The Security Shit Show

We all piss. We drink shit (not literally), the shit finds it's way to the kidney (I only have one left), and eventually to the prostrate (if you're genetically male), and out through the wanker.

Pretty standard stuff. At the end, you get urine (hopefully). That's it.

So, why the !%@$# pissing contest?! What's there to contest?
Is your pee yellower?
Is your stream stronger?
Did you hit the bowl this time?

Why are you so *!@& proud of yourself?

The fact of the matter is, we engage in pissing contests way too much in this industry, and it's a COMPLETE waste of time. They serve nothing but the selfish, destructive ego.

Let's go through two examples from this week, and see where it goes from there.
In example #1, it's the classic establish dominance right out of the gate maneuver, "Well, let me give you a scenario...".
Example #2 was straight up intimidation of a colleague with less experience and confidence. The pissing contestant went with the "Well, let me stop you right there..." move.

At the end of both examples, we DID make new friends, but not until we established that we don't give two shits about ego. Let's solve some damn problems!

I'm sure we'll come up with some more good examples during the show!

Vendor Questions!

On tonight’s YouTube #shitshow we’re going to discuss what to ask the vendors as the line up to take your annual budget....

Think of this as OUR version of 20 questions.

Join Ryan Cloutier, CISSP, Evan Francen, Rachel Arnold, and I, as we work through things to contemplate, cogitate, consider, AND use as you sort for that elusive needle IN the thicket we call the “right” InfoSec vendor in the ever increasingly convoluted and complex landscape.

Somewhere in among the twenty questions we WILL likely have the following:

- Where’s my data?
- What IS the airspeed velocity of a swallow?
- How do YOU train your staff?
- What IS the meaning of life?
- Explain how YOU use 2FA/MFA
- Do you feel lucky?
- What’s a polymorphic trojan, AND why is there one in your code?
- Is it safe?
- What’s your plan for the end of the world?
- Who ya gonna call (when it breaks)
- Define protection?
- Where’s your decoder ring for the acronyms?
- Who’s accountable when it breaks?
- Etc.

Join us THIS evening (Thursday 21:00 mountain time) as we (try) to piece together 20 USEFUL questions you can ask the next vendor that makes it past the front receptionist AND their trap doors…

BONUS: How to, and where to hide the body If the vendor in question prefixes each response with “That’s a really good question Chris, let me…”

SIGN-UP NOW! And receive spam for life free* (Postage not included)

CLICK THE LIKE!! And we’ll track the click AND enter you into a free draw to win stickers!
(This one we can do, we HAZ stickers, DM me if you want some!!)

Picture by Nerea Sesma Perez

Looking back at the history of modern technology, it's incredible how far we've come in such a short period of time. Parents remember life without a cell phone, while kids were born with them as part of their DNA (practically).

Parents struggle to keep up, kids can't wait for the next thing.

Social Media:
5.22 billion unique mobile device users.
4.20 billion social media users.
+1.0% (population growth), +1.8% (mobile user growth), +7.3% (Internet user growth), and +13.2% (active social media user growth) - All annual.
2.32 billion active monthly Facebook users.
2.5 hours per day spent on social networks and messaging (on average).
Most popular social platforms (in order): Facebook, YouTube, WhatsApp, FB Messenger, Instagram, Weixin/WeChat, TikTok, QQ, Douyin, Sina Weibo, Telegram, Snapchat, Kuaishou, Pinterest, Reddit, Twitter, and Quora.

Devices:
Average number of connected devices per household in 2020 (worldwide): 10
The smart home market will grow by $54 billion by 2022.
IoT data volume is expected to grow to nearly 79.4 zettabytes by 2025.
Worldwide network device ownership will be 3.6 per person in 2023.

All this comes with a price. What is the price and how will we pay for it? We've adopted technology so fast, MUCH faster than our ability to use it responsibly and MUCH faster than our ability to secure it.

Where are we? How did we get here? Are we OK with where we're at, or are we heading for disaster?

Good luck taking the phone out of your kids hands! Look down at your own.

This will be a great Shit Show!
Join myself (Evan), Chris, and Ryan LIVE at 2200CST right here.

At least in years past we could at least spot the neighbors as they tried to hide behind the shrubs in the garden, the curtains in the house, or ducked down below the fence line that separated each of our little slices of the American Dream....

These days; however, things are a little more subtle (if the neighbors have been paying attention to the InfoSec world for more than 5 minutes...)

Long gone are the days of just borrowing the neighbors wireless to launch an attack against the NSA through their cable provider (although it IS fun to see the black suburban roll up occasionally to their doorstep when you’re feeling mischievous..)

Today’s targets for neighborhood “watching” vary across an entire spectrum of fun and games...

I still feel slightly guilty about the 50-gallon barrel of lube my neighbors have, but “Hey Siri...” we just have to have some fun....

I DO enjoy making their microwave go off in the middle of the night, although they've replaced it a few times now, and the electrician doesn’t use Google Maps anymore to find them... amazing just how far away those WEMO plugs can be controlled from.

Now, thankfully Xfinity allows themselves to provide “free” WiFi to anyone with account credentials, so it IS still possible to get directly TO their router (you’d think folks would update the things.... but no) and given I’ve got around 1,335,000 Xfinity account ID/Passwords I’m set for a LONG time before I must leave my own fingerprints...

Oh, speaking of fingerprints, confession time... one of the neighbors has a RING doorbell, oh how we laughed when we changed out the screws during install and just last week got the doorbell to short circuit and burn ½ the place down... shame the fire alarms didn’t work, someone should REALLY unblock NEST’s fire alarms from the firewall and allow them to do their job. The video of the owners yelling “Hey Google FFS call the fire brigade” will be posted on YouTube later (thanks Arlo for the default account credentials...)

Oh, while we’re on the subject of the recently deceased, I guess playing Poltergeist on the other neighbors Roku device and having it display on all their nice Samsung IoT enabled TV’s is probably a mean thing to do... although it does make for entertainment as we might have also hooked up their Phillips Hue to pulse at the same frequency as the TV... I guess that’s why they seem a little nervous these days.

Oh, and we won’t mention the fun we had with the Tesla and some bright spark in the neighborhood thinking they could geofence the car into opening/closing the garage as they came home... Watching the garage door rapidly open and close AS the car tried to get in watching Grandma eat dinner with her falsies...

Speaking of that, I need to go mess with dear old Grandma’s IoT toothbrush, I think tonight we’ll set it for “killer mode” and see if it can chase her round the bathroom again...

We haven’t even gotten to the fun part watching the cute couple across the road react as their adult toys came to life in the middle of a webinar and started to inch across the desk... now THAT was fun to record… got to LOVE Bluetooth enabled things.

You get the idea; the neighborhood is SO much more fun these days....

Join us tonight as we talk though the evolution of the nosey neighbor :)

For the first time, the Security Shit Show hits the road for an in person event. Chris, Evan, and Ryan are heading down to the woods of Nebraska for the weekend. The first night we're there, we do the show.

We're not really sure what to expect, but we're pretty sure there will be some information security stuff, some shit, and some whiskey.

Sorry to Disturb You...
· But your front doors open...
· Your flies are undone...
· I found your kid wandering on the street...
· But I think you dropped your wallet...

All things many of us have said, done, acted upon OR been the recipient of over our years, and all of them taken in the spirit of the manner delivered, graciously, often with relief and a huge thanks to whomever delivered the news.

HOWEVER, in the digital realm...
· I do say, you appear to have an open port on the Internet...
· Um, your application has a hole in it...
· We found your data lost and confused....
· I think you might have a hole in your cloud...
SOME of us have tried to have these conversations with companies, individuals, and entities out in the digital realm and have been met with a variety of responses ranging from thanks AND relief, to accusation, lawyers, silence, or the FED’s arriving on the doorstep etc.

Somehow, in the physical realm when point out your mistakes, flaws and general numptiness you are happy to receive the feedback, yet in the digital realm when we do the same it’s as if we called your baby “robust with a face only a mother could love.”

What gives? How DO we give you YOUR data BACK in the digital realm without all this grief?

I mean, it’s NOT as if you realized it was gone, OR that chocolate fireguard you were sold would have slowed us down anyhow IF we did want it!

Things to ponder on and discuss this coming Thursday on the Shit Show with Evan, Ryan, and Chris
‘all for now
Chris

Well we are going to try this again Episode #47 went a different direction, so tonight we are going to to try Jeopardy again
It's time to play some Security Shit Show Jeopardy again. Hell yeah!

I will be your host Ryan Trebek

One game, one Cham Peon. Like v1, we'll pick three contestants from our live audience to play our version of Jeopardy. Winner gets some bragging rights and a Security Shit Show T-shirt (that I'll forget to send you).

YOU THINK YOU'VE GOT WHAT IT TAKES?!
COME PROVE IT!

Originally we were planning to play another round of Security Shit Show Jeopardy, but things went weird off the bat.

We just talked about stuff, really. Got honest about things. Hell, this is the Security Shit Show! What did you expect?!

My Retirement Plan…

Is to head to New Zealand…

Somewhere nice and remote…

With good power (or a wind farm, etc.)

Good internet (terrestrial and Satellite)

AND a nice AS/400 to live in

If I have my way, and I think well get there before I go too much more senile given the work being done on untangling some of the innerworkings of the brain, I should be at a point where not only can my current intelligent system recognize when I want a cuppa tea, but it can also figure out why, and likely decide what options to present me etc. Already it knows where I’m at, IF I’m thinking of him, and what settings to set the screen to based on several factors that my brain apparently is telling it without letting me know.

If I can help push the boundaries of what we’re working on I’ve every confidence that a digital version of me will be coursing around the Interwebs before I’m pushing up daisies. Which brings a WHOLE heap of questions.

What makes us human?

Are we just quarks and binding energy?

Is there really something else to this?

Can we be broken down into pulses?

Where ARE the limits (or are there any?)

Just one retirement plan, what else is there out there? Let’s discuss this and where else humanity IS heading as it does handstands on the edge of the existence cliff…

So, as nicely as I can say it, screw y’all, I’m going to hang out in my self sustaining AS/400 and watch things unfold AND if it looks really dodgy I’m going to work out a way to simply fire my digital self into space as a set of waves and see what the hell happens…

Lawnmower man, here we come!

‘all for now
Chris

Money!! it makes the world go round, we need it, we want it, and when it comes to money for our security program we fight for it, but are we spending it wisely?

- Will it have the impact on our security program we hopped it would?
- Did we spend too much or not enough?
- How much money is enough?
- What the hell should I be spending it on that will make the biggest impact?

Is it wiser to invest in your people and the fundamentals or to invest in state-of-the-art laser cats with predictive AI powers? What is the right level of budget for your organization and how will you show improvements to the organizational security posture against the spend on the security program.

Vendors love money, and the love of money is the root of all evil.

- How do you know if your vendor is predatory?
- Does the product or service do what they claim?
- Will you need to increase headcount to accommodate the tool or service?
- Could you get a better deal on this tool or service?
- Do I even need this tool in my portfolio or is there an existing tool that I can leverage better?

All this and more, on the Security Shit Show Join Chris Roberts, Evan Francen and myself for what should be a a very lively discussion.

On YouTube Thursday night at 9pm MTN 10 PM central time

- Ryan Cloutier