Let’s face it, I hate most of the stuff you watch – Barbie and the Dreamhouse was the low point. So this is a list of films I want you to watch.
Not in any particular order (although I’ll guide you on the proper order for Star Wars!) – just make sure they’re age appropriate. When you’ve watched them all, then I’ll allow Barbie again !!! (maybe not also !!)
Escape from New York
Mad Max (all of them so we can then debate which was the best)
War Games (I want to watch this again too, book it in!!)
Labyrinth (ask for my Ludo impression)
Flight of the Navigator
Short Circuit (don’t watch number 2 – it sucked)
Bill + Ted (all of them in one sitting)
Pretty Woman (with your mum)
Flatliners (they all die .. get over it)
Drop Dead Fred
Jurassic Park (Start at 9am and watch them all in one day)
Wayne’s World (Schwing! …. inappropriate but very funny !)
Dumb and Dumber
Ace Ventura (One of my hero’s is Ace … you may get my humour … CHICAGO !!)
Pulp Fiction (great soundtrack)
Judge Dredd (all versions then debate which is the best and why)
The Net (I’ll show you all the technical nonsense in it .. Sandra Bullock didn’t invent the internet)
Hackers (all of them – but you need to read a couple of books first)
Romeo and Juliet (with your mum)
Trainspotting (cracking soundtrack)
Mission Impossible (wait till you see 3 … you’ll die laughing)
Grosse Point Blank
Good Will Hunting
Austin Powers (and please get dressed up)
Men in Black (all of them in one sitting)
Rocky Horror Picture Show
Little Shop of Horrors
Godzilla (the older one)
Enemy of the state
Meet Joe Black
Shakespeare in Love (watch with your mum!)
Matrix (promise you’ll only watch the first one!)
Emperor’s New Groove
Gladiator (See MovieMistakes.com first)
Gone in 60 Seconds
O Brother Where Art Thou
Smokey and the Bandits
Fast and Furious (all of them)
Lord of the Rings
AI (please read Isaac Asimov I Robot first)
A Knight’s Tale
Catch Me If You Can
Men In Black (all of them)
Transporter (all of them)
Austin Powers (all of them)
Italian Job (the original)
School of Rock
League of Extraordinary Gentlemen
50 First Dates
Day After Tomorrow
National Treasure (after watching – speak to Grandy)
HitchHikers Guide (Orginal, read the books then watch the latest one)
V for Vendetta
Night at the Museum
Employee of the Month
Little Miss Sunshine
I am Legend (and then write the ending properly)
Meet the Robinsons
Madagascar (all of them)
That’ll do for now … I’ll add to it as I remember more.
If you have any suggestions please recommend them here :
Freedom from digital persecution (privacy in the future)
Freedom from digital colonisation
Freedom of digital access, movement and speech
I watched the keynote with interest and have the following thoughts :
Freedom from mass surveillance (target / blanket)
I appreciate that there is a time and place for surveillance. CCTV watches our every move and our internet traffic is scanned for key words. To remove this I believe would be a mistake – but instead, they should be more transparent instead. Go ahead, watch me and scan me … but only if you do something useful with this data to keep me safer. Sure I have secrets and sure, I am aware of what I post … but can you imagine a world where facial recognition does not pick up the criminals ? I think that there is a specific use case for mass surveillance, but it is currently not being handled well and certainly not following the same standard of disclosure globally.
Freedom from digital persecution (privacy in the future)
This I understand and totally support. Right now, May 2014, it is OK to have certain views, prejudices etc, but in 2020, will those standards still hold. Will my old opinion still be the same ? I once thought I was going to be an electrical engineer – that didn’t work out, so why should the opinions I have still hold ANY weight in the future ? We need to isolate a case, sure, look back in history to see if it a long-held opinion, but certainly not to use it to persecute in the future.
Freedom from digital colonisation
The lines between technology and our existence are more blurred than ever. With the Internet of Things, mobile tech etc … we see more intrusion of technology into our lives. And it is just that .. an intrusion. We need to learn to adopt the divide between tech and life. Just because technology exists doesn’t mean we have to shoe-horn it into every day lives – especially if it is to the detriment of our privacy. We all need to learn to have down-days. Non-tech days … and if you don’t know the answer to a problem, instead of Googling it … use this method:
Brain – think about it, work out the options and the theory.
Book – read it in a book, they are more than paperweights !
Buddy – ask a friend, a colleague … the meat space !
Boss – ask a person in authority, your boss, a department head, a lecturer, they generally got there by knowing something !
Freedom of digital access, movement and speech
Should I be allowed to write what I want ? What about offending someone or prejudice ? Should I be restricted in what I can/can’t say ? I think this comes down to an old skill that we seem to have forgotten with the advent of technology – the art of common sense. So I would like to introduce you to Gran’s law. Think about an elderly relative (a Grand-parent for example). Now go ahead and type your real feelings about something you feel passionate about. If your Gran were to read it, would she be offended, clip you round the ear, would she be horrified about it … if the answer is yes, then it is probably best to keep it off the internet ! Common sense can save you a lot of conversations later. You should not be thinking about your intended audience but that the internet sees all.
What are your thoughts ? Have you posted on the Digital Freedom site ?
I have to explain security concepts quite a bit in my job and so I thought I’d share my thoughts with you all for some discussion.
I’m going to keep it brief and then update this blog with the feedback and comments shortly.
There are two kinds of people – those who have been hacked and those that don’t know it yet.
I’m all for a bit of FUD, Fear, Uncertainty and Doubt. It is a good sales technique to be fair – but please, if you are going to use FUD, be accurate. The infosec is getting a bad rap for wild accusations so let’s keep it real. If you feel the need to use a FUD mantra – how about:
Do you want to be one of those companies that you get to read about who didn’t do anything and then got hacked.
Monitor, Manage and Maintain
Bit of a personal favourite of mine – so for transparency reasons … yes, I am biased!
Monitor – you have to be looking out to see what is coming your way. Ensure you have adequate monitoring that is telling you of an impending attack. Of course the critical part of all this is to know your base line – what is normal ? Once you know this, then you can work out what could be going wrong.
Manage – if you don’t have someone looking after these things, it goes the way of the paperless office … it was a good idea once. There should be a sponsor … a person at the top of the tree who ensures that the top line buys in, then there should be a busy bee worker who is making sure ‘stuff’ happens.
Maintain – patch, upgrade – do what you need to to ensure you are always at the edge and not falling in to the hands of criminals who love to capitalise on out of date systems
We have [VENDOR PRODUCT] so we’ll be OK
Buy our [VENDOR PRODUCT] and you will be secure
No, no, no, no. No piece of tin will keep you safe. I love this quote which explains this perfectly “It doesn’t matter how thick your suit of armour is, you can still get flu.” With humans, there is always a will and a way !
So there you go …. my starter for 10 …. what security mantras do you use to protect yourself or what mantras do you train others in ?
I ask myself this several times a month … why am I doing this ?
Yet again, another compromised site, more unpatched software – I could scream ! Well … I could … but I don’t. Each person has their own incident – to them it is a personal disaster and so I respect that.
April 2013 and I was sat in bed, the missus asleep and kids climbing all over me. I picked up my tablet and logged in to Twitter. It’s about 8am and there it was .. another leak of a database. I still don’t know why I felt compelled to act but I did. It was medical data. Maybe it was the first record being a young child and I empathised ? I don’t know … but I did respond.
I found the website of the source and it was a small charity. How cruel I thought. A small charity doing its best and someone compromised them and leaked their data – no ethics amongst thieves.
I called the charity – and yeah, I didn’t really know what I was going to say so I thought go with the facts. The lady I spoke to was upset, but I knew I could help. Sunday disappeared in a blur – calls, emails, web forms – within a very short space of time, the leaked data was removed from the net and a Police report filed.
Why would I give up my Sunday – one of the few days I get with my kids to help some tiny charity who had been attacked ? The answer is quite simple. This is what I do. I help people when they have been attacked, I dig and I find and I sort out the mess.
And in this case, they were saved from ICO fines, the data was protected as best as possible and the charity continued.
Around Christmas I saw a post on their Twitter account that a new website was launched and there was also good news with regards to treatments in their specific area. It really did give me such a great feeling to know that a few days of my and my colleagues time resulted in them continuing. It felt great and I sent them a quick note to wish them well.
Today is Saturday and I have just checked my email to receive some of the best news ever. I have quoted it in full below.
Why a sledgehammer can’t smash our butterfly A personal letter to members from CEO, Liz Glenister
On a Sunday morning in early April last year, the phone rang. I didn’t recognise the number so I let the answer phone pick up. ‘Hello, my name’s Stuart Coulson and I’m calling from a company called Secarma….’ which he proceeded to spell out. ‘Great, a cold caller on a Sunday morning!’ I thought and was heading downstairs when I heard the words ‘…..and your Twitter account has been hacked.’ Was this for real? I hesitated. ‘I’m an Information Security Professional and your patient database has been leaked.’ My blood ran cold. ‘Look up LulzsecWiki on Twitter; I’m afraid you’ve got a pretty big issue going on here.’ I picked up the phone and was launched into a nightmare that lasted 4 months.
Lulzsec are a notorious hacking group, an offshoot of the Anonymous collective, who hack for the ‘lulz’ or laughs but it was about as far from funny as you can get for us. The group had closed down the CIA server that very same morning – which did at least make us feel that maybe we couldn’t have been any more careful. They hacked into our patient database (apparently under the impression that it was a UK hospital database as part of an ongoing April Fool raid on the NHS), dumped the information (user names, passwords, medical details etc) in a site called Pastebin and then posted the link on their Twitter account, announcing the deed to the world with the word ‘Enjoy‘. I was completely shocked and devastated. As was Ivor, our webmaster, and the executive committee. We have always taken the security of our members very seriously indeed and were extremely worried. We barely slept for the next week as we took every step possible to track down and remove data, inform and protect our members.
We were supported at this point by our wonderful webmaster, Ivor Humphreys. Ivor has given years of his time to us voluntarily and had to shoulder this burden while driving miles back and forth to care for his mother who was severely ill. He was a complete and utter star. It was an extremely stressful and difficult time involving a huge amount of work but Ivor left no stone unturned and saw us safely through to recovery. We will always be grateful for his loyalty, his dogged persistence and especially his uplifting humour.
Superheroes to the rescue
We discovered that there was an entire community out there that we had not known existed and to whom we owe everything: the information security professionals. They are truly the superheroes of today, looking out for us and guarding against hackers. They had already taken steps themselves and we worked with them over the months, being guided through a quagmire of legalities and technicalities and out the other side. We had a massive amount of support from professionals who appeared out of the blue like this to offer help and advice. I would like to take this opportunity to publicly thank everyone who helped us and gave so freely of their expertise and time, particularly Stuart Coulson of SECARMA , online security specialists http://www.secarma.co.uk/about.html and James Cleeter of the Computer Security and Incidence Response team for JANET, the UK’s network for education & research communities https://www.ja.net/about-janet/about-us. I had an email from Stuart at Christmas whose personal delight in seeing us get back up and carry on I found very touching. Without him we probably wouldn’t be here. There are a lot of good guys out there too!
All these agencies were horrified that a small patient support charity had been so unusually targeted in this way and many articles appeared in both IT and healthcare press about the incident. You can read a typical summary here in PHIprivacy.net which reports and investigates health and medical related privacy breaches http://www.phiprivacy.net/uk-support-organization-hacked-data-leaked/. Thank you to author ‘Dissent‘ who moved fast to highlight our plight.
So then began the arduous task of choosing, and setting up a new forum. For this I would like to thank Ivor Humphreys, for the initial phase, and Mandy Mainland, forum administrator, and Su Clifton and Lisa Burke, forum moderators who worked long and hard to see it through to going live as swiftly as possible. They did a really fantastic job. We chose to look on this enforced shut down as an opportunity for positive change and we think the new forum is greatly improved! We hope you like it. Although each of you has received an email about it, not everyone who had registered on the old forum has yet re-registered on the new one so if you would like to show your support for all our work we’d be really pleased if you would go and sign up now. www.hypopara.org.uk/board.
Further to this is also this poem (I’ve never had a poem about me before!).
Hacked Off Su Clifton
We came across some hackers
I won’t reveal their name
Hacking on the internet
What a pointless claim to fame
They saw our little website
And thought ‘oh how divine
Lets rummage through their details
Then we’ll post them all online’
Secarma was our saviour
To guide us through this mess
Like knights in shining armour
To our damsels in distress
Stuart Coulson helped us out
Thank you most sincerely
Now no fine from ICO
That would have cost us dearly
Beefed up our security
Got a brand new forum
Usernames and passwords safe
All moderators awesome
So if you are a hacker
Please leave our site alone
We ask you most politely
As to us it feels like home.
So why do I do what I do ?
The arrival of this news today in my inbox helped my to finally write this blog. It is something I have tried to do several times before, but it is a difficult topic. Who you are.
So … why do I do what I do ?
Well the answers are many; for the love of it, because I care. But the most important one surely is because I can and so I do. I will always have a hand in security – my kids have amazing passwords, my 10yr old can pick locks. I’m building a secure future there. Just spreading the message by one person just helps to make the world safer. Even if it is one person at a time.
I’m hoping my blog hits home with some of the security community and maybe spur you to see what you can do to help small charities around you. Free vulnerability scan ? Quick 2 day pen test ? Protect a small charity that is fighting to get its voice heard ? Pro-active protection to help the little man from the cruel criminal community.
I wish the Hypopara supporters and team all the best wishes for the future. The new site looks great and with the leaps in the Natpara treatment, it looks like the charity has a bright future. You really are an amazing team and your incident response was second to none. You really did a great job. Genuinely humbled by you all. Thank you.
Talk .. its a simple thing. Sometimes we get criticised for talking too much, sometimes to the wrong person and often for not saying enough.
And yet the phrase is “talk is cheap.” I disagree, talking can be expensive!
Talking is a unique skill, animals can communicate but the breadth of language we have achieved across the earth is staggering; common languages, country specific languages, local languages, dialects, sign languages, the list seems endless.
But all this time there is something unique about talking. Because we use our face, we therefore use expression and so talking is a more genuine method of communication. Is this why it is easier to write an email to let someone know bad news than speak to them face to face?
Today we have a special chance though to talk.
I talk to my partner all the time. She hears my woes and successes and I know I am in a special situation in the fact she is a good listener. For that I am eternally grateful.
However, in our communities whether it is information security, web design, marketing or wherever you work, do we talk? I think no. We say a lot without actually talking. Today is a day when we need to focus on talking.
So let me talk, and I want you to listen and think about who you are going to talk to and about what. Some of the issues I talk about below have never been talked about openly for many years.
Yes, mental health is an issue. It creeps in to our lives without actually ever making itself evident. Depression is a classic, tiny things can start it off and it grows over time – over time it becomes like an all-consuming virus until it affects all areas of our lives.
I know I suffer with mental health issues. Yep, more than one. Some of my closest friends probably don’t even know it … but they are there. Today is my Time to Talk and help others take some courage to talk too.
I am a digiholic. You only have to be around me for a short space of time before you see the manifestation of what this looks like. I am fascinated by technology, I have been since owning a BBC Micro. I played Elite properly by working out the algorithm behind the game and how to rise through the ranks of the game (*Spoiler – it was based on 255). I drew maps of text adventures until I had whole worlds drawn out on music rule wide carriage paper. When I got my first PC, I took it apart. Every jumper off the motherboard, every screw … later in life this actually helped me pass my university course as I fixed PCs in payment for help with coursework.
But then I hit an interesting patch. My early jobs as helpdesk for an EDI Messaging company led me to research the land of e-commerce pre-2000 when to be cool meant putting an ‘e’ at the front rather than an ‘i’ or ‘cyber’. I used to spend over 18 hours a day at the keyboard reading, watching, learning. And there … right there, the obsession was born.
In the information security landscape, we see this described as autistic, ADHD trait, on the spectrum. This compulsion to find stuff out – curiosity on steroids. There in a bedsit I stared at a screen one Sunday morning and realised it had been over 50 hours with no sleep and I was staring at a screen trying to learn everything about e-commerce products and competitors. I locked the computer and walked out of the door. I walked. I walked for about 10 miles, I walked in silence. I ran away if you like until I found myself in a deer park and it was late, really quite late. I hadn’t eaten for 2 days and I was sat on a park bench. I took my time inside my head to have the conversations, to talk, and put in place my personal protection plan. I realised there and then how close I had become to just disappearing into a world that would have been difficult to come out of.
I knew I had to protect myself and my Personal Protection Plan is still in place today. I won’t go more than 24 hours behind a keyboard. I will always break it. I own the computer not the other way round. Recently my family went camping to an area with poor phone signal and for 2 weeks I spent a total of 2 hours on the internet. It was heaven but I also felt that twinge – like an addiction.
We need to un-jack ourselves. Power down. Step away from the keyboard. In the 80s the UK kids TV program had it right…
Why don’t you just switch off your television set and go and do something less boring instead?
I am still obsessed and still have this compulsion, but concentrating it into shorter burst means I am more effective which gives me greater pleasure in being always connected.
Or should I more accurately put it – the lack of depression. It is normal to have depression, it is a chemical reaction, but I don’t get the same reaction. I recently was told by a senior member of staff that he had been concerned about me, was I depressed, having a breakdown – I found the comment very amusing as I knew what he was trying to get to, but he also was being quite offensive and unfortunately did not understand what was actually going on. Let me explain.
As a child I was bullied. I was bullied for many reasons, I was short, fat, intelligent, socially awkward and I had an accent which didn’t fit with the school. To protect myself, I lost my accent – try doing that when you are 5 years old! I took control of my emotions – yes, I could be beaten up, kicked to the ground and yet I would not cry, I would not show emotion. I had mastered my emotions. This was so useful as a child in that I could not break in front of my attacker. However, the danger was there was no place I could let it out. And so one day I held my attacker by the throat against my classroom wall holding him about 18 inches off the ground and screamed in his face “Don’t ever touch me again.” I came to my senses very quickly and realised he was struggling and I let him go and walked out the classroom. I hid and cried. I cried for about 10 minutes before sorting myself out. Then when I came back to the classroom, the silence was deafening. My bully eventually became a great friend and he later apologised for the years I had been bullied.
As I have spent now over 30 years with my emotions in control, manipulative and pressure tactics used by managers have rarely worked. This control means that I can put myself into difficult situations and control my emotions enough to control the output. It also means that I have an interesting life – I don’t do stress, I don’t do depression. These negative emotions and habits are just not needed, so I find emotional workarounds. If I am feeling lower, I use music to raise my mood. If make sure that tough deadlines become realistic ones.
But … and this is a big but … I have to find my releases. I have to find a way to allow natural emotions come out. I have many ways to do this – and each of them is done in a controlled manner.
How do you control your emotions ? I have absolutely no idea if I am totally honest. I wish I could. Part of it is definitely having an understanding about what you want as an outcome to a situation and understanding how you need to behave to get it to happen. But depression is a no-no. It only serves to undermine your view, your psyche, your emotional stable. I therefore don’t let things get me down. No matter how hard things get, I am not at the bottom of the tree. I believe some of this is also my own personal integrity. Knowing myself means that I also know what I am sacrificing if I needed to and what I won’t compromise on.
So there we go, maybe next year I will share some of my other mental health areas. If you want to talk to me about your mental health and how healthy you think you are or not, then please feel free. I will listen.
The world is too small to not get on with each other.
You’re a long time dead, so enjoy the living.
In the infosec world, we have lost too many great people to mental health problems, depression, anxiety, autism, adhd, today is a time to talk.
Many thank to my old friend Mariel for bringing this to my attention.
So it looks like we survived 2013! No comets came crashing into Earth, the zombies stayed and the sun didn’t explode.
It’s always at this point in the year we see those blogs – “Retrospective on 2013” Well to save you the bother of reading them, here’s a little tip. Everything in 2012 happened again but to various different degrees.
Instead of Sony being attacked it was Target
Instead of Wikileaks it was Snowden
Instead of 123456 being the most common password to be leaked it was … 123456
And herein lies the problem with information security.
We spend all year inventing new technologies .. Web Application Firewalls, APT threat detection, Cloud Based anti-DDoS solutions – the list of tin and “solution” is vast. As an end user you now have a bewildering array at your disposal. But does it work ?
Well .. to put it bluntly .. no.
It’ll never work when the user thinks to be safe I’ll use 123456 for a password.
It’ll never work when users post photos of their debit cards on social media.
It’ll never work when companies store credentials plain text.
It’ll never work when vendors can be swayed by $10million from the NSA.
You can surround yourself with as much defence and attack capabilities as you like but if you are compromised before you start then save your money.
So that was 2013 …
A lot happened and the infosec community cannot say we won this year. If anything .. we took a bad battering. Take stock of what you learned and face 2014 with new energies to this year get it right.