ATO 2019 was a good year.
For a number of years now, each October, thousands of technical folks converge in Raleigh for All Things Open. The "all things" includes a lot of developers talking about opensource platforms, tools, stacks, and applications but it also includes topics on open hardware, open government, open education, and building communities in addition to projects and products.
For a couple of years, I felt there was too much of a programmer focus for me and I wasn't finding new things in the community tracks. It is local though and so with expectations set, I continue to support a great conference and enjoy the hallway track with a number of people I "see" mostly online even though I was not previously finding a lot of talks for my sysadmin or infosec interests.
I know several local people that have not attended the past couple of years because of this trend and I bring it up because this year was a bit different. While I attended expecting to once again content either repetitive (of other years and other conferences) or too dev focused, I was pleasantly surprised. There were full tracks both days for Security and Linux/Infrastructure. [1]
I attended a few of the security sessions, two that stood out were:
Prepping for the Zero Day Attack
Eric Starr discussed a CI/CD pipeline that includes checking for vulnerabilities with both source code analysis and container scanning. He shared experiences where unit tests were disable "to speed up the deployments" which later turned into disasters. He was practical in his approach where some of the scans take hours to run. If the deployment or test cycle is shorter than a day, maybe those scans get run daily instead of with each change but do NOT eliminate them just because they take too long! He mentioned tools that work for his project but regularly pointed out what type of tool it was and that the specific tool used is not important. I would add that the best or right tool is any one you will use though you may be limited by what will work in your environment.
Insecurities and Vulnerabilities: How to Keep the National Vulnerability Database Current
I really enjoyed this one! Rob Tompkins shared his experience reporting CVE as part of an opensource project security team. When I teach about tools such as openscap and Red Hat Insights which include information from the NVD and then suggest remediations, it is helpful to understand how the information gets into this database. This example along with a talk from OSCON years ago about reporting embargoed security issues helps me also explain how an administrator should go about reporting a suspected vulnerability with correct documentation. This is a topic I am now adding to my "write and article on this" list.
Next door, at the Linux/Infrastructure room, by title, I would be interested in Getting Started with Flatpak and possibly Platform Agnostic and Self Organizing Software Packages . Also the What You Most Likely Did Not Know About Sudo… and maybe the Terminal Velocity: Work faster in your shell talks.
With these tracks, I would encourage a few of my more "Ops" friends to rethink attending this conference, especially if they are local to the area. I also have some new ideas for articles to write and possible presentations at future events.
Oh, they also have great book signings scattered across both days!
-SML
[1] Note: at the time of writing the URLs for the tracks were for the current year. At some time in the future these will be replaced with the next year tracks. I do not know if they will be archived. I was able to submit the parent tracks page for the wayback machine.
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Thursday, October 24, 2019
Wednesday, October 23, 2019
Writing Summary - late summer 2019
I've done some (ok, very little) writing for opensource.com in the past and I still have some notes for more articles that keep getting pushed aside. This site is almost 10 years old, community driven (with Red Hat Sponsorship), and tries to cover a variety of open topics, products, projects, and distributions.
This summer, some of the staff from that project switched over to help Red Hat start a new blog for system administrators called Enable Sysadmin. As the name implies it is focused on system administration topics and as a corporate blog it can also be a bit more Red Hat product specific. In addition to a small staff, a few part time contractors, and a number of Red Hat employee contributors, they do accept and encourage community contributions.
I have enjoyed being one of the early authors. Of course, like all my writing projects, I have plenty more ideas in my head and not enough focus to get them organized in a timely manner.
So far I have written two articles about using SSH keypairs, two articles about SELinux, and a short article about cybersecurity awareness month.
How to manage multiple SSH key pairs
Passwordless SSH using public-private key pairs
Accessing SELinux policy documentation
Four semanage commands to keep SELinux in enforcing mode
Security advice for sysadmins: Own IT, Secure IT, Protect IT
-SML
This summer, some of the staff from that project switched over to help Red Hat start a new blog for system administrators called Enable Sysadmin. As the name implies it is focused on system administration topics and as a corporate blog it can also be a bit more Red Hat product specific. In addition to a small staff, a few part time contractors, and a number of Red Hat employee contributors, they do accept and encourage community contributions.
I have enjoyed being one of the early authors. Of course, like all my writing projects, I have plenty more ideas in my head and not enough focus to get them organized in a timely manner.
So far I have written two articles about using SSH keypairs, two articles about SELinux, and a short article about cybersecurity awareness month.
How to manage multiple SSH key pairs
Passwordless SSH using public-private key pairs
Accessing SELinux policy documentation
Four semanage commands to keep SELinux in enforcing mode
Security advice for sysadmins: Own IT, Secure IT, Protect IT
-SML
Friday, June 28, 2019
Red Hat Summit 2019: My notes
My notes from sessions at Red Hat Summit 2019 are for my reference and as documentation for any submitted continuing education credits.
The Ansible party was awesome as usual (even if was a part of the Smart Management party). Great food at Legal Harborside with lots of people I wanted to see.
I'm glad I watched most keynotes remotely. The one I did attend in person reminded me of how cold that space is and how many people where chemical scents that trigger my asthma.
Ran into more cool people at the Red Hat Women’s Leadership Community Luncheon.
Remaining notes include sessions attended as a reminder of which slides or videos to reference for more details as well as topics, commands, and keyword to dig into in the future.
Keynote recordings are available in the YouTube channel.
Session descriptions have links (where available) to slide decks.
On Demand session recordings require a login.
5/7: Red Hat security roadmap : It's a lifestyle, not a product
5/7: The current and future state of security: A discussion of security challenges (Birds of a feather)
5/7: Successfully implementing DevSecOps: Lessons learned
5/7: Security: Emerging technologies and open source
5/8: Top 10 security changes in Red Hat Enterprise Linux 8
5/8: Security and compliance automation: Demos of current capabilities and future technologies
5/9: Red Hat on Red Hat: Transitioning Red Hat IT to hybrid cloud infrastructure using OpenStack and Ceph Storage
5/9: Evolution of a Linux system identity and authentication stack
5/9: A practical introduction to container security using CRI-O (LAB)
-SML
The Ansible party was awesome as usual (even if was a part of the Smart Management party). Great food at Legal Harborside with lots of people I wanted to see.
I'm glad I watched most keynotes remotely. The one I did attend in person reminded me of how cold that space is and how many people where chemical scents that trigger my asthma.
Ran into more cool people at the Red Hat Women’s Leadership Community Luncheon.
Remaining notes include sessions attended as a reminder of which slides or videos to reference for more details as well as topics, commands, and keyword to dig into in the future.
Keynote recordings are available in the YouTube channel.
Session descriptions have links (where available) to slide decks.
On Demand session recordings require a login.
5/7: Red Hat security roadmap : It's a lifestyle, not a product
- Speaker: Mark Thacker, Red Hat
- Slides available
- Recording available
5/7: The current and future state of security: A discussion of security challenges (Birds of a feather)
5/7: Successfully implementing DevSecOps: Lessons learned
- Speakers: William Henry, Red Hat; Deven Phillips, Red Hat, Inc.; Lucy Kerner, Red Hat
- UBI - Universal Base Image
- https://github.com/rht-labs/labs-ci-cd
- Case Study: Homeland Security in Innovative Labs
- Look at pipeline box on Heritage slide.
5/7: Security: Emerging technologies and open source
- Speaker: Mike Bursell, Red Hat; Nathaniel McCallum
- Slides available
- Recording available
5/8: Top 10 security changes in Red Hat Enterprise Linux 8
- Speaker: Mark Thacker, Red Hat
- Slides Available
- Recording Available
5/8: Security and compliance automation: Demos of current capabilities and future technologies
- Speakers: Shawn Wells; Chris Reynolds, Red Hat; Gabriel Alford, Red Hat Inc
- Included pipelines with Ansible Tower, SCAP, and Open Controls.
5/9: Red Hat on Red Hat: Transitioning Red Hat IT to hybrid cloud infrastructure using OpenStack and Ceph Storage
- Speakers: Brian Atkisson, Red Hat, Inc.; Matthew Carpenter, Red Hat, Inc.
- Slides Available
5/9: Evolution of a Linux system identity and authentication stack
- Speaker: Dmitri Pal, Red Hat, Inc.
- Slides Available
5/9: A practical introduction to container security using CRI-O (LAB)
Thursday, January 11, 2018
InfoSec Basketball Rebounds
I was reading a post about red team vs blue team and all the support for purple teams and was struck with inspiration from one of the comments mentioned:
"(offense wins games, defense wins championships)"
They do not appear to be implying basketball and given the timing of the comment, they may have been thinking more about football. For me though, as a huge fan of Women's Basketball, I recognized it as a variation on a quote from the great Pat Summit:
"Offense sells tickets, defense wins games, rebounding wins championships."
And suddenly a hobby and work collide. My brilliant inspiration comes from how this really does apply to information security as well.
Everyone loves good offense. For some it is high flying dunk or a buzzer beater from half court. For others it is a successful, innovative attack as part of a red team. We attend "ethical hacking" courses because breaking into things is fun. Big exploits make the news and get cute little logos. Other crackers just keep working and getting two points here and there until it adds up on the scoreboard.
Defense is what is needed to win the game though. It doesn't matter how many point you put up if the other team is allowed to put up more. Can you prevent the problems in the first place? Have you done the basics of password security and patch management? Are we monitoring the logs? And even if it is done well, it might not make a stat line. Sure a couple blocks and few steals here and there but the standard box score doesn't list shot clock violations and a zone defense rarely makes the sports center top ten. The blue teams that prevent attacks from being expensive do not get badges (logos).
Shutouts are very rare and never in championship matches. Defense will not stop everything and even the best offense misses a lot of shots. Rebounds are how we react on a miss. Defensive rebounds end an opportunity for more points. The offense got a shot off, but if they miss, did you stand and watch or did you go after the ball and box out the opponent? If you are on offense and your shot bounces back, your goal is to secure the ball and try again. Attack another way, find another opening, maybe the same opening if you didn't get boxed out. With information security, are you monitoring logs, are your alerts set up correctly, are you reacting to even the missed attempt or are you just waiting and letting them take another shot? Are you boxing out?
Offense often comes down to skill and on the court, natural ability plays a big part. Defense can be taught with basic and repetitive drills. Rebounding is about heart. You don't have to be the tallest or biggest or strongest. Who wants it more? Who will go after the ball? Who can read the play and be the in correct position to respond?
And no one wins anything without a contributions in all areas and a whole lot of teamwork.
When it comes to programming and coming up with creative attacks, I do not have the natural abilities to make a good red team member. I am much more comfortable practicing defense and jumping into position to grab a rebound. Along with some post game analysis and armchair coaching!
-SML
"(offense wins games, defense wins championships)"
They do not appear to be implying basketball and given the timing of the comment, they may have been thinking more about football. For me though, as a huge fan of Women's Basketball, I recognized it as a variation on a quote from the great Pat Summit:
"Offense sells tickets, defense wins games, rebounding wins championships."
And suddenly a hobby and work collide. My brilliant inspiration comes from how this really does apply to information security as well.
Everyone loves good offense. For some it is high flying dunk or a buzzer beater from half court. For others it is a successful, innovative attack as part of a red team. We attend "ethical hacking" courses because breaking into things is fun. Big exploits make the news and get cute little logos. Other crackers just keep working and getting two points here and there until it adds up on the scoreboard.
Defense is what is needed to win the game though. It doesn't matter how many point you put up if the other team is allowed to put up more. Can you prevent the problems in the first place? Have you done the basics of password security and patch management? Are we monitoring the logs? And even if it is done well, it might not make a stat line. Sure a couple blocks and few steals here and there but the standard box score doesn't list shot clock violations and a zone defense rarely makes the sports center top ten. The blue teams that prevent attacks from being expensive do not get badges (logos).
Shutouts are very rare and never in championship matches. Defense will not stop everything and even the best offense misses a lot of shots. Rebounds are how we react on a miss. Defensive rebounds end an opportunity for more points. The offense got a shot off, but if they miss, did you stand and watch or did you go after the ball and box out the opponent? If you are on offense and your shot bounces back, your goal is to secure the ball and try again. Attack another way, find another opening, maybe the same opening if you didn't get boxed out. With information security, are you monitoring logs, are your alerts set up correctly, are you reacting to even the missed attempt or are you just waiting and letting them take another shot? Are you boxing out?
Offense often comes down to skill and on the court, natural ability plays a big part. Defense can be taught with basic and repetitive drills. Rebounding is about heart. You don't have to be the tallest or biggest or strongest. Who wants it more? Who will go after the ball? Who can read the play and be the in correct position to respond?
And no one wins anything without a contributions in all areas and a whole lot of teamwork.
When it comes to programming and coming up with creative attacks, I do not have the natural abilities to make a good red team member. I am much more comfortable practicing defense and jumping into position to grab a rebound. Along with some post game analysis and armchair coaching!
-SML
Wednesday, January 10, 2018
Watching the meltdown.
I have been watching Meltdown and Spectre unfold from the sidelines. Other than applying available updates, I'm just watching and absorbing the process of the disclosure. This one appears mid way along a long road.
I teach mostly administrators. I teach some developers. I teach those in, or desiring to be in, infosec. I like teaching security topics. I think securing systems requires more people thinking about security from the beginning of design and as an everyday, no big deal part of life. A question I ask with these newsworthy issues is what normal practices can mitigate even part of the problems? There are two big basics - least privilege and patch management - to always keep in mind. Issues like ShellShock and Venom were mostly mitigated from the beginning with SElinux enabled (least privilege) and WannaCry had little impact on those systems patched long ago when the SMB bug was first found and fixed.
However, in some cases, both exploits and accidents come from doing something that no one else thought of trying. This is why I like open source. There is the option (not always used) for more people trying different things and finding better uses as well as potential flaws. Any type of cooperation and collaboration can be the source of some of these findings including pull requests, conference talks, or corporations working with academic research projects.
Spectra and Meltdown are not the first bug of their kind, nor the last. Anything that grabs or holds more information than is requested - such as cache or speculation - is bound to eventually grab and expose something it shouldn't. Or allow some type of injection. I gave some kudos to the team getting the credit for this discovery and got some push back from a friend defending another friend that gave a related talk at a conference in 2016. Maybe not enough credit is given to those that speculated (pun intended) on this type of problem in the past. This timeline lists several and some retweets from people I trust to be smarter than me in this topic point to ideas even older.
The Google Project Zero team is getting the recognition because of a variety of pieces in a big puzzle. Right place, right time. Privilege from the backing of a large company. Their use of the embargo and disclosure process working across the industry. A new proof of concept and published paper. Indications of ways to exploit it at scale. A mitigation. It all comes together and suddenly more than just the researchers realize the scope of the risk that has been taken. Intel is getting more than their share of the blame too when people recognize a company name faster than a general concept or part of a computer. And, yes, in some cases there is also too much fluff and fear in the reporting.
The embargo and disclosure process is pretty interesting too. I sat in a talk a couple of years ago about how a large company deals with this in the open source world and Mike Bursell has a post with thoughts about it again in reference to this case. I actually had an idea something big was coming from the combination of noise and speculation about patches being submitted and who was NOT talking about them.
We are still discovering the full impact of the CPU design decisions made. Sure, they are serious, especially as more people are able to automate attacks against the vulnerability, but they are also nothing to panic about. This is not just an Intel problem. It is a market driven quest for more power with less money and despite various risks. We are all to blame. Apply the patches, monitor the impact, invest in the next generation of inventors and inventions. In other words, business as usual.
The choices were made in favor of optimization, so will things be a little slower now? Probably for many people, but not everyone. Will we get over it? I would think so.
What will happen in the long run with the latest news? I predict many people will choose performance over security. I predict a few years from now when someone finds a scalable way to exploit one or more of the variations, people will have forgotten that they should have updated bios, firmware, and kernels today. If we are lucky, they will have the latest patches already deployed and just need to make some configuration changes. But when has luck worked out as the best security practice?
Links I have collected helping me to understand:
SANS Institute webcast.
Fedora Magazine KTPI overview.
OpenStack, What you need to know.
Project Zero technical overview.
xkcd
My favorite analogy thread - the library comparison - (more were rounded up here).
-SML
I teach mostly administrators. I teach some developers. I teach those in, or desiring to be in, infosec. I like teaching security topics. I think securing systems requires more people thinking about security from the beginning of design and as an everyday, no big deal part of life. A question I ask with these newsworthy issues is what normal practices can mitigate even part of the problems? There are two big basics - least privilege and patch management - to always keep in mind. Issues like ShellShock and Venom were mostly mitigated from the beginning with SElinux enabled (least privilege) and WannaCry had little impact on those systems patched long ago when the SMB bug was first found and fixed.
However, in some cases, both exploits and accidents come from doing something that no one else thought of trying. This is why I like open source. There is the option (not always used) for more people trying different things and finding better uses as well as potential flaws. Any type of cooperation and collaboration can be the source of some of these findings including pull requests, conference talks, or corporations working with academic research projects.
Spectra and Meltdown are not the first bug of their kind, nor the last. Anything that grabs or holds more information than is requested - such as cache or speculation - is bound to eventually grab and expose something it shouldn't. Or allow some type of injection. I gave some kudos to the team getting the credit for this discovery and got some push back from a friend defending another friend that gave a related talk at a conference in 2016. Maybe not enough credit is given to those that speculated (pun intended) on this type of problem in the past. This timeline lists several and some retweets from people I trust to be smarter than me in this topic point to ideas even older.
Speculative execution considered harmful in 1995: "Prefetching may fetch otherwise inaccesible instructions in Virtual 8086 mode." https://t.co/KRMCEAfZgX pic.twitter.com/r62roI1Q6H— Trammell Hudson ⚙ (@qrs) January 8, 2018
Something much simpler than what you did :) See below. This is part of the work RafaĆ Wojtczuk and I did back in 2010. It's no longer under an NDA, so can paste here. We've never published it since we had no working attacks... pic.twitter.com/i5xUQbgbv3— Joanna Rutkowska (@rootkovska) January 4, 2018
The embargo and disclosure process is pretty interesting too. I sat in a talk a couple of years ago about how a large company deals with this in the open source world and Mike Bursell has a post with thoughts about it again in reference to this case. I actually had an idea something big was coming from the combination of noise and speculation about patches being submitted and who was NOT talking about them.
We are still discovering the full impact of the CPU design decisions made. Sure, they are serious, especially as more people are able to automate attacks against the vulnerability, but they are also nothing to panic about. This is not just an Intel problem. It is a market driven quest for more power with less money and despite various risks. We are all to blame. Apply the patches, monitor the impact, invest in the next generation of inventors and inventions. In other words, business as usual.
The choices were made in favor of optimization, so will things be a little slower now? Probably for many people, but not everyone. Will we get over it? I would think so.
What will happen in the long run with the latest news? I predict many people will choose performance over security. I predict a few years from now when someone finds a scalable way to exploit one or more of the variations, people will have forgotten that they should have updated bios, firmware, and kernels today. If we are lucky, they will have the latest patches already deployed and just need to make some configuration changes. But when has luck worked out as the best security practice?
Links I have collected helping me to understand:
SANS Institute webcast.
Watch the #Meltdown and #Spectre - Understanding and mitigating the threats - WEBCAST with @MalwareJake #DFIR #Threathunting via @YouTube @SANSEMEA @SANSAPAC @SANSInstitute @SANSPenTest https://t.co/riftmzDNVs— SANS DFIR (@sansforensics) January 8, 2018
#Meltdown & #Spectre are 2 security issues that threaten nearly all computers & mobile devices. Find out where they came from & what’s being done about them: https://t.co/K4udZdOTWa pic.twitter.com/Q6H1nSql5z— Red Hat, Inc. (@RedHatNews) January 6, 2018
Fedora Magazine KTPI overview.
OpenStack, What you need to know.
Project Zero technical overview.
xkcd
My favorite analogy thread - the library comparison - (more were rounded up here).
Here's my layman's not-totally-accurate-but-gets-the-point-across story about how #meltdown & #spectre type attacks work:— Joe Fitz (@securelyfitz) January 4, 2018
Let's say you go to a library that has a 'special collection' you're not allowed access to, but you want to to read one of the books. 1/10
-SML
Friday, December 22, 2017
Year in Review - reconnecting with Cloudera Training
I already wrote about Red Hat adventures of the past year but that is not the only part of my (professional) world. I also do some work with Apache Hadoop, mostly in partnership with Cloudera, Inc. I did not make any of the big data conferences this year but I did reconnect with Cloudera Training and Certification.
Apache Hadoop just had a release update but I am not sure when enough changes will trigger a major update to the downstream enterprise products.
The big news of the year for Cloudera as a company was the IPO (unfortunately they did not have a friends offering but hey, it isn't the big boom days either).
Over the past couple of years Cloudera has been moving their certifications to hands-on. This is a "good thing".
The big new class of the year is the Big Data Architecture Workshop which I have not yet had the chance to attend but am very interested (anyone care to sponsor me?). I do need to learn a bit more of the data science developer side first.
This year I had a chance to see some of the Cloudera Training OnDemand training (which they launched in 2016) and continue to contribute to some of their course materials.
A couple of related topics that I would like to explore in the coming months.
Apache Hadoop just had a release update but I am not sure when enough changes will trigger a major update to the downstream enterprise products.
Apache Hadoop 2.8.3 is released: https://t.co/IUIkJ6jrqi— Apache Hadoop (@hadoop) December 21, 2017
Overview: https://t.co/jSa2vV0MLX
Changes: https://t.co/28HfyUjlLU
Release notes: https://t.co/jMFGnxnaa3
Thanks to our community of developers, operators, and users.
The big news of the year for Cloudera as a company was the IPO (unfortunately they did not have a friends offering but hey, it isn't the big boom days either).
— NYSE (@NYSE) April 28, 2017
Over the past couple of years Cloudera has been moving their certifications to hands-on. This is a "good thing".
What's the value of Cloudera #certification? https://t.co/F3XI5fdYwf— Cloudera University (@ClouderaU) December 7, 2017
But don't just take our word for it... https://t.co/M4Ah2zGLpz— Cloudera University (@ClouderaU) November 7, 2017
The big new class of the year is the Big Data Architecture Workshop which I have not yet had the chance to attend but am very interested (anyone care to sponsor me?). I do need to learn a bit more of the data science developer side first.
Thinking to yourself, I'd really like to know what that #BigData Architecture Workshop is like? Wonder no more https://t.co/m42DTH1gFE— Cloudera University (@ClouderaU) September 26, 2017
This year I had a chance to see some of the Cloudera Training OnDemand training (which they launched in 2016) and continue to contribute to some of their course materials.
Show of hands, who's already redeemed their 20% off code for #OnDemand #training? Only a couple of days left! Go on, you know you want to gain valuable skills... CyberMonday_OD is your coupon code https://t.co/0EoswHMTaU pic.twitter.com/8Gr8cFitTH— Cloudera University (@ClouderaU) December 5, 2017
A couple of related topics that I would like to explore in the coming months.
- Integrating Cloudera Manager and FreeIPA. CM recognizes AD and direct admin connections to an MIT KDC but for FreeIPA it needs a custom script.
- Expore how the open Ambari manager works with securing hadoop clusters when using FreeIPA for the KDC. It appears to have been available as experimental since Ambari 2.4 according to this article.
- Investigate Hadoop ecosystem and similar products with Containers. Such as Machine Learning on OpenShift and Kubernetes and Big Data and Apache Spark on OpenShift Pt. I (2016)
It can be interesting to see the different and similar ways that companies manage curriculum development. Some day maybe I will see if I can get the permissions needed to share my amusements. Of course I have an opinion on which ways are better - just let me check on who is paying my fees for this week.... đ
I'll end with a plug for the Cloudera Training 2018 schedule since I hope that they sell enough seats to need me to teach! :)
I'll end with a plug for the Cloudera Training 2018 schedule since I hope that they sell enough seats to need me to teach! :)
Making plans for 2018 #training yet? We've got courses galore scheduled for you to choose from https://t.co/ny3x4LrSSk pic.twitter.com/F8zodC4hIF— Cloudera University (@ClouderaU) November 17, 2017
#training your employees is an investment pic.twitter.com/jJ6RwbLoLB— Cloudera University (@ClouderaU) September 14, 2017
Thursday, December 21, 2017
Year in Review - Red Hat training activity
I have been a certified instructor since the beginning of the program in 1999. I have contracts with delivery partners and am required to keep up on my skills and other information around the program. This a roundup of information from 2017 which is relevant to this part of my world.
Sunday, December 17, 2017
Triangle InfoSeCon - a (late) summary
Just a few thoughts on Triangle InfoSeCon 2017:
(and a record of sessions attended for CISSP continuing education credits).
A collection of available slides is at:
http://www.triangleinfosecon.com/2017-presentations/
For the most part I got into my first choice of talks each session. At least one was full before I decided. While this conference has less tracks than All Things Open (at the same venue) it has only a few less attendees. The people to seat ratios mean that some sessions are very full.
Low Hanging Fruit – Protecting Yourself from Ransomware by Being Brilliant at the Basics (Slides)
(and a record of sessions attended for CISSP continuing education credits).
A collection of available slides is at:
http://www.triangleinfosecon.com/2017-presentations/
For the most part I got into my first choice of talks each session. At least one was full before I decided. While this conference has less tracks than All Things Open (at the same venue) it has only a few less attendees. The people to seat ratios mean that some sessions are very full.
Low Hanging Fruit – Protecting Yourself from Ransomware by Being Brilliant at the Basics (Slides)
An entertaining speaker with good information but the all too common "too much info for the allocated time". I look forward to hearing from him again in the future.
The 3 Reasons Why Small Businesses Don't Have Better IT Security And Where to Start
The Machine Fights Back: AI and the Future of Cyber Defense (Afternoon Keynote) by Nicole Eagan - CEO at DARKTRACE
Fascinating implementation of learning patterns for each deployment instead of always comparing to a common and usually too generalized baseline.
Basic Web Threat Hunting
You cannot go wrong with a reference to regex golf!
Recent Developments in the Law of Cybersecurity
I think this is was an update of last year. Not as much has changed but I do hope this type of talk continues to get offered.
Trends in Healthcare Information Security and Privacy - Panel Discussion
This ended up being more about Security IT in hospitals and such. Very informative on how recent FDA instructions impact the fight to get vendors to allow OS updates on equipment. However, I was hoping for some information about how trends are impacting the individuals and doctor-patient relationships. Topics such as the privacy of data collected on wearable devices and the risks of attack through pacemakers and insulin pumps.
I also stayed for the After Dark session to race a drone and do a little electrical work.
Or rather try to race a drone. I did get it to take off and cross the first low wire. I also managed to crash it once and flip it once.
— ISSA Raleigh, NC (@RaleighISSA) October 27, 2017
The electronics session was hosted by Kramden Institute. They were testing a new class for summer camp.
Nothing like some electrical work at #InfoSeCon2017 After Dark pic.twitter.com/VIXrCvQgfk— ISSA Raleigh, NC (@RaleighISSA) October 27, 2017
Save the date: Oct 26, 2018
-SML
ATO2017 - A (late) summary
Just a few thoughts on All Things Open 2017:
(and a record of sessions attended for CISSP continuing education credits).
This event - which happened way back in October - just keeps growing. It is already almost too big!
Sunday: I made it to the early checkin and social in the evening. The location for the social is a cute place. It hosts local art and for the October dates, some spooky themes. Many thanks to Red Hat - specifically the Red Hat Open Source Stories team - for the sponsorship. I am not sure how many people realized that their videos (which are amazing!) were running on the TVs around the space.
Monday: After scoring a pair of socks from OpenSource.com, I focused on the Security track with the following sessions:
securing-microservices-with-istio
secdevops
openid-connect-the-client-is-not-always-right
preventing-cloud-data-breaches-with-open-source
I also attended one security related talk from the DevOps track:
enterprise-devops-bridging-the-infosec-gap
Chatter on twitter was coming mostly from the the community track which was nice since those talks always have some good stuff in them but I would have liked to hear a bit more about the other technical talks I was skipping. That is the problem with SO MANY tracks. It can be hard to choose where to invest your time.
Tuesday: I attended a couple talks in the Education track and explored the hallway a bit. Unfortunately one of the talks I had to leave due to asthma triggered by (chemical) cologne worn by another attendee. I never really got to feeling all that great the rest of day and headed out early to go home.
jupyterhub-for-distance-learning
using-an-api-scavenger-hunt-to-engage-api-newbies
I was also asked about the Fedora branded long sleeve white button up shirt I was wearing. Info is here:
https://fedoraproject.org/wiki/ButtonUp
Some slides from the conference are posted at:
https://www.slideshare.net/AllThingsOpen/presentations/
A comment on the focus and participation.
I overhead a conversation at lunch one of the two days that despite the name of "ALL" things open, this conference was very developer focused. I think that is and always has been the intent of this conference. The person who was a bit disappointed is more of an admin and ops person. I do remember having a few more interesting admin and community options in previous years but that may have more to do with what I was looking for those years. Also this year was in competition with a big conference in Europe that altered the attendance some. This is not necessarily a bad thing. Seeing the same people at all the conferences can result in really good talks by experienced presenters but it can also mean that there is not enough growth and encouragement for new talent in the industry.
As long as this a local, low cost, and fits my schedule, I will continue to attend and offer to speak. Even if it is more developer focused than my usual activities.
Save the dates: Oct 21-23, 2018.
-SML
(and a record of sessions attended for CISSP continuing education credits).
This event - which happened way back in October - just keeps growing. It is already almost too big!
Sunday: I made it to the early checkin and social in the evening. The location for the social is a cute place. It hosts local art and for the October dates, some spooky themes. Many thanks to Red Hat - specifically the Red Hat Open Source Stories team - for the sponsorship. I am not sure how many people realized that their videos (which are amazing!) were running on the TVs around the space.
Monday: After scoring a pair of socks from OpenSource.com, I focused on the Security track with the following sessions:
securing-microservices-with-istio
secdevops
openid-connect-the-client-is-not-always-right
preventing-cloud-data-breaches-with-open-source
I also attended one security related talk from the DevOps track:
enterprise-devops-bridging-the-infosec-gap
Chatter on twitter was coming mostly from the the community track which was nice since those talks always have some good stuff in them but I would have liked to hear a bit more about the other technical talks I was skipping. That is the problem with SO MANY tracks. It can be hard to choose where to invest your time.
Tuesday: I attended a couple talks in the Education track and explored the hallway a bit. Unfortunately one of the talks I had to leave due to asthma triggered by (chemical) cologne worn by another attendee. I never really got to feeling all that great the rest of day and headed out early to go home.
jupyterhub-for-distance-learning
using-an-api-scavenger-hunt-to-engage-api-newbies
I was also asked about the Fedora branded long sleeve white button up shirt I was wearing. Info is here:
https://fedoraproject.org/wiki/ButtonUp
Some slides from the conference are posted at:
https://www.slideshare.net/AllThingsOpen/presentations/
A comment on the focus and participation.
I overhead a conversation at lunch one of the two days that despite the name of "ALL" things open, this conference was very developer focused. I think that is and always has been the intent of this conference. The person who was a bit disappointed is more of an admin and ops person. I do remember having a few more interesting admin and community options in previous years but that may have more to do with what I was looking for those years. Also this year was in competition with a big conference in Europe that altered the attendance some. This is not necessarily a bad thing. Seeing the same people at all the conferences can result in really good talks by experienced presenters but it can also mean that there is not enough growth and encouragement for new talent in the industry.
As long as this a local, low cost, and fits my schedule, I will continue to attend and offer to speak. Even if it is more developer focused than my usual activities.
Save the dates: Oct 21-23, 2018.
-SML
Sunday, May 7, 2017
Red Hat Summit 2017
A quick recap with self reminders of session links.
Sunday night was dinner with a couple of other instructors. Always a blast.
Monday night was the Ansible (Red Hat Management) Social. The venue (Coppersmith) was really cool. Their description is as a vintage warehouse but it looked to me like it had once been a firehouse. The kitchen was in a pair of old food trucks welded together. And there was draft cider.
Tuesday was the start of the main activities. It was great to see the community groups in the center of things instead of a separate room like recent years. Also Training and Certification had various booths on the main floor instead of upstairs by the labs. For the print your own shirt, they added a RHCP option but I stuck with the skyline. I have enough other items with the RHCP logo on it.
I am not a fan of conferences in the Seaport district - the hotel and food options (for me and my allergies) are not as good as the older parts of town - but I understand the event the outgrown the Hynes. The extra room did result in a more spread out expo hall that actually appeared smaller than past years. Lines for sessions were also a bit smaller. I never heard the full numbers but I got the impression there was lower attendance as well. I also did not hear as much of an international flavor as previous year.
Tuesday evening I made an appearance at the Containers and Cloud party at Legal Test Kitchen (yummy shrimp!) before heading over to the RHCP party at Harpoon Brewery. They also had a draft craft cider.
Wednesday night we bailed on the Red Sox game. It was cold and windy and I wasn't sure what I would be able to eat. We went to Legal Seafood (again) and made it an early night. On Thursday at Summit I was able to pick up the ball caps with the Fenway logo on them. There were a couple of other Boston themed giveaways on the expo floor that I was able to score on the final day as well. Specifically, a really nice glass with a Boston map.
The plane up on Saturday morning was about 1/3 hatters and the Friday morning plane home was more like half hatters. We were all ready to sleep for the weekend. I did a lot more hallway track this year than in the past but I did catch a few security related sessions.
Sessions:
Keynotes and general sessions were live streamed and are available on the Red Hat Summit YouTube channel.
Red Hat Security Roadmap included some information on upstream projects that Red Hat is focusing on and contributing to including TPM (2.0 and virtual), PKCS#11, NBDE, USB Guard. They also mentioned the ongoing work with OpenSCAP and a new site for container health index.
The Fury and the Sound: A mock disaster security vulnerability fable was a fun panel type presentation which walked through a mock vulnerability with reps from project managements, infosec, exec office, and IT.
Automating security compliance for physical, virtual, cloud, and container environments with Red Hat CloudForms, Red Hat Satellite, and Ansible Tower by Red Hat included some demos of using CloudForms to launch OpenSCAP scans and provide remediation with playbooks located in Ansible Tower.
-SML
Sunday night was dinner with a couple of other instructors. Always a blast.
Monday night was the Ansible (Red Hat Management) Social. The venue (Coppersmith) was really cool. Their description is as a vintage warehouse but it looked to me like it had once been a firehouse. The kitchen was in a pair of old food trucks welded together. And there was draft cider.
Tuesday was the start of the main activities. It was great to see the community groups in the center of things instead of a separate room like recent years. Also Training and Certification had various booths on the main floor instead of upstairs by the labs. For the print your own shirt, they added a RHCP option but I stuck with the skyline. I have enough other items with the RHCP logo on it.
I am not a fan of conferences in the Seaport district - the hotel and food options (for me and my allergies) are not as good as the older parts of town - but I understand the event the outgrown the Hynes. The extra room did result in a more spread out expo hall that actually appeared smaller than past years. Lines for sessions were also a bit smaller. I never heard the full numbers but I got the impression there was lower attendance as well. I also did not hear as much of an international flavor as previous year.
Tuesday evening I made an appearance at the Containers and Cloud party at Legal Test Kitchen (yummy shrimp!) before heading over to the RHCP party at Harpoon Brewery. They also had a draft craft cider.
Wednesday night we bailed on the Red Sox game. It was cold and windy and I wasn't sure what I would be able to eat. We went to Legal Seafood (again) and made it an early night. On Thursday at Summit I was able to pick up the ball caps with the Fenway logo on them. There were a couple of other Boston themed giveaways on the expo floor that I was able to score on the final day as well. Specifically, a really nice glass with a Boston map.
The plane up on Saturday morning was about 1/3 hatters and the Friday morning plane home was more like half hatters. We were all ready to sleep for the weekend. I did a lot more hallway track this year than in the past but I did catch a few security related sessions.
Sessions:
Keynotes and general sessions were live streamed and are available on the Red Hat Summit YouTube channel.
Red Hat Security Roadmap included some information on upstream projects that Red Hat is focusing on and contributing to including TPM (2.0 and virtual), PKCS#11, NBDE, USB Guard. They also mentioned the ongoing work with OpenSCAP and a new site for container health index.
The Fury and the Sound: A mock disaster security vulnerability fable was a fun panel type presentation which walked through a mock vulnerability with reps from project managements, infosec, exec office, and IT.
Automating security compliance for physical, virtual, cloud, and container environments with Red Hat CloudForms, Red Hat Satellite, and Ansible Tower by Red Hat included some demos of using CloudForms to launch OpenSCAP scans and provide remediation with playbooks located in Ansible Tower.
-SML
Wednesday, November 2, 2016
Conferences 2016 (recaps and reminders)
Note to readers: This is primarily for reference for myself and for the reporting of CPEs for certifications I hold.
Full Schedule
Matthew Micene
Greg DeKoenigsberg
Lots of cool stuff!!! Where is the video?
Red Hat security roadmap
1 Hour Red Hat Summit - Slide presentation
Josh Bressers
Slides available for download.
Red Hat Summit 2017 is back in Boston May 2-4, 2017
[December 2, 2016: Last day to submit a proposal]
I was laughing as the "Cyber Threats and Trends 2016 (FBI)" talked about potential problems from Maria just as the DDOS news was being updated with the connection.
2016 Red Hat Summit
The RHCP party at the ballgame was awesome!Full Schedule
Two talks that I specifically took notes in:
1 Hour Red Hat Summit - Slide presentationMatthew Micene
Greg DeKoenigsberg
Lots of cool stuff!!! Where is the video?
Red Hat security roadmap
1 Hour Red Hat Summit - Slide presentation
Josh Bressers
Slides available for download.
Red Hat Summit 2017 is back in Boston May 2-4, 2017
[December 2, 2016: Last day to submit a proposal]
2016 Raleigh InfoSeCon - Friday October 21st
I volunteered this year which makes for a long day but I did sit in a few good talks.I was laughing as the "Cyber Threats and Trends 2016 (FBI)" talked about potential problems from Maria just as the DDOS news was being updated with the connection.
2016 All Things Open - October 26 - 27
Great two days. And spectacular weather. I wish I would have battled the traffic to get a T-shirt from early registration and see Totty at the pre-party.
With the increase in attendance, the rooms are still packed even with more sessions to choose from and lots of conflicts. Can't wait until a sponsor steps up to allow at least some sessions to be recorded and viewed later. I did find a few talks had been recorded. One on the Asian Penguins club was well done. The other on encrypted data in mysql was too hard to hear to be useful. (Please use the mic when being recorded even if those in the room can hear you without amplification).
- The keynotes were great.
- I attended technical talks on Spark and Vault.
- I had some fun with Blinky Flashy Things, Security with Tolkien, and listening to Bob Young talk about startups.
- I now have three new (signed) books to read.
- I feel less guilty about not writing as much as I want to since I now know I am just stuck in the reading/research phase of writing according to Rikki (with the help of Stephen King).
Looking forward to next year. ATO and InfoSeCon are the same week in October so that will help my schedule some. I need to decide on something to talk about...
-SML
Thursday, October 1, 2015
Being the speaker
I am the speaker all the time. I teach. I present material most weeks. I'm paid know my stuff. People pay to learn stuff. While I mostly teach materials written by a large team of other people, I have also often been on those teams. With so many years of experience both writing and presenting material, why have I not been a speaker at conferences more frequently?
For me, a large part is figuring out a topic. Much of what I teach is multi-day classes. Most conference presentations are about 40 minutes with maybe another 10 for questions. What topics do I love to talk about can be narrowed down to a short presentation? What do people really want to hear? What is new or not talked about enough?
So I finally come up with some ideas. Am I describing it correctly to get chosen? How do I convince the committee? Do any of them know me or is the choice from the description only? Have I specified the correct "level" for the conference notes?
And then a talk is accepted. Now I have to actually finish the presentation materials. Bullets are bad. Pictures are good. Once again, have I specified the correct level or otherwise described my presentation correctly? Will anyone attend? What if I get asked a question I cannot answer? Why does the pre-conference attendee list include [leader in field X]as planning to attend my intro talk!?! Why am I doing this? For free?
This year I presented at LinuxCon and was surprised at the response. They moved rooms as the interest shown in the talk increased. I ended up with 95 people attending my "SELinux, Its about the Labels" talk. That is a lot. The keynotes hold about 900 people. The Linux Security Summit at the end of the week was in a smaller room with about 100 people. Intimidating. It went well though - at least I think it did. I had a few people come up and ask questions at the end of the talk and a few others recognize me and mention the talk later in the week. No one flamed me in person or on social media. That is a win.
I am giving the same talk again next month and I learned a few things and will be tweaking the presentation but only a small amount.
-SML
For me, a large part is figuring out a topic. Much of what I teach is multi-day classes. Most conference presentations are about 40 minutes with maybe another 10 for questions. What topics do I love to talk about can be narrowed down to a short presentation? What do people really want to hear? What is new or not talked about enough?
So I finally come up with some ideas. Am I describing it correctly to get chosen? How do I convince the committee? Do any of them know me or is the choice from the description only? Have I specified the correct "level" for the conference notes?
And then a talk is accepted. Now I have to actually finish the presentation materials. Bullets are bad. Pictures are good. Once again, have I specified the correct level or otherwise described my presentation correctly? Will anyone attend? What if I get asked a question I cannot answer? Why does the pre-conference attendee list include [leader in field X]
This year I presented at LinuxCon and was surprised at the response. They moved rooms as the interest shown in the talk increased. I ended up with 95 people attending my "SELinux, Its about the Labels" talk. That is a lot. The keynotes hold about 900 people. The Linux Security Summit at the end of the week was in a smaller room with about 100 people. Intimidating. It went well though - at least I think it did. I had a few people come up and ask questions at the end of the talk and a few others recognize me and mention the talk later in the week. No one flamed me in person or on social media. That is a win.
I am giving the same talk again next month and I learned a few things and will be tweaking the presentation but only a small amount.
Linux Security Summit
Continuing my notes and link references from August....
Before leaving Seattle, I stayed for part of the Linux Security Summit.
Paul Moore gave a great review of the summit.
I have to agree that Konstantin's keynote was exceptional. Check out the Presentation, referenced video, and released policies.
The CC3 talk was fine but just not anything I am remotely working with at the moment.
Stephen Smalley's SELinux on Android talk was informative for me. It gave me some ideas and links to look at before my next talk.
Rethinking Audit went too deep in the kernel source for me but I followed the discussion - or at least most of it.
The afternoon included a nap but I did return for the discussion on the Core Infrastructure Initiative. There is a lot of work to do here but the concept has some promise.
On Friday morning I popped into the Samsung talk before checking out and heading to the airport. I was a bit disappointed as it seems to me they are reinventing the wheel to have a security framework on their platform. I did note a couple of capabilities they are trying to get into the kernel so I do see the relevance of speaking at the summit. It did not seem deep enough - or "source code" enough to interest the kernel developers, and was too much overview to interest my ops side.
-SML
Wednesday, September 30, 2015
LInuxCon 2015 - Seattle
More catching up...
The second keynote was "How Collaborative Systems are Reinventing Capitalism" byRobin Chase, Founder of Zipcar and Author of Peers Inc. It was an interesting talk but not what I expected for a LinuxCon audience. By the end the loose ends did eventually tie her Peers, Inc. concept to Open Source collaboration with the idea for Peers, Peers where both innovative user experience and innovative platform environments.
The final keynote of Day 1 was "Full Sail Ahead: What’s Next For Container Technology" presented by several Docker employees and complete with live demos - always a fascinating thing made even more impressive by running smoothly. A key element here was the introduction to notary options - verified and signed containers not just trusted repositories.
LinuxCon Day1
As usual I was awake early, very early. So a walk and a Whole Foods breakfast were accomplished in time to catch all the keynotes. The first was a snooze. I understand large sponsors getting time with a captive audiance but I really wish they would not just give a sales pitch. They could have announced their new offering in under 5 minutes, listed the related talks and booth locations, and talked about something more interesting than price points of a mainframe.The second keynote was "How Collaborative Systems are Reinventing Capitalism" byRobin Chase, Founder of Zipcar and Author of Peers Inc. It was an interesting talk but not what I expected for a LinuxCon audience. By the end the loose ends did eventually tie her Peers, Inc. concept to Open Source collaboration with the idea for Peers, Peers where both innovative user experience and innovative platform environments.
The final keynote of Day 1 was "Full Sail Ahead: What’s Next For Container Technology" presented by several Docker employees and complete with live demos - always a fascinating thing made even more impressive by running smoothly. A key element here was the introduction to notary options - verified and signed containers not just trusted repositories.
Also announced at the keynotes was the Core Infrastructure Initiative which was also discussed more at the Linux Security Summit a few days later.
I ducked into a few talks on Monday including "Why be a Rock Star Developer when you can be a Willie Nelson" by Rikki Endsley but mostly I just worked the hallway track and got my slides finalized and uploaded.
The Monday Evening event, open to Speakers and VIPs, was at Chihuly Garden and Glass I was very excited for this event. The glass is spectacular.
LinuxCon Day 2
Day 2 turned into a security day for me.
The first Keynote was a video conference with Bruce Schneier, renowned security technologist and CTO, Resilient Systems where he discussed "Attacks, Trends and Responses". Mostly he talked about the Sony attack and how that has affected the security playing field.
In addition to my talk, I popped into a couple of other security related sessions:
Securing Big Data at Rest with Encryption for Hadoop, Cassandra and MongoDB on Red Hat. - Alejandro Gonzalez, Cloudera
Evening Booth Crawl was crowded and I did not find any food or drink that fits my dietary restrictions. I did finally find a quieter area and some good conversation.
LinuxCon Day 3
The most notable sessions from Day 3 were Repeatable Processes for Building Secure Containers with Ryan Jarvinen & Dan Walsh (which was really an introduction to OpenShift 3) and Container Security - Past, Present & Future presented by Serge Hallyn from Canonical.
Lunch with the Linux Foundation Instructors was a highlight of the day. I was actually most surprised that Rock Bottom Brewery could find something I could eat. The afternoon booth drawings were a bust and I was just plain tired by the time of the evening event at the EMP Museum. My favorite was the Animation Art of Chuck Jones "What's Up Doc?" exhibit.
-SML
Catching up - OSCON notes
Better late than never?
I enjoyed my first ever OSCON event. Here are a few observations and a couple of reminders to self:
* In a preview of OSCON, a point was made that this year the tracks are not focused on programming language but rather on function/usage such as "mobility", "Design", and "Data". I noticed this before the article and the shift is a part of what attracted me to attend for the first time. I was particularly interested in the "Protect" track as well as some "Data" topics.
* I started the week by attending a few of the morning talks at Open Cloud Day.
* Security focused talks attended (for CISSP CPEs).
How my POODLE lost his Xen state by seeing a Ghost, going BERserk, and getting ShellShock with a Heartbleed.
Evolution of information security threats.
Vulnerability management for open software development.
* Any slides are at: http://www.oscon.com/open-source-2015/public/schedule/proceedings
* The lunch time food was very well done, at least for my specific allergy concerns. On Day 1, everything in the "special diet" line was both gluten free and vegan. I felt the need for a thick rare steak later but I found plenty to eat at the time. Day 2 lunch was mexican day. The mixed dishes were gluten free and vegan so I just had to avoid the side add ons: tortillas, cheese, and sour cream.
The evening events were not so well marked and not as robust in the selections that were marked as vegan and gluten free. I am so ready for the world to label "dairy free" as nicely as they have begun to identify the gluten free items. While vegan is dairy free, dairy free does not have to be vegan.
* OSCON has an interesting dynamic but I find a number of contrasting statements. On one hand you have the core conference focused on developers. On the other hand you have the Cultivate preconference event and a variety of talks on building community.
There were talks on sysadmins turned developers and overcoming the impostor syndrome. There were talks about the importance of new contributors and how to make them feel welcome. There were talks on the paperwork and management side of reporting and handling security vulnerabilities. In other words, many talks that are not all about programming.
Even in the keynotes and social media, there are references to inclusion, diversity, and community.
Yet in some of those same discussions, there are references to "we all have computer science degrees" and the use of #programmer along with complaints of "many people use opensource but few contribute". This last one really hit a nerve with me. It feeds my pet peeve of hearing "I cannot contribute to opensource because I don't code" ARG! But that is rant for another post.
* I remembered to get my Fedora Badge.
-SML
I enjoyed my first ever OSCON event. Here are a few observations and a couple of reminders to self:
* In a preview of OSCON, a point was made that this year the tracks are not focused on programming language but rather on function/usage such as "mobility", "Design", and "Data". I noticed this before the article and the shift is a part of what attracted me to attend for the first time. I was particularly interested in the "Protect" track as well as some "Data" topics.
* I started the week by attending a few of the morning talks at Open Cloud Day.
How my POODLE lost his Xen state by seeing a Ghost, going BERserk, and getting ShellShock with a Heartbleed.
Evolution of information security threats.
Vulnerability management for open software development.
* Any slides are at: http://www.oscon.com/open-source-2015/public/schedule/proceedings
The evening events were not so well marked and not as robust in the selections that were marked as vegan and gluten free. I am so ready for the world to label "dairy free" as nicely as they have begun to identify the gluten free items. While vegan is dairy free, dairy free does not have to be vegan.
* OSCON has an interesting dynamic but I find a number of contrasting statements. On one hand you have the core conference focused on developers. On the other hand you have the Cultivate preconference event and a variety of talks on building community.
There were talks on sysadmins turned developers and overcoming the impostor syndrome. There were talks about the importance of new contributors and how to make them feel welcome. There were talks on the paperwork and management side of reporting and handling security vulnerabilities. In other words, many talks that are not all about programming.
Even in the keynotes and social media, there are references to inclusion, diversity, and community.
Yet in some of those same discussions, there are references to "we all have computer science degrees" and the use of #programmer along with complaints of "many people use opensource but few contribute". This last one really hit a nerve with me. It feeds my pet peeve of hearing "I cannot contribute to opensource because I don't code" ARG! But that is rant for another post.
* I remembered to get my Fedora Badge.
-SML
Friday, July 24, 2015
Need sources of "IT for youth" (not programming)
At a recent event there was a participant who posed a serious problem. She has plenty of resources available to assist young women who are interested in learning to code. She also knows plenty of young women who are interested in other STEM topics in general but not interested in programming. Young women who have tried to code but found it is not for them. Learning the basic concepts of programming in order to understand the logic is great and important but there are other aspects to the IT world than just programmers. This event participant was looking for ways to interest (or keep interested) young women in information technology with tasks other than programming.
I keep meaning to put together a panel presentation for conferences about how to contribute to or make a living with open source when you do not consider yourself a programmer. I know people that do design, testing, documentation, security compliance, administration, and community management. They all have technical skills with various levels of scripting knowledge or have formerly been programmers. At least one has done special programs with the schools (teaching the use of InkScape) and is hosting a summer intern to assist with her UX job.
I believe that the event participant is a system administrator who can script and work with devops but does not consider herself a coder - much like my background. She is looking for ideas on how to share the message with today's youth that there is more to computer science and information technology than being a programmer. Here are some of my thoughts:
Cyberpatriot - "THE NATIONAL YOUTH CYBER DEFENSE COMPETITION"
Originally for Junior ROTC programs but expanded to any high school group.
USFirst - Teaches teamwork through robotics which involves design and electronics as well as the programming.
Kaggle - "The Home of Data Science" has competitions that teach data science concepts and contribute to all kinds of research. Many projects need some scripting (coding) skills but others are more about statistics, graphing, and visualization. Check out the tutorials section.
Also check out local meetups and ask for assistance presenting options to youth. Look for groups such as:
If anyone knows of programs specifically teaching system administration or network administration to youth, let me know so I can pass on the links.
-SML
I keep meaning to put together a panel presentation for conferences about how to contribute to or make a living with open source when you do not consider yourself a programmer. I know people that do design, testing, documentation, security compliance, administration, and community management. They all have technical skills with various levels of scripting knowledge or have formerly been programmers. At least one has done special programs with the schools (teaching the use of InkScape) and is hosting a summer intern to assist with her UX job.
My panel idea is focused around contributing to open source projects and is targeted more at adults. It is a starting point for ideas. However, there are other IT related projects that can be of interest to youth (and other non-programmers) interested in other aspects of computers. [Note: these are US infinitives aimed to help a group in Florida]
I believe that the event participant is a system administrator who can script and work with devops but does not consider herself a coder - much like my background. She is looking for ideas on how to share the message with today's youth that there is more to computer science and information technology than being a programmer. Here are some of my thoughts:
Originally for Junior ROTC programs but expanded to any high school group.
USFirst - Teaches teamwork through robotics which involves design and electronics as well as the programming.
Kaggle - "The Home of Data Science" has competitions that teach data science concepts and contribute to all kinds of research. Many projects need some scripting (coding) skills but others are more about statistics, graphing, and visualization. Check out the tutorials section.
Also check out local meetups and ask for assistance presenting options to youth. Look for groups such as:
- HackerSpace or MakerSpace or Makers groups
- Any group inventing with Raspberry Pi, Arduino, or similar devices
- Meetups entertaining wearable electronics topics.
- Groups working with 3-D printers (perhaps even for a good cause like http://enablingthefuture.org)
If anyone knows of programs specifically teaching system administration or network administration to youth, let me know so I can pass on the links.
-SML
Tuesday, October 14, 2014
GHC14 - Technical Talks
A few notes (as much for myself) on a couple of the technical talks that I attended.
There were three technical tracks (beside the Open Source Day) that I had some interest in: Security/Privacy, Data Science, and IoT/Wearables. Between conflicts in scheduling, making the most of "hallway sessions", seeking [allergy free] food, and pure exhaustion leading to afternoon naps, I only made it to a few of these sessions. Here are reviews of two:
Fingers, eyes, ear shape, etc were mentioned briefly but without as much technical information on where the industry is for my tastes. There was some discussion of active vs passive enrollments for bio-metric devices. Most of that discussion focused around voice and how it does take into account twins or having a cold or other day to day changes. Basically (and not new to me),any bio-metric technology has a level of confidence match. A low confidence match is sufficient for an recognizing identity for a device used by multi persons such as then providing a custom screen on the family Ipad. One way they want to extend this is with customer service call centers. Instead of having to go through a proof of identity each time to you call in - especially with followup calls - have the computer system recognize the voice. This then extends into the Matrix versions of in store identity and personalized experience. I still vote creepy. I prefer being an anonymous shopper.
There were three technical tracks (beside the Open Source Day) that I had some interest in: Security/Privacy, Data Science, and IoT/Wearables. Between conflicts in scheduling, making the most of "hallway sessions", seeking [allergy free] food, and pure exhaustion leading to afternoon naps, I only made it to a few of these sessions. Here are reviews of two:
Bio-metrics - Cool or Creepy?
This panel was all industry professionals. There appeared to be a higher priority on customer experience than security. They did acknowledge that there is a difference between personalization identity and authentication identity. It bugged me that they referred to these as "identity" and "authentication" instead of two types of identity. They also made a distinction between local implementation (on a phone or tablet) and cloud or remote identity and pointed out (though maybe not forcefully enough to be heard) that authentication needs multiple factors and a higher level of confidence match.Fingers, eyes, ear shape, etc were mentioned briefly but without as much technical information on where the industry is for my tastes. There was some discussion of active vs passive enrollments for bio-metric devices. Most of that discussion focused around voice and how it does take into account twins or having a cold or other day to day changes. Basically (and not new to me),any bio-metric technology has a level of confidence match. A low confidence match is sufficient for an recognizing identity for a device used by multi persons such as then providing a custom screen on the family Ipad. One way they want to extend this is with customer service call centers. Instead of having to go through a proof of identity each time to you call in - especially with followup calls - have the computer system recognize the voice. This then extends into the Matrix versions of in store identity and personalized experience. I still vote creepy. I prefer being an anonymous shopper.
Designing secure and privacy-aware IoT and wearable technologies for healthcare.
I was disappointed with this talk based on the title and description. The content was interesting but not what I expected. There were four panelists - two from industry and two from academic research.
The first two presenters - from FitBit and UC Berkeley - talked mostly about the research they are doing to enhance the user experience. All the ideas are about collecting more data and automating the sharing of the data. Nothing was mentioned about securing the data. I have a fitbit and I already knew that the data is transferred clear text and stored in the cloud. Also that even with my privacy settings set to "me only" for a particular field, that data is still transferred to other organizations who are allowed to sync my data. I think the "allow this company to sync" should be seen at a "friend" level of privacy not a "me" level of see everything. Nothing was mentioned about privacy settings, authentication to get data, or securing the transport of the data. The UC Berkeley professor discussed the challenges of developing wearable technologies for the elderly. Again, interesting research but nothing about privacy or security was mentioned.
The third and fourth presentations got a bit more on topic.
The professor from the University of Illinois at Urbana-Champaign commented on a review of Android apps: 63.6% of mHealth apps are sending data over the internet in plaintext and 81.8% are using 3rd party storage and hosting such as AWS. I almost tuned the whole thing out when she started with "BOYD is coming". News flash: its been an issue for years now! As solutions, she did offer some examples:
"consider auditing" - mAuditor
The professor from the University of Illinois at Urbana-Champaign commented on a review of Android apps: 63.6% of mHealth apps are sending data over the internet in plaintext and 81.8% are using 3rd party storage and hosting such as AWS. I almost tuned the whole thing out when she started with "BOYD is coming". News flash: its been an issue for years now! As solutions, she did offer some examples:
"consider auditing" - mAuditor
"consider secure storage" - datalocker
"consider authentication" - lighttouch
"consider secure data collection and transmission" - selinda
The representative from Epic discussed a few issues using EHRs to store and access data:
Problem: Transfer of data: each EHR is separate database. There is a need for more standards concerning sharing the data. Some are: HL7, HealthIT.gov, and FHIR. FHIR is new, uses REST API.
Problem: Proving identity. Some possible starting points are perapp, OpenID, oauth, healthkit
Problem: The firehose of data. How do we make it pretty with quick access for the 7 minutes Dr visit.
Problem: Who cares? A Dr needs data from the less healthy not the healthy tech runner with a fitbit. How do we get information from the right person(s)?
Problem: Legal issues. Current laws require holding all data that is collected. This can be expensive on the storage side unless there is enough value from the data and/or a change in rules that allow for disposing of certain data sets - such as historic fitbit raw data on a healthy individual.
-SML
GHC14 - Day 3 keynotes and wrapup
Day three opened with references to handling mistakes, some direct, some more subtle. Making sure we are all listening, learning, improving, and moving forward.Its been a while since I heard the term "active listening".
The conference was marked by controversy over men at a women's conference telling women the same old things that really have not worked. From how the Wed evening panel was handled (by both the organizers and the participants) to the comments made by the CEO of Microsoft. Both situations resulted in the men LISTENing to the criticism, apologizing for not do better, and publicly trying to lead the change toward doing better. It is still to be seen how the words and efforts will play out in the long run.
Here are a few (paraphrased) sentences I heard:
The conference was marked by controversy over men at a women's conference telling women the same old things that really have not worked. From how the Wed evening panel was handled (by both the organizers and the participants) to the comments made by the CEO of Microsoft. Both situations resulted in the men LISTENing to the criticism, apologizing for not do better, and publicly trying to lead the change toward doing better. It is still to be seen how the words and efforts will play out in the long run.
Here are a few (paraphrased) sentences I heard:
- We need to have the tough conversation.
- We all make mistakes.
- We cannot push an ally away with persecution for a single mistake.
- We all need to listen to the criticism and learn from the mistakes.
- We need to thank those that enter the minefield and show up to have the hard conversations.
Outside of the conference, I loved the quote by Diane Sawyer after talking about The Nobel Peace Prize given to Malala and straight out of Malala's goals: "It is amazing what can happen when we educate girls".
The keynote speaker for the final day was Dr. Arati Prabhaker from DARPA. She was scheduled for last year but the government shutdown forced a last minute substitution. A few of the technical research efforts that her team is working on are:
- Space - launching small satellites from military planes from any runway. These are 100 pound satellites placed into low orbit with the costs down to 1 million dollars and 24 hours notice instead of 10's of million and in 24 months of planning.
- Biology - Research into moving injured military from rehab to recovery with better prothetics and direct brain control. Human trials are already started and a 60 minutes video shows a women (in attendance at the conference) using thought to manipulate a robot arm.
- Biology - Infectious diseases are in the news. Right now a flu shot needs weeks to get the body to create antibodies. DARPA research is looking for quicker diagnosis to reduce the spread as well as create targeted cures and prevention. They are looking for a flu shot that triggers antibodies within hours instead of weeks.
- Information Technology - Today we really do have only the option of "patch and pray". What can we do in the future to reset this? DARPA research is working on a Capture the Flag for AI machines only. They plan to place it next to the Capture the Flag at the next DefCon. They are also working on accuracy and speed in pattern matching and other data analysis technologies. Recently a pattern matching exercise resulted in a list of phone numbers which were matched to a local law enforcement database which narrowed the list to known criminals and eventually to about 30 numbers from (or near) North Korea that eventually led to reducing human trafficking.
The last day is also a day to get the final set of swag from the career fair and attend the final party. Do not forget a bag for the swag at the party and be early to get in on the raffle from the sponsors.
On the swag: I love the puzzles. I can use the portable chargers and cables (though I now have many more cables than I need). I have once again replenished my office supply of pens (a few more PostIt notes would have been helpful) and my work from home wardrobe of T-shirts (more colors than at most tech conferences but still a lot of my least favorite black and grey). Some of the tote bags are useful, specifically the ones that can handle groceries (flat bottoms with strong handles).
-SML
Friday, October 10, 2014
GHC14 Day 1 - keynotes
I enjoyed the first keynote of the GHC this year. Shafi Goldwasser is a leader in encryption research at MIT. Many attendees found the presentation too technical to the point where "over my head" was a common social media post. As a InfoSec professional (in the administration side, not the theoretical or mathematical side), I enjoyed the talk. She used cartoonish pictures instead of bullets (thank you!) and described the ideas with general analogies. The slides also included with the pictures, some equations and references to research for those that want to dig in further.
The work centers around how to work with private data without exposing all the data. For example, how do we get data for medical research - such as the number of cases where both X and Y are found - from a number of hospitals without getting all the patient records? How can we store data in the cloud encrypted, and query it without giving away the keys to the whole data set? How can we prove a theory without showing the proof?
The work includes HElib to do computation on encrypted data and Functional Encryption for fuzzy identity based encryption (Sakai,Waters - 2005).
Fun stuff.
-SML
The work centers around how to work with private data without exposing all the data. For example, how do we get data for medical research - such as the number of cases where both X and Y are found - from a number of hospitals without getting all the patient records? How can we store data in the cloud encrypted, and query it without giving away the keys to the whole data set? How can we prove a theory without showing the proof?
The work includes HElib to do computation on encrypted data and Functional Encryption for fuzzy identity based encryption (Sakai,Waters - 2005).
Fun stuff.
-SML
Subscribe to:
Posts (Atom)