Category: Personal Reflections

I don’t necessarily mean faith as it pertains to religion, although that is by far the best example of how faith can completely negate ever having to think for yourself. Ever again.

When I talk about faith, as defined by; “A complete trust or confidence in someone or something.” you can perhaps see where faith can be a force of tremendous good, or horrific bad. When you remove the need to question something, you remove any reason for that thing to change. When your most valuable asset; your ability to reason, is subsumed into a concept not of your making, you have lost your individuality, your uniqueness. You have lost your sense of self.

When humans first became self-aware (estimated at around 60,000 years ago), the number of things to fear rose exponentially. Animals don’t fear an eclipse, but humans managed to attribute countless negative interpretations to this natural phenomenon. With self-awareness comes both the need for rationality (a reason for something), and the trait that I think truly defines us most as human;

Curiosity.

When you are absolutely certain of something, you can effectively ignore it; I have absolutely faith the sun will rise tomorrow or why would I bother getting out of bed? I have absolute faith that my wife loves me or why would I be with her?

The difference between the above paragraph’s examples, and faith in religion (for example), is both tangibility and direct experience. The sun has come up every day I’ve been alive (except the few days I spent in Scotland), and I’ve been with my wife for 10 years. That’s proof enough for me. But what if I base my faith on a concept that has only been passed on by others? Or out of a book? What does that do to our thinking? In some cases clearly not much, but some of the worst horrors in history have been perpetuated based on interpretations of words written centuries before.

And what happens when such thoughts becomes mandatory? When not having the same thoughts becomes a valid reason to violate the rights of others. Again, this is not just religion, but science and even sports aren’t immune from unshakable faith. Scientists and fans alike have committed atrocious acts because in their mind the victims were so wrong that their very lives were forfeit.

It’s a combination of things that keeps this destructive force self-perpetuating; from bigoted parents teaching their kids to hate, to inflexible older generations unable or unwilling to adapt, to a general unwillingness to admit when you’re wrong. Hiding bigotry against sexual orientation behind the bible, racial bigotry behind past atrocities, and murder behind a God all have their roots in the natural byproduct of misplaced faith; ignorance.

I have no answer for this, all I can do is not be part of the problem. Life is not fair, life just is, and YOUR life is what you make of it. That fact remains that it is already difficult enough to find sufficient happiness to make the life you have worth living without making it difficult for yourselves by hating, and hurting everyone around you by your selfish actions.

Believe in whatever you want to believe, just leave the rest of us out if it.

[If you liked this article, please share! Want more like it, subscribe!]

I had the honour of presenting at an ISC2 London Chapter meeting a little while ago, and my chosen subject was ‘Mobile: Changing the Face of Identity Management (IM)’. What I thought was going to be half an hour of me espousing my ideas (or ranting, depending on your point of view), turned into the most lively debate I have ever had in front of an audience.

Initially I wondered if my 10 slides was going to be enough (although I never actually read to the material), but I didn’t even make it past slide 7. By the time I was on slide 5 the questions started, then the dissenters chimed in, and by the time I reached slide 7 the presentation was forgotten. My 30 minute slot was over before I knew it, and it was clear a lot of people had a LOT more to say, which they did over beers afterwards.

The culmination of this discussion was when I heard the following; “I don’t agree with ANYTHING you are saying!”, which for a lot of people (especially ‘expert’ presenters) can be the cause of anger, considered a challenge, or can even cause outright panic. To me it should only ever be the cause of curiosity; WHY am I wrong? I certainly don’t think I am, and probably still won’t after I hear your explanation. I’m curious nonetheless.

But what I will do is hear what you have to say as objectively as I can, and respond as neutrally and I can. Usually without much success mind you, we are all very attached to our opinions, but I will at least try.

Presenters are supposed to be experts in their fields, otherwise why the Hell are they on stage, but that does not [necessarily] make them right, especially when the subject is focused on future-state concepts as opposed to subjects which are long established. I have no idea where Identity Management will be in 5 years, but I have a rough idea. Also, my ideas are also right for ME, but I am decidedly on one side of the privacy challenges that surround the field of identity and privacy like a miasma.

I guess in the end you must decide for yourself if you want to be a lecturer, where your subject is not really up for debate (like when I train groups in PCI for example) or a presenter, when your ideas must be open to not only comment, but potentially ridicule. I have to admit, it makes presenting is a lot more fun, and if I only have to produce 7 slides to get an audience engaged, then I have a lot less work to do! 🙂

The lessons I learned in that presentation will stand me in very good stead for the next one, and who knows, maybe I’ll even finish all 10 slides.

[If you liked this article, please share! Want more like it, subscribe!]

This could potentially be my most contentious blog yet, but the very thing I am railing against [somewhat] is the very thing that allows me to post this in the first place; human rights, as enforced by my country’s laws and/or societal norms. MY society anyway.

My issue is not with human rights per se, they are a concept that should only become more important as the world gets smaller. Shared information available to an enormous distribution of mobile devices will, in theory, help combat the rampant ignorance across the globe, often enforced by oppressive government entities themselves. Just look at the ridiculous Twitter ban in Turkey for one of the milder examples. When everyone on the planet knows that they shouldn’t have to live under any totalitarian regime, human rights will provide the long-term road map for progress towards the freedom most of us take for granted.

My issue with human rights is the equal enforcement of them. As an extreme; why does someone convicted of multiple homicides have the same rights as someone who spends their whole life helping others? Yes, the killer may lose their freedom, but their rights as a human being are still in full effect. You take from someone everything they will ever have, and in my opinion, you are giving up some – and potentially all (depending on your crime(s)) – of your rights to be treated equally AS a human.

No, this is NOT a case for capital punishment, that’s too specific a judgment, this is about the fact that as species, there is no way we human beings will EVER reach a 100% consensus on anything, and we need to stop pretending that we can. The majority opinion must rule, as long as it’s not MOB rule, and the losing minority needs to abide by the prevailing decision. Criminals of every sort ALL have an opinion different from the majority, and it’s one they have likely acted upon. They think they are somehow exempt from doing the right thing, and in most ‘civilised’ nations those right things are instilled from childhood and reflect an accepted standard of ‘common decency’.

Do NOT steal, do NOT kill, do NOT take anyone by force and so on, but what about those countries where the established norms – if not the actual laws – are different? Can anyone reading this blog POSSIBLY justify the murder of the 11 people working for Charlie Hebdo just because they printed satirical matter and images related to their deity? Or any of the hundreds of terrorist attacks perpetrated for religious or political reasons across the globe? These things are REAL, but what makes US right? What makes US the arbiters of that common decency?

We’re the majority, that’s what gives us the right to condemn their actions. Anything other than treating everyone as you would wish to be treated yourself should be unacceptable in any society.

So we clearly need to stop pretending that as a species we are that evolved OR that civilised, and neither religion nor government should have the final say in what’s right and what’s wrong. We are all born with rights, but from that point forward they become a privilege every individual has the responsibility to maintain. All of our freedoms and all of our rights come at a cost, we must all be prepared to pay those costs.

In the end, humans are just another mammal, the attribution of instincts above layer 4 of Maslow’s Hierarchy of Needs is admirable, and certainly an aspiration, but fighting a sociopath with rules is no different than making a wish by blowing out candles on a birthday cake. I will live my life by a simple set of self-imposed laws, and would hope everyone around me does the same;

The 5 Laws of Human Rights:

  • Everyone starts out in life with the same rights;
  • Everyone may utilise their rights to their own unqualified ends as long as those actions do not infringe on the rights of others;
  • Infringement of the rights of others will result in a loss of your rights equal to that inflicted on the other party(ies);
  • Use of rights for one’s own benefit comes with a risk of loss, everyone will accept personal responsibility for this loss; and
  • No-one shall take their rights for granted.

We need to stop pandering to those living outside the globally accepted norms of common decency, they have no place here with the rest of us.

[If you liked this article, please share! Want more like it, subscribe!]

I could not help but laugh while having drinks with a friend of mine yesterday. He kept looking at his watch, and before I understood why I was starting to get annoyed he said that he had an incoming call.

To people of my generation and above (not many of those left) looking at your watch frequently is a sign of impatience, and that you have somewhere you need, or would rather, be. For those sensitive to these non-verbal clues, it signals the end of a conversation, date, meeting, and so on, often resulting in stilted conversation and perhaps even resentment.

Ironically, if he had been looking at his phone that frequently, I would not have thought twice as I do the exact same thing myself. We are both busy, he the CEO / Founder of a successful security company, me an insecure addict of social media affirmation (please like this).

I have tried to figure out why I found this so amusing, but have not reach a conclusion yet, but seeing as this would be a very short blog otherwise, here are some thoughts:

  1. My laughter contained at least a hint of nostalgia, it’s clear that I was remembering a simpler time. And by ‘simple’ I mean utterly disconnected from anything not immediately in front of me. A time without mobile phones. A time when the ‘Like’ button was a smile on your friend’s face;
    o
  2. My laughter also contained chagrin. I thought I was as up to speed with technology and innovation as anyone, but clearly my values and reactions to everything around me were formed in a time very different from this one. I now know that part of me will always stay there;
    o
  3. Jealousy that I didn’t have one because I have not seen one I like, and I have the wrists of a 7 year old girl;
    o
  4. Frustration that ALL of this can’t be replaced by a contact-lens-driven heads-up display;
    o
  5. Several large Woodford Reserve bourbon and ginger ales.

I don’t think anyone can deny the enormous impact mobile devices (especially smart phones) have had on both work and personal interactions. And we mostly agree that because this change has been so profound in so remarkably short a period of time indicates that we are actually only at the beginning of bigger changes to come (Internet of Things for example). Where people differ is their reaction to it; from abject fear and utter rejection, to excitement and complete embracement. Most of us are somewhere in-between.

What I do know is that to reject this change is to be left behind, and to stick with traditional concepts of privacy will exclude you from the conveniences to come. I’m not judging this in a negative way, I’m sure you are perfectly happy to BE ‘left behind’, and to do things the ‘old way’ but I’m also saying that I will not be one of those, I’m too bloody lazy not to have as many things done for me automatically as possible.

I am also happy to accept the consequences, and I will likely be laughing all over again when it all goes horribly wrong! 🙂

[If you liked this article, please share! Want more like it, subscribe!]

There are some things in life that you assume everyone must know by now; give a firm handshake, never accept credit for someone else’s efforts, never be rude to waiters and so on. Yet so many vendors in the information security industry fall foul of an offence far worse than these.

They use phrases like:

  • 100% secure
  • Unbreakable
  • Completely safe
  • Fraud-proof
  • Hack-proof
  • and so on…

The fact remains that NOTHING in information technology is 100% secure. Nothing. If someone wants it badly enough, and they have the necessary skill-set/support, they are going to get it, and anyone who espouses differently should find another line of work before they cause any[more] damage.

And it’s all so unnecessary. You don’t need 100% security even if it was possible, what you need is security ENOUGH. The bad guys are lazy, and if you’re too difficult to breach they will move on, so just ‘build your fence higher than your neighbour’s’ From what I’ve seen in the 15 years I’ve been consulting across the globe, this should not be too difficult.

The calculation you have to make is this;

If the Cost of Security > Value of Data = do what you can afford and no more, OR, if the Cost of Security < Value of Data = do it, but do only what makes sense.

So what process magically gives you the answers to this equation? Easy, the Risk Assessment. One of the most basic tenets of a security program done well, and one of the most under-utilised business tools in every organisation I’ve helped. A risk assessment process performed appropriately will tell you what you’re not doing well, how to fix it, AND how much to spend on doing so.

But I digress.

I can actually empathise with organisations and individuals trying to sell security. It’s tough, but that’s no excuse for lying about your products, and that’s exactly what you’re doing if you claim 100% security. Lying. You have a responsibility to your customers, and whether you like it or not, and whether you ARE or not, you are the usually the expert in the room (if you know 1% more than the other person you are the expert). Your client came to you for help, it’s up to you to provide what they NEED, not necessarily what they asked for.

Your credibility as a provider of information security services or products goes hand-in-hand with your integrity as an organisation and/or individual. Think of your integrity as a form of currency; you can either invest it in your credibility, or spend it on quick wins. Only one of these has a long-term future.

I will note however that if you’re a buyer of security services, you have as much responsibility as the seller to buy only what you need. YOU must ask the right questions, and the only way you can do that is to either do your homework, or hire someone to do it for you. Never expect a salesperson to think twice about giving you what you ask for, then charging you again for providing what you should have asked for in the first place. This scope creep is your fault as much as theirs.

This white paper is not how to sell, I can’t do that, this is how I think you sell with integrity; How to Sell Security