There’s a nice article at the Smithsonian about the difference between riddles and mysteries. I received this via the security metrics email list.

Risks and Riddles

This reminds me of intelligence work, for obvious reasons.

There are 2 major types of offensive actions an army can conduct: deliberate attack and movement to contact. (Yes, those of you pedantic enough will bring up hasty attacks and a dozen other scenarios, I’m being a generalist here =) )

In a deliberate attack, you know roughly what the Bad Guys are doing–they are defending key terrain. The task for the intelligence people is to find specific Bad Guy battle positions down the the platoon level. This is a puzzle with a fairly established framework, you are interested in the details.

In a movement to contact, you have a very hazy idea that there are Bad Guys out there. You move with an eye towards retaining flexibility so that you can develop the situation based on what you learn during the mission. The task for the intelligence people is to determine the overall trend on what the Bad Guys are doing. This is a mystery, and you’re more concerned with finding out the overall direction than you are with the specifics–they’ll get lost due to “friction” anyway.

Now translated to information security, there is some of what we know about the Bad Guys that is static and therefore more of a puzzle–think about threats that have mature technologies like firewalls, Anti-virus, etc to counter them. Solutions to these threats are all about products.

On the other hand, we have the mysteries: 0-day attacks, covert channels, and the ever-popular insider threat. Just like a well-established military has problems understanding the mystery that is movement to contact, information security practitioners have problems responding to threats that have not been well-defined.

So information security, viewed in the light of puzzle v/s mystery becomes the following scenario: how much time, effort, and money do we spend on the puzzles versus how much time do we spend on mysteries? The risk geek in me wants to sit down and determine probabilities, rate of occurance, etc in order to make the all-important cost-benefit-risk comparison. But for mysteries I can’t, by definition of what a mystery is, do that, and our model goes back to peddling voodoo to the business consumers.

Bookmark to:

Hide Sites

Hey, makes sense to me. If you’re a sovereign nation, you have a right to manage the radio spectrum above your territory, no matter how large or small the territory is.

The BOFH in me thinks it’s a perfect unintended consequence of the white man’s greed hundreds of years ago. =)

Manitoba Chiefs Want Cellphone Revenue

Bookmark to:

Hide Sites

“When I was a kid, I wasn’t a criminal but I sure did some things that I could have been sent to jail for.” –George H

George was my squad leader back in 1998.

I think it’s still apropos, only today instead of poaching salmon and doing unnatural acts with firecrackers, the kids have computers. =)

Bookmark to:

Hide Sites

Why wait until the zombie outbreak to figure out what your response will be?  Why not start training now?
Kevan Davis has written a very good web-based MMORPG called Urban Dead.  I’ve been playing it for about 3 weeks now, although the game has been live for over 2 years.

What’s amazing to me is that the game has roughly 38K players and has a HUGE amount of user-created content on it’s wiki.  In addition to that, each player group has their own forum that they maintain.  That places the game squarely in the “cult” category. =)  Try it, it’s lots of fun.

Skills you will need for the upcoming zombie pandemic:

• Barricade buildings to keep the zombies out
• Revive zombified buddies
• Heal your friends that have been bitten and infected with zombie mojo
• Kill the zombies that are in your well-barricaded building
• Dump the corpses outside so they don’t come back as undead inside your building

Inside the wiki, there are fantastic guides that tell you how to survive in the zombified streets of Malton.  I recommend you read up on these and incorporate them into your zombie pandemic response plans.

Bookmark to:

Hide Sites