On a side note, a friend linked me to a page describing “the two things” you should know about a variety of subjects. Ya know, the two most important things you can tell someone about a subject. It has this to say about project management:

The Two Things about Project Management:
1. The schedule will slip.
2. It’s about how you manage the schedule slippage.

So what are your two things?

Ishikawa Diagram

and think of this

Ishikawa from Ghost in the Shell

instead?

Work expands so as to fill the time available for its completion.

In other words, if you schedule “extra” time for work to be completed it will magically take exactly that long to do. People naturally pad to fill the available time. They might do this by wasting time and resources, or making a simple task overly complex, etc. The law was posited in a humorous essay for the Economist, but it really rings true. Be careful to manage any float time carefully, lest you or others fill it just because it’s there!

This video is a little old now, but still a cool demo none the less. It shows how (in theory) you can switch off servers when load on your VMs is low to save energy but then spin them up in response to demand. From some quick research it looks like it wasn’t very feature complete in VMWare at first but they improved it to add iLO and IPMI wake up as well as scheduled spin up for when know when demand will increase and want to get out ahead of it. Not only does it allow you to save money and be more agile, but you can be greener too. What’s not to like? (yeah yeah, expensive VMWare licenses and support contracts…but still if the ROI is there, fantastic)

The DR was interesting just because I haven’t really given it a lot of thought before. I make onsite and offsite backups of my personal data and have read and (try to) live the Tao of Backup, but formal DR plans and procedures aren’t something I’ve done. I find it really interesting, especially from mindset of availability being one of a security officer’s responsibilities in conjunction with general IT staff.

My study also included some brush up on cryptography. I’ve always enjoyed learning about cryptography. I read Simon Singh’s “The Code Book” when I was younger and really enjoyed it (great book if you’re interested in learning about crypto and its impact on history). Even though math hasn’t always been my favorite subject, I always enjoyed reading about crypto and how it worked. Of course I knew about symmetric vs asymmetric cryptography and RSA/PGP, but I learned things like the differences between block and stream ciphers, how RC4 is used securely in SSL and insecurely in WEP, Twofish being beat by Rijndael for the AES standard, Blowfish was designed by Bruce Schneier (who I love), etc.

People on the Techexams forums have been singing the praises about Darril Gibson’s Security+ book. Though WGU provided adequate learning resources and only a dead tree edition is available, I decided to just go ahead and buy Darril’s book anyway. I wasn’t at all disappointed that I did, even if I bought it just before Amazon decided to drop the price from list price. Hopefully a Kindle edition will be available soon. Last I heard from Darril in a blog post was sometime in the next 3 months. Anyway, you’ll find an excerpt from my review below.

I just finished reading Darril Gibson’s updated Security+ exam preparation guide “CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide“. The book is well written and seems to throughly cover the exam objectives of the SY0-301 as posted by CompTIA. I haven’t sat for the exam yet, but feel completely confident I will pass due in part to this guide.

As with most exam prep guides, this book contains practice questions and exams. The one thing that sets this book apart from others is the inclusion of detail explanations as to the correct answer for each question. Sometimes you’re left wondering about the rationale behind a certain answer being correct or the “best” answer, but this book leaves no mystery with its detailed answer keys. This is one feature I’d definitely like to see in more exam prep books.

If at first you don’t succeed, you fail.

I can’t promise how active it will be in the immediate future as I’m going to be busy with a cross country move shortly, but rest assured I’ll do my best to keep the cobwebs here at bay. Thanks for dropping by.

Prime example, news this week of a former Fannie Mae contractor leaving a malicious script designed to wipe out thousands of computers after he was fired for…a scripting error he made earlier in the month. Luckily they stumbled upon the script before it was set to execute. They might not have been so lucky though. Bruce Schneier has some good tips about reducing the threat trusted individuals can pose.

In the end, you can take several measures to reduce your insider risk but you can never eliminate it entirely. At the end of the day the weakest link always comes down to people. People are sometimes dishonest, it’s simply a fact of life. Luckily for the rest of us, they seem to be a pretty small minority.