TaoSecurity Blog

I've noticed coverage of "leadership" in IT magazines recently, but I'm not comfortable with the approach they take. For example, this editorial in CIO Magazine titled Leadership Isn't a Fairy Tale After All has "Personal attention and hands-on involvement can make good IT managers great IT leaders" as the subtitle. The text then says: Our story spells out detailed tactics and practical ideas that CIOs can use to turn good IT managers into potentially great IT leaders... You’ll notice a strong thread of personal attention and hands-on involvement from the very top at the companies developing a strong bench of future leaders. At REDACTED, for example, the CEO walks the walk on one-to-one leadership development by holding regular career conversations with his senior leadership team. His CIO, REDACTED, then makes sure that style of direct communication flows downward to the IT team. “If you don’t take time to talk to people about their professional dev...

I took a look at the newest print edition of CIO Magazine and saw the story IT Value Is Dead. Long Live Business Value. (Registration is needed for the whole article, but you don't need it.) The article includes these gems: The end of IT-business alignment is nigh. And no one is happier about it than the business-focused CIO. “If you stand in front of an audience of CIOs and start talking about IT-business alignment, at best you get eye rolls, and at worst you get people walking out of the room...” [A]lignment, it turns out, is not the ultimate end for corporate IT. In fact, says Dave Aron, vice president and fellow in Gartner’s CIO Research group, the language of IT-business alignment—encouraged and endorsed for more than a decade by industry analysts, consultants and, for a time, this magazine—is now dangerously counterproductive, setting IT apart from the enterprise even as technology itself becomes more inextricably entrenched in it. You heard it here already! For example...

For the first time in four years, I will teach for the USENIX organization! I'm pleased to announce that on August 8-9 at USENIX Security 2011 in San Francisco, I will teach a special two-day edition of TCP/IP Weapons School 3.0 . This class is designed for junior and intermediate security analysts. The "sweet spot" for the potential student is someone working in a security operations center (SOC) or computer incident response team (CIRT), or someone trying to establish one of those organizations. The class is very hands-on, and focuses on labs and discussions. There are less than 10 slides at the very beginning of the class, and I build the flow of the class based on what you want to hear. If you would like details on the class, please see the linked site. You may also find my announcement for my Black Hat sessions on 30-31 July and 1-2 August to be helpful too. It will be a busy few weeks this summer but I'm looking forward to seeing you learn the investiga...

Today I attended a talk by Joel Brenner, formerly national counterintelligence executive (NCIX) and now a lawyer with Cooley LLP . He talked about the threat to national and economic security posed by our overseas friends. I was most excited to learn that he has a new book arriving this fall titled America the Vulnerable: New Technology and the Next Theat to National Security . Given his experience as NCIX, his former role at NSA, and his current role with intellectual property defense at Cooley, I am looking forward to reading this book! Tweet

Kevin Mitnick was kind enough to send me a galley copy of his upcoming autobiography Ghost in the Wires . Amazon.com won't let me post a review yet, so I'll write what I would have supplied to the site. In 2002 I reviewed Kevin Mitnick's first book, The Art of Deception . In 2005 I reviewed his second book, The Art of Intrusion . I gave both books four stars. Mitnick's newest book, however, with long-time co-author Bill Simon, is a cut above their previous collaborations and earns five stars. As far as I can tell (and I am no Mitnick expert, despite reading almost all previous texts mentioning him), this is the real deal. Mitnick addresses just about everything you might want to know about. For me, the factor that made the book very unique was the authors' attention to detail. This sounds like it might have been a point of contention between the co-authors, but I found the methodical explanation of the social engineering and technical attacks to be rele...

Amazon.com just posted my five star review of Windows Internals, 5th Ed by Mark Russinovich and David Solomon, with Alex Ionescu. Microsoft Press provided a free review copy. From the review : Windows Internals, 5th Ed (WI5E) by Mark Russinovich and David Solomon, with Alex Ionescu, is a remarkable technical achievement. I read the book to better understand Windows to improve my security knowledge. I am not a Windows programmer, but I thought WI5E would provide context for some of the exploit and vulnerability information I occasionally encounter. I absorbed as much of WI5E as I could, but quickly found the scope and depth of the material to be incredible. While there is no substitute for reading source code, the explanations in WI5E come close! So many aspects of Windows are described, to such a deep level, that you might find yourself wanting to use Windows just to see WI5E's descriptions at work. Tweet

Amazon.com just posted my five star review of Windows System Programming, 4th Ed by Johnson M. Hart. Addison-Wesley provided a free review copy. From the review : I read Windows System Programming, 4th Ed (WSP4E) by Johnson M. Hart after finishing Windows via C/C++, 5th Ed (WVCP5E) by Richter and Nasarre. While I liked WVCP5E, I found WSP4E to be the better book for the sort of understanding I was trying to achieve. I'm not a professional Windows programmer, but I wanted to learn more about how Windows works. Hart's book did the trick, especially for a person like me with more of a Unix background. If you want to better know how to program on Windows, and specifically recognize differences among using the C libraries, the Windows API, and Windows "convenience functions," WSP4E is the book for you too. Tweet