The UNSECURITY Podcast – Episode 45 Show Notes

Welcome back for another quick recap of the week and another dose of UNSECURITY Podcast show notes. Hope you all had a great week!

For last week’s show, Brad was in studio while I was calling in from Sofia, Bulgaria. Brad was joined by Ryan Cloutier, an awesome return guest. As far as I could tell, it was another great show. I had some connectivity issues, but who doesn’t have connectivity issues in Bulgaria? Brad did a great job holding things together while we chatted about issues such as liability and speaking information security with “humans”.

Catch episode 44 here.

I was in Bulgaria to visit members of our SecurityStudio development team, check out the new office, and spend some time planning future releases of the software. Bulgaria is eight hours ahead, so timing with U.S. resources was interesting.

This slideshow requires JavaScript.

The trip was very successful and we made significant progress on a number of fronts. While I was halfway around the world, Brad held down the fort. He’s a really good leader and I’m sure he has a bunch of things going on. I didn’t get to check in with him last week, so we’ll ask how he’s doing on the podcast.

Lots of other really cool stuff to share, but I’ll do that in another post or on the show.

Let’s do some show notes now.


SHOW NOTES – Episode 45

Date: Monday, September 16th, 2019

Show Topics:

Our topics this week:

  • Catching Up
    • More Mentor Program success
    • Civic duty example
  • vCISO Revisited
  • Book Announcement

[Evan] – Hi folks, welcome to the UNSECURITY Podcast. This is episode 45 and I’m your host, Evan Francen. Brad’s joining me as usual. Hi Brad!

[Brad] Brad politely says hello to me and by proxy all of our listeners. Good Brad.

[Evan] Man, this is two shows in a row where I’m out of studio. Today I’m stuck in Washington, D.C. for a meeting. Only one day, so that’s good. What’s up with you?

[Brad] Stuff and things.

[Evan] We haven’t recorded together in person the last couple of weeks, and I haven’t even been able to catch up with you. You cool if we catchup quick?

[Brad] Brad will probably say “yes”.

[Evan] Alright, let’s start with your week. Tell us what you’ve been up to.

Catching up

  • What Brad’s up to.
  • What I’m up to.
  • We have more Mentor Program success to talk about
  • One of our listeners is setting a great example for all of us in holding his local government accountable for security.

[Evan] Alright, lots of good things. We’re all in this together and there’s a job and place for everyone.

[Brad] Brad’s words of wisdom.

[Evan] We’re always grateful for feedback that we get from listeners. If you’d got some, email us at unsecurity@protonmail.com. One of the more popular topics in the past few months has been that of the virtual Chief Information Security Officer (or vCISO). We’ve received some great questions about how to become a vCISO. A couple of episode ago, we talked about what a good vCISO is, but we didn’t really talk about how to become one. Let’s do that.

How to become a vCISO discussion

  • If you’re new (less experience).
  • If you’re experienced (even existing CISOs)
  • What are the benefits to being a vCISO versus being a FTE CISO?

[Evan] Alright. Good perspective and good discussion. Thank you Brad.

[Brad] Brad’s gotta say something or we’ll have an uncomfortable silence here.

[Evan] OK, last topic before we get into some news. I want to announce something that I’m VERY excited about. You and I are going to write a book, right?

[Brad] Brad confirms. See if you can notice any change in the tone of his voice when he responds.

New book announcement and discussion

There’s a tie in here with vCISO too.

[Evan] I’m pumped about writing with you Brad. What better time than 4th quarter to get started?

[Brad] He’s lived through multiple 4th quarters, so he’ll laugh/cry.

[Evan] Let’s close this thing out with some news, eh?

News

Here’s our news for this week:

Closing

[Evan] There you have it. Thank you for another great show Brad!

A special thank you to our loyal listeners. We love your feedback and sincerely appreciate the fact that you join us each week. Send your feedback to us at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @evanfrancen, and Brad’s @BradNigh.

Talk to you all again next week!

Must have more data…

So, I wrote the first book, Unsecurity based more on experience and less on research. It was easy (well, not “easy”) because the audience for the book were the people in my own tribe (information security people). It was like writing a book to myself.

Now I’m writing the second book, and the audience has changed. It’s a book written to and for non-information security people whom I’ve affectionately called “normal” people. This doesn’t mean that a normal person isn’t awesome or exceptional, they are.  It’s just the word I chose to reference people who aren’t information security folks. Maybe “the masses” is a better reference. We’ll see what makes it into the book.

Anyway, I have a problem. Sort of.

The Problem

I had a revelation while I was writing this book. It came to me while I was writing about how we (security people) make the mistake of assuming we know what the masses think. Even worse, we sometimes tell the masses what the masses think. It’s wrong!

Well, I was about to make the same mistake that I was rebuking other security people about.

STOP!

Don’t you think it makes better sense to ask the masses what they think about information security rather than to assume I know what they think? This book will make a lot more sense and be much more helpful if it uses the same language that the masses use and addresses their concerns!

The Solution

The best way I know how to get answers to the questions I have was to create a simple survey, one that can be completed in five minutes or less. So, I did.

So far I’ve received more than 500 responses to the thirty question survey, and the data is awesome! As I’ve mulled through some of the preliminary data, it’s amazing to see what people think! Who’d a thunk?

500 results gives the survey a lot of credibility. The margin of error is ~5%, which is great! Wouldn’t it be great to get a margin of error of <=3%? I think so, and the only way to get there is to ask for more responses. This is where I’m asking for your help.

Would you be so kind as to take this survey (it’s a safe link) and send it to as many of your contacts as you feel comfortable? The survey link is here:

https://www.surveymonkey.com/r/security_for_normal_people

The better the data, the better the book. That’s the theory at least.

I’ll be writing more about the upcoming book in future articles. I think it’s going to be fun, and it’s going to help a lot of people!

THANK YOU!

P.S. The word map you see as the “featured image” in the title is mapped from the raw input (answers without any filters or changes) to the question “What could information security experts do to help people better?” (in the survey).

Status Update – March 24, 2019

Just got to the hotel in Aberdeen. Getting into the groove, and I felt compelled to share an update with you all. Compelled mainly because I haven’t been able to write here nearly as much as I had intended. It’s not unusual for me to bite off a little (or a lot) more than I can chew.

No matter. It is what it is. If I could learn to say no more often, I’d probably be healthier.

Current (or Recent) Things

Here’s some of things going on in this guy’s work life:

  • Running FRSecure, sort of. I’m the CEO here, but I’m not the person who get’s things done. I say “sort of” because I’ve been blessed with an INCREDIBLE leadership team who truly runs the best company in our industry. I love what they’re doing and they’re breaking records every month.
  • Running SecurityStudio, sort of. I’m the CEO here too. Like FRSecure, I’m not the person who get’s things done. I’m a little more involved with SecurityStudio because it’s such a young company. Awesome, awesome, awesome leaders here and it’s so much fun to watch this company grow. VENDEFENSE is attracting new customers every week, and there is some really exciting news coming soon!
  • The UNSECURITY: Information Security for Normal People book is behind schedule right now, so I need to focus more attention on completing the draft/manuscript. This will take up most of my time for the next few weeks or so. I’m really excited about this book, mostly because of the audience it’s intended for and the plain-Englishness of it all. I’m hoping it will resonate with “normal” people and help them better, more secure lives.
  • The So You Want to Get into Security? series of articles is complete, and I’ve compiled the articles into a simple free eBook. I’d never published an eBook to iTunes before, and it was a fun exercise to learn. I’ll plan on making more, and better quality eBooks available in the future. Check out this one, if you don’t mine, and let me know what you think.
  • The UNSECURITY Podcast is going well, but it’s a struggle to do a weekly one hour show sometimes. Feeling like we’re dragging @55 a little bit, but we’ll get back into the groove. My show notes have been a couple days late the last two weeks (vacation and work travel), but that should get back on track soon. We’ve done 19 consecutive weekly shows so far and we’ve learned a lot, but we’ve still got a ways to go before it really feels dialed in. Please be patient with us (me and Brad Nigh). We’re committed to creating a really good show and we’ll keep at it.
  • I’ve written a few more articles lately for other publications. Some are better than others:
  • I’m coming up on my one-year anniversary as the vCISO for a large, global company. I’m actually the vCISO for only one region, the Americas region that includes Canada, United States, and Mexico. It’s a 40-50 hour/month commitment, but it would be a lot more if there weren’t some awesome people there running the day-to-day operations. Great experience with really good people all around.
  • Was at the RSA Conference a couple weeks ago. I had no agenda but to see a friend of mine give his talk and to have lunch with him. Flew in late Thursday night, did what I was there to do, then left Friday afternoon. My friend is Roger Grimes, and he delivered a really good, and very well-attended talk titled 12 Ways to Hack 2FA. Afterwards, we visited (not nearly long enough) for lunch. Roger has an amazing security mind and he’s got impeccable character. We think A LOT alike.
  • The first gathering/meeting of the Cloud Security Alliance Minnesota Chapter (CSA MN) Executive Advisory Board met on March 14th, but I was on vacation. Sucked to miss the first meeting, but vacation was scheduled many months ago. I’m excited to help CSA MN make a real impact. Lots of great people involved!
  • Trying to stay up with Twitter and LinkedIn feeds. I’m thinking that I sort of suck at social mediaing.

I think that covers most of it.

What’s Coming – Future Things

  • Travelling to Aberdeen, South Dakota this week to work with a new client and figure out how we can secure the Ag industry better. We have a lot of work to do in the ag industry!
  • The UNSECURITY Podcast episode 20, live from Aberdeen with Shawn Pollard.
  • Sometime this week, I’m going to start a new hashtag #100DaysOfSecurityTruth. Each day, for 100 days, I will tweet a new truth. Hoping for some interaction, ideas, suggestions, etc.
  • New article for Cyber Security Intelligence about Identity Management. Tim Heath is the CEO over there, and he’s a good dude.
  • New article for here (or somewhere) about the bad things about RSA.
  • Planning the next Security Summit for my vCISO client. These are always fun. People from all over the region come to meet, learn, teach, and have fun together. The last Security Summit was one full day of incident management training and a second day about identity and access management.
  • The next Hacks and Hops event is this week. We didn’t pick the most enthralling topic (third-party security risk management), but it is a critical one. There will be good opportunities to network and learn what work (and what doesn’t). Come if you can.
  • Speaking of third-party security risk management, there’s another eBook being planned. The book will be a soup to nuts/zero to hero book; practical advice from starting from scratch —> the best friggin’ program ever, and everything in between. Thinking a few months or so, but it’s on the docket.
  • Lots of writing for the next book. I’m already behind a bit, so it’s time to get real on this thing! This is actually the number one priority right now.
  • More collaboration with security people I admire. I’d like to collaborate more with Chris Roberts and Roger. I already said a few great things about Roger, but Chris is pretty damn awesome too. More allies = more progress.

I’m sure something else will pop up, but that’s all I can think of right now. If you ask me to do something else, don’t be offended if I graciously decline (for now).

NOTE:  The Writing UNSECURITY series of articles – I still intend to finish writing this series, but for now it’s on hold. There are too many other pressing things (the Information Security for Normal People book, other articles, business commitments, speaking engagements, podcasting, and oh yeah… family!) that need focus too. Comes down to priorities, as it should, and this series must take a back seat for now.

Take care!

-Evan

 

Writing UNSECURITY Journey – Back Home/Kidney Stones

A series of posts dedicated to the journey of writing my first book, Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?

This is the seventh article in the series. The others:

See here for the full list of articles, including those that are yet to be written for this series.

Introduction

You already know what’s coming in this article. My titles in this series aren’t very creative, are they?

It was good to be back home. The only thing that sucked was the weather. In Cancun it was sunny most days and the temperature was in the mid-to-upper 70s. At home, it was below zero and snowing. The good news was I wouldn’t be tempted to go outside much. Good writing weather!

Cancun was mostly a success, minus the first week drama. The score at the beginning of the Cancun trip was; 76 days to go before my self-imposed deadline and zero words written (sort of). I came back with a score of 62 days to go and 21,672 words written. Seemed good to me at the time. Remember though, I was a naive newbie writer, and I had no clue how long these books are supposed to be or what they’re supposed to look like.

The Routine

While I was away, I had few interruptions. At the office, I was interrupted constantly. I love being an accessible leader who’s genuinely interested in every employee who works at FRSecure and SecurityStudio. Between my need to be with our employees, the phone calls, meetings, and emails, there was no time to write anything between the hours of 8:00am and 5:00pm.

I wanted to avoid writing at home because knew it would dominate family time. Something had to give. I needed to find writing time somewhere.

The solution… I’ll get up every morning at 3:00am, get to the office by 4:00am, and write from 4:00am to 8:00am. Brilliant. I knew that I wouldn’t be able to do this every morning, but I would try anyway. If I couldn’t find the energy some mornings to get out of bed, I would just reset the alarm and find an hour or two somewhere else in the day.

Week one was essentially shot because I hadn’t figured out what I was going to do yet. It was a struggle to catch up with emails, let alone write anything. Score: 54 days to go and maybe 22,000 words done. I felt like I was starting to fall behind, but I was sure I had a solution.

Week two, Monday morning, I’m up and raring to go! Good writing session. Tuesday, same thing. Wednesday, starting to drag a little. Thursday, nope. Friday, somehow managed to get in early, but could not write anything. My brain was not having it. The 3:00am thing is going to be a real turd. Maybe I’ll try 4:00am instead.

Turns out the 4:00am each morning did the trick. Some days were better writing days than others. I tracked my progress each day by how many words I wrote. Some days I wrote 1,200(ish) words and some days I struggled to write 250 words. Here’s what I learned…

How many words you write each day doesn’t matter as much as writing each day.

Kidney Stone

Life was good, and I was trucking along, until one morning I didn’t feel right. I wasn’t sure why, but I felt like I needed to use the restroom really bad. No problem, to the restroom I would go. At this time it’s probably 5:30am, and there’s nobody else in the office yet. I didn’t feel right, but there was no reason to panic.

I tried writing, but it was a struggle because I couldn’t concentrate. I constantly felt like I needed to go to the bathroom, yet every time I went to the bathroom, nothing happened. There was no urine or bowel movement, just an unusually pronounced feeling that I needed to excrete something. As time went on, the feeling got worse, bit by bit. The time was now 9:30, and I’m getting a little more concerned.

Things progressed much faster, and by 11:00am, I’m laying on the bathroom floor. Wasn’t panicking before, that’s changed. Something is seriously wrong. Thankfully my wife was in the office at the time, so I told her about my problem. I told her that I need to go to the doctor right away. I don’t know what’s wrong, but I know that it hurts like a sumbich. She knows I have a high pain tolerance, so this is very unusual. She immediately gets the car while I get my jacket.

We’re in the car on the way to the nearest clinic, 15 minutes away. She keeps asking me if I’m OK, and I don’t want to talk. I want the pain to go away, and I’m in full on “GIVE ME ANYTHING TO TAKE THIS PAIN AWAY RIGHT NOW” mode. After an eternity, we arrive at the clinic. We get in to see a doctor quickly and the doctor starts asking me a bunch of questions. I don’t want to answer any questions! The pain is unbearable, and I want her to 1) give me something to make me feel better or 2) shoot me. She tells us she thinks I have a kidney stone, and that I have to go to a hospital.

That’s it?! No drugs? No gun?! Just go to a damn hospital?! Useless. I’m pissed. I’m angry. I feel like an alien is going to come popping out of my stomach or my ass or my back at anytime (I can’t tell which). I’m obviously dying, and now I’m told to get back into a car and endure another 20 minutes of hell before I eventually get to the emergency room. Fine. Whatever. I’ll do anything right now.

Another eternity passes. Two eternities in one day if your keeping score. We arrive at the emergency room, and more questions! The nurses want to ask me questions, and I don’t want to talk to anyone. I want drugs or a bullet. That’s it. My wife intervenes (she’s an angel) and eventually I end up in a bed. Still dying, but dying harder now. How can I possibly be dying harder? This is crazy! Why God?! What did I do to deserve a living death like this?

We’re in this room with a curtain thing that separates my bare bottom in a scratchy gown from the rest of the world. A nurse or doctor (I can’t tell because I’m having trouble seeing now, I think) comes in and she wants to ask me questions too! Seriously, stop with the flipping questions already, and get down to business! I look at my wife in desperation. She tells the doctor I don’t want to talk and she answers for me. Out of all the questions that were asked, I heard one that I actually wanted to answer. The doctor asked what my pain level was on a scale of 1 – 10, 10 being the worst. I blurt out, “it’s a 20!”. Even that answer was hard to muster between my panting and dry heaving. Oh yeah, the pain is making me dry heave now.

Seriously, I’m dyyyyyyyiiiiiiiinnnnnnnggggggggg. The doctor leaves for some reason or another, an now I can’t lay down. I’m pacing the room, stopping to lean head first against a wall every now and then. While I’m pacing and trying to find some way to move in a manner that will give me some relief, I can overhear the nurses outside my shower curtain door talking about recipes for some whatever thing. I’m like, why?! Why do you let a good man die while you talk about tater tot hot dish recipes?! Life sucks. Seriously, is this the end?! Is this how I’m going out?

Finally, a nurse comes in to see me again. She wants me to pee in a cup. I want to shove the cup up her… No! I stop myself. It’s the pain talking. I did shout, “when can I get some drugs”? She stopped what she was doing and gives me a puzzled look. “Wait. Nobody has given you anything yet?”. I can’t say anything because I want to cry. My wife answers for me, and before long I get some morphine. Thank you Jesus!

The pain slowly eases, and I can talk better. Why do things like this always happen to me? For one, this mother of all pains, and then forgetting to give me some drugs? Double whammy of suck.

The morphine didn’t take the pain away entirely and it didn’t last very long either. My pain probably dropped to an 8 (which is a helluva lot better than 20). Seemed like thirty minutes later, and my pain started to inch up again. Next up, the doctor wants a CT scan. OK fine, just don’t forget the drugs. The whole CT scan thing was quick, and before I know it, I’m back in my room. The pain is getting really strong again, but the nurse gives me something in my IV right away. Within five minutes I’m feeling good. Like, what the hell just happened?! I asked the nurse what she just gave me, because I want that stuff on stand-by.

I was expecting the nurse to tell me the name of some super-narcotic, but no. She gave me ibuprofen in my IV. Ibu fricken profen?! Really?! Yep. I was too amazed and exhausted to ask them why we didn’t start with this an hour or two ago. The results from the CT scan were ready, and it turned out that I had a 7mm kidney stone. The doctor suggested that we let the stone pass. Skeptically, I agreed. She thought it would pass on its own and told me if the pain comes back, take more ibuprofen. Easy enough. I LOVE Ibuprofen (now).

Before the doctor left, she mentions one more thing on the way out. She requested that I come see her at the nurse’s station after I get dressed. I asked he why. She wanted to show me something on my CT scan. My wife and I looked at each other, and we could read what the other was thinking. Why? What do you want to show us? I quickly got dressed and scurried out to the nurse’s station where the doctor was waiting for me.

She showed us a grainy looking image. In the middle of the image was my kidney. The doctor pointed at the kidney, and focused out attention on a darker part of the image. She explained that she’s concerned about a “mass” on my kidney. Apparently the mass had a diameter of 55mm. She advised that I get a CT scan with contrast soon, and that was that. She wouldn’t answer any additional questions and just referred us to our family doctor for next steps.

That’s it… Writing wasn’t really on my mind anymore, at least not on this day.

Writing UNSECURITY Journey – Cancun(2)

A series of posts dedicated to the journey of writing my first book, Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?

This is the sixth article in the series. The others:

See here for the full list of articles, including those that are yet to be written for this series.

Introduction

The second week in Cancun was infinitely better than the first. The second week officially started with the arrival of my wife and daughter. They were coming to spend time with me and enjoy some of the Cancun sun. My wife had a spare laptop power cord in hand, so I was finally back in full service! After writing the first 25 pages of the book on an iPhone, it was such a relief.

The Restart

It’s Saturday, and the alarm was set for 5:00am. The plan was to write all day at corner table in the resort lobby. I chose this table because it was off in a quiet corner, it was just the right height, and the chairs were comfortable. I was pumped! Last week it felt like this day was never going to come.

One thing I did a few days ago, maybe Thursday, was set goals. I also wanted to set some writing time structure that I could follow. My goal was to write 3,000 words/day and adjust as I went. This would equate to about 12 pages/day, and this seemed like a reasonable goal starting out. The structure I would follow would be 50 minutes on, followed by 10 minutes off, and I would not stop any earlier than 3pm. I had already done a lot of research for the book, so my day would be all a go for writing!

My first ever full writing day ended at 3:45pm. I hadn’t eaten anything, but I didn’t even notice my hunger until I stopped for the day. Final results; 2,732 words, or about one and a half chapters. It felt like a productive day, and it felt an incredible sense of accomplishment. Finally, something got done!

I spent the rest of day with family. Great day.

The Coffee Club

Sunday started with the same goal and the same approach as the day before. Writing started at 5am sharp. Each writing session would be 50 minutes, just as it was the day before. As I was starting the third writing session of the day, two old guys came and sat at my table, one on my left and the other on my right. Awkward. I struggled a little to maintain focus, and did my best to ignore them. These guys obviously knew each other and they began a (loud) conversation like I wasn’t there, even though I was in between them. Ten minutes later, another old guy shows up and takes his seat at the table. The conversation amongst the old men continues.

I’m doing my best to stay in the zone, but my bladder starts screaming for some relief, so I had to stop for a quick bathroom break. After relieving myself, I walk back to my writing spot when I notice that there’s a problem. This isn’t my spot anymore. There are now eight or nine old men sitting all around the table! I sit down, but I’m cramped. I struggled through the rest of the writing session, and took a break outside. I’m flustered and irritated by these rude old men. I’ll just need to fight on and keep writing. It’s the only comfortable spot around here.

Three quarters of the way through the next writing session, the old men begin to disperse. Before long, I’m alone at my table again. Awesome! During the next break, I reflect on the awkward experience, and convince myself that it must have been some kind of Sunday morning gathering. I’m hoping that tomorrow will be different, back to normal. The second day was a little better than the first in terms of the number of words  written, 3,012. I was determined to hit my goal, and I was getting better at writing too.

Monday comes, and the same old man experience. The first five minutes with these guys were frustrating. I was actually angry. Today was different though. Before long, I started listening to their conversations, and they even addressed me a couple of times. Before they left, I had introduced myself to them all, and I was actually starting to warm up to these guys. Monday was a good writing day, but I have to admit I was looking forward to seeing the guys tomorrow.

Tuesday came, and so did the old men. These guys meet each morning for their coffee club and I was in their territory. I was happy to see them, and I think they were happy to see me too. Rather than trying to write anything, I closed my laptop and fully engaged in conversations. I’m not good with names, but there were two guys that I immediately hit it off with, Bob and Lynn. Bob was a dentist for 36 years in a small Missouri town. Lynn owns a farm that is the largest producer of gladiolas in the United States. All these guys were retired and spend some number of winter weeks in Cancun each year.

4ED34A53-1426-453E-B00A-7C6A4DFC1A9C

My Cancun Coffee Club

Bob asked me what I was doing with my laptop, working. When I told him that I was working on a book, he seemed genuinely interested. He asked me what I was writing about, and I told him that I was writing about information security. The look on his face was priceless, partially because it’s Bob and partially because he had no idea what I was talking about. I did my best to explain, but I could tell it was going to take a while. He wanted to know more, but we didn’t have the time.

This is when I realized what the second book would be. You know, the one I’m writing right now. This thought at the time was crazy because I hadn’t even written half my first book before I’m thinking about the second one. The second book would be titled “Information Security for Normal People”, or something similar. Normal people are people like Bob. The more I thought about it, the more convinced I became. How sad would it be for a wonderful, salt of the earth, all-around good guy to lose everything to some jackass attacker? Yes, I have to write this second book. Shelve it for now.

As the week progressed, my relationship with the coffee club deepened. We got to know each other pretty well. It didn’t let it take away from writing progress because I planned it each day now. When it came time for me to leave for home, we said our good-byes, and  I promised them I would be back again next year.

Heading Home

The second week went fast, much faster than the first. I spent at least 60 hours at the keyboard, and still found time to become part of a coffee club and make great memories with my wife and daughter. The week produced a total of 21,672 words. If I would have avoided the week one drama, I think I could have had 45,000 words. Oh well, at this point I still have a month and a half to finish up the draft. I’ll just need to do it at home.

Lessons from Cancun:

  1. Prepare much better. There was no excuse for leaving my laptop cord behind. If you’re going somewhere to write, pack well and prepare for contingencies.
  2. Goal setting is important. There were days where I wanted to quit for the day, but I was short of my goal. I would not allow myself to quit on a couple of days, because of my goal.
  3. Segmented writing works well for me. The 50 minutes of focused writing followed by a 10 minute break was a good approach. It forced some discipline into my writing and inserted healthy breaks.
  4. Don’t try to force through distractions. If I don’t want distractions, go somewhere quiet. If I’m distracted, and I don’t want to go somewhere else, stop writing. It saves me frustration and I made some great new friends.

That’s it for the two-week Cancun writing trip. I’m actually starting to feel like a writer at this point in the process, and I’m excited to write at home or in my office.

Writing UNSECURITY Journey – Cancun(1)

A series of posts dedicated to the journey of writing my first book, Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?

This is the fifth article in the series. The others:

See here for the full list of articles in this series, including those that are planned in the future.

Introduction

This article is longer than the others. There’s some drama in this one.

If you don’t recall, or if you’re just joining the conversation now, my plan called for a two-week writing trip to Cancun in January 2018. Life sucks, right?! The challenge was convincing my co-workers that I was going to Cancun to write a book, not to go on vacation. They said they believed me, but you could see the skepticism on their faces. I had to come back with a finished book, or at least solid progress on one if I was going to convince them. This was added pressure that I didn’t need, but I was up for proving them wrong.

The plan was for me to be in Cancun for one week by myself, doing nothing but writing. I would be joined by my wife and my 13 year-old daughter for the second week. On the second week, I would write all day and spend the evenings with my family. A good plan, I thought.

The Outline

I didn’t want to wait for the trip before I started doing something with the book. So, months before leaving, I started the outline. At the time, there was no title and all I had was the idea. The book was supposed to be about what’s broken in the information security industry. If you know this industry, you know that there’s no shortage of topics that I could have chosen to write about. The fact is, there are many things that are broken, depending upon your perspective and experience. I needed to figure out how to take all the things that I think are broken and organize them logically into chunks, which would later become chapters.

I open Microsoft Word and stare at the screen. Ten minutes pass. What’s wrong with me?! OK, break time.

While on my well-deserved break, I convinced myself that I needed to write something. Write anything! This is where it all started. I just wrote anything and everything that came to mind about the frustrations I have with the information security industry and what seems broken to me.

I think the experts call this brainstorming.

I drew upon the experiences of my past, and kept typing words, with no attention given to context or structure. The document started to fill with topics. Slowly, out of the topics emerged themes. Once thoughts started to flow, I was surprised by how easy the thoughts went from brain to document. After an hour, I even added some pictures that I downloaded from the Internet. The pictures with the smattering of unorganized words in a Word document started to become my outline. I did something. Yay me!

Here’s the first brainstorming document. Impressed?

Over the course of the next few months, and before leaving for Cancun, I made numerous changes to the outline. I didn’t do any heavy writing, just revisiting the outline once a week and tweaking it here and there.

Before I knew it, it was time to leave, and it was time to get serious about writing this book!

Can’t Believe I Forgot

This was a week that I won’t forget. Read on, and you’ll know why.

I arrived in Cancun on Saturday, January 6th. We rented someone’s condo lockoff at the Royal Sands. I’m a regular guy, so a four-star resort is not an everyday experience for me. The Royal Sands is an impressive place, and I had to check it all out. I already knew that I wasn’t going to get much writing done on this first day in Mexican paradise, and I needed to get comfortable with my new surroundings first. I spent the day getting oriented. The weather was perfect, the resort was very comfortable, and I didn’t know anybody. This was going to be the perfect place to get comfortable and write. I was feeling good!

Just one thing to do before I turned in for the day. I needed to complete some tasks for a large bank client of ours. Once I completed these simple tasks, I planned to get some rest. I would get up early the next morning and get busy. No problem. I break out my laptop and get to work. Thirty minutes in, I notice that my laptop could use a charge. Easy enough. I grab my computer bag and stick my hand in the pocket where I always keep my power cord, and…

I FORGOT MY POWER CORD!!!

Who does this? Turns out I do. I’m notorious for leaving power cords behind, and my wife even reminded me before I left. Ugh. At first, a little panic. The panic didn’t last long though. Cancun is a big town, and I’m sure I can find a power cord somewhere. In the morning, I’ll just check with the front desk.

Finished up my bank work, then sat outside in the warm ocean air before I turned in for the night. It was a good day.

The Hunt

It’s Sunday. I’m settled, and I’m excited to get focused on what I came here for, writing! Quick shower, short walk on the beach, and a visit with the kind people at the front desk was in order. I asked the concierge if he knew where I could find a laptop charging cable. He had no idea. OK, not a good start. I asked if the resort had any laptop power cables that were left behind by other guests. Nope. I try my first inquiry again. After some back and forth, he tells me that there’s an Office Depot in town. Cool, they’re sure to have a cord! I whipped out my iPhone and found it. It’s only 10 miles away.

Take the R2 bus for 12 pesos, 30 minute ride, and I’m there.

I’m starting to feel a sense of relief and excitement as I walk in the store confident that they’ll have what I’m looking for. I had trouble communicating with the store employees because I don’t speak Spanish and they didn’t speak English. This just meant that I roamed around the store for awhile. Then voila! I’m in luck, a universal laptop charger with an assortment of attachments! I grab the goods for a closer inspection. The closer look revealed that this universal charger wasn’t all that “universal”. It didn’t contain my attachment, so it wouldn’t work. At the time I was using a Lenovo laptop with a rectangular male end. No dice.

What now? Well, I’m thinking that this can’t possibly be the only store in Cancun with computer accessories, and I was right. My trusty iPhone revealed that there’s an Office Max, a Walmart, a RadioShack (yes, Radio Shack), an Ofix, and a Sanborns. Plenty of options. I just need to walk. Lord knows, I can use the exercise. First stop Walmart, on the way I pass a scary looking jail or prison, no dice. Next, RadioShack, nope. Ofix wasn’t open. Sanborns had some computers, but no cords. Another RadioShack, and I’ve struck out. In all, I’ve walked 9 – 10 miles and I have nothing to show for it. My mind is racing because I have writing to do dammit!

I decide to do what I always do when I’m at my wit’s end. I called my wife. After discussing the situation, we figured we had two options. I could buy a new laptop or we could (maybe) ship my power cord from Minnesota to Cancun. We decide to check on whether latter. Twenty minutes later, my wife calls to tell me that FedEx can get my cord to me by Tuesday morning for $83. OK, deal. Between this time and Tuesday, I figure I’ll write thoughts on paper and conduct as much research as I can on my iPhone. I needed a haircut, so I’ll knock that out too in my new spare time.

On the walk back to the resort, I called a friend, just to chat. I shared my dilemma with him, and he had a seemingly brilliant idea. Isn’t there a Dragon dictation app for iPhone? My heart jumps, is there?! I open my iPhone’s App Store, do a quick search, and YES, yes there is an app! There’s an app called Dragon Anywhere. Sweet, I’ll just dictate my book while I wait for my new cord to arrive. I install the app, pay the fee to open all the features, and I’m in business.

Or so it seemed.

I don’t know if you’ve tried dictating a book on an iPhone, but it’s painful. I couldn’t get it to work well. I don’t think it’s the app, I think it’s me. Training the app, and my training for using the app, were both pains in the butt. In addition to my troubles using the app, I couldn’t get over the awkward feeling of talking to my phone without a person on the other end. I was not digging this at all, but I’d just have to fight through it. Maybe it would get easier.

I finally got back to the resort late in the afternoon, and I was tired. No writing on Saturday. A great workout on Sunday, but very little writing done. This is not going according to plan.

Painfully Waiting

It’s Monday morning. I have some expectations, and I have some hope. I expect to get my power cord the next day. Today I’ll spend my time muscling through the best I can with paper and an iPhone. I spend the morning writing thoughts in my notebook, doing research on my iPhone, and talking to a stupid blinking cursor that hated me. My frustration was mounting, but I had hope. By noon, I’d already had enough. I needed a break.

I took the bus downtown to get a haircut. I found this place called La Cueva del Lobo (The Cave of the Wolf). It was listed online and it looked like a decent place. The reviews were good, so I went. My barber didn’t speak a lick of English, so I used my phone to translate what I wanted. Oh my…

THE BEST SHAVE AND A HAIRCUT EVER!!!

I’m not a high-end barber or spa guy, I’m a give me a quick haircut and get me out of here guy. All I wanted was a quick trim, and what I got was so much more. The visit to this small barber shop in Cancun was an incredible experience. My barber’s name was Jose Luis, and this guy takes his craft seriously! It’s hard to put this experience into words. I knew that I didn’t want it to end, but it did. Is this weird?

Despite the fact that my haircut was magical, I still wasn’t making much progress on the book. Writing was painfully slow without my laptop. I tracked my FedEx package all day, and my spirits were raised with each new update. The updates showed my cord getting closer and closer. I went to bed this night confident that I’d be running at full speed sometime the next day.

Tuesday arrives. It’s another beautiful day. I continued my slow progress while checking the FedEx tracking for my package every hour. This was an uneventful day. Then 3:30 in the afternoon came. This is when I got the ominous message from FedEx. The status on my package had been updated with a bright red bold “Clearance delay” message. According to the update from FedEx, my power cord is in Cancun, but it’s held up in the “clearance process”. I have no scheduled delivery date anymore, so I’m not sure what to think.

After getting over the disappointment, I convince myself that it can’t take long for a power cord to clear Mexican customs, can it? Hope returns. Tuesday passes, no cord.

Wednesday arrives. Same status. I’m now wishing that I would have bought a new laptop during my forced tour of Cancun on Sunday. I could go get one now, but the cord could clear customs at any moment, plus my wife arrives in two days. This is a pickle. Called FedEx, they’re completely useless in this situation.

Wednesday passes, no cord. I hate writing on an iPhone and a notebook. 4-1/2 days gone, 15 pages written, all on an iPhone, using my teeny keyboard and a dumb dictation app that keeps misspelling every other word.

Thursday arrives. Same status. My power cord is still held up in the clearance process! It’s hard to express my anger. Checked the package status all day, same stupid message. At this point, I hate FedEx, I hate Mexican customs people, I hate writing, I hate my neighbors, I hate the sun, I hate ocean waves, I hate everything. Believe it or not, I’m a positive guy. Eventually I get over it. My wife arrives in less than 24 hours. She’ll rescue me again, this time with a power cord.

Thursday ends. Friday arrives. I’m juiced! My wife will arrive today! She’ll bring her pretty self and she’ll bring me a power cord! She arrived in the afternoon, with a power cord in hand. All seemed right with my world again.

Week one was over. Progress: 25 pages on an iPhone. Package still stuck in customs. On to next week…

Writing UNSECURITY Journey – UPDATE

A series of posts dedicated to the journey of writing my first book, Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?

This is just a quick update post. After the planning article, I thought I should take my own advice and plan out the rest of the series for you. Eating my own dog food, isn’t that what they say?

This is the entire series:

Finally, after the series is completed, I will wrap all the posts into one and make it a free ebook for anyone who’s interested.

That’s it for this update. Now you know what to expect. Hope you enjoy!

Subscribe if you want to follow along. The subscribe button on the top of the right pane works like a charm!

Writing UNSECURITY Journey –Planning

A series of posts dedicated to the journey of writing my first book, Unsecurity: Information security is failing. Breaches are epidemic. How can we fix this broken industry?. This is the fourth post in the series.

The others…

Once I had the idea for the book and found the courage to write one, I started planning. Honestly, I had no idea what I was planning at the time, but I think I was pretty good at faking it.

Planning

If you’re going to write a book, you need to have a plan. You could do what I did. I thought I had a plan, but I later found out that I had no clue. One word sums up my plan, naïve. I was naïve to think that writing a book would be simple, and I was too proud to ask someone for guidance.

Here’s the deal. I had zero experience writing books. What would make me think that I knew what it takes to write a book? The answer is pride. I got this! So, I planned like any cavalier neophyte would. I didn’t.

Well, that’s not entirely true. I did plan one thing. I planned time off to write. I set aside two full weeks to write the book. I would take two weeks, write the book, and life would be grand. After that, I’ll just give the book to our marketing team, and they’ll come back with a finished, published book. Simple, right?

Except that’s not how it works.

First off, you don’t write a book in two weeks. Not this kind of book anyway. Maybe it’s been done somewhere before by someone with super special powers, but normal people don’t write books in two weeks. Normal people take months, and even years to write a book.

Second, there’s a helluva lot more to writing a book than writing. It’s a pipe dream to think that I could write a book, go away for some period of time, and voila, a published book.

I sort of had a plan, but my planned sucked.

If would have taken the time to stop, ask questions of other authors, and listened to what they had to say, I would have known to plan much better than I did. The lack of planning led to unrealistic expectations of myself and others. It made the journey less pleasurable than it could have been. Don’t get me wrong, writing this book was an amazing experience, it just could have been amazinger.

Some of the things I didn’t know, and I wish I would have asked a fellow author about:

  1. How long it takes to write a book?
  2. How long should a book like mine be?
  3. What comes after writing a book draft?
  4. How much fighting with myself that I’d have to endure?
  5. How to overcome the times of despair?

There’s probably more, but you get the gist.

My (naïve) Plan

Get this. I was dumb enough to think I could write a book in two weeks! The notion started with a discussion I had with a colleague who suggested that I take two weeks off, get away, and write the book. He said that I’d probably knock most of it out if I was able to get in a quiet place and focus. There’s a problem with this advice, it was given by someone who’d never written a book before. If only I had known.

So, I booked two weeks away in Cancun to write. The first week, I would be completely by myself. I would be in isolation so I could write. The second week, I would be joined by my wife and my 13-year-old daughter. In the second week, I would write all day and spend the late afternoons and evenings with my family. Sounds like a helluva plan!

My goal was to have my draft completed before I was going to leave on vacation in March. This means the plan was to start writing the book on January 6th, 2018 and complete the first draft 76 days later on March 23rd, 2018. Piece of cake.

I would later learn, sometime in April, after the draft was completed, that writing a book like this in 76 days was insane! Why did I learn this later? Pride kept me from asking anyone.

Your Planning

I learned some things about planning and book writing (now), and I hope you learn from my mistakes. Here’s a shortlist of tips for you as you begin planning your first book (or even latter ones):

Ask for advice. Don’t think you know how to do something that you’ve never done before. An experienced author would have told me what to expect, would have helped me plan better, and quite frankly would have helped me create a better book.

Planning to write is only one part of planning a book. Set aside time each day. The time you set aside is sacred writing time. Writing only. Even if you don’t feel like it some days, fight through it. Even if you just sit there staring at the screen, it’s still set aside writing time.

Other planning that I didn’t do, that I most certainly will do next time:

  • Marketing the book. I think book marketing should start before you start writing. Think about who’s going to find value in your book, who’s going to read your book, and how you’re going to reach them with a message that will get them to buy your book. This a bigger plan than you think, and you’re probably going to need some help.
  • Publishing. Who’s going to publish the book? If you’re going to self-publish, you might want to read up on what this all entails. If you’re going to engage a publisher, it probably makes sense to identify potential publishers now. Publishers will cost you money, so a budget should be created. Identifying and engaging a publisher can be a project by itself. Once engaged, they will help with other parts of your plan.
  • Other help. What other help might I need, how will I find them, how much will it cost, and when will I need them? Will I need a ghost writer, one or more editors (yes), one or more proofreaders (yes), a book designer, etc.? How about endorsements? If your planning to work with a publisher, they can help you with most of these things. If your self-publishing, you’ve got more research to do.

Establish a rough timeline. I don’t suggest that you try to write a book in 76 days, or less. I suggest you find someone who can coach you and help you set appropriate expectations. Deadlines are good for some people and sticking to a timeline works. For others, deadlines and timelines only add unnecessary stress. Turns out, it’s not necessarily how much I write each day that matters as much as that I write each day.

WARNING: Don’t use planning as an excuse for writing. At some point, it’s time to write.

Advice

Don’t make the same mistake I did. If you’ve never written a book before, ask someone for advice, preferably someone who has written a book before. My failure to seek advice led to a very unhealthy 76 days, and it also led me to write twice as much content than I needed. The stress in writing a book in such a short period of time is grueling, and writing twice as much as I needed was just wasted effort.

I didn’t discover that my timeline was unrealistic or about the wasted effort until I finally asked someone who knew. My original 500+ pages in the draft wound up being 288 pages in the published book. Ugh!

Writing UNSECURITY Journey – Encouragement

A series of posts dedicated to the journey of writing my first book, UNSECURITY. This is the third post in the series. The other two posts in the series are the Introduction and The Idea. As I continue to expand this series, I will add a table of contents. This will make it easier for everyone to follow.

Introduction

The first time I thought of writing a book was four or five years ago. It was an idea, but it wasn’t a serious one. It wasn’t until late 2017 that the idea became more than that. What I was lacking was encouragement.

I’m sure that there are authors who have written books with little or no encouragement, but not this guy. Being an author takes independence, but not isolation. For me, I needed someone to convince me to act on my idea, to lift me up when I didn’t feel like writing anymore, to help alleviate my fears, to impart wisdom, and someone who would sacrifice something with me.

Some of these things were stated in the book’s Acknowledgements, but here I’m stating them for a different purpose. I want to be honest with you, give examples of encouragement during my book writing struggles, and hopefully inspire you to write yourself.

James Williams

There’s plenty of backstory, but it was late 2017 when James told me that I must write a book. At the time, James was the president of FRSecure and SecurityStudio. He played (and plays) a critical role in our business success. If you know James, he’s not the sort of guy that takes no for an answer. Because of his passion and personality, I had no choice but to listen. So, I did.

James is bought in to our mission, to fix the broken information security industry, so he’s also someone that I trust. Long story short, James got my attention and encouraged me to write. He also made several suggestions along the way, gave me the book The War of Art by Steven Pressfield (highly recommended) to read, gave me time to write, and set deadlines.

All these things were great, but it was the encouragement that made the difference.

My Wife

Obviously, this short list of people who encouraged me is not in order of importance. If it were, then my wife would have been listed first. My wife sacrificed time, put up with my grumpiness, and partnered with me as only a wife can. There were many mornings that I was up at 3:00am to write. Getting up at 3:00am each morning, came with consequences. Despite the consequences, my wife continued in her unwavering encouragement. She always saw the bigger picture and helped me see it too.

She encouraged me and built me up all along the way.

Suzy Fiene

Suzy was my book buddy. She has years of experience in writing and marketing. She was the perfect fit to help me throughout the book writing process. Despite all her skills and experience, it was her encouragement that mattered most.

Co-workers

Writing a book, especially on a short timeline, is a grueling effort. Don’t think for a second that it doesn’t affect other parts of your life, including the relationships you have with your co-workers. This was true with me. At work, we’re a team and we’re a family. My team and my family always deserve my best, and the time that goes into book writing is less time with them. During the book writing process, my co-workers didn’t get the best out of me. Some (or a lot) of me when into the book.

Time and time again, my co-workers encouraged me and showed a genuine excitement for the book.

Others

The list of other encouragers is long, and I won’t be able to list them all. I encourage you to read the Acknowledgements section of the book, because you’ll find some of these people listed there. From my publisher, to ghost writer, to editor, to proofreader, to designer, and on and on. The role that each of these people played in the book will be covered in subsequent posts within this series. The process for me wasn’t as straightforward as it may seem. If each person didn’t play their role, the book wouldn’t be what it is.

Advice

Whether you want to write a book, or if you’re in the middle of a book, you’re going to need encouragement. Find the encouragers and listen to them. If you encounter a critic or two (or ten) along the way, ignore them and run to your source(s) of encouragement. If you have trouble finding someone to encourage you, I will. Get in touch with me.

Next post is about planning. A book requires time to write and making time requires planning. After writing, comes all the other things that go into book production, and those things all need plans too.