Why do I do what I do ?

I ask myself this several times a month … why am I doing this ?

Yet again, another compromised site, more unpatched software – I could scream ! Well … I could … but I don’t. Each person has their own incident – to them it is a personal disaster and so I respect that.

April 2013 and I was sat in bed, the missus asleep and kids climbing all over me. I picked up my tablet and logged in to Twitter. It’s about 8am and there it was .. another leak of a database. I still don’t know why I felt compelled to act but I did. It was medical data. Maybe it was the first record being a young child and I empathised ? I don’t know … but I did respond.

I found the website of the source and it was a small charity. How cruel I thought. A small charity doing its best and someone compromised them and leaked their data – no ethics amongst thieves.

I called the charity – and yeah, I didn’t really know what I was going to say so I thought go with the facts. The lady I spoke to was upset, but I knew I could help. Sunday disappeared in a blur – calls, emails, web forms – within a very short space of time, the leaked data was removed from the net and a Police report filed.

Why ?

Why would I give up my Sunday – one of the few days I get with my kids to help some tiny charity who had been attacked ? The answer is quite simple. This is what I do. I help people when they have been attacked, I dig and I find and I sort out the mess.

And in this case, they were saved from ICO fines, the data was protected as best as possible and the charity continued.

Around Christmas I saw a post on their Twitter account that a new website was launched and there was also good news with regards to treatments in their specific area. It really did give me such a great feeling to know that a few days of my and my colleagues time resulted in them continuing. It felt great and I sent them a quick note to wish them well.

Today is Saturday and I have just checked my email to receive some of the best news ever. I have quoted it in full below.

Why a sledgehammer can’t smash our butterfly
A personal letter to members from CEO, Liz Glenister

On a Sunday morning in early April last year, the phone rang. I didn’t recognise the number so I let the answer phone pick up. ‘Hello, my name’s Stuart Coulson and I’m calling from a company called Secarma….’ which he proceeded to spell out. ‘Great, a cold caller on a Sunday morning!’ I thought and was heading downstairs when I heard the words ‘…..and your Twitter account has been hacked.’ Was this for real? I hesitated. ‘I’m an Information Security Professional and your patient database has been leaked.’ My blood ran cold. ‘Look up LulzsecWiki on Twitter; I’m afraid you’ve got a pretty big issue going on here.’ I picked up the phone and was launched into a nightmare that lasted 4 months.

Hacked off

Lulzsec are a notorious hacking group, an offshoot of the Anonymous collective, who hack for the ‘lulz’ or laughs but it was about as far from funny as you can get for us. The group had closed down the CIA server that very same morning – which did at least make us feel that maybe we couldn’t have been any more careful. They hacked into our patient database (apparently under the impression that it was a UK hospital database as part of an ongoing April Fool raid on the NHS), dumped the information (user names, passwords, medical details etc) in a site called Pastebin and then posted the link on their Twitter account, announcing the deed to the world with the word ‘Enjoy‘. I was completely shocked and devastated. As was Ivor, our webmaster, and the executive committee. We have always taken the security of our members very seriously indeed and were extremely worried. We barely slept for the next week as we took every step possible to track down and remove data, inform and protect our members.

Wonderful webmaster

We were supported at this point by our wonderful webmaster, Ivor Humphreys. Ivor has given years of his time to us voluntarily and had to shoulder this burden while driving miles back and forth to care for his mother who was severely ill. He was a complete and utter star. It was an extremely stressful and difficult time involving a huge amount of work but Ivor left no stone unturned and saw us safely through to recovery. We will always be grateful for his loyalty, his dogged persistence and especially his uplifting humour.

Superheroes to the rescue

We discovered that there was an entire community out there that we had not known existed and to whom we owe everything: the information security professionals. They are truly the superheroes of today, looking out for us and guarding against hackers. They had already taken steps themselves and we worked with them over the months, being guided through a quagmire of legalities and technicalities and out the other side. We had a massive amount of support from professionals who appeared out of the blue like this to offer help and advice. I would like to take this opportunity to publicly thank everyone who helped us and gave so freely of their expertise and time, particularly Stuart Coulson of SECARMA , online security specialists http://www.secarma.co.uk/about.html and James Cleeter of the Computer Security and Incidence Response team for JANET, the UK’s network for education & research communities https://www.ja.net/about-janet/about-us. I had an email from Stuart at Christmas whose personal delight in seeing us get back up and carry on I found very touching. Without him we probably wouldn’t be here. There are a lot of good guys out there too!

All these agencies were horrified that a small patient support charity had been so unusually targeted in this way and many articles appeared in both IT and healthcare press about the incident. You can read a typical summary here in PHIprivacy.net which reports and investigates health and medical related privacy breaches http://www.phiprivacy.net/uk-support-organization-hacked-data-leaked/. Thank you to author ‘Dissent‘ who moved fast to highlight our plight.

New forum

So then began the arduous task of choosing, and setting up a new forum. For this I would like to thank Ivor Humphreys, for the initial phase, and Mandy Mainland, forum administrator, and Su Clifton and Lisa Burke, forum moderators who worked long and hard to see it through to going live as swiftly as possible. They did a really fantastic job. We chose to look on this enforced shut down as an opportunity for positive change and we think the new forum is greatly improved! We hope you like it. Although each of you has received an email about it, not everyone who had registered on the old forum has yet re-registered on the new one so if you would like to show your support for all our work we’d be really pleased if you would go and sign up now. www.hypopara.org.uk/board.

Further to this is also this poem (I’ve never had a poem about me before!).

Hacked Off
Su Clifton

We came across some hackers
I won’t reveal their name
Hacking on the internet
What a pointless claim to fame

They saw our little website
And thought ‘oh how divine
Lets rummage through their details
Then we’ll post them all online’

Secarma was our saviour
To guide us through this mess
Like knights in shining armour
To our damsels in distress

Stuart Coulson helped us out
Thank you most sincerely
Now no fine from ICO
That would have cost us dearly

Beefed up our security
Got a brand new forum
Usernames and passwords safe
All moderators awesome

So if you are a hacker
Please leave our site alone
We ask you most politely
As to us it feels like home.

So why do I do what I do ?

The arrival of this news today in my inbox helped my to finally write this blog. It is something I have tried to do several times before, but it is a difficult topic. Who you are.

So … why do I do what I do ?

Well the answers are many; for the love of it, because I care. But the most important one surely is because I can and so I do. I will always have a hand in security – my kids have amazing passwords, my 10yr old can pick locks. I’m building a secure future there. Just spreading the message by one person just helps to make the world safer. Even if it is one person at a time.

I’m hoping my blog hits home with some of the security community and maybe spur you to see what you can do to help small charities around you. Free vulnerability scan ? Quick 2 day pen test ? Protect a small charity that is fighting to get its voice heard ? Pro-active protection to help the little man from the cruel criminal community.


I wish the Hypopara supporters and team all the best wishes for the future. The new site looks great and with the leaps in the Natpara treatment, it looks like the charity has a bright future. You really are an amazing team and your incident response was second to none. You really did a great job. Genuinely humbled by you all. Thank you.


It’s time to talk

Talk .. its a simple thing. Sometimes we get criticised for talking too much, sometimes to the wrong person and often for not saying enough.

And yet the phrase is “talk is cheap.” I disagree, talking can be expensive!

Talking is a unique skill, animals can communicate but the breadth of language we have achieved across the earth is staggering; common languages, country specific languages, local languages, dialects, sign languages, the list seems endless.

But all this time there is something unique about talking. Because we use our face, we therefore use expression and so talking is a more genuine method of communication. Is this why it is easier to write an email to let someone know bad news than speak to them face to face?
Today we have a special chance though to talk.

Today, 6th February is #TimetoTalk day.

Time to Talk

I talk to my partner all the time. She hears my woes and successes and I know I am in a special situation in the fact she is a good listener. For that I am eternally grateful.

However, in our communities whether it is information security, web design, marketing or wherever you work, do we talk? I think no. We say a lot without actually talking. Today is a day when we need to focus on talking.

So let me talk, and I want you to listen and think about who you are going to talk to and about what. Some of the issues I talk about below have never been talked about openly for many years.

Yes, mental health is an issue. It creeps in to our lives without actually ever making itself evident. Depression is a classic, tiny things can start it off and it grows over time – over time it becomes like an all-consuming virus until it affects all areas of our lives.

I know I suffer with mental health issues. Yep, more than one. Some of my closest friends probably don’t even know it … but they are there. Today is my Time to Talk and help others take some courage to talk too.


I am a digiholic. You only have to be around me for a short space of time before you see the manifestation of what this looks like. I am fascinated by technology, I have been since owning a BBC Micro. I played Elite properly by working out the algorithm behind the game and how to rise through the ranks of the game (*Spoiler – it was based on 255). I drew maps of text adventures until I had whole worlds drawn out on music rule wide carriage paper. When I got my first PC, I took it apart. Every jumper off the motherboard, every screw … later in life this actually helped me pass my university course as I fixed PCs in payment for help with coursework.

But then I hit an interesting patch. My early jobs as helpdesk for an EDI Messaging company led me to research the land of e-commerce pre-2000 when to be cool meant putting an ‘e’ at the front rather than an ‘i’ or ‘cyber’. I used to spend over 18 hours a day at the keyboard reading, watching, learning. And there … right there, the obsession was born.

In the information security landscape, we see this described as autistic, ADHD trait, on the spectrum. This compulsion to find stuff out – curiosity on steroids. There in a bedsit I stared at a screen one Sunday morning and realised it had been over 50 hours with no sleep and I was staring at a screen trying to learn everything about e-commerce products and competitors. I locked the computer and walked out of the door. I walked. I walked for about 10 miles, I walked in silence. I ran away if you like until I found myself in a deer park and it was late, really quite late. I hadn’t eaten for 2 days and I was sat on a park bench. I took my time inside my head to have the conversations, to talk, and put in place my personal protection plan. I realised there and then how close I had become to just disappearing into a world that would have been difficult to come out of.

I knew I had to protect myself and my Personal Protection Plan is still in place today. I won’t go more than 24 hours behind a keyboard. I will always break it. I own the computer not the other way round. Recently my family went camping to an area with poor phone signal and for 2 weeks I spent a total of 2 hours on the internet. It was heaven but I also felt that twinge – like an addiction.

We need to un-jack ourselves. Power down. Step away from the keyboard. In the 80s the UK kids TV program had it right…

Why don’t you just switch off your television set and go and do something less boring instead?

I am still obsessed and still have this compulsion, but concentrating it into shorter burst means I am more effective which gives me greater pleasure in being always connected.


Or should I more accurately put it – the lack of depression. It is normal to have depression, it is a chemical reaction, but I don’t get the same reaction. I recently was told by a senior member of staff that he had been concerned about me, was I depressed, having a breakdown – I found the comment very amusing as I knew what he was trying to get to, but he also was being quite offensive and unfortunately did not understand what was actually going on. Let me explain.

As a child I was bullied. I was bullied for many reasons, I was short, fat, intelligent, socially awkward and I had an accent which didn’t fit with the school. To protect myself, I lost my accent – try doing that when you are 5 years old! I took control of my emotions – yes, I could be beaten up, kicked to the ground and yet I would not cry, I would not show emotion. I had mastered my emotions. This was so useful as a child in that I could not break in front of my attacker. However, the danger was there was no place I could let it out. And so one day I held my attacker by the throat against my classroom wall holding him about 18 inches off the ground and screamed in his face “Don’t ever touch me again.” I came to my senses very quickly and realised he was struggling and I let him go and walked out the classroom. I hid and cried. I cried for about 10 minutes before sorting myself out. Then when I came back to the classroom, the silence was deafening. My bully eventually became a great friend and he later apologised for the years I had been bullied.

As I have spent now over 30 years with my emotions in control, manipulative and pressure tactics used by managers have rarely worked. This control means that I can put myself into difficult situations and control my emotions enough to control the output. It also means that I have an interesting life – I don’t do stress, I don’t do depression. These negative emotions and habits are just not needed, so I find emotional workarounds. If I am feeling lower, I use music to raise my mood. If make sure that tough deadlines become realistic ones.

But … and this is a big but … I have to find my releases. I have to find a way to allow natural emotions come out. I have many ways to do this – and each of them is done in a controlled manner.

How do you control your emotions ? I have absolutely no idea if I am totally honest.  I wish I could. Part of it is definitely having an understanding about what you want as an outcome to a situation and understanding how you need to behave to get it to happen. But depression is a no-no. It only serves to undermine your view, your psyche, your emotional stable. I therefore don’t let things get me down. No matter how hard things get, I am not at the bottom of the tree. I believe some of this is also my own personal integrity. Knowing myself means that I also know what I am sacrificing if I needed to and what I won’t compromise on.

So there we go, maybe next year I will share some of my other mental health areas. If you want to talk to me about your mental health and how healthy you think you are or not, then please feel free. I will listen.

The world is too small to not get on with each other.

You’re a long time dead, so enjoy the living.

In the infosec world, we have lost too many great people to mental health problems, depression, anxiety, autism, adhd, today is a time to talk.

Many thank to my old friend Mariel for bringing this to my attention.


Just Give Up … and see what happens !

If you could have untold happiness, what would you give up ?

We’re told all the time to give up smoking, reduce our alcohol intake … You may have experienced this already. But it’s hardly untold happiness!

Over two years ago, I gave up tea and coffee. I know it doesn’t sound much, but try it… Just for one week. Yeah, tough isn’t it!

First comes the problem of what to drink. Water, fruit juice, until you see the amount of sugar in fruit juices ! Then comes restaurants – when you automatically order drinks and end up with a coffee without realising how it got there. Next comes overcoming addiction. Yep, I believe tea and coffee is addictive. How many years have you been drinking coffee or tea? 52 repetitions of a task becomes habit so it’s easy to become addicted. Then like some final nail in a coffin – movies. Dunking into your cup, then realise you have a biscuit floating in a glass of water.

I gave up these beverages as I realised I was drinking too many cups… I say too many cups, but count them… How many have you drunk today? I was well over 10 cups … That feels like way too much caffeine to me.

So I gave up. That was it. I’ll stop. No defined period. Just stop.

At first is was really tough… But once I’d got used to it, started to not be distracted by the pain of giving I saw the benefits almost immediately. Ever have the foggy feeling when you waken up tired ? Have a coffee and it’s a bad one ? Burnt beans, yuck.

Over two years I’ve learned to live without artificial stimulants to keep me going when I’m shattered. A good cold glass of water is a miracle cure. Over 2 years of water, juice, hot chocolates and warm Vimtos.

Clear mind, healthier, fitter, awaken quicker, its a long list of benefits and these are just the ones I can remember at the moment. I have no idea how well my internal organs are now coping and if I’ve done much health positive, but yeah, I gave up and have received so much more as a result. So give up … Just for one day, then stretch it out to a couple of days … Push yourself and after a couple of weeks, try re-evaluating your life and any benefits you can correlate to giving up.

Lent 2013. I’ve never done Lent. I’m not religious so I’ve never had a reason. So this year it was odd for me to partake. But what to give up? Chocolate… That’s the usual one, but I’m not going to give that up easily, so it would have to be something else. So I gave up bread… Not quite all bread as I don’t think I can think of that many alternatives, so sliced bread went.

What’s better than sliced bread ? Having no sliced bread actually! The alternatives are slim pickings so to speak. I’m not sure I could do it for longer than Lent, but it certainly was a health kick. Something I found out … The recipe for bread was changed before the 60s and the yeast is now not fully activated so that when you eat bread, it continues to cook inside you …. That sounds as weird as it actually is!

So there you have it … 2 simple things you could stop doing right now and gain health benefits almost immediately. I couldn’t vouch for mental benefits 😉 but definitely happier for making the changes in my life, saved a fortune too no bread, no teabags, no coffee, no Starbucks.

So give up … Just one thing.

No time limits,

Just go as long as you can.

So what would you be prepared to remove from your life to obtain gains, health, wealth, happiness ?


UPDATE 17th June 2013 : Only just realised, by giving up tea and coffee, I’ve also drastically reduced my milk and sugar intake – you see, give up and there’s a cascade of benefits !!



Friends and Happiness

This is one of those blogs I have been looking forward to for quite some time.

What do you consider to be a friend ? What qualities do your closest friends share ?

Although I am quite an outgoing and fun person, and if you don’t know me, just take that as read, to get truly close to me is quite difficult. I like to blame my star sign, but this is a great excuse and yes, I’ll hold by it !

This now leaves me with an interesting problem though, I don’t have many close friends. Ok, I have friends, acquaintances, colleagues, don’t get me wrong … But my closest friends ? I can probably count those on one hand.

Maybe I set the bar high in my mind ? I don’t expect much from my friends either, in fact, if I named my friends on here, most would be shocked they were included, many complaining that I haven’t spoken to them for years !!

But what makes a person your closest friend ? Friends, acquaintances where are those lines drawn ? When does a passing acquaintance become a friend become a close friend ?

For me it’s trust. Do I trust you …. 100% ? If my life or the lives of my closest depended on it, would you drop everything ? Could I trust you to do that ? If I needed you, would you be there ?

That is my line. Cross it and you are in or out. It’s as simple as that.

Maybe this is where I derive my happy outlook. If you can keep life simple, if you know your friends, if you know who you can trust, then you know where you are. Knowing the “now” of life is critical.

My dad once taught me a valuable lesson .. “before you break the rules, know the rules.” And so here I am, a friend base that I know and can trust, I know my moment, I am in control and so I can remain happy. I know the life rules, the ones that help us to survive and I therefore know how to play the game of life .. And Dad, if you’re reading this, I don’t break as many rules any more!

I had a great conversation with a close friend recently and she was quite shocked at some news I gave her about by “now.” I was going through quite an interesting time, things can change rapidly around us but I shrugged and explained that there was a new now and I had moved on. As my boss would say, my resilience gene had been well and truly tested! She is a close friend, she understood where I was and what it meant to me to have such a life change and she wished me well. With her going through something similar recently, I hope she found her “now” also. If you’re reading this … We still need wine !! Tannat-Merlot, Cotes de Gascogne (Alain Brumont) – Exotic black fruit with great tannin structure, delicious with steak.

And then there was my greatest friend of all time. My nan. I wish everyone could have known her. I laugh so much still when I think of her. She’s gone now, no doubt dying with a smile on her face. How about this for a pearl of wisdom … “no point in dieting, it only makes thin corpses!” genius ? Probably !!

So at the end of this blog where I salute my closest friends and I thank you all for being there during my existence thus far, I owe you all such a debt of gratitude. From those that picked me up when I was down and got me into rock music, those who made me laugh at the wrong time, those who have supported me when I didn’t have a clue but didn’t say a thing just helped me through and finally to those who just arrived with a smile and smiled all the way through, the never-ending smile. Thank you.

“You’re a long time dead …. Enjoy the living!”


The first blog entry is an important one. It is the first benchmark put into the digital sands.

I remember talking to an old colleague of mine on the news he was getting a company car. I asked him “What is going to be the first tune you play?”

Think about it… It’s a big thing. It defines you. It defines your space.

So this is my definition. I will quote people, I will re-tweet them, I may even offend people. Remember though. It’s a digital world and a real world.

Come find me, talk to me, that is who I am.