My Bit9 posts are dead, long live my Bit9 posts!

Bit9 recently renamed itself to Carbon Black. It looks like they won't be carrying over the Bit9 blog posts to the Carbon Black blog. Makes sense, but it's still kind of a bummer. Good thing we have the WaybackMachine! Nothing dies on the internet, folks:

• Data Mining: 7 Reasons How New Technology Could Impact Privacy - May 18, 2012
• The Gamble of Failure-Oblivious Computing - May 29, 2012 
• Malware Fear: Are Security Companies Manipulating or Highlighting the Truth? - June 11, 2012 
• Beyond the Maginot Line: 8 Ways to Improve Your Personal Security Posture - June 28, 2012
• The Darwin Awards of IT Security: 6 Things to Avoid - July 17, 2012
• Computer Licensing: Should IT Departments Act More Like the RMV? - August 20, 2012
• 3 Lessons from a Breach, a War Game, and a Password Corpus  - August 29, 2012
• Preaching to the Choir: The Problem with Cybersecurity Education - January 11, 2013 
• 4 Realities of Cyber Security - January 29, 2013 
• How to Handle UPnP Vulnerabilities - February 1, 2013
• The Realities of Cyberwar: Fear, Uncertainty and Doubt - April 2, 2013
• Convenience vs. Security: Avoiding Trade-offs That Hurt Your Business - April 25, 2013
• Threat Intelligence: Using The Machine for Cybersecurity or Cyberattacks - May 29, 2013 
• Thinking About Security Daemons - June 14, 2013
• Managing Security Tradeoffs between Private and Public Information - July 11, 2013 
• Legal and Political Perspectives of Cyber Security - October 21, 2013

You can even go and see my old blog profile at Bit9.

Dude, you're getting Bit9!

Dell SecureWorks Adds Innovative Advanced Endpoint Threat Detection Service to its Cyber Threat Services Portfolio

Bit9 CTO on CNN

Edit 6/3/14: Stupid video always auto-played, so I'm replacing it with a link

Legal and Political Perspectives of Cyber Security

New Bit9 blog post: Legal and Political Perspectives of Cyber Security

Widening the bell curve

My wife calls me a hero worshipper. My hero worshipping manifested itself at an early age by my love of He-Man and Superman. Thank goodness we did not have YouTube during my childhood and therefore will never again see 5-year-old-me running around in Superman underwear with a cape and boots. I grew out of that, but did not grow out of wanting to be a hero. In the years since my youthful admiration of fictional heroes I have learned that real heroes exist, but they often start out as normal people. Men such as Joshua Lawrence Chamberlain and Roger Bushell rose to the occasions into which they were placed. The key to becoming a hero is recognizing a need and then filling it.

Famous heroes manifest themselves in difficult situations when the need is great and filling it seems impossible.The horrors of war provide those circumstances in abundance. I like learning about wars for that reason. Heroes can appear anywhere and everywhere during a war. That includes anything from the battlefield heroics on Omaha beach to the decryption of Enigma at Bletchley Park. Considering those two scenarios as a computer geek, I can more easily picture myself assisting in the war effort alongside Turing and his bombes. Maybe that would not make a great Spielberg movie, but it could definitely fill a lengthy novel.

I recently finished Cryptonomicon, a historical/science fiction novel by Neal Stephenson that reviews the Enigma decryption effort in significant detail. A large portion of that story deals with a real practice that one character calls “widening the bell curve.” With regards to cracking Enigma, having it cracked only remained valuable so long as the Nazis did not know the Allies had broken it. Unbridled use of cracked information would yield short-term victories, but then Allies would tip their hand and reveal the weaknesses of Enigma. The Axis could then address those weaknesses and upgrade their encryption. On the other hand, not using the information rendered it equally useless. The trick became figuring out how use it without revealing knowledge of it. 

That brings us back to “widening the bell curve.” A normal distribution follows a bell curve: extremes happen much less often than the average. Something not following that probability, such as “magically” finding every Nazi transport, would appear as an extraneous bump on the bell curve. The information theory solution of widening the bell curve ahead of time tries to avoid exposing that bump. Widening occurs by adding additional data points to smooth out the distribution, and must be added in many places to ensure a smooth and symmetrical bell shape. Figuring out just what to do to maintain the normal bell curve became the job of one protagonist in Cryptonomicon.

The Allies, both in the book and in the real war, introduced additional data points through various means. Instead of magically showing up with a fleet to attack a transport, they sent out “spotter” submarines and aircraft to “find” the transport. Even better, they sent out additional spotters to other locations, providing false negatives. The Allies had to occasionally ignore information from the Enigma because acting on it would reveal the cypher’s weakness.. At one point the Allies transmitted a congratulation to a non-existent spy in Italy for the excellent information provided, which covered up an out-of-the-blue convoy attack. These and similar techniques resulting in the Enigma cracking remaining secret until publicly disclosed nearly three decades later. The most accurate word to describe the effort involved to maintain that secrecy is heroic.

This all has direct applications to today’s security landscape. We can look for irregularities in computer usage, or bumps on the bell curve, to indicate a threat. However, in order to find the bumps we must already know the shape of the curve. Bad actors will try to widen the bell curve in order to avoid detection. Organizations something to fill the role of identifying washed-out bumps. Bit9 can map the curve and identify the bumps so you can become a security hero!

Person of Interest: Now a documentary!

I love this show. It seems like sci-fi nuts seem to criticize it for not having enough fi. It's not their fault it lines up with the news so perfectly! They showed this at SDCC last week:



I wrote a blog posts at the ends of season one and two talking about how the show's world melded with our current reality and what we could learn from that.

Managing Security Tradeoffs between Private and Public Information

New Bit9 blog post: Managing Security Tradeoffs between Private and Public Information.

It talks about this graph I've been thinking about:

You can read all my Bit9 blog posts here.

Thinking About Security Daemons

Posted on the Bit9 blog: Thinking About Security Daemons

See all my Bit9 blog posts here.

Threat Intelligence: Using The Machine for Cybersecurity or Cyberattacks

New post on Bit9 blog: Threat Intelligence: Using The Machine for Cybersecurity or Cyberattacks

Convenience vs. Security: Avoiding Trade-offs That Hurt Your Business

I wrote a blog post for Bit9: Convenience vs. Security: Avoiding Trade-offs That Hurt Your Business

How to Handle UPnP Vulnerabilities

Posted on the Bit9 blog: How to Handle UPnP Vulnerabilities

See all my Bit9 blog posts here.

Release the Kraken

Posted on the Bit9 blog: 4 Realities of Cybersecurity

See all my Bit9 blog posts here.

Preaching to the Choir: The Problem with Cybersecurity Education

Posted on the Bit9 blog: Preaching to the Choir: The Problem with Cybersecurity Education

See all my Bit9 blog posts here.

3 Lessons from a Breach, a War Game, and a Password Corpus

Posted on the Bit9 blog: 3 Lessons from a Breach, a War Game, and a Password Corpus

See all my Bit9 blog posts here.

Why it's awesome to work at Bit9

I recently had the pleasure of attending some instruction from retired four-star General Bruce Carlson. The material covered a number of things, including some important life lessons. He emphasized the importance of making sure you love what you do, saying something along the lines of: “my wife tells me I had a job, but I don’t remember doing a single day of work. I got to fly planes for a living.” I suspect some degree of hyperbole, but it still made me think about where I currently choose to earn my living. Not only do I enjoy working at Bit9 (CrunchBase Profile), but I feel others should know that so they will join the company if given the opportunity.

Computer Licensing: Should IT Departments Act More Like the RMV?

Posted on the Bit9 blog: Computer Licensing: Should IT Departments Act More Like the RMV?

The Darwin Awards of IT Security: 6 Things to Avoid

I wrote another blog post on my company's blog: The Darwin Awards of IT Security: 6 Things to Avoid

Beyond the Maginot Line: 8 Ways to Improve Your Personal Security Posture

A post to the Bit9 Blog: Beyond the Maginot Line: 8 Ways to Improve Your Personal Security Posture.

See all my Bit9 blog posts here

Malware Fear: Are Security Companies Manipulating or Highlighting the Truth?

Some thoughts I've been thinking lately:
Malware Fear: Are Security Companies Manipulating or Highlighting the Truth?

The Gamble of Failure-Oblivious Computing

New post on the Bit9 blog: The Gamble of Failure-Oblivious Computing