The Security Shit Show

Recently a well known cybersecurity company made a very bold claim that they can end cyber risk!
This begs the question can you end cyber risk? what would it take to end all cyber risk? Is it even possible to end cyber risk? what if you put the phone in the chipper shredder, throw the laptop into a crucible and melt it to bits, will that help? How deep does the digital rabbit hole go? is there any escape from cyber risk?

Can you go off grid or will the grid follow you? if you do go off grid does that impact how much you care about your digital life? does being off grid affect your cyber risk exposure?

Or is it all just a pipe dream? are vendors selling pipe dreams and not solutions? or are they just smoking some funny stuff that makes them think this behavior is ok.

We're back after three weeks off!
Seems the world didn't right itself while we were away.
BUMMER or BUGGER (for Chris)!

2020's gone. YAY!
2021's here. YAY (maybe)?!

The calendar flipped, but the script didn't. 2020 was a f*cked up year for sure. Like seriously f*cked up! There was no shortage of breaches, sh*tty security stuff, panic, fear, loathing, division, etc., etc., etc.

The new year brings hope, right? Hope for a fresh start. When the calendar flipped to 2021, there was a collective sigh of relief.

Yes, 2020 is behind us! There's hope! We can see light at the end of the tunnel! Hope is GOOD!

Then reality hits (again).

The sh*t from 2020 didn't go away. It's like 2020s sh*t is still in the toilet bowl and the f*cking toilet is clogged. Will 2021 be a year we find the plunger or a year we eat a sh*tload of bad Mexican food while we ignore the clog? We don't want 2021s sh*t to pile on top of 2020s sh*t, do we?!

We've stumbled out of the gate (in 2021). If we don't do something soon, 2021s sh*t is gonna be bad. We can't let 2021 become 2020 with more sh*t. The smell is terrible and it's unhealth as... Well, sh*t!

Can we flip the script? Sooner or later, we're gonna have to! Hell, isn't flipping the script something that motivates us in this industry?

This will be a good episode for sure! We're HAPPY to be back!

Written at the turn of penultimate century, and published around 1910, Kipling’s “If” is a force that speaks as wisely today as at the time of writing.

Breaking it down to a few simple guides, we can learn the following:

- Keep a clear head while others around are losing theirs.
- Be mindful of our thoughts AND actions.
- Never ever give up.
- Reach FOR the stars, but keep your feet firmly planted.

Now, given the last few weeks of fun and games in our industry have put the icing on an already challenging year, the words above should probably be printed and stuck TO our monitors.

Here’s how I see those guides:
- WE need us to show people that we can handle a crisis; THEIR digital lives are in our hands.

- WE need to ALL cooperate, collaborate AND work through our issues as one.

- The world sucks reach out and do a buddy check, you never know how necessary it is sometimes.

- We DO hold the keys to the digital realm; NEVER forget that without everyone else, we would NEVER succeed.

We’re going to dig into this a little more Thursday night on the Security Shit Show, join Rachel Arnold, Evan Francen, Ryan Cloutier, CISSP, and I at 2100 mountain on YouTube.

Another day, another breach in the news, what's new? well..., this time the victim is one of the worlds leading information/cybersecurity providers.

The tech, the calls, and clicks of folly
Fa-la-la-la-la, la-la-la-la
‘Tis the season to rob Holly
Fa-la-la-la-la, la-la-la-la
Don, he shops online in peril
Fa-la-la, la-la-la, la-la-la
Scammers have him over a barrel
Fa-la-la-la-la, la-la-la-la

This is the audio recording of the Security Shit Show, which runs live every Thursday night at 10om CST on YouTube (https://www.youtube.com/c/SecurityShitShow).

HOT CHIPS!!!

We're gonna take the Paqui Chip Challenge this week. Chris will NOT be cheating and Evan has his chip in hand. Ryan? We think he ordered his, but we forgot to check.

Whatever. It's the SHIT SHOW!

Here's what we're gonna talk about:
Compliance…

We’ve taken something that should be simple….

AND

Turned it into something so SO damn convoluted that once again we’ve have to create an entire branch of our industry to JUST decipher it

We need to simplify this, so HOW do we do it?

What is that smell?... Is that smoke I see?... Why am I hot?

OH SHIT, I'm ON FIRE!

Work in InfoSec long enough and you will see a fire or two, Oh hell let's be honest, work in InfoSec long enough and you will be the cause of a fire or two. It could be your flagship application leaking vast amounts of data, it could be the secretary clicking on a link, a misconfiguration, a failed patch, your most critical 3rd party has a data breach, and ransomware event all in one, then there is the tomfoolery of China, Russia, North Korea just to name a few.

At some point, we have all gotten the "Shits on fire" call at some ungodly hour of the night, and this is assuming we were sleeping, instead of sitting up chewing our fingernails waiting for the phone to ring with a fire on the other end that we then have to deal with. This constant barrage of fires, day in and day out, takes a toll just like in a real fire-you get burnt.

Then we have the political fires when someone is trying to burn us down, we have to deal with this on top of the security fires, and this only further contributes to the personal burning, (no not that kind of personal burning, get your mind out of the gutter) I am referring to the burning of our energy and passion, the kind of burning that if not managed leads to burn out. The old saying goes "be careful not to burn the candle at both ends for too long" this is because you will eventually burn out, but along the way, you will burn up first.

Oh and don't forget, your doorbell, cell phone charger, smart oven, furnace, lightbulbs are all trying to burn down your house.

So what can be done? What is the digital equivalent of a fire extinguisher, smoke detector, or sprinkler? How do you tell when you or a colleague is getting burned up or is already burned out? What do you do when your doorbell is trying to kill you with FIRE!

All this and SPICY Chips (or Crisps as Chris would say) on the Shit Show.

Who doesn't want the best sex life possible? Hmm. Maybe not someone we'd want to know.

Believe it or not, some of us are convinced that good/better security can lead to a good/better sex life. Thought-provoking? We think so.

Chris, Evan, and Ryan are going to dissect this theory and give you (at least) seven ways better information security can lead to a better sex life. If you're interested (in a better sex life), you'd better tune in!

So, les face it, the decisions for the next president is probably already made despite everyone still running round the country stumping for more votes and hoping for a last minute turnout. We’ve seen record numbers of folks at the polls and the USPS folks have carried (successfully) more and more mail in ballots than we’ve seen in many years gone past.

Which means the dye is cast, we just have to wait to hear who’s won the next 4 years in the hot seat.

Which means the time for healing is upon us, or at least we should be planning for it.

OR CAN we?

Every 4 years it seems as if we up the ante in this fight for power, mud is slung, words are exchanged, wounds opened and then it’s over. We’re meant to move on, and try to get back to working together as ONE country as opposed to two divided ideologies or 50 individual states. To me this is like lawyers at the end of a trial who’ve insulted each other and their clients for days on end, they just shake hands and move on, while some of us STILL want to throw that Molotov cocktail across the courtroom.

HOW does this nation repair itself, how do families, communities and people come together, CAN WE?

How does one side not gloat? How does the other not lament what could/should have been? AND how DOES a house divided against itself actually work??

LOTS to talk about this evening, join us for a lengthy discussion on these topics and more.

Will my vote count this year?
What is the safest way to vote?
So many options, so many questions, and a shitload of confusion.

As the last few weeks of this unprecedented year have unfolded the focus has been shifting to the upcoming election and the challenges the pandemic has created for our democratic process, specifically how in the actual F are we going to vote this year. some of the questions we have been pondering are:

If I vote by mail will it arrive and be counted?
Is 1234 actually an admin password for voting machines?
Are the Russians and Iranians or "others" setting up fake ballot boxes?
I want to wait in line for 19 hours to vote in person how safe is the voting machine?
Should I vote from my phone, is that safer than mail or in-person?
Will my vote be thrown out on a technicality?
Who is counting the votes and are they trustworthy?
How safe is my polling location?
How can I identify real poling security from someone pretending to be?
The list of questions goes on and on, it is enough to make your head spin your stomach hurt and your confidence in our democratic process to be shaken to its core.

What can you do? who has the answers we seek? how can you ensure your vote is secure and counted?

But don't worry yet, all hope is not lost there are things that can be done, and lots we can learn to improve in the future, we will be discussing this and more on this episode of the ShitShow.