Author: Steve OHearn

Security Inside The Perimeter

A key in a keyboard lock

One of the issues that was being discussed at this past Oracle Open World 2012 was the importance of considering security during the design stage of a system development effort.  Technology journalist Michael Lee wrote about this issue last fall in a piece titled Developers ignore their security responsibilities: Oracle.  In it, Lee addressed the observations of Oracle Chief Security Officer Mary Ann Davidson:

Marines don’t consider perimeters to be completely unbreachable, and hence, need to be prepared to defend themselves from attack from the inside … Davidson said that many organisations still assumed that attackers won’t get inside their perimeter … [1]

Davidson is totally right, but it is starting to change.  An increasing number of the customers I work with are starting to operate on the assumption that security perimeters will be breached.  Security measures are no longer limited to protection at the perimeter.

This is one place where analytics can play a role.  I’m not just talking about security information and event management (SIEM).  Through data collection and pattern analysis, an alert system can proactively monitor for aberrations in the data flows and process flows within a system, and can help identify probabilities of a possible intrusion and take actions accordingly. But the point is that most security starts with a healthy dose of common sense, applied at all levels of a system’s operational capabilities.

I live in the suburbs of Washington, DC, but recently attended an NFL football game in Philadelphia, and afterwards was having dinner in downtown Philly, when I received a call on my mobile phone from Visa.  They said it was a courtesy call regarding my credit card, and offered some proof of who they were and how they knew my account, and then asked a few questions to confirm who I was.  The exchange was professional and left me confident of the authenticity of the call.  They then asked if they could review a few recent purchase requests on my credit card, and I said – sure.  Sitting there in the restaurant, I listened as they asked me if I had authorized a purchase of gasoline in Pennsylvania that morning?  I said well yes, as a matter of fact, and feeling comfortable that they were who they said they were, I offered that I was heading to the Redskins-Eagles game that day, and was intending to use the same card to pay for the dinner I was eating as they were speaking to me.

They then asked if I’d attempted to purchase a washing machine at a Target department store in Washington, DC on that same afternoon.

I said – uh – no.  I was sitting in the Eagles stadium in Philadelphia about that time.

What about a refrigerator at a second location, also in DC?

Definitely not.

They then said well, you probably didn’t authorize these additional six or seven attempts to purchase large appliances at five different department stores in Washington, DC this afternoon, if you’re in Philly at a football game.  I said – no, not at all.

Thank you, they said, we rejected all of those attempts and just wanted to confirm we did the right thing.  And should you use the card to purchase your dinner tonight, it will be approved with no problem.  But we’re going to cancel this number and issue a new credit card to you, you’ll not be charged.

I said – thank you.

I enjoyed the rest of dinner, paid for it with no trouble, and two days later I had my new credit card with the new number.  I was never charged anything inaccurate or fraudulent.  It all worked out remarkably well.

To help put the incident in perspective, I had the correct physical credit card with me at all times, and the would-be scammer did not, but whoever it was had my credit card number, and he or she was attempting to use the number alone – without the card – to make these purchases.  Visa rejected them all, and according to what they told me, it was in large part due to the fact that the purchases conflicted with my patterns.  Also, this all happened right before Visa began issuing cards with an additional numeric code printed on the back of the card.  That started immediately after these events, so it didn’t apply to these circumstances.

At the end of the day, security is not only about the latest technological breakthrough.  It’s about a combination of two things:

  • A sound understanding of the how the fundamentals of technology operate
  • A common sense approach to defense against classic con games

Any system developer must keep these concepts in mind, and recognize them in securing perimeters, and in developing a solid plan of defense for those times when perimeters are broken.  Perimeters will be broken.  The only question is:  how will you respond?

Footnotes

[1] http://www.zdnet.com/developers-ignore-their-security-responsibilities-oracle-7000005808/

Social Media Rock Stars Jon Ealy and Jeremiah Anthony

In October 2011, two students at Iowa City’s West High decided to use social networking to complimenet and encourage fellow students, as something of a counter to the practice of cyber-bullying that’s been reported in various news articles lately. The students are named Jon Ealy and Jeremiah Anthony. The practice has attracted a good amount of notice, particularly from Skere9.  There’s a photo at Pinterest of Jon and Jeremiah working together on the sites.  Their sites include a Twitter account named @WestHighBros.

And here’s a video – that only mentions Jeremiah for some reason, but – see below.

For “Old Christmas”: Carrie Underwood and “How Great Thou Art”

Today is January 6, which is “Old Christmas” in many parts of the world.  In Ireland, January 6 is observed as “Little Christmas“. The Feast of Epiphany may or may not be January 6 – it depends.  But the tradition of “Old Christmas” is always observed on January 6.

January 6 is also the day my grandfather passed away, twenty-seven years ago today, a day I’ll never forget.  He was born in Myrtle Beach, South Carolina on December 25 – Christmas Day – and at his funeral, I heard some of the folks there in South Carolina remark that he was born on “New Christmas” and passed away on “Old Christmas”.

My grandfather was James Demery, and he was a great man.  And he played electric guitar a lot like Vince Gill plays in this video, a fact I didn’t know for years, even after I’d picked up the guitar myself at ten years old.  And whenever i think of gospel music like this – which I love – I often think of my grandfather.

I don’t generally post on Sunday, but this isn’t just any Sunday, not to me. So for today, here’s a unique video. This is perhaps the best performance of one of the greatest hymns ever – Carrie Underwood singing “How Great Thou Art”, with Vince Gill on guitar.

For more about Old Christmas, see:

The Cowboy Chicken Club

I had the fortunate opportunity to attend last week’s football game between my favorite team, the Washington Redskins, and our longtime rival, the Dallas Cowboys. The Redskins were victorious, amazingly enough, and we’re all looking forward to going to the playoffs this week, something that hasn’t happened in quite a while.

I was digging around for some old Redskins performance records and stumbled on this fascinating piece of history I’d never heard before, found at Wikipedia page titled Cowboys-Redskins Rivalry“:

In December 1961, an unknown number of Cowboys fans sneaked into D. C. Stadium, armed with bags of chicken feed. When Alaskan snow dogs were to drag Santa Claus onto the field during the halftime show, the pranksters would unleash dozens of hungry chickens onto the field – 75 white, one black. The significance of the black chicken was to symbolize how [Redskins owner George Preston] Marshall was the only owner in the league who would not recruit an African-American football player; Marshall stating, “We’ll start signing Negroes when the Harlem Globetrotters start signing whites.” [1]

Talk about a bizarre moments in football history.

Footnotes

[1] http://en.wikipedia.org/wiki/Cowboys%E2%80%93Redskins_rivalry#Cowboy_Chicken_Club

The Twitter Dress and Wearable Computers

If you’re looking for a great Christmas gift for a special someone, you might consider the new “Twitter dress”. The BBC did a three and a half minute video showing it in action. The “Twitter dress” displays an animated series of controllable lights in various displays of an LED style of lights, with the capability of displaying tweets or other messages received in real time. It also can take photos.

Nicole Scherzinger at the 4G Launch party of UK's Everything Everywhere.

The name “Twitter dress” comes from the London launch event of the new 4G service of UK mobile network Everything Everywhere.  The launch event featured Nicole Scherzinger, the former lead singer of the Pussycat Dolls.  (Some still blame Nicole for the breakup of the band, but that’s another story.)  Scherzinger’s dress drew a great deal of attention at the EE 4G launch, with its flashing lights and ability to display tweets in real time, and triggered a lot of buzz in the Twitterverse during the live event.  This all just happened in November, so we’ll see if the name “Twitter dress” sticks, but for now, that’s what it seems to be known as.

I first saw a wearable computer at COMDEX in the 1990’s in Las Vegas.  A company called Xybernaut seemed to be leading the field.  I remember exiting the COMDEX convention one night, and finding a “booth babe” standing just outside of the convention center.  Imagine a vast concerete and stone patio, under the dark night desert sky, with the balmy warm breezes of Nevada gently blowing.  In the distance were the lights of the convention center in one direction, the lights of the casinos in another direction, but standing between them on the patio, a surreal tall cylinder, about ten feet high, cut open on one side, and looking like a Star Trek-style teleporter device, large enough for only one person to stand in.  A few dramatic beams of light shown straight down from the inside ceiling of the cylinder, down through the dark onto the person standing inside, who was just waiting there for whoever might happen to walk by as they exited the convention – as I was doing.  She was a pretty model, of course, with long flowing hair, dressed in a form-fitting costume like Batgirl from the 1968 Batman TV series, complete with a utility belt to house her wearable CPU, as well as storage and other devices, with a fascinating monocle over one eye for her heads-up display (HUD), and a tiny joystick in her left hand, like something you might use to operate an old racing slot-car.  I found the monocle a bit hard to use, I could tell it would take getting used to, but I thought the potential was fascinating.  It was one of the more compelling displays I’ve seen at technical conference, as you may have surmised by now.  But it was also the last time I saw anything about wearable computers at a technical conference.  I think the rise of mobile devices made the wearable computer concept a bit irrelevant.

But is that changing now?  With new advances in the miniaturization of cameras, displays, controllers, and other devices, and the widespread adaptation of hand-held devices – and therefore public acceptance of these products – we may soon see the “Twitter dress” and other developments gain traction with end-users.  I think it’s inevitable that technology will merge with clothes, fashion, and other forms of personal expression and interactive communication.

Stay tuned!

What do you call …

What Do You Call….

1. What do you call a cow that’s just had a baby? Decalfinated.
2. What do you call an exploding ape? A baboom.
3. What do you call a snake who is employed by the government? A civil serpent.
4. What do you call a hippy’s wife? Mississippi.
5. What do you call bears without ears? B.
6. What do you call the shortest distance between 2 jokes? A straight line.
7. What do you call a blind dinosaur? A Doyouthinkhesawus.
8. What do you call a parrot when it has dried itself after taking a bath? Polly unsaturated.
9. What do you call a cat who ate a duck? A duck-filled-fatty-puss.
10. What do you call a cat that tells jokes? A witty kitty.
11. What do you call a person who draws amusing pictures of motor vehicles? A car-toonist.
12. What do you call a rooster who wakes you up at the same time every morning? An alarm cluck.
13. What do you call a lady magician? Trixie.
14. What do you call a crazy spaceman? An astronut.
15. What do you call a cow with no legs? Ground beef.
16. What do you call a veterinary surgeon with laryngitis? A hoarse doctor.
17. What do you call a snake that becomes a Canadian law officer? Mountie Python.
18. What do you call a rabbit who is really cool? A hip hopper.
19. What do you call a butterfingered nurse? A medicine dropper.
20. What do you call a fake noodle? An Impasta.
21. What do you call the best butter on the farm? A goat.
22. What do you call a song sung in a car? A car-tune.
23. What do you call something lying at the bottom of the ocean and twitching? A nervous wreck.
24. What do you call two guys from Mexico playing basketball? Juan on Juan.
25. What do you call a camel with no humps? Humphrey.

Announcing the winner of the Cartesian Product Challenge

Hello friends!

I announced the winner of the Cartesian Product Challenge at this year’s Oracle Open World 2012, here’s the formal announcement:

Steve O’Hearn – The Challenge from Oracle Certification on Vimeo

And yes, what I say above is true – this is the winner of the FIRST annual Cartesian Product Challenge! More on that soon, in the meantime, to all my American colleagues, a very happy Thanksgiving!

Here’s a little background on this video: this was shot at the Oracle Open World Certification Lounge, in the Moscone Center, on Monday, October 1, 2012. However – it wasn’t really planned. I was there to do a question-and-answer session with Oracle Open World attendees on issues pertaining to certification in general, and the SQL Expert exam in particular. The outstanding Carey Hardey made a lot of the arrangements, and the fantastic Harold Green of Oracle Corp. was there as well – he does Oracle TV spots for the company and had an impressive setup in the back of the room. I’d already brought up the idea of making the announcement of the Cartesian Product Challenge winner there, and Harold and Carey were both supportive of it, and when I was there, Harold had the idea of filming it. So I made some notes on my iPad (that’s what you see me glancing down to read) and grabbed some coffee, and with maybe five minutes of prep, we shot it. Harold is equipped with a tremendous portable recording system, complete with a high quality camera and excellent lighting system, and you can see the results above.

 

A few minutes later, we shot a second video for the Meet the Author series, which I’ll post tomorrow. After that, Harold folded up shop and was gone within about five minutes, to travel a few blocks and set up all over again for another shoot – I think that was scheduled to be at the nearby companion conference, JavaOne.

Stay tuned for more!