@securityguy23:

Hope never has -- and never will be -- an effective risk management strategy. . .

@securityguy23:

The best way to gauge the effectiveness of an organization's approach to risk management and response all too often comes down to three simple canary questions:

1) When the building caught fire, why did they respond by pointing the hose at the parking lot?
2) Were they surprised when the building still burned down?
3) Did they learn from the mistake and change the approach before somebody brought in the next box of matches?

@securityguy23:

Monitoring is vastly different than just logging.

And if you're doing only the latter despite claiming the former -- you've neither got security, nor a remotely defensible position when the auditors and lawyers come-a calling. . .

@securityguy23:

There's no crying in baseball or information security. . .

@securityguy23:

Now Nonahexaconta Certified with GIAC Advanced Smartphone Forensics (GASF) Goodness. . .

@securityguy23

(Listening to Respond) ≠ (Listening to Comprehend)

@securityguy23:

Back from Paternity Leave -- returning to regularly scheduled programming, already in progress. . .

A Teachable Moment about Usernames, Passwords, Whiteboards, and Live Television

(Update 6:25P)
The later live shot went out of their way to not show the section of the whiteboard with the usernames and passwords. What was shown had the wifi password erased clean without any after image.

Good on them.

Bad security to have the info posted in the first place.

But the Organization reacted quickly to minimize the security incident. That's the right next move to be sure.

Hopefully, they are also (at a minimum):
1) Immediately changing all the affected passwords to new complex equivalents (while masked in my screenshot, the original passwords did not appear to follow such standards)

2) Establish/maintain a formal policy prohibiting the sharing of usernames and passwords in open mediums (post-it notes, whiteboards, etc)

3) Require unique usernames and passwords be assigned and used by all authorized individuals (as activity on shared accounts cannot be tracked/monitored without repudiation to a specific offender)

4) Establish/maintain a password expiration mechanism that forces all users to reset their passwords every 60-90 days (at a maximum)

5) Codify mandatory username and password lifecycle management requirements and limitations within a formal Access Control Policy (if it hasn't already been)

6) Include username and password requirements and limitations within Awareness Training and Acceptable Use Policy (AUP) provided to all organization stakeholders

Bonus points if they are also (at a minimum):
7) Creating new accounts replacing those which were wrongly shown to the live tv audience

8) Disabling and removing all assigned privileges from the existing now replaced accounts (including any remote access abilities)

9) (Regardless of points 6 and 7 are followed) Monitoring all accounts, both the newly established and the replaced disabled, for any misuse attempts

10) Establish/maintain a policy which reviews an internal/restricted area for confidential information -- removing/masking any identified -- prior to being accessible by the public (whether onsite, via a recorded video, or during a live TV shot)

---

(Original Post 4:38P)
Clearly no nefarious act here with the company or the news station. . . but. . .

If you're going to let a local news crew into your office to do a live shot praising your service - please remember to remove your admin and wifi passwords from the whiteboard in the background.

Or just don't put them there to begin with. That's a far better plan.

And also please only use complex passwords and accounts tied to an individual user so the activity can be fully tracked.

So much badness here. Not good times.

@securityguy23:

Gotten more email asking if I'm at RSA this year than I ever recall before. . . Wondering if I'm missing something really good. Like free puppy giveaway good.

For the record, if anybody I know is there *and* they're giving away puppies, please feel free to take mine and give him/her a good home. I ask only that you name them 'Puddles' and treat them with a kind playful heart (even if they live up to their moniker).

@securityguy23:

Now starting year 20, day 1 of the information security career. . .

@securityguy23:

Now a member of the International Association of Privacy Professionals (IAPP) Advisory Board for CIPT Exam Development. . .

@christoperj:

Back from team meetings in Seattle -- returning to regularly scheduled programming, already in progress. . .

Yes, I Have In Fact Resigned from SHI. . .

Just a quick post to address some rumors, now that I'm back from closing out my final services project.

I am leaving SHI at the end of November to pursue a Security Services role with Avanade. This decision was made several weeks ago. Kept quiet only as so it would not be distracting to a handful of open customer facing engagements. But it is official.

When I started all those days, months, and years ago, I was very excited for the opportunity to contribute to the SHI Security Practice and what the team was trying to do. My role was intended to be that of DLP pre- and post-sales delivery architect. A position, admittedly, I was never able to actually do given various marketspace realities mixed with the inherent internal challenges typical of any Organization.

But those hurdles made the position, in fact, better. A well diverse team of Security Peers along with frequent pivots in direction allowed me to evolve my skillsets. Kept me interested. Kept me busy. Kept me growing. Made me a far more seasoned security and privacy nerd leaving the building than thought I would ever be when I came in. For that I am deeply thankful.

This moment, this day, however, it's time to move on to something different. My new Avanade role is that. With my new team, I'll be focused on aiding sales and pre-sales efforts regarding all things security. I'll be collaborating with customers and internal sales teams to help craft security services messaging, proposal responses, and deal solutioning of enterprise engagements. And all in all, just being a 'trusted advisor' to whoever has a security and privacy challenge, question, or concern.

I've never ever wanted to be the smartest guy in any building. Just be a member of a smart team doing smart security. And I will continue to enjoy that benefit in my new role.

It's also important to note I neither went looking for this opening nor made my decision in response to any particular circumstance or frustration. Avanade approached me directly, and I responded in courtesy. We talked in depth about their goals and vision. And as we did, it became very apparent very quickly this was something I needed to give serious consideration.

The rest is what it is. And I feel as I am leaving SHI in the positive way I always intended.

As always, if you want to keep in touch – I would welcome it.

The best way to do it (other than email) is via Facebook or LinkedIn depending on your pleasure. I still like to keep things simple, so the below links will forward to the full profile pages.

For Facebook – www.facebook.com/christoperj
For LinkedIn – www.linkedin.com/in/securityguy23

I’m elsewhere, too if you want to find me on other sites – but primarily in these. (Everyplace else simply syncs the info down in one way or another).

My cel phone number will also remain the same if you care to call or text.

For those waiting for LinkedIn Recommendations -- I know I’m behind in pending requests. Sorry. Time continues to be getting away from me the last few weeks as I work towards the smooth turnover of everything. I’ll be catching up on those queued in the next few days through the holiday week and next month once I get settled into my new role. If you want to be added to the list, just send me a request through the site. And if you want to submit one for me, I certainly won’t complain.

If you have any questions, please do not hesitate to contact me directly. All updates will also be posted out here @ www.christoperj.com

Goodbye and take care

@securityguy23:

Back from Arkansas, presenting HIPAA security program and policy remediation recommendations on my final SHI customer engagement -- returning to regularly scheduled programming, already in progress. . .

@securityguy23:

(To the random support team I just spoke with)

I appreciate your quick service when I had to call in so you could manually make the needed minor tweak.

But claiming that my call in was necessary 'for security reasons' in one breath -- while not doing anything to remotely validate my identity before executing this account impacting change -- you're very much doing it oh so wrong.

@securityguy23:

Back from executing a HIPAA Risk Assessment in Tampa -- Returning to regularly scheduled programming, already in progress. . .

@securityguy23:

Back from presenting vulnerability scan results and recommendations in Killeen -- returning to regularly scheduled programming already in progress. . .

@securityguy23:

Back from presenting HIPAA Security Assessment findings in Green Bay -- returning to regularly scheduled programming, already in progress. . .

@securityguy23:

Compliance only is a meaningless checkbox. . . Effective risk management requires actual security execution. . .

@securityguy23:

If the first thing out of your mouth is "Here's how I'm going to solve all your problems" instead of "What is your problem and how can I help?" -- You're doing it wrong. . .