The movie list

This list is for my kids.

 

Let’s face it, I hate most of the stuff you watch – Barbie and the Dreamhouse was the low point. So this is a list of films I want you to watch.

Not in any particular order (although I’ll guide you on the proper order for Star Wars!) – just make sure they’re age appropriate. When you’ve watched them all, then I’ll allow Barbie again !!! (maybe not also !!)

 

  • THX1138
  • Blazing Saddles
  • Rollerball
  • Driver
  • Convoy
  • Time Bandits
  • Escape from New York
  • Mad Max (all of them so we can then debate which was the best)
  • Blade Runner
  • Dark Crystal
  • War Games (I want to watch this again too, book it in!!)
  • Top Gun
  • Labyrinth (ask for my Ludo impression)
  • Flight of the Navigator
  • Short Circuit (don’t watch number 2 – it sucked)
  • Ferris Beuller
  • Lost Boys
  • Dirty Dancing
  • La Bamba
  • BeetleJuice
  • Akira
  • Bill + Ted (all of them in one sitting)
  • Pretty Woman (with your mum)
  • Flatliners (they all die .. get over it)
  • Drop Dead Fred
  • Jurassic Park (Start at 9am and watch them all in one day)
  • Mrs Doubtfire
  • Wayne’s World (Schwing! …. inappropriate but very funny !)
  • Dumb and Dumber
  • Mask
  • Shawshank Redemption
  • Forrest Gump
  • Ace Ventura (One of my hero’s is Ace … you may get my humour … CHICAGO !!)
  • Pulp Fiction (great soundtrack)
  • Leon
  • Judge Dredd (all versions then debate which is the best and why)
  • The Net (I’ll show you all the technical nonsense in it .. Sandra Bullock didn’t invent the internet)
  • Crimson Tide
  • Hackers (all of them – but you need to read a couple of books first)
  • Tank Girl
  • Braveheart
  • Romeo and Juliet (with your mum)
  • Trainspotting (cracking soundtrack)
  • Mission Impossible (wait till you see 3 … you’ll die laughing)
  • The Rock
  • DragonHeart
  • Eraser
  • Swingers
  • Contact
  • Face Off
  • Gattaca
  • Grosse Point Blank
  • Full Monty
  • Titanic
  • Good Will Hunting
  • Austin Powers (and please get dressed up)
  • Men in Black (all of them in one sitting)
  • Rocky Horror Picture Show
  • Little Shop of Horrors

 

  • Weird Science
  • CannonBall Run
  • Devils Advocate
  • Fifth Element
  • Godzilla (the older one)
  • Truman Show
  • Enemy of the state
  • Armageddon
  • Lock Stock
  • Snatch
  • Meet Joe Black
  • Shakespeare in Love (watch with your mum!)
  • Avengers
  • Matrix (promise you’ll only watch the first one!)
  • American Pie
  • 6th Sense
  • Notting Hill
  • Office Space
  • Payback
  • Three Kings
  • Emperor’s New Groove
  • Chicken Run
  • Road Trip
  • Gladiator (See MovieMistakes.com first)
  • Gone in 60 Seconds
  • Pich Black
  • O Brother Where Art Thou
  • Boiler Room
  • Hollow Man
  • Perfect Storm
  • Monsters Inc
  • Dune
  • Convoy
  • Smokey and the Bandits
  • Fast and Furious (all of them)
  • Lord of the Rings
  • Oceans 11
  • AI (please read Isaac Asimov I Robot first)
  • Moulin Rouge
  • Swordfish
  • A Knight’s Tale
  • Catch Me If You Can
  • Bourne Identity
  • Men In Black (all of them)
  • Transporter (all of them)
  • Minority Report
  • Austin Powers (all of them)
  • Finding Nemo
  • Italian Job (the original)
  • School of Rock
  • League of Extraordinary Gentlemen
  • Love Actually
  • 50 First Dates
  • Day After Tomorrow
  • National Treasure (after watching – speak to Grandy)
  • Anchorman
  • Van Helsing
  • Yes Man
  • HitchHikers Guide (Orginal, read  the books then watch the latest one)
  • xXx
  • Cars
  • Flushed Away
  • 300
  • V for Vendetta
  • Talladega Nights
  • Ice Age
  • Night at the Museum
  • Employee of the Month
  • Little Miss Sunshine
  • I am Legend (and then write the ending properly)
  • Meet the Robinsons
  • Madagascar (all of them)
  • Below

 

That’ll do for now … I’ll add to it as I remember more.

 

If you have any suggestions please recommend them here :

 

Digital Freedom – the manifesto is launched

Mikko Hypponen and David Hasselhoff have appeared on stage at re:publica 14 and launched the new Digital Freedom manifesto.

The manifesto is based on 4 points :

  1. Freedom from mass surveillance (target / blanket)
  2. Freedom from digital persecution (privacy in the future)
  3. Freedom from digital colonisation
  4. Freedom of digital access, movement and speech

 

I watched the keynote with interest and have the following thoughts :

Freedom from mass surveillance (target / blanket)

I appreciate that there is a time and place for surveillance. CCTV watches our every move and our internet traffic is scanned for key words. To remove this I believe would be a mistake – but instead, they should be more transparent instead. Go ahead, watch me and scan me … but only if you do something useful with this data to keep me safer. Sure I have secrets and sure, I am aware of what I post … but can you imagine a world where facial recognition does not pick up the criminals ? I think that there is a specific use case for mass surveillance, but it is currently not being handled well and certainly not following the same standard of disclosure globally.

Freedom from digital persecution (privacy in the future)

This I understand and totally support. Right now, May 2014, it is OK to have certain views, prejudices etc, but in 2020, will those standards still hold. Will my old opinion still be the same ? I once thought I was going to be an electrical engineer – that didn’t work out, so why should the opinions I have still hold ANY weight in the future ? We need to isolate a case, sure, look back in history to see if it a long-held opinion, but certainly not to use it to persecute in the future.

Freedom from digital colonisation

The lines between technology and our existence are more blurred than ever. With the Internet of Things, mobile tech etc … we see more intrusion of technology into our lives. And it is just that .. an intrusion. We need to learn to adopt the divide between tech and life. Just because technology exists doesn’t mean we have to shoe-horn it into every day lives – especially if it is to the detriment of our privacy. We all need to learn to have down-days. Non-tech days … and if you don’t know the answer to a problem, instead of Googling it … use this method:

  • Brain – think about it, work out the options and the theory.
  • Book – read it in a book, they are more than paperweights !
  • Buddy – ask a friend, a colleague … the meat space !
  • Boss – ask a person in authority, your boss, a department head, a lecturer, they generally got there by knowing something !

Freedom of digital access, movement and speech

Should I be allowed to write what I want ? What about offending someone or prejudice ? Should I be restricted in what I can/can’t say ? I think this comes down to an old skill that we seem to have forgotten with the advent of technology – the art of common sense. So I would like to introduce you to Gran’s law. Think about an elderly relative (a Grand-parent for example). Now go ahead and type your real feelings about something you feel passionate about. If your Gran were to read it, would she be offended, clip you round the ear, would she be horrified about it … if the answer is yes, then it is probably best to keep it off the internet ! Common sense can save you a lot of conversations later. You should not be thinking about your intended audience but that the internet sees all.

 

What are your thoughts ? Have you posted on the Digital Freedom site ?

 

Security Mantras

I have to explain security concepts quite a bit in my job and so I thought I’d share my thoughts with you all for some discussion.

 

I’m going to keep it brief and then update this blog with the feedback and comments shortly.

 

Mantra 1

There are two kinds of people – those who have been hacked and those that don’t know it yet.

I’m all for a bit of FUD, Fear, Uncertainty and Doubt. It is a good sales technique to be fair – but please, if you are going to use FUD, be accurate. The infosec is getting a bad rap for wild accusations so let’s keep it real. If you feel the need to use a FUD mantra – how about:

Do you want to be one of those companies that you get to read about who didn’t do anything and then got hacked.

 

Mantra 2

Monitor, Manage and Maintain

Bit of a personal favourite of mine – so for transparency reasons … yes, I am biased!

  • Monitor – you have to be looking out to see what is coming your way. Ensure you have adequate monitoring that is telling you of an impending attack. Of course the critical part of all this is to know your base line – what is normal ? Once you know this, then you can work out what could be going wrong.
  • Manage – if you don’t have someone looking after these things, it goes the way of the paperless office … it was a good idea once. There should be a sponsor … a person at the top of the tree who ensures that the top line buys in, then there should be a busy bee worker who is making sure ‘stuff’ happens.
  • Maintain – patch, upgrade – do what you need to to ensure you are always at the edge and not falling in to the hands of criminals who love to capitalise on out of date systems

 

Mantra 3

We have [VENDOR PRODUCT] so we’ll be OK

or

Buy our [VENDOR PRODUCT] and you will be secure

No, no, no, no. No piece of tin will keep you safe. I love this quote which explains this perfectly “It doesn’t matter how thick your suit of armour is, you can still get flu.” With humans, there is always a will and a way !

 

 

So there you go …. my starter for 10 …. what security mantras do you use to protect yourself or what mantras do you train others in ?

 

 

Why do I do what I do ?

I ask myself this several times a month … why am I doing this ?

Yet again, another compromised site, more unpatched software – I could scream ! Well … I could … but I don’t. Each person has their own incident – to them it is a personal disaster and so I respect that.

April 2013 and I was sat in bed, the missus asleep and kids climbing all over me. I picked up my tablet and logged in to Twitter. It’s about 8am and there it was .. another leak of a database. I still don’t know why I felt compelled to act but I did. It was medical data. Maybe it was the first record being a young child and I empathised ? I don’t know … but I did respond.

I found the website of the source and it was a small charity. How cruel I thought. A small charity doing its best and someone compromised them and leaked their data – no ethics amongst thieves.

I called the charity – and yeah, I didn’t really know what I was going to say so I thought go with the facts. The lady I spoke to was upset, but I knew I could help. Sunday disappeared in a blur – calls, emails, web forms – within a very short space of time, the leaked data was removed from the net and a Police report filed.

Why ?

Why would I give up my Sunday – one of the few days I get with my kids to help some tiny charity who had been attacked ? The answer is quite simple. This is what I do. I help people when they have been attacked, I dig and I find and I sort out the mess.

And in this case, they were saved from ICO fines, the data was protected as best as possible and the charity continued.

Around Christmas I saw a post on their Twitter account that a new website was launched and there was also good news with regards to treatments in their specific area. It really did give me such a great feeling to know that a few days of my and my colleagues time resulted in them continuing. It felt great and I sent them a quick note to wish them well.

Today is Saturday and I have just checked my email to receive some of the best news ever. I have quoted it in full below.

Why a sledgehammer can’t smash our butterfly
A personal letter to members from CEO, Liz Glenister

On a Sunday morning in early April last year, the phone rang. I didn’t recognise the number so I let the answer phone pick up. ‘Hello, my name’s Stuart Coulson and I’m calling from a company called Secarma….’ which he proceeded to spell out. ‘Great, a cold caller on a Sunday morning!’ I thought and was heading downstairs when I heard the words ‘…..and your Twitter account has been hacked.’ Was this for real? I hesitated. ‘I’m an Information Security Professional and your patient database has been leaked.’ My blood ran cold. ‘Look up LulzsecWiki on Twitter; I’m afraid you’ve got a pretty big issue going on here.’ I picked up the phone and was launched into a nightmare that lasted 4 months.

Hacked off

Lulzsec are a notorious hacking group, an offshoot of the Anonymous collective, who hack for the ‘lulz’ or laughs but it was about as far from funny as you can get for us. The group had closed down the CIA server that very same morning – which did at least make us feel that maybe we couldn’t have been any more careful. They hacked into our patient database (apparently under the impression that it was a UK hospital database as part of an ongoing April Fool raid on the NHS), dumped the information (user names, passwords, medical details etc) in a site called Pastebin and then posted the link on their Twitter account, announcing the deed to the world with the word ‘Enjoy‘. I was completely shocked and devastated. As was Ivor, our webmaster, and the executive committee. We have always taken the security of our members very seriously indeed and were extremely worried. We barely slept for the next week as we took every step possible to track down and remove data, inform and protect our members.

Wonderful webmaster

We were supported at this point by our wonderful webmaster, Ivor Humphreys. Ivor has given years of his time to us voluntarily and had to shoulder this burden while driving miles back and forth to care for his mother who was severely ill. He was a complete and utter star. It was an extremely stressful and difficult time involving a huge amount of work but Ivor left no stone unturned and saw us safely through to recovery. We will always be grateful for his loyalty, his dogged persistence and especially his uplifting humour.

Superheroes to the rescue

We discovered that there was an entire community out there that we had not known existed and to whom we owe everything: the information security professionals. They are truly the superheroes of today, looking out for us and guarding against hackers. They had already taken steps themselves and we worked with them over the months, being guided through a quagmire of legalities and technicalities and out the other side. We had a massive amount of support from professionals who appeared out of the blue like this to offer help and advice. I would like to take this opportunity to publicly thank everyone who helped us and gave so freely of their expertise and time, particularly Stuart Coulson of SECARMA , online security specialists http://www.secarma.co.uk/about.html and James Cleeter of the Computer Security and Incidence Response team for JANET, the UK’s network for education & research communities https://www.ja.net/about-janet/about-us. I had an email from Stuart at Christmas whose personal delight in seeing us get back up and carry on I found very touching. Without him we probably wouldn’t be here. There are a lot of good guys out there too!

All these agencies were horrified that a small patient support charity had been so unusually targeted in this way and many articles appeared in both IT and healthcare press about the incident. You can read a typical summary here in PHIprivacy.net which reports and investigates health and medical related privacy breaches http://www.phiprivacy.net/uk-support-organization-hacked-data-leaked/. Thank you to author ‘Dissent‘ who moved fast to highlight our plight.

New forum

So then began the arduous task of choosing, and setting up a new forum. For this I would like to thank Ivor Humphreys, for the initial phase, and Mandy Mainland, forum administrator, and Su Clifton and Lisa Burke, forum moderators who worked long and hard to see it through to going live as swiftly as possible. They did a really fantastic job. We chose to look on this enforced shut down as an opportunity for positive change and we think the new forum is greatly improved! We hope you like it. Although each of you has received an email about it, not everyone who had registered on the old forum has yet re-registered on the new one so if you would like to show your support for all our work we’d be really pleased if you would go and sign up now. www.hypopara.org.uk/board.

Further to this is also this poem (I’ve never had a poem about me before!).

Hacked Off
Su Clifton

We came across some hackers
I won’t reveal their name
Hacking on the internet
What a pointless claim to fame

They saw our little website
And thought ‘oh how divine
Lets rummage through their details
Then we’ll post them all online’

Secarma was our saviour
To guide us through this mess
Like knights in shining armour
To our damsels in distress

Stuart Coulson helped us out
Thank you most sincerely
Now no fine from ICO
That would have cost us dearly

Beefed up our security
Got a brand new forum
Usernames and passwords safe
All moderators awesome

So if you are a hacker
Please leave our site alone
We ask you most politely
As to us it feels like home.

So why do I do what I do ?

The arrival of this news today in my inbox helped my to finally write this blog. It is something I have tried to do several times before, but it is a difficult topic. Who you are.

So … why do I do what I do ?

Well the answers are many; for the love of it, because I care. But the most important one surely is because I can and so I do. I will always have a hand in security – my kids have amazing passwords, my 10yr old can pick locks. I’m building a secure future there. Just spreading the message by one person just helps to make the world safer. Even if it is one person at a time.

I’m hoping my blog hits home with some of the security community and maybe spur you to see what you can do to help small charities around you. Free vulnerability scan ? Quick 2 day pen test ? Protect a small charity that is fighting to get its voice heard ? Pro-active protection to help the little man from the cruel criminal community.

 

I wish the Hypopara supporters and team all the best wishes for the future. The new site looks great and with the leaps in the Natpara treatment, it looks like the charity has a bright future. You really are an amazing team and your incident response was second to none. You really did a great job. Genuinely humbled by you all. Thank you.

Security Valentines

So for Valentines, I decided to create a Hashtag #SecurityValentine partly for some fun but also to get some ideas together for simple security messages.

Roses are red,
Violets are blue,
I’m sat here,
Waiting to help you.

Roses are red
Violets are blue
All my base
Are belong to you

Snort is good
Kali is better
Get that signature
On the authorising letter

I hacked in
Found the data
I’m zipping it up
To exfiltrate later

Talk to me

I’m a Social Engineer
I won’t use your password
There’s nothing to fear (honest!)

I really regret
The hacker I dated
Get me a WAF
I’ve been penetrated. (Source David Powell)

I’m a virus
I’m here to destroy
There’s also a backdoor
That was my ploy

Give me your money
Ransomware is here
I’ll give you your data
After I’ve had this beer

Roses are red
Your password was weak
You’re now in a Pastebin
For hackers to seek. (Source @DeathsPirate)

Some malware is bad
But Cryptolocker is clever
I know your tactics
Click that Link – NEVER !

Roses are #C91D1D
Violets are #6411D5
…or would you prefer those in RGB?

Security gets me down
My Password is my DoB
What do you mean I’ve been hacked
Thought my AV was there to protect me

Valentines Day
Girls love me
I clicked this girls profile
Worst infection I coulda got me !

The roses have wilted
The violets have died
I didn’t do patch management
I’ve just been fired.

Website is down
Log files are blank
Fixing this stuff
Is not going to be fun at all is it ?

Compliance is dull
And sometime is effective
Its trying to implement it
To the great collective

Scada attack
Wow that sounds quite a fright
I’ll be OK
Hey, who turned out the light ?

Burp is the best,
Zap is nice too,
But stay inside scope,
Or you’ll end up in poo. (Source @PMason00)

I’m a script kiddie
I’m a DDoS king
Does that make me a Leet Hacker?
Or an annoying little thing ?

Roses are red
Pineapple’s yellow
Auto connecting …
Beware of the peril!(Source @DeathsPirate)

“I know who is
Who’s behind the @th3j35ter ”
Yet another troll out there
Reputation to be messed up !

Roses are red
This hat is white
Network Security’s
an ongoing fight!(Source @DeathsPirate)

Lock picking is fun
Use an electric gun
But using a bump kep
Is just as fun

Roses are red
Defcon badges are blue
Who’ll pay for a ticket
For Defcon #22 ?

I have a risk register
It did us some harm
I’ve never updated it
No need for alarm!
(is there?)

Log files are read
Language is blue
Firewalls opened up
Who was it .. was it you ?

Buried in the basement
Where no-one can see
Sysadmins everywhere
Are protecting you and me

Ethical hacking
Pen Testing too
Whatever you call it
Finding holes for you

Love em or hate em
Whistleblowers are here
It’s the data the still have
The govts/companies fear

Roses are red
Violets are blue
My security is weak
The hackers for through !

It’s time to talk

Talk .. its a simple thing. Sometimes we get criticised for talking too much, sometimes to the wrong person and often for not saying enough.

And yet the phrase is “talk is cheap.” I disagree, talking can be expensive!

Talking is a unique skill, animals can communicate but the breadth of language we have achieved across the earth is staggering; common languages, country specific languages, local languages, dialects, sign languages, the list seems endless.

But all this time there is something unique about talking. Because we use our face, we therefore use expression and so talking is a more genuine method of communication. Is this why it is easier to write an email to let someone know bad news than speak to them face to face?
Today we have a special chance though to talk.

Today, 6th February is #TimetoTalk day.

Time to Talk
#TimeToTalk

I talk to my partner all the time. She hears my woes and successes and I know I am in a special situation in the fact she is a good listener. For that I am eternally grateful.

However, in our communities whether it is information security, web design, marketing or wherever you work, do we talk? I think no. We say a lot without actually talking. Today is a day when we need to focus on talking.

So let me talk, and I want you to listen and think about who you are going to talk to and about what. Some of the issues I talk about below have never been talked about openly for many years.

Yes, mental health is an issue. It creeps in to our lives without actually ever making itself evident. Depression is a classic, tiny things can start it off and it grows over time – over time it becomes like an all-consuming virus until it affects all areas of our lives.

I know I suffer with mental health issues. Yep, more than one. Some of my closest friends probably don’t even know it … but they are there. Today is my Time to Talk and help others take some courage to talk too.

Digiholic.

I am a digiholic. You only have to be around me for a short space of time before you see the manifestation of what this looks like. I am fascinated by technology, I have been since owning a BBC Micro. I played Elite properly by working out the algorithm behind the game and how to rise through the ranks of the game (*Spoiler – it was based on 255). I drew maps of text adventures until I had whole worlds drawn out on music rule wide carriage paper. When I got my first PC, I took it apart. Every jumper off the motherboard, every screw … later in life this actually helped me pass my university course as I fixed PCs in payment for help with coursework.

But then I hit an interesting patch. My early jobs as helpdesk for an EDI Messaging company led me to research the land of e-commerce pre-2000 when to be cool meant putting an ‘e’ at the front rather than an ‘i’ or ‘cyber’. I used to spend over 18 hours a day at the keyboard reading, watching, learning. And there … right there, the obsession was born.

In the information security landscape, we see this described as autistic, ADHD trait, on the spectrum. This compulsion to find stuff out – curiosity on steroids. There in a bedsit I stared at a screen one Sunday morning and realised it had been over 50 hours with no sleep and I was staring at a screen trying to learn everything about e-commerce products and competitors. I locked the computer and walked out of the door. I walked. I walked for about 10 miles, I walked in silence. I ran away if you like until I found myself in a deer park and it was late, really quite late. I hadn’t eaten for 2 days and I was sat on a park bench. I took my time inside my head to have the conversations, to talk, and put in place my personal protection plan. I realised there and then how close I had become to just disappearing into a world that would have been difficult to come out of.

I knew I had to protect myself and my Personal Protection Plan is still in place today. I won’t go more than 24 hours behind a keyboard. I will always break it. I own the computer not the other way round. Recently my family went camping to an area with poor phone signal and for 2 weeks I spent a total of 2 hours on the internet. It was heaven but I also felt that twinge – like an addiction.

We need to un-jack ourselves. Power down. Step away from the keyboard. In the 80s the UK kids TV program had it right…

Why don’t you just switch off your television set and go and do something less boring instead?

I am still obsessed and still have this compulsion, but concentrating it into shorter burst means I am more effective which gives me greater pleasure in being always connected.

Depression.

Or should I more accurately put it – the lack of depression. It is normal to have depression, it is a chemical reaction, but I don’t get the same reaction. I recently was told by a senior member of staff that he had been concerned about me, was I depressed, having a breakdown – I found the comment very amusing as I knew what he was trying to get to, but he also was being quite offensive and unfortunately did not understand what was actually going on. Let me explain.

As a child I was bullied. I was bullied for many reasons, I was short, fat, intelligent, socially awkward and I had an accent which didn’t fit with the school. To protect myself, I lost my accent – try doing that when you are 5 years old! I took control of my emotions – yes, I could be beaten up, kicked to the ground and yet I would not cry, I would not show emotion. I had mastered my emotions. This was so useful as a child in that I could not break in front of my attacker. However, the danger was there was no place I could let it out. And so one day I held my attacker by the throat against my classroom wall holding him about 18 inches off the ground and screamed in his face “Don’t ever touch me again.” I came to my senses very quickly and realised he was struggling and I let him go and walked out the classroom. I hid and cried. I cried for about 10 minutes before sorting myself out. Then when I came back to the classroom, the silence was deafening. My bully eventually became a great friend and he later apologised for the years I had been bullied.

As I have spent now over 30 years with my emotions in control, manipulative and pressure tactics used by managers have rarely worked. This control means that I can put myself into difficult situations and control my emotions enough to control the output. It also means that I have an interesting life – I don’t do stress, I don’t do depression. These negative emotions and habits are just not needed, so I find emotional workarounds. If I am feeling lower, I use music to raise my mood. If make sure that tough deadlines become realistic ones.

But … and this is a big but … I have to find my releases. I have to find a way to allow natural emotions come out. I have many ways to do this – and each of them is done in a controlled manner.

How do you control your emotions ? I have absolutely no idea if I am totally honest.  I wish I could. Part of it is definitely having an understanding about what you want as an outcome to a situation and understanding how you need to behave to get it to happen. But depression is a no-no. It only serves to undermine your view, your psyche, your emotional stable. I therefore don’t let things get me down. No matter how hard things get, I am not at the bottom of the tree. I believe some of this is also my own personal integrity. Knowing myself means that I also know what I am sacrificing if I needed to and what I won’t compromise on.

So there we go, maybe next year I will share some of my other mental health areas. If you want to talk to me about your mental health and how healthy you think you are or not, then please feel free. I will listen.

The world is too small to not get on with each other.

You’re a long time dead, so enjoy the living.

In the infosec world, we have lost too many great people to mental health problems, depression, anxiety, autism, adhd, today is a time to talk.

Many thank to my old friend Mariel for bringing this to my attention.

Stu

Infosec in 2013

So it looks like we survived 2013! No comets came crashing into Earth, the zombies stayed and the sun didn’t explode.

It’s always at this point in the year we see those blogs – “Retrospective on 2013” Well to save you the bother of reading them, here’s a little tip. Everything in 2012 happened again but to various different degrees.

  • Instead of Sony being attacked it was Target
  • Instead of Wikileaks it was Snowden
  • Instead of 123456 being the most common password to be leaked it was … 123456

And herein lies the problem with information security.

We spend all year inventing new technologies .. Web Application Firewalls, APT threat detection, Cloud Based anti-DDoS solutions – the list of tin and “solution” is vast. As an end user you now have a bewildering array at your disposal. But does it work ?

Well .. to put it bluntly .. no.

  • It’ll never work when the user thinks to be safe I’ll use 123456 for a password.
  • It’ll never work when users post photos of their debit cards on social media.
  • It’ll never work when companies store credentials plain text.
  • It’ll never work when vendors can be swayed by $10million from the NSA.

You can surround yourself with as much defence and attack capabilities as you like but if you are compromised before you start then save your money.

So that was 2013 …

A lot happened and the infosec community cannot say we won this year. If anything .. we took a bad battering. Take stock of what you learned and face 2014 with new energies to this year get it right.
 
 

Start with yourself,

then your family,

then your friends,

then the company you work for.

Do something. Anything … but do SOMETHING.