Rorschach.net

My PC has a dead motherboard so I can’t participate in today’s GNO. Next week we’ll be going back to X360. Any other suggestions besides Call of Duty 4?

Sometimes it’s tough to explain to non-security people and especially non-IT people what my job is about. Bruce Schneier has a pretty good anecdote for this problem in his latest essay for Wired.

Imagine if the inventor of antilock brakes — or any automobile safety or security feature — had to sell them directly to the consumer. It would be an uphill battle convincing the average driver that he needed to buy them; maybe that technology would have succeeded and maybe it wouldn’t. But that’s not what happens. Antilock brakes, airbags, and that annoying sensor that beeps when you’re backing up too close to another object are sold to automobile companies, and those companies bundle them together into cars that are sold to consumers. This doesn’t mean that automobile safety isn’t important, and often these new features are touted by the car manufacturers.

In the essay the context is security vendors selling products to companies, but it holds with my job. I don’t directly provide any services to my company. I make sure the company’s services strike a balance between feasibility and security. That’s not a zero-sum game with good security meaning an impractical service. With the number of security methods and technologies you can use, you can probably find the right balance of good security and still focus on the business side. But when you get down to it, business don’t really want security, they want to do business. My job is to show the value of security and provide solutions that enable business.

Don Parker has an intersting take on my job that was reported on in Information Security Magazine at the beginning of this year. Information Security has been all about managing risk. He contends that the objective of reducing risk isn’t measurable so it’s better to focus some new objectives for security:

1. Compliance – making sure that your business follows the laws, rules, and regulations required to do business
2. Benchmarking – compare your capabilities with your peers and the industry as a whole
3. Differentiation – make security a reason to choose your business over another

Information Security is changing. It’s becoming more mature and more of a commodity (like electricity or water) and less of being it’s own specialized industry. I’m excited about the direction and looking forward to the change as long as I can keep in front of it.

A new month is fast approaching. What are your nominations/recommendations for the May game? Shall we go back to the X360? Stay with the PC. Revisit CoD4 with new maps? Check out Halo3 with new maps? Anyone up for a racing game like PGR4 or Forza2? Comment now!

This is one of my favorite games of 2007. Already out for PC and coming to consoles soon.

Friendly reminder that Supreme Commander: Forged Alliance is the PC game this month. The exploding starts at 6PST/8CST if you all aren’t too celebrated out by KU’s victory last night.

I’m a sucker for Pixar movies. The next one is robots and sci-fi so it’s got me coming and going. What happens when humanity leaves Earth and forgets to turn off the last robot? Rmapant consumerism provided by the Buy-n-Large corporation winds up trashing the earth so we all go on an extended space-cruise. 700 years later a little trash compactor robot left behind develops sentience mainly from boredom of collecting trash for 7 centuries. Wackiness ensues. After Iron Man, this is the next movie I’m all over.

We’ve decided on Supreme Commander: Forged Alliance for GNO in April. It’s a pretty hardcore RTS that will make your computer cry. We mostly play us against the AI, so newbies are welcome. We use Skype for voice communications since XBL spoiled us from typing all the time. Just search on my full (real) name in Skype to find me.

Maybe I’m cranky from having a cold, but I hereby declare April 1 “Stay the Hell off the Internet” Day. Some things (few things) are genuinely funny or charming, but mainly the Internet just doesn’t work today. Pages get swapped and forum posts are bogus. Perhaps next year I’ll have an unplugged day and celebrate my annoyance with avoidance. Grumble.