Learning Python

 I stumbled across what appears to be a great resource for learning Python. It's been over a decade since I've known I need to learn Python. During that time I have taken a Coursera course and written a few scripts here and there, but I still do most of my Python programming by Googling and searching Stack Overflow. That works okay for occasional use, but I have recently found the need to make Python my daily driver. So I went in search of some solutions in the fall. 

I started by looking for something that I could use on my phone. Python Programming: Ultimate guide looked promising, but my enthusiasm for their app waned as I an into some technical difficulties. I should go back and revisit that, though. 

Eventually I found Python Morsels, and I think this is what I need in my life right now. I did the free month-long trial in the fall and I just signed up for a year. The site is created and maintained by Trey Hunner, a Python trainer for teams. I'm still fairly new on my journey there, and he just introduced a new "flexible mode," but the basic structure seems pretty well established. He gives an assignment, reference hints, automated verification, and follow-up discussions of the solutions. I highly recommend it.

The new "flexible mode" sets up a profile that can be made public. Mine's not that interesting, but I expect it will become more so over this next year!

3/11/21 Edit: I just noticed that Trey is a contributor to EditorConfig and his name is on a bunch of the plugins.

How to Cut Through Vendor Claims & Marketing Hype When Evaluating New Security Tools

I have a new post on the Threat Stack blog.

Check out my other recent Threat Stack posts!

How to Identify Threats Within Your Docker Containers

I have a new post on the Threat Stack blog.

Check out my other recent Threat Stack posts!

The Difference Between Security Trick Plays and Security Fundamentals

I have a new post on the Threat Stack blog.

Check out my other recent Threat Stack posts!

SLDC, SOC 2, and Other Four Letter Words

I have a new post on the Threat Stack blog based on my presentation last week at SOURCE Boston!

Talk description:

Except for any authors of trojans that may have stumbled in accidentally, we all want to write secure applications. In spite of our sincere desires, vulnerable code gets shipped. Why? What do we do to fix it? What can we do to prevent it from happening? The answers exist in the realm of the software development life cycle, or SDLC. Various compliance vehicles (such as SOC2) exist to help us formulate an effective SDLC, but any security expert knows that checking a box does not typically yield the desired results. This talk describes the SDLC used by the agent team at Threat Stack, while also bringing in outside experiences to supplement. It also goes over pitfalls observed and lessons learned. You might not use the same tools or produce the same product, but the talk focuses on principles to make the resulting product more secure.

Check out my other recent Threat Stack posts!

Slides for SOURCE Boston 2018

You can find my slides from SOURCE Boston below and here. I tweaked them a bit from my presentation SOURCE Mesa-Phoenix.

Slides for SOURCE Mesa 2018

You can find my slides from SOURCE Mesa-Phoenix below and here.

Heading to SOURCE Mesa/Phoenix

This week I'm heading to SOURCE Mesa/Phoenix. While there I will present my talk: SDLC, SOC2, and other four letter words. I'll post the slides for the talk later, but you can read the abstract now:

Except for any authors of trojans that may have stumbled in accidentally, we all want to write secure applications. In spite of our sincere desires, vulnerable code gets shipped. Why? What do we do to fix it? What can we do to prevent it from happening? The answers exist in the realm of the software development life cycle, or SDLC. Various compliance vehicles (such as SOC2) exist to help us formulate an effective SDLC, but any security expert knows that checking a box does not typically yield the desired results. This talk describes the SDLC used by the agent team at Threat Stack, while also bringing in outside experiences to supplement. It also goes over pitfalls observed and lessons learned. You might not use the same tools or produce the same product, but the talk focuses on principles to make the resulting product more secure.

I'm slotted to present on day two, March 1st, at 1:10 pm. So right after lunch. Rob Cheyne interviewed me ahead of the conference to preview my talk, and you can find that on YouTube:

Sorry about the audio. I definitely have some lessons learned there for myself about getting the right equipment and prepping for the discussion a bit better.

I'll be there for both days of the main conference. I look forward to meeting new folks and learning new things!

Eyes on the Ground: Why You Need Security Agents

I have a new post on the Threat Stack blog based on my presentation last week at SOURCE Boston!

Talk description from SOURCE agenda:

Whether you build, buy, borrow, or steal it, you need a security agent on your endpoints. We can already hear your cries of "agent fatigue" and we sympathize. Any agent, no matter how lightweight, has costs associated with running it. Minimize those costs and get an agent, because you need the information that only an agent can harvest from the endpoint. We talk about various types of security agents, including their respective strengths and weaknesses. We explore how agents can interact and interfere with each other, and provide some tips for evaluating agents. We cover open-source, custom-built, and vendor perspectives, from cloud to IoT. We need information to do our jobs, and we need agents on our digital assets to provide that information. 

I exported the keynote slides to slideshare.

Check out my other recent Threat Stack posts!

Welcome SOURCE visitors!

Maybe you've stumbled onto this blog after hearing of me through SOURCE Conference Boston. Welcome! While this blog has links to my professional blog posts, they actually live on my company's blog.

Things that make it onto this blog tend to be things that do not fit elsewhere. That includes the notes for religious talks I give as part of my volunteer position in the LDS (Mormon) church, among other things. Feel free to ask me about them!

It's dangerous to cloud alone

It's dangerous to cloud alone! Take this.

C++ in the Linux kernel

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

How to Educate Yourself About Cloud Security

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

Changing Metaphors to Make Sense of Security in the Cloud

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

Boston SOURCE Conference 2016: I Got the T-Shirt and a Whole Lot More

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

How security changes in the cloud

I gave a talk this morning at SOURCE Conference Boston:

How security changes in the cloud and why you care from Nathan Cooprider

You can also download the keynote version.

A Glimpse into Boston Secure World 2016

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

My Bit9 posts are dead, long live my Bit9 posts!

Bit9 recently renamed itself to Carbon Black. It looks like they won't be carrying over the Bit9 blog posts to the Carbon Black blog. Makes sense, but it's still kind of a bummer. Good thing we have the WaybackMachine! Nothing dies on the internet, folks:

• Data Mining: 7 Reasons How New Technology Could Impact Privacy - May 18, 2012
• The Gamble of Failure-Oblivious Computing - May 29, 2012 
• Malware Fear: Are Security Companies Manipulating or Highlighting the Truth? - June 11, 2012 
• Beyond the Maginot Line: 8 Ways to Improve Your Personal Security Posture - June 28, 2012
• The Darwin Awards of IT Security: 6 Things to Avoid - July 17, 2012
• Computer Licensing: Should IT Departments Act More Like the RMV? - August 20, 2012
• 3 Lessons from a Breach, a War Game, and a Password Corpus  - August 29, 2012
• Preaching to the Choir: The Problem with Cybersecurity Education - January 11, 2013 
• 4 Realities of Cyber Security - January 29, 2013 
• How to Handle UPnP Vulnerabilities - February 1, 2013
• The Realities of Cyberwar: Fear, Uncertainty and Doubt - April 2, 2013
• Convenience vs. Security: Avoiding Trade-offs That Hurt Your Business - April 25, 2013
• Threat Intelligence: Using The Machine for Cybersecurity or Cyberattacks - May 29, 2013 
• Thinking About Security Daemons - June 14, 2013
• Managing Security Tradeoffs between Private and Public Information - July 11, 2013 
• Legal and Political Perspectives of Cyber Security - October 21, 2013

You can even go and see my old blog profile at Bit9.

Whitelisting is Dead, Long Live Whitelisting!

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!

Highlights From Facebook's Security@Scale (@SecatScale)

2/4/2016 - Oops! I forgot about this one! Adding it later and then back-dating it. Shhhh!

I have a new post on the Threat Stack blog!

Check out my other recent Threat Stack posts!