Posts

UNSECURITY Episode 129 Show Notes

We have another great guest for episode 129, and we’re excited to get his take on things!

Special Guest – Ron Woerner

In this episode of the UNSECURITY Podcast, we’re joined by another good friend of ours, Ron Woerner.

Ron and I (Evan) first met at the RSA Conference last year (2020) after being introduced to each other by Ryan Cloutier, another good friend. Ron is a no nonsense, plain English-speaking information security expert with a heart for helping people from all walks protect themselves better. I love this guy and I’m excited to chat with him on the show!

Things about Ron:

We’re in for a treat in this episode!

Other Guests – Past, Present, and Future
  • Episode 128 Special Guest – Roger Grimes (0n 4/20)
  • Episode 129 Special Guest – Ron Woerner (this week)
  • Episode 130 Special Guest – John Strand (on 5/4)
    • Believe it or not, I have never met John in person. Despite running in some of the same circles for many years, this will be the first time I meet him.
    • John also has a laundry list of accomplishments. He’s the Founder and Owner of Black Hills Information Security, Senior Instructor with the SANS Institute, teaches SEC504: Hacker Techniques, Exploits, and Incident Handling; SEC560: Network Penetration Testing and Ethical Hacking; SEC580: Metasploit Kung Fu for Enterprise Pen Testing; and SEC464: Hacker Detection for System Administrators. John is the course author for SEC464: Hacker Detection for System Administrators and the co-author for SEC580: Metasploit Kung Fu for Enterprise Pen Testing. He’s also presented at the FBI, NASA, NSA, DefCon, and lots of other places.
  • Episode 131 Special Guest – Chris Roberts (on 5/11)
  • Episode 132 Special Guest – Gabriel Friedlander (on 5/18)

Lots of GREAT conversations with lots of GREAT information security folks!


SHOW NOTES – Episode 129 – Tuesday April 27th, 2021

Recorded Monday April 26th, 2021

Opening

[Evan] Welcome listeners! Thanks for tuning into this episode of the UNSECURITY Podcast. This is episode 129, and the date is April 27th, 2021. Joining me is my good friend, solid partner, and and top infosec expert Brad Nigh. Welcome Brad!

Also joining the UNSECURITY Podcast is our special guest, Mr. Ron Woerner! Welcome Ron. It’s an honor to have you on our show!

Introducing Ron Woerner

It’s great to have Ron on our show! He gets information security and he always has an interesting perspective on things.

  • Open Discussion.
  • Top of mind things.
  • Current projects.
  • Current events.

Pretty sure we’ll get to talk about Ron’s talks at RSA, his work/lectures at Bellevue University, social engineering things, information security as a life skill, and other goodies!

News

We’ll probably skip news in this show. Guessing that Brad, Ron, and myself will have no problem filling the entire show with good discussion.

Wrapping Up – Shout Outs

Who’s getting shout outs this week?

Thank you to all our listeners! HUGE thank you to Ron for joining us. If you have something you’d like to tell us, feel free to email the show at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @evanfrancen, and Brad’s @BradNigh.

Ron can be reached on LinkedIn, Twitter (@RonW123), and other places he’ll probably share during the show.

Other Twitter handles where you can find some of the stuff we do, UNSECURITY is @unsecurityP, SecurityStudio is @studiosecurity, and FRSecure is @FRSecure.

That’s it. Talk to you all again next week!

…and we’re done.

UNSECURITY Episode 128 Show Notes

Oh boy. Chalk last week up as “the lost week”.

I live in a suburb of Minneapolis, Minnesota (MN). The same Minneapolis, MN where George Floyd died last May, sparking civil unrest around the world. The same Minneapolis, MN where the eyes of the world are anxiously awaiting the verdict in the trial of former police officer Derek Chauvin, charged with second-degree murder in George Floyd’s death. The same Minneapolis, MN where Daunte Wright lost his life on April 11th, at the hands of 26-year veteran police officer Kimberly Ann Potter.

Minneapolis seems like ground zero for crazy.

Me being me, I don’t like when things don’t make sense. Despite knowing it’s best to let some things go, I decided to embark on a journey of self reflection and sense-making.

The result?

I learned how I process things. I learned I love people. I learned I’m not crazy. I learned we have significant problems facing our society, and not enough people willing to solve them. Even worse, the leaders we elect to solve problems, selfishly use problems to score popularity points and ignorant votes. If our leaders wanted to solve problems, they would. Simple as that.

More to come, but we have a podcast to do!

Special Guest – Roger Grimes

In this episode of the UNSECURITY Podcast, we’re joined by a good friend, a bona fide information security authority, renowned author (of 12 books), and all around awesome human being, Roger Grimes. This is a man I respect deeply and hold in very high esteem. We are information security kindred spirits in a way, and we’re honored to welcome him on our show!

Things about Roger:

  • LinkedIn Profile – https://www.linkedin.com/in/rogeragrimes/
  • Information technology and/or information security expert since the mid-late 1980s
  • Written more than 1,200 national magazine articles on information security and was the weekly computer security columnist for InfoWorld/CSO magazines from 2005 to 2019
  • His “goal in life is to get more people and companies to use data and the scientific method to improve their computer security.” He goes on to state, “If I leave this world without having made the Internet a safer place for all people to compute, I have failed.See, my kind of guy!
  • Spent more than 11 years as Microsoft’s Principal Security Architect.
  • Written 12 books (and working on two now), including:
    • Hacking Multifactor Authentication
    • Cryptography Apocalypse
    • A Data-Driven Computer Defense
    • Hacking the Hacker
    • Malicious Mobile Code
    • And more…

Seriously dig this guy, and pumped that he’s joining us this week!

Other Guests Coming

Roger is our first special guest in a series of special guests. We might keep hosting special guests indefinitely. Here’s what’s coming soon:

  • Episode 129 Special Guest – Ron Woerner
    • I met Ron through my good friend Ryan Cloutier, and I’m very grateful for it.
    • Ron has a laundry list of accolades. He’s the CEO and President of Cyber-AAA, Professor of CyberSecurity Studies at Bellevue University, featured speaker at the RSA conference for more than 12 years, and much more.
  • Episode 130 Special Guest – John Strand
    • Believe it or not, I have never met John in person. Despite running in some of the same circles for many years, this will be the first time I meet him.
    • John also has a laundry list of accomplishments. He’s the Founder and Owner of Black Hills Information Security, Senior Instructor with the SANS Institute, teaches SEC504: Hacker Techniques, Exploits, and Incident Handling; SEC560: Network Penetration Testing and Ethical Hacking; SEC580: Metasploit Kung Fu for Enterprise Pen Testing; and SEC464: Hacker Detection for System Administrators. John is the course author for SEC464: Hacker Detection for System Administrators and the co-author for SEC580: Metasploit Kung Fu for Enterprise Pen Testing. He’s also presented at the FBI, NASA, NSA, DefCon, and lots of other places.

We’re finalizing details with guests for episode 131 and 132 too. Lots of GREAT conversations to come!

Let’s get right to it, show notes for episode 128 of the UNSECURITY Podcast…


SHOW NOTES – Episode 128 – Tuesday April 20th, 2021

Recorded Friday April 16th, 2021

Opening

[Evan] Welcome listeners! Thanks for tuning into this episode of the UNSECURITY Podcast. This is episode 128, and the date is April 20th, 2021. Joining me is my good friend, great guy, and infosec expert Brad Nigh. Welcome Brad!

Also joining the UNSECURITY Podcast is our special guest, Mr. Roger Grimes! Welcome Roger. It’s an honor to have you on our show!

Introducing Roger Grimes

Some of our listeners may not know Roger. That’s about to change! He has a fascinating information security mind, and we’re all sure to learn some things.

  • Open Discussion.
  • Top of mind things.
  • Current projects.
  • Current events.

Roger and I first met through a friend, Steve Marsden, a few years ago. Almost immediately it became clear that we see information security the same way. Soon after our first conversation, I flew out to see Roger give his talk at the RSA conference and have lunch with him and his wife. It confirmed that he is the “real deal” and I flew on to my next destination immediately after lunch. Since then, we’ve kept in touch, and he even served on SecurityStudio’s board of directors for a time.

This will be a fun conversation, guaranteed!

News

We’ll probably skip news in this show. Guessing that Brad, Roger, and myself will have no problem filling the entire show with good discussion.

Wrapping Up – Shout Outs

Who’s getting shout outs this week?

Closing – Thank you to all our listeners! HUGE thank you to Roger for joining us. If you have something you’d like to tell us, feel free to email the show at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @evanfrancen, and Brad’s @BradNigh. Roger, where would you like people to connect with you? (his Twitter handle is @rogeragrimes). Other Twitter handles where you can find some of the stuff we do, UNSECURITY is @unsecurityP, SecurityStudio is @studiosecurity, and FRSecure is @FRSecure. That’s it. Talk to you all again next week!

…and we’re done.

UNSECURITY Episode 126 Show Notes

Here we are, time for another episode of the UNSECURITY Podcast.

I came across another interesting article this week, “15 Cybersecurity Pitfalls and Fixes for SMBs“. I have a heart for underserved markets, and small to mid-sized businesses (SMBs) are certainly an underserved (or poorly served) market.

NOTE: The other underserved markets I’m especially interested in are state/local government, education (higher education & K12), and individual consumers.

This is a perfect time to talk about SMB information security. As we come out of COVID (Lord, I hope we are!), more and more SMBs are getting back on their feet. As they start on this next (or first) chapter of their SMB journey, it’s imperative they take information security seriously and do things right. The last thing anyone (except for attackers) wants is to start building/rebuilding a business with limited resources only to lose everything from an attack.

Looking forward to dissecting this with Brad on this episode!

Let’s get right to it, show notes for episode 126 of the UNSECURITY Podcast…


SHOW NOTES – Episode 126 – Wednesday April 7th, 2021

Opening

[Evan] Welcome listeners! Thanks for tuning into this episode of the UNSECURITY Podcast. This is episode 126, and the date is April 7th, 2021. Joining me is my good friend, great guy, and infosec expert Brad Nigh. Welcome Brad!

Another good show today. We’re gonna talk about this article I came across the other day. The title of the article is “15 Cybersecurity Pitfalls and Fixes for SMBs”.

15 Cybersecurity Pitfalls and Fixes for SMBs

This article features a roundtable discussion between Timur Kovalev, CTO of Untangle, Erich Kron from KnowBe4 and Greg Murphy, CEO of Order. They give their take on what SMBs think about information security, the common mistakes they make, and how to do thinks better.

As you know, we have no shortage of information security “experts” in our industry. Let’s see if we agree, disagree, and/or have something to add to this discussion.

  1. Think they’re too small to be a target.
  2. Haven’t made a thorough asset inventory assessment.
  3. No network segmentation.
  4. Ignore fundamentals.
  5. Haven’t done a business risk evaluation.
  6. Insecure digital assets.
  7. Don’t know what “normal” activity looks like.
  8. No 2FA.
  9. Misconfigured cloud servers/confusion about move to the cloud.
  10. User security training.
  11. Haven’t evaluated their threat to the supply chain.
  12. Lack of business continuity plan.
  13. Aren’t thinking strategically about asset allocation and budgeting.
  14. Failing to backup.
  15. Lax patching.

NOTE: This is not our list, this is the list from the article.

If you had to pick your 15 most common information security mistakes made by SMBs, what would you pick? This will be a good discussion!

News

As of 9:15AM on 4/5/2021, the number of registered students in the FRSecure CISSP Mentor Program is 5,618!

Three interesting news articles this week:

Wrapping Up – Shout Outs

Good talk. Thank you Brad, and thank you listeners!

Who’s getting shout outs this week?

Closing – Thank you to all our listeners! Send things to us by email at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @evanfrancen, and Brad’s @BradNigh. Other Twitter handles where you can find some of the stuff we do, UNSECURITY is @unsecurityP, SecurityStudio is @studiosecurity, and FRSecure is @FRSecure. That’s it. Talk to you all again next week!

…and we’re done.

UNSECURITY Episode 125 Show Notes

A news article caught my eye this morning while getting ready for this episode of the UNSECURITY Podcast.

US Strategic Command Twitter account accessed by child: report

Link: https://www.foxnews.com/us/us-strategic-command-twitter-account-accessed-by-small-child-report

My first thought was “oh, that’s funny and sorta cute.” Then I thought some more. It seems innocent(ish) to walk away from your computer while you’re at home. What could happen? Well, this could happen, but it could have been much worse!

This is the Twitter account of the U.S. Strategic Command (“USSTRATCOM”). For those of you who don’t know what USSTRATCOM is, or what they do, here’s information from their “About” page:

“USSTRATCOM integrates and coordinates the necessary command and control capability to provide support with the most accurate and timely information for the President, the Secretary of Defense, other national leadership and combatant commanders.

The mission of USSTRATCOM is to deter strategic attack and employ forces, as directed, to guarantee the security of our Nation and our Allies. The command’s assigned responsibilities include strategic deterrence; nuclear operations; space operations; joint electronic spectrum operations; global strike; missile defense; and analysis and targeting. USSTRATCOM’s forces and capabilities underpin and enable all other Joint Force operations.

USSTRATCOM combines the synergy of the U.S. legacy nuclear command and control mission with responsibility for space operations, global strike, and global missile defense. This dynamic command gives national leadership a unified resource for greater understanding of specific threats around the world and the means to respond to those threats rapidly.”

Sounds pretty damn important! Social media is used by organizations (public and private) to disseminate information to the public and their customers. What if the information disseminated is harmful to others? In this particular case, a child typed “;l;gmlxzssaw”. The message was broadcast all over the world and caused a stir. Caused a stir, but not panic.

What if this wasn’t a child and/or the message was more nefarious. What is someone typed:

“The United States of America is under current attack. The President has raised our alert condition to DEFCON 1. THIS IS NOT A DRILL. DO NOT panic, but please be aware. Additional details forthcoming, including further instruction for protection of U.S. citizens and our assets.”

Now, you may know that USSTRATCOM would never issue such a warning on Twitter, but do others? Even if others do know this, you’ve seen how some people throw logic and reason out the window when something panicky happens, right? What if the alert was more thought out with direct instructions to do certain things that could be destructive. Would this cause a panic? On the surface, this particular instance may seem funny. In reality, it’s sad. It’s sad that people often use computers without thinking of consequences and that we are STILL trying to get people to lock their computers when they step away.

Anyway, we’ve got a show to do. Let’s get right to it, show notes for episode 125 of the UNSECURITY Podcast…


SHOW NOTES – Episode 125 – Tuesday March 30th, 2021

Opening

[Evan] Welcome listeners! Thanks for tuning into this episode of the UNSECURITY Podcast. This is episode 125, and the date is March 30th, 2021. Back again is my good friend and security ninja Brad Nigh. Welcome Brad!

Another good show today. We’re gonna talk about this FRSecure CISSP Mentor Program think you might have heard about.

FRSecure CISSP Mentor Program

  • What is it?
  • Who’s it for?
  • The history of the FRSecure CISSP Mentor Program
    • 1st class in 2010 – six students
    • 11th class in 2020 – ~2,400 students
    • 12th class this year (2021) – 5,300+ students
  • Why did we start this thing?
  • Why do we keep doing this thing?
  • Next class starts on April 12th (2021)
    • What are we expecting?
    • Who’s teaching?
    • Is there time to sign up still?
  • Is it really FREE?!
    • What strings are attached?
    • Will I be marketed to?
    • Will I be sold something?
    • Will you sell my information?
  • What’s the future of the FRSecure CISSP Mentor Program?
  • Where can I sign up?
  • Can I refer others?
  • What if I’m not planning to take the test?

And whatever other question we can think of. We’ll be transparent as we talk about the program and our experiences with it.

Want to know more? GO HERE: https://frsecure.com/cissp-mentor-program/

News

Three interesting news articles this week:

Wrapping Up – Shout Outs

Good talk. Thank you Brad, and thank you listeners!

  • Who’s getting shout outs this week?
  • Closing – Thank you to all our listeners! Send things to us by email at unsecurity@protonmail.com. If you’re the social type, socialize with us on Twitter, I’m @evanfrancen, and Brad’s @BradNigh. Other Twitter handles where you can find some of the stuff we do, UNSECURITY is @unsecurityP, SecurityStudio is @studiosecurity, and FRSecure is @FRSecure. That’s it. Talk to you all again next week!

…and we’re done.

FRSecure CISSP Mentor Program Welcome Message

Only 46 more days. It’s almost time to start the FRSecure CISSP Mentor Program!

As of yesterday (2/23/21), we have more than 3,500 registered students for the 2021 class. That’s awesome! (and a little nuts) For context, we started the program in 2010 with six students. At the time, FRSecure was a teeny startup (3 employees), but our size didn’t matter. We started with a simple goal:

Provide quality information security training for free.

No strings. No ulterior motive. No marketing gimmicks. Nothing but helping people on their journey.

Why this goal?

We love people. By proxy, we love people in our industry, and by (another) proxy, we love the people served by our industry. Our mission (“to fix the broken industry”) is born from and rooted in love, and we will always do right by our mission. Makes sense, yeah? We’re all #MissionBeforeMoney around here!

Fast forward, this will be our 12th consecutive year. We’ve been a positive influence (to one degree or another) in the lives of more than 6,000 people through the CISSP Mentor Program in the past two years alone (3,500+ students this year so far, 2,400+ students last year). Everyone is welcome here, regardless of background, experience or education. If you don’t want to take the CISSP exam, or don’t feel ready, join us anyway. You’ll learn more about information security, and maybe you’ll pick up some life skills along the way!

Welcome Message

Posted in the 2021 CISSP Mentor Program Study Group on 2/19/21:

Hello 2021 FRSecure CISSP Mentor Program Class,

I’m Evan Francen, the founder and CEO of FRSecure (and SecurityStudio) and one of the instructors here. We’ll get to know each other once class gets going, but I wanted to introduce myself now and welcome you.

Welcome to the 2021 FRSecure CISSP Mentor Program!

I’m excited that you’re here and honored to be part of your journey.

A little history…

In 2008, we started FRSecure with this mission:

To fix the broken information security industry.

Our mission came from a deep passion to do things right and serve others. You see, information security isn’t about information or security as much as it is about people. People cause the havoc (intentionally or accidentally) and people suffer the consequences. If nobody suffered, nobody would care.

The information security industry is still young. There’s no shortage of work to do, and the sooner we get to work on the right things, the better off everyone will be. Two things are at (or near) the core of our information security industry problems:

  • People take advantage of other people. If there was a single motivator for me, this would be it.Attackers – people who don’t hide their intent to do others harm. Most people think we’re only concerned about the attackers, but there’s much more.Frenemies – people in our industry who sell products and services that are not in the best interests of the buyer and/or do not do what they claim.
    • “Experts” – yes, in quotes. There are people in our industry who are in it for the wrong reasons. They are motivated by selfishness and not to serve others. This wouldn’t seem so bad, but most of these people are charged with securing information that does not belong to them. Inflated egos intimidate and discourage others, ignorance leads to poor decisions, comfort leads to inactivity, etc., etc.
  • Information security fundamentals are not universally understood or applied. This is true in the public sector and private industry. It’s also true at home. If we (as an industry) mastered the application of fundamental information security concepts, we’d reduce the number of breaches by as much as ~80-90% (my conservative estimate) and significantly reduce the impact to society.

Fixing these problems is certainly easier said than done, but the pursuit continues…

So, where does the FRSecure CISSP Mentor Program fit in this equation, and what does it mean for you?

Simple. Our industry needs more good information security people. We need you!

The FRSecure CISSP Mentor Program was born out of our mission. In our first year (2010), there were six students. All six students went on to pass their exams and became CISSPs. Today, they are all working in our industry and making a positive difference in the lives of others. Last year was the 11th consecutive year for the program, and we had more than 2,400 registrations. It’s been an incredible experience for us, and for me personally. We do this because we love people, and we do it for no other reason. No strings, just #MissionBeforeMoney!

The 2021 CISSP Mentor Program

We’re sticking with the formula that works. Due to COVID still being COVID, we will once again teach all classes remotely. We’ve already surpassed last year’s record number of student registrations, and we’re on track for more than 5,000! This will be the best class yet, and I’m VERY excited to get to know some of you along the way! You’ll see me and some of the other FRSecure folks drop in here (the study group) from time to time. We’re here to help you as much as we are able (given day job and family stuff).

Once again, welcome! Thank you for letting us be part of your success. In know I speak for the other instructors (Brad Nigh and Ryan Cloutier) and the entire FRSecure team when I say that.

Let’s do this!

If you’ve thought about signing up, but haven’t yet, go do it. If you know somebody who could use some of this, tell them about it. See, more simple!

Information Security Isn’t About Information or Security

NOTE: Throughout this article, I’ll refer to “we” and “us”. This collective is defined as me, FRSecure employees, SecurityStudio employees, our families, our customers, our partners, and everyone else who thinks in similar ways.

We have a strong belief that:

Information security isn’t about information or security as much as it is about people.

The fact is, if people didn’t suffer when things go wrong (cybersecurity incident, data breach, etc.), then nobody would (or should) care. Obviously, people do suffer, and we DO care.

There’s a second point related to our belief, it’s the fact that people (NOT technology) pose the greatest risk (to themselves and to each other). Technology only does what we tell it to do, but it’s people who tell technology to do the things that are risky (click links, download files, misconfigure settings, etc.).

We’ve held fast to this belief for years, and it’s not just a catchy saying. This is a deep belief we apply every day, in all that we do. For example, our sales team only sells what people need*, our analysts pour their heart and soul into every project, we’re committed to being product agnostic, and we always sleep well knowing we did right by the people who count on us.

*A rumor has been circulating for years at FRSecure; if you sell something that a customer doesn’t need (i.e. money-motivated BS solutions) I’ll run you over with my truck. I want to dispel this rumor. I will NOT run you over with my F250 (officially). Unofficially, this is a good rumor. For the record, I’ve never run anyone over (yet).

Why am I bringing this up again, and why now? Simple, I think it’s relevant.

People who love other people make the best information security people.

When making information security decisions, it’s important to feel the weight of those decisions. Especially when the information you’re protecting isn’t yours, meaning you’re not the one who suffers when it’s lost or stolen.

Relevance to Current Events

We’ve lived our belief (about people) for years, and it’s as relevant today as it’s ever been. People are suffering, directly and/or indirectly from the results of information security incidents. These are people from all walks, regardless of race, religious beliefs, economic backgrounds, political affiliations, or sexual or gender preferences.

Risk doesn’t discriminate, and neither do threats (attackers).

This is true in general terms. There are always specific threats targeting specific groups; however, in general, risk by itself doesn’t discriminate. Even if you’re not specifically targeted, you’ll still encounter some degree of consequence. In today’s world, most of us are digitally connected. In fact, most of us are digitally connected through a mesh of associations; networks, applications (SaaS platforms, social media, online shopping, and other shared services), etc.

The truth is we are all at risk, and people DO suffer. When people suffer, we shouldn’t roll over an take it. We all should get a little (or a lot) pissed off! People taking advantage of others should raise an ire in all of us. Playing the victim helps no one.

Beyond the non-discriminatory nature of information security, there’s additional relevance related to focus, emotions and lack of personal accountability.

Focus

While we’re focusing on VERY legitimate racial injustices in our society, the attackers are still attacking. Attackers know that we’re not paying as much attention to them, and they’re crafting attacks that are more likely to succeed given our emotional state.

Attackers are taking down (DDoS) local and state government websites and services, using language like “Black Lives Matter”, “Peaceful Protest”, and “Support Racial Injustice” as click bait (opposed to legitimate causes), and setting up fake fundraising sites to lure people into giving money for fake causes.

Attackers always use current, well-known, and emotion-laden events to take advantage of panic, fear, and compassion. The attacks happen every time these types of events, and it’s because they work. The attacks work so well that attackers don’t even bother changing their tactics.

Do your best to maintain (at least some) focus on information security. Easier said than done for some of us, but you can do it if you try!

Emotions

When emotions run high, we are quicker to react, and more likely to find ourselves in bad situations. This is due to the way our brain works. Our left brain is more pragmatic and tells us to act logically, while our right brain tells us to follow our heart. In a “normal” state, the left brain and right brain wrestle for control of a decision and the result is a compromise between the two. In highly emotional states, the right brain tends to dominate our decisions and logic takes a back seat. We think less and react more.

People are beautiful. Human beings are delicate and intricate systems, yet we come with this magnificent resilience that seems to defy logic. Most (or maybe it’s many, I don’t know) of us posses empathy, compassion, and love that are interwoven perfectly together. While these things are true, sometimes our emotions get the best of us, and we do things we wouldn’t normally do. It almost seems like things get a little jumbled when we’re in a highly emotional state.

There are at least two important tendencies that are more common for us when we’re in a highly emotional state:

  1. We make more mistakes. In our rush to act, we’re more likely to act before thinking things through to a logical conclusion. The right brain sorta kicks our left brain’s ass.
  2. We open ourselves more to manipulation. If an attacker knows you’re in a highly emotional state, it’s easier to use these emotions against you. Let’s say that you’re torn up about racial injustice. You feel the need to do something about it, driven by your deep compassion for others. If an attacker makes up a compelling story about how you can help right some of the wrongs in our society, don’t you think you’d be more likely to act on it? In a less heightened emotional state, you might be more logical about it the decision to help, be skeptical, and even do some research first.

If you can learn to recognize where your decisions are coming from, you’ll be better prepared to make good decisions. This takes self-discipline and honest introspection. For the time being, it might make sense to put off important decisions until after you’ve had time to process your emotions. Maybe take some time off.

Personal Accountability

During tense and emotional times, there is a much stronger desire to hold people accountable (for something or anything). We’re quicker to assign blame, point fingers, and lash out at anyone we perceive to be going against our personal version of right. This is true in societal issues like racial inequality and to some extent it’s also true with information security. In our rush to hold someone externally accountable, we lessen (even more) our own personal accountability.

Sadly, a great number of people think that their information security is somebody else’s responsibility. The truth is, you’re the one who’s primarily responsible for your own information security, privacy, and safety. Nobody cares about (or should care about) your information security more than you. If information security doesn’t motivate you, maybe your privacy will. If that still doesn’t work, maybe your own safety, and the safety of your loved ones will motivate you to act. In today’s world, safety, privacy, and information security can’t be separated.

Sure, there are others who play a role too, but you are responsible for all parts of information security for which you can control. You can control what your children are accessing online. You can control patching of your home network equipment. You can control which passwords you choose, what applications you run, and which websites you visit for entertainment.

What to Do

So, I covered a lot of stuff. Mostly educational stuff. Now, the practical stuff (hopefully).

The best thing you and I can work on is our habits. If we take the time to learn and form good information security habits, we’ll be in a much better spot to protect ourselves from attackers, especially in light of world-shaking events. Habits form a mindset of default actions, and default actions form a baseline that’s less likely to change, even in response to high stress situations.

In Organizations

Develop an information security program that fits with your culture and master the fundamentals. A good security program is built around risk management and risk management starts with:

  1. An intimate understanding of what “risk” is.
  2. Management commitment, not just endorsement.
  3. An objective and measurable risk assessment.
  4. A roadmap built from the unacceptable risks discovered in the risk assessment.
  5. Execution of the roadmap using creative solutions and processes that fit your culture.
  6. Re-assessment and repetition. This builds the habits.

If your information security program is counter-culture it won’t result in good habit forming. If you can’t secure management commitment, you’re just going through the motions.

At Home

You are the CEO at home, you make the calls, and you are ultimately responsible. The same process outlined above for businesses applies at home. You will need management commitment (you), an objective and measurable risk assessment (see below), a roadmap for improvements, action to implement the improvements, and repetition.

At SecurityStudio we’ve built all of these steps into a simple and FREE tool called S2Me. The only thing we couldn’t build into the tool is your commitment. That’s on you.

Quick Conclusion

There’s too much hate in the world, and we don’t want to make problems worse. I can only think of one thing I hate, and it’s people taking advantage of other people. For me, it’s the lowest of the low. Today, we’re witnessing riots all across the country (and world). They’re not about information security, but they’re about people taking advantage of other people. It’s all bullshit, and it needs to stop! Learn and play your role in information security, and don’t let yourself be a helpless victim.