In 1988, two men sit in a room. One of them is cryptographer Bob Morris, the father of Robert Morris, who had just released the first Internet worm.
"A line had been crossed and the world we inhabited had changed."
(@johnmccumber, Assessing&Managing Security Risk in IT Systems)
Book excerpt: "In 1988, a young graduate student at Cornell University released the first destructive Internet worm. Late one night in November of that year, it crashed thousands of connected computer systems and startled computer administrators and government officials alike."🧵
"Shortly after that incident, I learned about it from my supervisor, who was also this young man’s father. As I sat with Bob Morris in his office that early morning, he motioned me to shut the door so he could try to get away with smoking in the government office building."
"He always got caught, but he fought the rules anyway. After I returned to the side chair, he spoke for a few minutes about his mixed feelings of filial pride and parental frustration. But after only a few comments, we both found ourselves lost in personal reflection."
"Bob Morris slowly twirled the unfiltered cigarette in his nicotine-stained fingers and stared at the smoke rising from the end. We were both aware a line had been crossed and the world we inhabited had changed."
On technical communication:
The authority of the sender and the mental capability of the recipient are irrelevant.
Communication is to achieve results. If it is not succeeding, the communication and environment should be changed until it does. Anything else is whining.
I worked in Helpdesk. I've written communications to a thousand people asking them to do something in their own interest. When that didn't happen, I sat and stewed and left them to their fate.
That also achieved nothing. Value judgements are pointless. Find out how to get results
Communication is its own form of hacking. You find out what the recipient responds to, makes time for, and then is convinced to act on.
This is often simpler and dumber and without the detail you think it expects. In fact, leaving stuff out is often critical. Find out how to win.
ADEPT-LEVEL IT TROUBLESHOOTING:
In this series, I will lay concepts and processes for ascertaining technical causes of IT failures and outages.
🎖I am a Microsoft MVP in Windows management, worked 10 years in Helpdesk and System Engineering, and now work as an F500 Security IC.
⭐️LESSON 1: EXECUTION CONTEXT
You initiate a process that should work. But it seems like it can't access what it needs. For example, you make a machine login script on a network share, but logs access denied. Or, you launch a process, and the target you have access to can't open.
A critical, advanced IT troubleshooting concept is understanding _execution context_.
You see a machine with everything on one screen. Diagnostic tool or another tool should have same experience as other apps, right? If you can access file, everything else should? No.
Explained:
Not everything can be captured on phone cameras (40D 70-200 f/2.8)
Note the 40D is a DSLR from 2007, over 14 years ago.
Your prosumer camera and even lower-tier lenses were unimaginable when I was getting into photography.
The biggest advancement in sensors in my mind has been low-light performance. It's just unimaginable how clear night photography has become. This was as good as I could get it in 2009. (South Silicon Valley as seen from turnoff near Lick Observatory, 40D 24-105 f/4)
If you are junior IT in small to medium biz, isolated, caring about critical security issues you learn about daily as you expand your knowledge — I've been right the fuck exactly where you are. Years isolated, stewing in humiliation.
Here's what I learned the hardest way, alone:
1.) It is naively admirable to identify yourself and take personal stake in security of your employer's network. It sounds like a way to establish personal investment in the success of a project.
But it's a false idol. Be passionate on aims, but not occlusive in career scope.
Sidebar: Power is restraint.
Technical command of a subject – ability to speak authoritatively to others – is not itself correctness or effectiveness. Biting your tongue is not weakness.
It's strategy. Only you know your mind. Choosing not to strike rhetorically is discipline.
I'm part of an IT architecture task force guiding business units and vendors in our supply chain.
The cyber requirements we write 90% __do not require specialized InfoSec skills__. They require IT staff with competency in their tools, provided resources and management backing.
If you work in IT and work to work in InfoSec, congratulations, you start today. Understand your tools, their security implications and guidelines, and how to integrate that into your architecture. That's what Security is.
"Who makes sure the bridge doesn't fall down?"
The person who designs it.
Sure there's other checks and changes during building and inspections and service expectations, but it's the designer. Not the Bridge-Don't-Fall-Down Department.