“If you hide your form, conceal your tracks, and always remain strictly prepared, then you can be invulnerable yourself.” The Art of War, Chapter 4: Formation

There’s a lot of analysts and journalists who write and talk a lot, but it’s just all blah blah blah blah, with little substance or anything that matters. And they tend to talk in circles and argue a lot about much of nothing. Brian Krebs is not such a writer. He’s one of those rare journalist gems in the security world who gets it, and has respect. He tells it like it is, and I gotta admit, I’ve enjoyed his writing, accuracy, and tenacity in sticking to his guns despite the unwashed ignorant commenting masses on his more popular topics. He wades into the whole substitute teacher porn exposure case quite deeply, and rightly, ready to get the facts out as this whole incident is one out of proportion debacle. Sic balls, chopper!

Another analyst that I have grown to like, mostly because of his style of posting bullet points and getting all his stuff in one post as much as his incites (sic), is Mike Rothman. I may not always agree and I may find his stuff not relevant to my roles, but he has gems. He had one today where he said, “Everyone needs a plan, but those that spend all day planning, spend very little time doing. So plan quick, do stuff, adapt and repeat.” We can sit and talk about how to get the perfect security plan and plan, plan, plan so that we’re not the next headline in the paper. But we could end up doing that for ten years…and get nowhere. Just do it. Get an idea or something to do and do it. It might be only part of the solution, it might even be wrong, but just do it. Evaluate it. Fix it. Adapt. Improve. But bottomline do something! A company that really wants to support its IT and security personnel will be willing to allow some levity in getting things done and making mistakes here and there. If the company is not, they either won’t ever have security, have scared admins who end up doing nothing but the barest bottom line, or they have a team of perfect Jesus Admins working for them.

Laptop encryption is a big deal these days. But one must always keep in mind that the best way to keep sensitive information safe is to not have it on insecure devices and to physically destroy media when no longer used. Encryption, if you want to get really technical, is just obfuscation. It cannot realistically be broken today…but the key word there is “today.” If that drive is important enough, an attacker can keep hold of it for years and continuously work against it. Encryption is a huge step up from bare data, but it is still not a complete substitute for sound information storage and usage practices. Either way, full-disk encryption will soon become standard on every hard drive, and users can turn it off if they want on the hardware. Kinda like providing a lock and key on a computer case. If you want to take the trouble to supply the key each time you want in, go for it, otherwise just don’t lock it.