Triangle InfoSeCon - a (late) summary

Just a few thoughts on Triangle InfoSeCon 2017:
(and a record of sessions attended for CISSP continuing education credits).

A collection of available slides is at:
http://www.triangleinfosecon.com/2017-presentations/

For the most part I got into my first choice of talks each session. At least one was full before I decided. While this conference has less tracks than All Things Open (at the same venue) it has only a few less attendees. The people to seat ratios mean that some sessions are very full.

Low Hanging Fruit – Protecting Yourself from Ransomware by Being Brilliant at the Basics (Slides)

An entertaining speaker with good information but the all too common "too much info for the allocated time". I look forward to hearing from him again in the future.

The 3 Reasons Why Small Businesses Don't Have Better IT Security And Where to Start

The Machine Fights Back: AI and the Future of Cyber Defense (Afternoon Keynote) by Nicole Eagan - CEO at DARKTRACE

Fascinating implementation of learning patterns for each deployment instead of always comparing to a common and usually too generalized baseline. 

Basic Web Threat Hunting

You cannot go wrong with a reference to regex golf!

Recent Developments in the Law of Cybersecurity

I think this is was an update of last year. Not as much has changed but I do hope this type of talk continues to get offered.

Trends in Healthcare Information Security and Privacy - Panel Discussion

This ended up being more about Security IT in hospitals and such. Very informative on how recent FDA instructions impact the fight to get vendors to allow OS updates on equipment. However, I was hoping for some information about how trends are impacting the individuals and doctor-patient relationships. Topics such as the privacy of data collected on wearable devices and the risks of attack through pacemakers and insulin pumps.

I also stayed for the After Dark session to race a drone and do a little electrical work.

Or rather try to race a drone. I did get it to take off and cross the first low wire. I also managed to crash it once and flip it once.

Time for some #InfoSeCon2017 After Dark #drone racing pic.twitter.com/tzBgond3Bh

— ISSA Raleigh, NC (@RaleighISSA) October 27, 2017

The electronics session was hosted by Kramden Institute. They were testing a new class for summer camp. 

Nothing like some electrical work at #InfoSeCon2017 After Dark pic.twitter.com/VIXrCvQgfk

— ISSA Raleigh, NC (@RaleighISSA) October 27, 2017

Save the date: Oct 26, 2018

-SML

ATO2017 - A (late) summary

Just a few thoughts on All Things Open 2017:
(and a record of sessions attended for CISSP continuing education credits).

This event - which happened way back in October - just keeps growing. It is already almost too big!

Sunday: I made it to the early checkin and social in the evening. The location for the social is a cute place. It hosts local art and for the October dates, some spooky themes. Many thanks to Red Hat - specifically the Red Hat Open Source Stories team - for the sponsorship. I am not sure how many people realized that their videos (which are amazing!) were running on the TVs around the space.

Monday: After scoring a pair of socks from OpenSource.com, I focused on the Security track with the following sessions:

securing-microservices-with-istio

secdevops

openid-connect-the-client-is-not-always-right

preventing-cloud-data-breaches-with-open-source

I also attended one security related talk from the DevOps track:

enterprise-devops-bridging-the-infosec-gap

Chatter on twitter was coming mostly from the the community track which was nice since those talks always have some good stuff in them but I would have liked to hear a bit more about the other technical talks I was skipping. That is the problem with SO MANY tracks. It can be hard to choose where to invest your time.

Tuesday: I attended a couple talks in the Education track and explored the hallway a bit. Unfortunately one of the talks I had to leave due to asthma triggered by (chemical) cologne worn by another attendee. I never really got to feeling all that great the rest of day and headed out early to go home.

jupyterhub-for-distance-learning

using-an-api-scavenger-hunt-to-engage-api-newbies

I was also asked about the Fedora branded long sleeve white button up shirt I was wearing.  Info is here:
https://fedoraproject.org/wiki/ButtonUp

Some slides from the conference are posted at:
https://www.slideshare.net/AllThingsOpen/presentations/

A comment on the focus and participation.
I overhead a conversation at lunch one of the two days that despite the name of "ALL" things open, this conference was very developer focused. I think that is and always has been  the intent of this conference. The person who was a bit disappointed is more of an admin and ops person.  I do remember having a few more interesting admin and community options in previous years but that may have more to do with what I was looking for those years. Also this year was in competition with a big conference in Europe that altered the attendance some. This is not necessarily a bad thing. Seeing the same people at all the conferences can result in really good talks by experienced presenters but it can also mean that there is not enough growth and encouragement for new talent in the industry.

As long as this a local, low cost, and fits my schedule, I will continue to attend and offer to speak. Even if it is more developer focused than my usual activities.

Save the dates:  Oct 21-23, 2018.

-SML

Taking Stock, Making Plans.

My company has a couple of projects that are about to wrap up. In both cases the client has hired a full time employee to pick up the work. This is great for them and normal for my business but it does mean finding "the next big thing" around the holidays.

My company is small. Really small. OK, it is just me. So I have the flexibility to take my time finding the next big project. I still have smaller, recurring contracts to carry through.

Before I get into what kind of excitement I want from my next big thing, I am looking forward to taking a few weeks off and maybe getting to a few of the many "if only I had the time" projects that are on my list. At least spending *some* time on wish items in between searching for the next big thing.

I often wish I could be more diligent about writing  and presenting. Writing here and even contributing to opensource.com. Presenting at conferences which I have done in the past, but also at local meetups. The small groups are a lot more fun! I had a couple of conference proposals that did not make the cut recently but that I think are still valuable. One I even planned to write an article on and still just have not gotten it done. It is on the list.

As I have watched my Goddaughter grow up, I have meant to get more involved in sharing my knowledge with kids. I took her to a Kid's Day event before a Red Hat Summit one year and we had a blast. Since I first explored the CISSP certification I have had the interest to go through the Safe and Secure Online training so I can look for volunteer opportunities. I also think the Techgirlz program is awesome (I might be a bit biased since a fellow instructor went to work there) and they have a local chapter. It is on the list.

When I got started contributing to open source communities it was with the Fedora Project and specifically the Docs team. I have not been anywhere near as active with Fedora lately and I miss it. I still consider myself an active Ambassador with each class I teach but I have not really contributed through content or formal activities lately. I am actually looking for a new challenge though, rather than returning to an old stomping ground, and probably with a smaller project. I dabbled in an Apache Hadoop ecosystem project for a bit and I still follow that mailing list but I never really got into that community. Melding open source and security is ideal, though I have really enjoyed the past year where I jumped into automation with Ansible and containers with OpenShift. The search continues.

Then of course there is the true time off - something that never really happens when you own your own business - where I can get things done around the house. The builtin bookcase that is already planned, the office cleaned out with all the old equipment donated, the yard spruced up, some light reading, etc.  Also all on the list.

-SML

Cleaning the basement

It is a rare long weekend for me. I am wrapping up one work from home project and am already prepped for my next teach which isn't for another week. So I have resumed my battle with the basement where I try very hard to stick to the "you haven't thought about it in over 5 years, toss it out" rule. Of course it isn't working. Instead I just head down memory lane.

This morning I tackled a box that appears to be one of the last ones packed the last time I moved. A collection of things to sort out later. One pile was all papers. Some were worth keeping at the time such as a receipt from a work trip not old enough (when I moved) to be out of audit range. Others are a mystery like boarding passes with no particular meaning. Some are no longer readable.


Then there are the more meaningful tickets to keep like the entry to the Empire State building Observatory. I get why I might have kept it at the time. Sort of. I used to do some scrap-booking but even then, this particular ticket is just a been there done that memory. It was in the evening, after class, by myself. Not a Sleepless in Seattle moment in any way.


Another brought up memories of a planes, trains, and automobiles trip in a blizzard. That trip also introduced me to a really cool coworker. With a storm shutting down the Northeast when we both had classes scheduled, the company we were contracting for at the time rearranged our travel.

We each flew from different parts of NC to Philadelphia
then met at the Amtrak station in the city to catch a train to Boston. I know Boston well and if I had not been with a traveling companion, I would never have agreed to a planned arrival at South Station, at night, in a blizzard, with the need to get out to Burlington.  Yet here I was, meeting a coworker for the first time at a train station in Philly to travel together the rest of the way. It was more like 1am when we got to South Station and my traveling companion managed to wrangle us a taxi over to the airport to pick up a rental car. My knowledge of the area got us to the hotel in Burlington as we passed under road signs indicating all but emergency personnel should stay off the roads. We called the hotel on the way to make sure they stayed awake to let us in which was good since they had about given up on our arrival. Just to add to the excitement, when we got up in the morning to teach our respective classes, the car had a flat tire. The hotel shuttle took us to the training facility and the show continued. I don't remember how many of our students actually made it but since some were from out of town and also in our hotel, I know there were some.

These tickets are now nicely preserved in the wonderful world of the Internet. A few less pieces of paper cluttering my basement.

-SML

Box Turtles

Walking home from the neighbors tonight (May 27, 2017) I spotted a beautiful box turtle laying eggs.  It is near the woods but in the sun. Unfortunately it is also a path well traveled by my family.

I returned and took some photos. I used the longer lens in hopes of minimizing any disturbance and I hope that she finished what she was doing.  When I checked a little later she had moved off the nest but I couldn't tell if she had already started to cover eggs or had moved away without laying any. It was just barely dusk so a little early to be done but who knows.

I will look for the nest in the morning and mark the spot so we walk around. Of course even then, survival is highly unlikely with all the snakes, coons, possums, and coyotes in the neighborhood.

I am not sure if this is the same one I saw in the backyard last weekend.

Meanwhile here are some photos.

She may have been looking to use some of the warmth from the carport but the dirt is pretty hard any closer.  Even where she selected, I suspect she was only able to dig the hole today because of how much rain we have had lately.  If the little ones survive, they may have to go further than expected to find water.

-SML

Red Hat Summit 2017

A quick recap with self reminders of session links.

Sunday night was dinner with a couple of other instructors. Always a blast.

Monday night was the Ansible (Red Hat Management) Social. The venue (Coppersmith) was really cool. Their description is as a vintage warehouse but it looked to me like it had once been a firehouse.  The kitchen was in a pair of old food trucks welded together. And there was draft cider.

Tuesday was the start of the main activities. It was great to see the community groups in the center of things instead of a separate room like recent years. Also Training and Certification had various booths on the main floor instead of upstairs by the labs. For the print your own shirt, they added a RHCP option but I stuck with the skyline. I have enough other items with the RHCP logo on it.

I am not a fan of conferences in the Seaport district - the hotel and food options (for me and my allergies) are not as good as the older parts of town - but I understand the event the outgrown the Hynes. The extra room did result in a more spread out expo hall that actually appeared smaller than past years. Lines for sessions were also a bit smaller. I never heard the full numbers but I got the impression there was lower attendance as well. I also did not hear as much of an international flavor as previous year.

Tuesday evening I made an appearance at the Containers and Cloud party at Legal Test Kitchen (yummy shrimp!) before heading over to the RHCP party at Harpoon Brewery. They also had a draft craft cider.

Wednesday night we bailed on the Red Sox game. It was cold and windy and I wasn't sure what I would be able to eat. We went to Legal Seafood (again) and made it an early night. On Thursday at Summit I was able to pick up the ball caps with the Fenway logo on them.  There were a couple of other Boston themed giveaways on the expo floor that I was able to score on the final day as well. Specifically, a really nice glass with a Boston map.

The plane up on Saturday morning was about 1/3 hatters and the Friday morning plane home was more like half hatters.  We were all ready to sleep for the weekend.  I did a lot more hallway track this year than in the past but I did catch a few security related sessions.

Sessions:
Keynotes and general sessions were live streamed and are available on the Red Hat Summit YouTube channel.

Red Hat Security Roadmap included some information on upstream projects that Red Hat is focusing on and contributing to including TPM (2.0 and virtual), PKCS#11, NBDE, USB Guard. They also mentioned the ongoing work with OpenSCAP and a new site for container health index.

The Fury and the Sound: A mock disaster security vulnerability fable was a fun panel type presentation which walked through a mock vulnerability with reps from project managements, infosec, exec office, and IT.

Automating security compliance for physical, virtual, cloud, and container environments with Red Hat CloudForms, Red Hat Satellite, and Ansible Tower by Red Hat included some demos of using CloudForms to launch OpenSCAP scans and provide remediation with playbooks located in Ansible Tower.

-SML

International Women's Day

In honor of International Women's Day, I would like to thank some of the allies that have helped me live a life doing something I love and getting paid for it.

First and most of all is my Dad.

• A man who taught me to make pancakes and made my school lunches. 
• A man that sat with me (and cleaned up) when I was sick at 2am. 
• An engineer who taught me to love logic puzzles. 
• A business man who showed by example how to manage people. All kinds of people. In the realm of manufacturing and quality control.
• A man who encouraged me and supported me when I was told directly by my teenage boy classmates and even indirectly by one of my teachers that "girls can't pay drums". 

My Mom also supported me and told me I could do anything, be anything that I wanted to be. She was a biology, pre-med major so there was no shortage of science knowledge in our home.

I was lucky to have some great role models in high school as well. A biology and life science teacher was a favorite. Also strong female role models teaching Calculus and Physics. Oh, and a band director that encouraged me to audition for several regional and state honor bands (several of which picked me).

My first full time job had its struggles but I can think of a couple of people that stood up for me, eventually.

As I moved into technical training I found most resistance came from students at the beginning of class.  There is a specific look on their faces as they walk into the classroom on day one and wonder what this chick can teach them about Linux. After 20 years I don't see that very often anymore.  I like to think that it is a good sign for the world in general. I never had a problem proving myself before the end of class - at least for the class in general - and for those few students that just didn't like me for no clear reason, the managers handling those complaints always backed me up.

Since I have been an independent consultant I have had the privilege of working with a few really great companies.  Red Hat, Cloudera, and /training/etc stand out with supportive environments for diversity, including "Women in Tech".  My thanks to several curriculum team members, several fellow instructors, and most of the scheduling and quality managers for their support over the years.

If I name names, I will miss somebody really important. But here are a few that stand out for specific events. Mom and Dad, Amy, Jay, Steve, Joe, Henry, Randy, George, Will,  Susan, Tom, Mike, Nate, Mark, Paul, Wade, Marc, Chris, Matt, and a bunch of others too: Thank You!  And all the other just all around good people that I have had the opportunity to work with or chat with or learn from or follow: Thank You!  And anyone else who has been a good citizen of a diverse community: Thank You!

-SML