Clever post by TheAtlantic.com blogger Megan McArdle:
"I'm forced to conclude that (the import of) Mexican lemons have improved highway safety a great deal. The vitamin C, maybe? The fragrance? Bioflavanoids?"
Read the short article, featuring a great graph, with near perfect correlation of increasing lemon imports and a reduction in US highway fatalities
A great reminder to ask the right questions about some of those problematic security surveys and studies that are being churned out at high rates with low integrity.
"What's the mechanism?" is one good question to ask.
http://meganmcardle.theatlantic.com/archives/2009/04/department_of_awful_statistics_6.php
PS I'm not partisan when it comes to information security, so McArdle's political spin is her own.
April 05, 2009
March 11, 2009
Professionalism in the Security Community
Marcus Ranum recently started discussing CyberWar and its basis in reality (or lack thereof). He first presented the Cyberwar is BS talk at HackInTheBox in Singapore and more recently at DojoSec in Columbia, MD.
The talk was naturally controversial because, hey, that's Ranum's style and it's also the subject matter itself. Some people have resorted to delighting in Ranum's alleged '0wn@ge' since his talk supposedly got some nasty feedback, including some people calling him an idiot or saying that he doesn't know what he's talking about, etc. (more on that later...)
I welcome a sober discussion on cyberwar (what it is, why it's real or not, etc) and while I don't agree with everything he said at DojoSec, http://www.vimeo.com/3519680 , I would never call Marcus Ranum an idiot. Why not?
A few reasons just off the top of my head:
1. He is clearly not "an idiot." He's been around the infosec block for a long time, on both the technical and business side and he has the experience and technical skills to match any young ankle-biter I know who wants to take Ranum down a notch by calling him names.
2. Even if I thought he was wrong about some, most or even ALL of his points, he'd still not be "an idiot," he'd just be wrong. It would be my responsibility to say why I thought so, privately and/or publicly, but in a respectful manner.
3. He owns a very accurate rifle and knows how to use it...http://ranum.com/fun/bsu/diy-dealy/index.html
But seriously... Let's stop calling each other names and trying to take people down in order to make ourselves look good... and let's get back to contributing CONSTRUCTIVELY to the community.
A community where, I might add, Marcus Ranum is a longstanding, honorable member and leader. There are plenty of people who disagree with some of the content in the "Cyberwar is BS" talk, but there are those in our community who can disagree with someone and still display professionalism and respect.
Like, say, Richard Bejtlich, who blogs at TaoSecurity and himself is fully qualified to discuss cyberwar and its implications: http://taosecurity.blogspot.com/2008/11/response-to-marcus-ranum-hitb-cyberwar.html
Guess what? I too disagree with some of Ranum's points in the "Cyberwar is BS" talk and I found myself occasionally squirming in my seat at DojoSec during his talk. I emailed him to tell him so instead of calling him names, telling him that I'd try to formulate a cogent argument for modifying some of these points (coming soon). Ranum will take good points and revise his thinking and presentation if it makes sense to him.
With that said, I couldn't agree more with what Ranum asked of his audience at DojoSec on March 5th:
"I am totally OK with people who say I don't know what I'm talking about, but what really makes me happy is if you tell me WHY I don't know what I'm talking about.
You can sit there until you're purple in the face and say 'ah he's an idiot' but if you tell me WHY I'm an idiot, you've got my undivided attention. So if you wanna argue with me about this, I am yours until hell freezes over, but don't just say I'm stupid, cuz I'll just say you're stupid back"
Please, people, don't fall into the the cynicism/namecalling trap: It's counterproductive, unprofessional and makes you look disrespectful to fellow security people and possibly others outside the community. It will never elevate your status long-term, even if you happen to be right about a certain part of an argument. Keep it cool and calm: We're expected to be graceful under fire, after all.
BTW, if you think I'm an idiot for saying this, re-read the above quotes and let me know WHY...
The talk was naturally controversial because, hey, that's Ranum's style and it's also the subject matter itself. Some people have resorted to delighting in Ranum's alleged '0wn@ge' since his talk supposedly got some nasty feedback, including some people calling him an idiot or saying that he doesn't know what he's talking about, etc. (more on that later...)
I welcome a sober discussion on cyberwar (what it is, why it's real or not, etc) and while I don't agree with everything he said at DojoSec, http://www.vimeo.com/3519680 , I would never call Marcus Ranum an idiot. Why not?
A few reasons just off the top of my head:
1. He is clearly not "an idiot." He's been around the infosec block for a long time, on both the technical and business side and he has the experience and technical skills to match any young ankle-biter I know who wants to take Ranum down a notch by calling him names.
2. Even if I thought he was wrong about some, most or even ALL of his points, he'd still not be "an idiot," he'd just be wrong. It would be my responsibility to say why I thought so, privately and/or publicly, but in a respectful manner.
3. He owns a very accurate rifle and knows how to use it...http://ranum.com/fun/bsu/diy-dealy/index.html
But seriously... Let's stop calling each other names and trying to take people down in order to make ourselves look good... and let's get back to contributing CONSTRUCTIVELY to the community.
A community where, I might add, Marcus Ranum is a longstanding, honorable member and leader. There are plenty of people who disagree with some of the content in the "Cyberwar is BS" talk, but there are those in our community who can disagree with someone and still display professionalism and respect.
Like, say, Richard Bejtlich, who blogs at TaoSecurity and himself is fully qualified to discuss cyberwar and its implications: http://taosecurity.blogspot.com/2008/11/response-to-marcus-ranum-hitb-cyberwar.html
Guess what? I too disagree with some of Ranum's points in the "Cyberwar is BS" talk and I found myself occasionally squirming in my seat at DojoSec during his talk. I emailed him to tell him so instead of calling him names, telling him that I'd try to formulate a cogent argument for modifying some of these points (coming soon). Ranum will take good points and revise his thinking and presentation if it makes sense to him.
With that said, I couldn't agree more with what Ranum asked of his audience at DojoSec on March 5th:
"I am totally OK with people who say I don't know what I'm talking about, but what really makes me happy is if you tell me WHY I don't know what I'm talking about.
You can sit there until you're purple in the face and say 'ah he's an idiot' but if you tell me WHY I'm an idiot, you've got my undivided attention. So if you wanna argue with me about this, I am yours until hell freezes over, but don't just say I'm stupid, cuz I'll just say you're stupid back"
Please, people, don't fall into the the cynicism/namecalling trap: It's counterproductive, unprofessional and makes you look disrespectful to fellow security people and possibly others outside the community. It will never elevate your status long-term, even if you happen to be right about a certain part of an argument. Keep it cool and calm: We're expected to be graceful under fire, after all.
BTW, if you think I'm an idiot for saying this, re-read the above quotes and let me know WHY...
February 23, 2009
How terrorist groups end (RAND)
This has some interesting implications to hacking groups, both financially and politically motivated. While sending a Hellfire-equipped Predator drone after hacktivists is typically regarded in polite society as "a bit much," the lessons learned here can be grafted to the online world with some modification.
The list is certainly not exhaustive in terms of case studies, but it is valuable for the framework of tracking a tango group from cradle-to-grave, with time and cause of death available.
http://www.rand.org/pubs/monographs/MG741-1/
The list is certainly not exhaustive in terms of case studies, but it is valuable for the framework of tracking a tango group from cradle-to-grave, with time and cause of death available.
http://www.rand.org/pubs/monographs/MG741-1/
911.gov project site at UMaryland
http://www.cs.umd.edu/hcil/911gov/index.shtml
This is an interesting project that seeks to exploit the capabilities of the web to enable better communications between citizens and government during a crisis (ideally a two-way street...)
This is rife with possibilities and of course security challenges, well worth a look.
This is an interesting project that seeks to exploit the capabilities of the web to enable better communications between citizens and government during a crisis (ideally a two-way street...)
This is rife with possibilities and of course security challenges, well worth a look.
RAND on the prospect of a Domestic Intelligence Agency for the US
RAND studies western European experience with domestic intelligence agencies and gives US policymakers some pointers.
http://www.rand.org/pubs/monographs/MG805/
(relevant to infosec since a lot of surveillance/prosecution these days is digital...)
http://www.rand.org/pubs/monographs/MG805/
(relevant to infosec since a lot of surveillance/prosecution these days is digital...)
Vulnerabilities in the Terrorist Attack Cycle (Stratfor)
DHS, Infragard and other such organizations that work to mitigate infrastructure threats have constituents that seek their advice on where to spend scarce resources on preventing attacks.
Where are the best places for defenders to disrupt the attacks before it's too late?
Some thoughts here (still relevant from 2005):
http://www.stratfor.com/vulnerabilities_terrorist_attack_cycle
Where are the best places for defenders to disrupt the attacks before it's too late?
Some thoughts here (still relevant from 2005):
http://www.stratfor.com/vulnerabilities_terrorist_attack_cycle
It's official, I'm a twit...
As if you didn't know THAT.
But seriously, I'm on Twitter now... Sad but true.
Twitter.com/shpantzer
Rejoice?
But seriously, I'm on Twitter now... Sad but true.
Twitter.com/shpantzer
Rejoice?
Subscribe to:
Posts (Atom)
