of course, healthcare organizations will be able to be "certified" through a HiTrust certification program. Which will likely mean as much as PCI compliance or a SAS70 audit. But I guess I shouldn't complain, I'm just another one of those parasites, feeding off the fat of the land, calling everyone else a parasite.
- Time to start looking for the BBD? - Over the past 18 months, many security folks have basically kept their head low and tried to make sure they weren't on the list to be downsized. But now with the economy (seemingly) improving, does that mean it's time to start looking for the bigger, better deal (BBD)? It depends. In this CSO article, Jack Phillips from IANS voices the concerns of large company CISOs that are worried their employees might look for greener pastures elsewhere. If you are staff level, I think how your company treated you during the downturn is instructive. If you felt abused and like a piece of meat, I suspect it won't get better during the upturn because that is a cultural issue. The words may change, but the behaviors likely won't. For managers, unfortunately now is the wrong time to try to make it right for team members. If you treated (or were forced to treat) your people like crap, blaming the economy and just letting it happen, you will reap what you have sown. When those employees find something better, don't wonder what happened. And build a culture where people want to work there, regardless of the economy.
- Quant comes to the database - I'm a fan of the work Rich and Adrian do in their "Project Quant" initiatives. Every security person struggles with understanding the relevant metrics to track both security and operational efficiency. So spending time to decompose the actual process behind a function and look to quantify those functions (by having folks in the community share their own data) is valuable. The Securosis guys started with the patch management front and are now focusing on database security. This post represents early work on establishing the process model for database security. I suspect the goal is to build Quant models for all the major aspects of security, which will be a great thing for all of us that still can't answer the questions about whether we suck at security or not. At least from an operational perspective.
- How deep is the moat? - Many of us security talking heads spend a lot of time focusing on what's next. So things like application security and database security are big issues. Unfortunately most of the world is still trying to figure out how an IPS works. Far too many may have spent some time building a moat (in terms of a perimeter security strategy), but really have no idea whether it works and if they are protected from the badness "out there." This piece by Joel Snyder on SearchSecurity reminds us about how and why to validate those perimeter defenses. Now to be clear, the cutting edge stuff represents real attack vectors and I'm not minimizing the importance of those aspects. I'm just reminding myself (and maybe all of you) that most organizations have no idea how to test their defenses, and they really need to learn.
- Security and Business Strategy, huh? - I'm constantly reminded that most security professionals still think it's about the bad guys. They are our foils and provide us with innovative attacks to keep us on our toes, but we always need to remember security is a means to an end, in that ultimately we have to contribute to helping the company either make money or save money. Here is a link to Part 1 of an interview with SANS Stephen Northcutt talking about some of these issues. I also like to ask security folks whether they know their companies mission statement and how often they get face time with business leaders. For those that don't understand their business, they've got a very small shot at being successful.
- Finding the impact of what we do - The always entertaining Shrdlu goes in a bit of a tirade here about the "meaning of metrics" and before Thanksgiving did a far better job than I have to isolate the issues with how we count things. The reality is we tend to focus on things we do, not the IMPACT of what we do. I've long held the belief that security folks have to really manage two sets of "metrics." There are operational metrics that indicate how well we do security. And there are other metrics that need to quantify the real business impact (either positive or negative) of what we do. Business folks don't care about operational metrics, but they sure do care if they can't take orders because some hacker group has poked huge holes in the e-commerce application. Operational metrics should be reasonably consistent regardless of what business or size of company you are in. Impact metrics will be very specific to your company and depending on culture may or may not be consistent even within your vertical. For better or worse, the success of most CISOs is directly correlated to how well they understand the impact metrics.
The Daily Incite - 12/07/09 - Happy, Sad, Repeat
December 7, 2009 - Volume 4, #36Good Morning {!firstname}:
Life is a roller coaster. Pure and simple. During a particularly difficult time about 15 years ago, my Dad sent me Seinfeld's book, with this specific passage highlighted:
It's hard to keep that in context during the day to day grind. One minute you are up and then in what seems like the next second you are down. It's also a bit more challenging for security folks, because in general we tend to be somewhat cynical (OK, very cynical) and borderline paranoid. It's take me a long time to get in tune with my own peaks and troughs, and some days that presents a pretty significant battle.
yesterday, for example. I was excited to go see the hometown Falcons
play the Eagles. Yeah, I hate the Eagles. Growing up in NY and being a
Giants fan means you pretty much hate the Eagles. I know hate is a
strong word, but actually it may not be strong enough. I hate^2 the
Eagles, so I was hoping the dirty birds would put a hurting on visitors.
Of course, my optimism lasted about 10 minutes and the reality of the impact of having 40% of the offense inactive set in. It was ugly, and totally compounded by the number of Eagles fans there to gloat. OK, they didn't gloat, they were pretty cool (especially for Eagles fans), but still. It hurt, and I was grumpy.
So I get back to Chez Incite and settle in to watch the Giants play the hated^2 Cowboys. Things started slowly for the G-men, and my mood was descending into dark places. The Boss was going to vacate the premises, but then at the end of the first half the Giants got going and held on for the victory. Elation personified. I'm not sure why football gets me so fired up, but it does. And given how the Giants have played over the past two months, getting a big win was awesome.
But then I need to take a step back. There were pretty low lows and pretty high highs all in the course of about 6 hours. And this was about football, not anything really important. I think part of finding balance and happiness is to acknowledge that there are some things that you CHOOSE to get excited about. That means you also need to accept that those very things will make you miserable at times.
Then the misery will pass. Just as the happiness will pass. This is the cycle we call life. Some can't deal with it and think there is something wrong with them because they get whiplash swinging back and forth between pessimism and optimism. There is nothing wrong with that. There is nothing wrong with them. It's called being human.
Photo: "Ms. Happy, meet Mr. Sad 111/365" originally uploaded by SashaW
Technorati: Information Security, CSO,Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 U
- Liberation and Thought Leadership - RockyD rocks the house on FUDSEC last week with a post about getting out of the rut many of us are in. There is a lot of good stuff in here (especially about focusing on R&D and better information sharing) and like most of the FUDSEC posts, it's about spurring discussion. Mort takes issues with some of the stuff on the Securosis blog, and I agree with his positions, so I'm not going to rehash. What I'm going to pick on is the part where Rocky advocates a "vendor thought leadership" approach to the more strategic problem set. Sorry dude, it's not going to happen. Unless you count having every vendor (or consultant) apply what's in their bag and position it as a "strategic" solution. The profit motive ensures that the job of the vendor (and in many cases, consultant) is to convince the customer the strategic problem-set is addressed by the products. I know you are advocating the exact opposite approach, but I can't see it happening because a quarterly mind-set ensures short cuts are taken at every opportunity.
- Noise level at an all-time high - The results of the annual CSI survey are out. The Help-Net Security folks did a nice job summarizing the findings. Basically we are dealing with a lot more incidents, but the average loss per incident is coming down. Hmmm. That wouldn't have to do with the fact that losses are not growing as fast as the number of incidents, eh? But the point is this is all noise. These surveys are interesting to look at in five year cycles to see where we've been, but not very instructive to understand where we are going. Fact is, we need to focus on blocking and tackling - STILL. And given that cyber-crime is a growth market, I don't expect these surveys to show anything remarkably different for years to come. The point is for you to not end up as one of the statistics.
- More noise about data breaches - The folks at Imperva were also kind enough to point out the fact that even though the number of reported data breaches is going down, the number of records compromised has exponentially increased. Which again is predictable. With some exceptions, the amount of work to steal a million identities is similar to stealing 50 million. So why wouldn't the bad guys go after bigger targets? And they have - successfully. Good for them. The point is the noise can be used for FUD purposes (yes, there is a time and place for fear, uncertainty, and doubt in every security practitioners bag), but it shouldn't be impacting our plans, strategies or processes AT ALL. Incidents and breaches happen, we know that. Blocking and tackling will help make sure you aren't low hanging fruit - but you will still likely be pwned. Then it's about making sure your incident response plan is where it needs to be.
- Santa in camo comes early for ARST - ArcSight announced their fiscal 2Q results last week, and the numbers were good. Here is the release and the earnings call transcript. 39% year of year growth and another quarter of strong cash flow. Lots of activity in the federal space, which is expected - given the focus on cyber-X that most of the defense and civilian agencies have. In fact, government revenues accounted for 49% of their quarter. As the federal markets figure out which end is up for FY 2010, it'll be interesting to see if/how the commercial markets continue to adopt security management technology. Given compliance mandates, everyone needs it - but there are cheap ways to check the box and there are expensive ways to overhaul operations. Which path commercial organizations take is still an open question (in my mind anyway).
- Rebranding SIEM - Speaking of SIEM, Independent Anton (did you check out his new consulting site?) has an interesting analysis of the SIEM market, bringing in some Ries marketing mojo and really trying to tackle the issue of perception vs. reality. Given that I know a thing or two about how to (or more likely, how NOT to) market a SIEM platform, the reality is that SIEM is not a must-have. I know about 10 vendors that will be jumping up and down telling me I'm wrong. But they are missing the point. Compliance is a must have, and that means some of the aspects of most modern SIEMs (like log management) must be highlighted because that's where the funding is. Once the funding is found, then it's about highlighting difference - such as with capabilities like SIEM or NBA or configuration audit. Anton is right that the focus must be on solving problems, not on flashing lights or even scalability. Until a customer is convinced a SIEM can solve a problem, how fast it is (or how many other capabilities it has) is really besides the point.
- Andreas' love note to 2009 - The analyst I now dub "Double A" for Andreas Antonopoulos does a little revisiting of his 2009 predictions in one of his last NetworkWorld columns for 2009. As you can see, there wasn't anything too controversial here and for the most part he was right. It turns out that if you keep your head off the chopping block, it usually is still attached at the end of the year. I'd take some issue with his "correct" prediction about mobile security, given the iPhone worm was only applicable to those with jail broken phones, but it's good to see someone holding themselves accountable for the things said. Perhaps Big Research will get into the act as well (0% probability).
- Cloud-based security services unite - I loved the Wonder Twins cartoon when I was growing up. And when I saw this announcement about RSA leveraging some of Trend Micro's threat intelligence in their own fraud detection services, the Wonder Twins popped into my head. The reality is this kind of information sharing is a good thing. Will it make a difference? Who knows, but it makes for good marketing since when trying to differentiate "cloud intelligence" it's all about how much data you have. What you use, on the other hand, is very likely a different story. Obviously Art (playing the role of Zan) transforms into a cloud. But what about Eva (playing Jayna)? What animal form makes the most sense for her? Leave your thoughts in the comments...
- Pretty good rules to live by - It's great to see other folks sharing their own life philosophies, and I'll point the interesting one's out as appropriate. I want to give Michael Dahn some props on a set of three "rules" that he lives by, that I think are applicable to most of us. The first is "nothing is impossible, the impossible just takes longer." Perseverance is a key to success, check. "Learn the good, avoid the bad" seems obvious, but is VERY hard to actually do. I've found that most folks have to learn the hard way what is good and what is bad. It's a rare bird that can actually learn from someone else's pain. And finally "never stop improving" which is actually a double edged sword. One of my problems is that I am never satisfied and that creates some real issues in knowing how good you need to be in any aspect of anything.
The Daily Incite - 12/03/09 - Not so GRRRRREEEEAAAAATTTTT!!!!
December 3, 2009 - Volume 4, #35Good Morning:
With the holiday season coming up, I know it's hard to get presents for me. I want for nothing and if I do want something, more often than not I just go and buy it. Within reason, of course. So I know it's a challenge for folks in my family to get me anything. But I can only imagine how hard it is to buy a present for a guy like Tiger Woods.
Yes, that Tiger Woods. The
one who makes over a hundred million a year. And who married the
Swedish model. If you were to ask almost everyone, if they could pick a
perfect life - I'd say most would say Tiger's got it pretty good.
Evidently not. I was pretty disturbed when the news of his "transgressions" hit the major media yesterday. First of all, this story has outweighed little issues like sending 30,000 more troops to Afghanistan over the past week. But I shouldn't be surprised. Our celebrity-centric US media engine means they'll sell a lot more page views by talking about Tiger's dick than the tens of thousands now in harm's way. Got to let that one go.
At least Tiger didn't pull a Steve Phillips. The stripper or whatever is pretty decent looking. But still, he married a SWEDISH MODEL. Really seriously I just don't get it. Is this guy's life so good that he has to go and screw it up because he can? Because a dream for 99.999999% of the population has just become commonplace. Please, help me understand it.
Is it the need to exercise power? Is it the feeling of being invincible? I guess all the psychologists out there are having a field day trying to figure it out. I guess now that I'm writing, I'm just sad. Sad that what seems like the perfect life I guess isn't so perfect. Sad that this guy has to face his failings in such a public way. But ultimately sad that once again, human nature has trumped any sense of logic.
That old adage about money doesn't buy happiness, I guess is true. It seems a Swedish model doesn't make you happy either. I guess for Tiger being the best golfer ever is not enough. Having untold riches is not enough. Having a beautiful family isn't enough either. After all, in Tiger-land I guess things aren't really that GRRRRREEEEEAAAATTTTT!!!!.
Photo: "The world's saddest tiger, part deux" originally uploaded by peppergrasss
Technorati: Information Security, CSO, Security Mike, Internet Security
The Pragmatic CSO:
Available Now!
Read the Intro and Get
"5 Tips to be a Better CSO"
me on Twitter:
I'm not sure where I'm going, but I'll get there in 140 characters - or less...
Incite 4 UIt's nice to be flexing the analytical muscles again. I can say I've gotten a bit soft over the past 15 months. But like all muscle memory, the cynicism, skepticism, and general venom will be back before you know it. Alan and Mitchell invited me to participate in their podcast yesterday, which was great fun. We laughed, we cried, we made fun of people, but mostly we laughed. Enjoy.
- It's not just a job, it's an adventure - Happiness is a fleeting concept. It's here for a few minutes, then it's gone, then it's back. Hopefully it's not gone for too long. I wanted to send a shout out to AndyITGuy for doing some good analysis of where his head was at after he got laid off recently. It was a heartfelt and candid post. We all have days where we feel like that. The reality is security is a hard job - on a good day. And if we are going to find any measure of happiness, you have to be able to understand you can do only what you can do. Sometimes you just need to move on, especially if the organization isn't going to give you the opportunity to be successful. But many of us thrive on challenge and don't believe anything is impossible. That's why you do security.
- If you aren't breaking your stuff... - Someone else is. That's right, it seems driven by the recent Rapid7/Metasploit deal, pen testing software is back in the spotlight. The folks over at Dark Reading did an analysis of the market, and Nick Selby also weighed in on what he expects in that market over the next year. I'm glad folks are starting to see the importance of what I call "security assurance." If you are a company of size, you should have someone on your staff breaking things every day. And they should be using live ammo. Vuln scanners are important too (if only to see the depth of your issues), you really need to take it to the next level and see what can really be exploited. It's also good to see higher level application attacks starting to show up in the app scanners as well.
- Ramping up the "cyberwar" hype cycle - Here is the reality: technology is an intrinsic part of everything today. Why do I need to state some an obvious truism? Because folks continue to want to convince us that there is something new here. Take McAfee, for instance - they recently did a report on "cyberwar," making the point that an increasing number of attacks seem politically motivated. And what's new about that? If you want to sabotage a competitor, why not break into their systems? Or rob a bank? Or bring down critical infrastructure? Or get intel on an enemy's defenses? Of course, a technology attack is the first, best path. You only bring in the Black Ops guys when you really need to. I'm not challenging the findings, I'm just wonder why this is news?
- SMBs like SaaS - Directly from the Duh! files, the folks at Dark Reading are hyping a report they wrote about how SMB organizations should be protecting their stuff. One of the conclusions is that Security as a Service (SaaS) is an attractive alternative. Really? And then they start throwing the numbers out. $38K for a web gateway software vs. $15K for a managed service. If you know how to use Excel, you can make the numbers say anything you want. But the reality is not really about cost savings, it's about expertise and leverage. A lot of these security devices need daily tuning, care and feeding and that just doesn't work for an overworked IT guy in a smaller company. So to me the interesting part of SaaS isn't how much money you can save, which may or may not materialize. It's the leverage that can be gained by having someone else manage the crap you don't have time to manage.
- If Big J says I'm doing it wrong... - We are still very early in the evolution of application security, and that means we are still subjected to religious battles like white box vs. black box testing. Thankfully Jeremiah Grossman provides some much needed perspective here, in terms of making the point that BOTH is the right answer. There are some things that code review are better at finding, and you cannot minimize the need to automate using scanners and other tools. As with everything else in security, there is no one silver bullet for application security. It's about minimizing the risk that you've missed something and using every tool, technique and process at your disposal is just the right thing to do.
- Whitelisting good - Normally reviews don't interest me that much, unless it's really indicative of a changing market. So this piece by Roger Grimes for XWorld (all the IDG properties seem to share content now) testing a bunch of white listing products is really indicative a market that is mature enough to disappear. Huh? That's right, once a large set of products actually work and solve the problem, then the capabilities can and should be subsumed into a bigger category and that's exactly what is happening. First of all, I'm a big believer in white listing. The old way to find malware (checking against signatures) isn't getting it done. And over time, we'll see all of the big AV vendors move to a hybrid "cloud" (meaning the extended sig database is in the cloud) and white list driven approach. And it still won't work, but that's another story for another day.
- Think dummy, think - Adam says it all. We don't do enough of this.
- Damage control, the 30,000 foot view - Sometimes I like to check out "security tips" targeted towards a mass market audience to see how closely some of this stuff maps to reality. The good news from this post on how to respond to an incident from VentureBeat is pretty good. To be clear, it's VERY high level, but for this audience that's fine. They don't want to hear about chain of custody, enCase or BackTrack. They need to understand the general process, not the details. The very high priced forensic guys can worry about the details. But as I've said countless times, it's not about being perfect (you can't), it's about making sure an incident doesn't become a catastrophe.


text:
- Which version of Windows Phone do I have?
- How do I update my phone software?
- Phone updates FAQ
- Copying and pasting
- Switching between apps
- What do the icons on your phone mean?
- Tips to help keep your phone secure
- Keyboard
- Accessibility on your phone
- Lock screen
- Using Speech on your phone
- Lokalizovanie strateného telefónu
- My Phone FAQ
- How can I minimise my data usage?
- Battery: making it last
- SD cards and your phone
- Using a PIN to lock your SIM card
- Privacy resources
- Feature and service availability
Correcting the date and time to update your phone
If you're having trouble installing a Windows Phone update, your phone might not be set to the correct date and time. In most cases, your phone's date and time are set automatically by your mobile operator. If they aren't, you can do so manually. Here's how.
Disconnect your phone from your computer.
On Start, flick left to the App list, then tap Settings.
Tap Date+time.
Turn off Set automatically.
Set the correct values for Time zone, Date and Time.
Reconnect your phone to your computer, then try updating your phone again.

subset: commoncrawl


text:
VRec Lite - Voice Recorder
Music & Audio
by Viacheslav Blinder
Download this app if: you want a handy voice recorder.
Developer Notes
VRec Light is a free digital sound recorder, which allows you to record any sound that is in close proximity of your smartphone. All record files will be stored at on phone's SD card as a default storage.
After the installation if no specific audio format has been chosen, the application will use...
Sound — Offers a nice easy way to record sounds and stores them on your SD card so the length you record is only limited by the space available.


text:
Always Low Prices? There's a Walmart iPad App for That
Bargain hunting just got a little easier for Walmart customers who are also Apple customers. The world's largest retailer has launched a new app for the iPad and updated its app for the iPhone to keep in step with its shoppers' growing use of the popular Apple products.


text:
If you're going to a masquerade or Mardi Gras ball then you'll want the best mask you can get. The Blue and Gold Baroque Fantasy Mask is an elegant choice for any light colored costume. It features a powder blue domino mask with blue and gold detailing and trim. There's a tall plume of blue feathers in front attached with a jewel. The spindle handle is gold.
Our Price: $39.97
Our Price: $41.97
Our Price: $7.97
Our Price: $24.97


text:
this wiki
The Andromada is a fixed-wing aircraft featured in Grand Theft Auto: San Andreas and possibly in Grand Theft Auto V.
The Andromada is a large 4-engine transport airplane based on the Lockheed C-141 Starlifter. Its name is a misspelling of "Andromeda", a Greek deity, a galaxy and constellation. If the Andromada is obtained, the player can fly it as if it were a normal plane, with controls and handling similar to the AT-400. The plane is not fully textured, and as such the cockpit windows are dark. The plane can support a combination of two body colors: One for the fuselage, and the other for the wings, engines, vertical stabilizer and elevators.
The plane's rear cargo door can be also opened and closed, but nothing can be stored in the plane itself; neither can the player enter the rear is impossible due to an invisible wall. There are, however, mods [1] available to create a fully functional cargo area. When using the CLEO mods for standard vehicle spawners, there is no door you enter to get into the Andromada, only a passage which still shows the exterior of the Andromada. [2]
The interior of the Andromada is seen in the mission "Stowaway", however, like the interior of the Shamal in Freefall, this interior is not part of the plane model. It is in the "interior universe" (where all game interiors in San Andreas are situated), high above the sky, with clouds moving outside to simulate the plane itself moving. Parts of the exterior of the plane are visible when standing at the edge of the ramp. The interior is only enterable via that mission, cheats, or a trainer. Within the interior are two cargo areas walled off by netting, followed by cargo boxes, then shelves stocked with barrels.
Also, a considerably large cargo plane, that appears to be an hybrid between an Antonov An-124 and a B52 Stratofortress, is seen in multiple screenshots for Grand Theft Auto V. In the second trailer a Bodhi is seen being driven off the ramp of a cargo plane mid-flight, possibly the same one as seen in the screenshots.
The plane is featured in the mission "Stowaway", where Carl Johnson drives a PCJ-600 into the back of the plane, blows it up, and then parachutes out. It is also seen briefly in the mission "A Home In The Hills" as CJ is on his way to Madd Dogg's mansion; there is a shot of the Andromada flying over the The Camel's Toe Casino out of Las Venturas, heading south to Los Santos. Like the AT-400, Andromadas are seen flying over cities, however they fly much faster than AT-400s.
The Andromada is not intended to be obtainable by the player, as there is no animation for opening the door of the plane upon entry. However, it can be stolen during "Stowaway" with a trick that involves blowing up the plane and pushing it into the hangar, but it is difficult to exploit as the plane may disappear.[3] Otherwise, the Andromada can also be obtained by way of a third-party trainer program.
The Andromada is slower and heavier than AT-400, but it can reach higher than AT-400. It has soft handling and is soft when landing.
There is a way to enter the Andromada cockpit during the mission Stowaway. It involves using the "blow up all cars" cheat before CJ hops on the motorcycle. The plane will not blow up, and will be frozen in place, however the mission cannot progress. The plane is then enterable, but it cannot be controlled or even exited. Another way is that when your bike blows up, kill all of the enemies, and blow up the Andromada. Then, use the "Spawn a Rhino" cheat (see Cheats in GTA San Andreas), and use the Rhino to push the destroyed Andromada into your hangar, then kill yourself. Go back to your hangar, and you'll see that it is flyable.
- A handling line for the Andromada can be found in Grand Theft Auto IV's game files, suggesting that it (or a plane of the same name) was at some point going to feature in GTA IV.[4]
- The Andromada draws inspiration from the Lockheed C-5 Galaxy cargo aircraft.
- It also shares its name with the real life Andromeda Galaxy, which in itself is possibly a reference to the Andromada's size, as well as its real-life counterpart the C-5 Galaxy.
- The Andromada is strange in that walking across its wings sounds the same as walking on grass and also that the plane has no shadow.
- It is possible (though rare) for the Andromada to appear in the impound lot, though it is more then likely to explode when approached, this is even possible on console versions of the game.
- The Andromada plays Radio X by default.
- Sometimes, the Andromada is seen flying very high in the sky, though rarely. Even if it is shot with a minigun (which has significant range) the plane won't explode and will most likely fly away before the player can shoot it. The plane flies very fast, so even if you lock on to it, the missile won't reach it.
- Using flying mods such as Superman mods, the player can catch up to the Andromada flying high in the sky; also, if the player with the flying mod can shoot explosives they can also bring the plane down that way. Without mods or cheats, it is nearly impossible for a regular Andromada to crash on its own, as weapons will be out of range and the plane flies so high, it wouldn't be able to crash, even at high points like Mt. Chiliad.
- The plane's incompleteness may suggest the fact that Rockstar wanted this to be a fully-functional plane, but either didn't have time to finish it, or simply scrapped the idea. However, its appearance in the mission Stowaway could also suggest that this is an exclusive plane.
- If you go to Verdant Meadows (the small private airstrip in the desert) .You will notice that on each side of the runway/airstrip there are piles of out-of-use plane parts. Some of these plane parts seem to very closely resemble the look of the Andromada but without the recognizable black spot on the nose.


text:
FORT WAYNE, Ind. (21Alive) – Last week was a poor time for animals in Northeast Indiana, but it was particularly bad for animals with poor owners.
According to the Journal Gazette, from Saturday through Tuesday of last week, the city's animal control department got 158 calls from residents reporting possibly distressed animals, and people delivered 32 strays caught out in the weather to the animal shelter.
In all, 15 owners were given tickets and will have to go to court for neglecting animals.
Of those 15, six people were allowed to take their pets inside and keep them, but nine pets were seized by Animal Control officers and taken to the shelter because their lives were deemed to be in immediate danger.
What are your thoughts CLICK HERE to leave us a "QUESTION OF THE DAY" comment.
TextCaster alerts from 21Alive.com are your defining source for instant information delivered right to your cell phone and email. It's free, easy and instant. Sign-Up Now!
Powered by Summit City Chevrolet
© Copyright 2015, A Granite Broadcasting Station. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


text:
Decontamination chamber
this wiki
(covers information from several alternate timelines)
The decontamination chamber (or simply decon chamber) was a facility on Earth Starfleet vessels (such as Template:ShipClass starships) in the mid-22nd century.
Decon was used for decontaminating crewmembers after exposure to the potentially dangerous environmental conditions, lifeforms, materials, airborne bodies, or other contaminants found in alien environments such as planets or spacecraft. Aboard NX-class ships, decon was located adjacent to the launch bay and was not much larger than a turbolift, featuring two benches and a window looking out into a corridor. Utilizing a combination of ultraviolet radiation and various topical skin gels to achieve its effect, the chamber offered very little privacy, requiring officers to disrobe and remain in the cramped chamber for sometimes extended periods. While the decon chamber was inordinately small, Enterprise armory officer Malcolm Reed likened it to a spa he once visited. (ENT: "Sleeping Dogs")
The first use of the decon chamber aboard Enterprise came in 2151, when Commander Trip Tucker and Vulcan Subcommander T'Pol were exposed to protocystian spores after visiting a trading complex on Rigel X. (ENT: "Broken Bow")
In the year 2152, Tucker was protected from a sedative gas released by Ferengi pirates while enduring an overextended stay in decon and was therefore the only crewmember left conscious during the initial stages of that crisis. (ENT: "Acquisition")
In 2154, Enterprise crewmembers Hoshi Sato and Charles Tucker were confined to the decon chamber after becoming infected with a silicon-based virus. While the chamber was locked to prevent the exposure of the entire crew, Sato managed to break the lock and escape during a fever-induced hallucination. This resulted in the immediate lockdown of that entire deck. (ENT: "Observer Effect")
In the mirror universe, the crew of the ISS Enterprise held a Tholian prisoner in their decon chamber, using the device to torture and ultimately kill the alien in 2155. (ENT: "In a Mirror, Darkly")
By the 23rd and 24th centuries, the decontamination chamber became obsolete aboard Federation vessels, as transporter biofilters and advanced shipboard ventilation systems ruled out the necessity for such a device. (TNG: "Realm of Fear")


text:
Jack & Amanda Get Married
Jack Porter & Amanda Clarke renew the vows they took on the beach as kids.
Jack Porter & Amanda Clarke renew the vows they took on the beach as kids.
Amanda and Jack sail off into the sunset.
Victoria is shot...but not by Amanda.
David Clarke takes his last breath with Amanda by his side.
White Gold stabs Jack in the stomach.
Amanda & Jack can't resist each other any longer.
Louise tells Amanda where to find Victoria.
Nolan takes down White Gold (Courtney Love) & Margaux turns herself in.
Amanda finally has her chance to kill Victoria.
David breaks the news to Amanda that he only has a few months to live.
Margaux doesn't cooperate so Amanda takes things into her own hands.
Victoria Grayson is alive & Ben Hunter is killed by Courtney Love.
Louise finds out how much Charlotte despises Victoria.
Four years in the making, Amanda & Jack are finally a couple.
Louise has evidence that Amanda was framed by Victoria.
Margaux is arrested...with a little help from Jack.
When Emily Thorne arrived in the Hamptons, she appeared to be nothing more than the friendly, sophisticated "girl next door." But Emily is more than what she seems. When she was a child, her father was framed then murdered by the people he trusted most, leaving her to be consumed by loss, betrayal and rage. Since then, Emily's every social overture has been carefully planned to bring the opulent lives of her enemies crashing down around them. But now, having achieved her goal of taking the Graysons down, a new truth has come to light... her father is ALIVE! How will she continue when the biggest motive behind her revenge is no longer true?? Watch full episodes of Revenge with WATCH ABC.
Played by Emily VanCamp
Played by Madeleine Stowe
Played by Josh Bowman
Played by Nick Wechsler
Played by Gabriel Mann
Played by Christa B. Allen
Played by Karine Vanasse
Played by James Tupper


text:
The Spot Blog
- Read the inside scoop on Colorado politics and policies at blogs.denverpost.com/thespot/.
- Track state legislation with our Colorado Bill Tracker.
- Full political news coverage at denverpost.com/politics.
- Jan 10:
- First gay speaker of Colorado House among session's highlights
- Jan 9:
- Senate Minority Leader Bill Cadman's prepared remarks
- Colorado House opens under first gay speaker, Democratic control
- State Senate officially opens with a nod to heroes
- New faces ready for their debut as Colorado legislature begins session
- Jan 7:
- Colorado Democrats plan tax breaks despite shaky state budget
Key legislative issues
Budget: The state's revenue picture is improving for the first time in years, triggering fights over which programs to restore first.
Death penalty: Some lawmakers want to outlaw the death penalty, while one whose son was murdered says voters should decide.
Economy: Colorado is only beginning to recover from a downturn, and the first bills to be introduced are aimed at helping working families and creating jobs.
Education: House Republicans want to pump more money into colleges, while Democrats are looking at the first significant reform of the school finance act in decades.
Elections: Democrats want to change rules that prevent registered voters from getting mail ballots if they've missed an election, and put more restraints on Secretary of State Scott Gessler, a Republican, who they say has been trying to suppress voters.
Guns: Mass murder at an Aurora theater and a Connecticut elementary school push Second Amendment issues to the fore.
Labor: With Democrats in control of both chambers and the governor's office, union activists are pushing their causes, including the return of a bill to allow collective bargaining for firefighters.
Marijuana: Voters legalized the sale of marijuana, and lawmakers will need to implement rules.
Oil and gas: Battles continue between the extraction industry and local communities, with some residents wanting lawmakers to take a side.


text:
ACParadise Network: American Cosplay Paradise American Cosplay Experience American Cosplay Snapshots
Hello! My name is Paula, and I've been cosplaying since 2007 (though I've been going to cons for a bit longer than that). My favorite characters to cosplay are ones that I can relate to in some way, be it in their personality or the type of clothing they like to wear or how they interact with other charaters :) I'm so happy and proud when I finish making a costume for a character I really love, it's such a great feeling!
I love this hobby and all the nice people I've met through it, and I don't think I'll be stopping any time soon :D
Celestial Shortcut URL:
Recent Updates
Costume 11 12009 Views
Costume 10 1258 Views
Costume 1 0455 Views
Costume 17 25459 Views
Costume 16 74564 Views
Costume 3 2578 Views
Costume 2 0377 Views
Costume 8 11203 Views
Costume 7 0704 Views
Costume 11 54442 Views
Newest Favorites
Newest Fans
Recent Comments
- TwiliteSea says, "You make such a cute Anna ;_; "
- For Anna from Frozen
- Cepia says, "Thank you so much! It is a wig with clip on pigtails :)"
- For Usagi Tsukino from Sailor Moon Super S
- Envel says, "I can't find the words to describe what a cute Usagi you are! I really love that the wig looks so real it could be your real hair! (Or is it your real hair? It looks fantastic!)"
- For Usagi Tsukino from Sailor Moon Super S
- tokidoki loki says, "OH MY GOODNESS THIS IS SO PRECIOUS! "
- For Madoka Kaname from Madoka Magica
- zipchan says, "You're an awesome Usagi!"
- For Usagi Tsukino from Sailor Moon


text:
Jeremy Mayer: Typewriter Sculpture
Posted by Cynthia | Filed under Inspiration, Musings
I recently learned of the the phenomenal world of talented illustrator and sculptor Jeremy Mayer.
His medium: Typewriters.
I find Jeremy's work to be interesting on multiple levels; It is exacting, playful, mechanical and an expression of nature simultaneously. There is such beauty in the expression of his creations. I can feel the depth in the eyes, and the delicacy of the hand. The figure above is titled: Delilah. She is real. Isn't she?
Jeremy describes his work and process: "I disassemble typewriters and then reassemble them into full-scale, anatomically correct human figures. I do not solder, weld, or glue these assemblages together- the process is entirely cold assembly. I'm very interested in assembly, particularly in nature. I pay very close attention to the strong current in science and technology flowing inexorably toward an emulation of natural systems".
To learn more about the work of Jeremy Mayer, visit his website at http://www.jeremymayer.com.
All photography courtesy of the artist.
Tags: artwork, Illustration, Jeremy Mayer, sculptural art, Sculpture, Typewriter Assembly