response to metrics questions

I hate metrics because most of the time the people in upper management who use them have no idea what the context behind them is.

This was the latest request I got:
What % of exploits use buffer overflow
What % use ROP
What % use stack pivoting techniques in the case the overflowed buffer isn't large enough to hold the entire "ROP sled" [I'm sure they meant NOP sled.]

Does anyone have time to actually keep track that? Are we talking about worldwide?

Sourcefire and Symantec might:

http://labs.snort.org/blogfiles/Sourcefire-25-Years-of-Vulnerabilities-Research-Report.pdf

Their justification for this information: "I have a meeting I have to attend."

My thoughts: "Do they know the difference between vulnerability and exploit? Probably not."

My response: "Google Metasploit capabilities." LMAO

Dream Malware Lab Gets Milkshake Bar

Today they made everyone fill out another form because it might snow tonight.

2nd Law of Bureaucracy: "When in doubt, add paperwork."

Speaking of bureaucracy, the last 6 months of my life kinda go like this:
POLICY: What do you want?
ME: Malware policy
POLICY: Like written down
ME: Well, yeah, written down or at least in existence.
POLICY: What do you want it to look like?
ME: You tell me. You're the policy experts.
POLICY: We don't know, you tell us.
ME: I want it to look like this....[presents a beautiful bouquet of flowers]
POLICY: [eats flowers and barfs into vat of cafeteria chili] Oops...sorry

REPEAT REPEAT REPEAT REPEAT

For that reason we decided to install a fire pit at the dream malware lab. It will be out back. There will be aboriginal chieftains chanting at the people trying to commune with malware. The computers will be running off a generator which the policy people will be manual powering...I'm thinking via hamster wheel.

And then we added the milkshake bar for shits and giggles. It'll have to be Chick-fil-A milkshakes though.

The Dream Malware Lab in the Sky

Today I found this on Tumblr:
http://securityreactions.tumblr.com

And immediately I lost 30 minutes of work time laughing my ass off because it's all so true.

I run a malware lab. If the government wasn't so shitty, I wouldn't be sequestered.

If I wasn't sequestered, perhaps I would be able to build my dream malware lab in the sky. Not literally in the sky but it would probably have skylights.

And picture windows. Which would have scenic views.

I would have an aquarium maybe. Or a shark tank.

I would install slides to get from a top floor to a bottom floor.

I would get touch screens...maybe like Minority Report. Fuck it, I'll get precogs too.

Or at least the latest hardware and software to run bad stuff against.

In short maybe I should go work at Google.

Or Amazon.

Or publish a couple of my books on Amazon.

Oh hey! There's one for writer's too:
http://authorlife.tumblr.com

LMAO

Beavers on Wood

It's Beaver season obviously.

We went to Boston over the long Presidential's Day weekend. Among other adventures we went to the Boston Tea Party Museum, and of course, in the gift shop they had a variety of stuffed animals such as teddy bears with sailor suits on. As well as beavers!!! STUFFED BEAVERS! Wha...? I get that one of the tea ships was called the Beaver, but really?

So of course I bought a stuffed beaver because how could you not endorse such a rodent.

This was obviously prophetic because yesterday running around the lake I pointed out the trees chewed. And rounding the lake, we actually encountered the industrious pair. Fortunately, we have video footage.

OH NATURE!!! NATURE IN THE SUBURBS!


 

That awkward moment...

That awkward moment when you sit down on the toilet seat, and it's overly warm. Not that a cold toilet seat is comfortable, but it's better than the thought of strange asses.

Plus there's weird BO in the stall. Not a cutting-fresh-Bieber-tracks kind of odor. More like a day-old-Frenchman sort of smell. WTF?!?!

My boyfriend recently started working from home, and what is the number one plus...? No public restroom. He informed me that men have all sorts of rules about stall use in public bathrooms. When you're a guy, I guess you kinda know what other people are doing in those stalls. But women don't have that luxury. You don't always know what you're getting into until you sit down, the seat is warm, the stall smells awful, and on either side of you there are other women....shifting, sighing, groaning....  And rolling toilet paper. The stall is shaking they are rolling out toilet paper so vigorously!! Holy crap, leave some for the next victim, woman!

On this occasion I was also blessed with a faulty flush sensor, so despite sitting perfectly still, the toilet was in a constant state of Niagara Falls.

If this was at a restaurant, I would feel compelled to Yelp my troubles as I was doing my business.

But no, this was at the shitty government building I work in. Thus the coat hook falling out of a third set of holes drilled into the door. And the mediocre attempt to simulate a sophisticated powder room by the means of a 1970s era, ratty armchair.

I see people brushing their teeth in there and doing dishes. It all kind of gives me the heebie-jeebies for some reason. I want to be so fabulous, I get my own washroom. I don't think that happens in the government unless you're like the President or something.

Writing on the Job

Hey, don't mind the delay....I've just been lost in management hell.

Not sure about outside the government, but here in the Bowels of Bureacracy, "management hell" is the perfect storm of reviewing promotion packages and writing mid-term evaluations. Lest you think that's still "not too bad," remember that the Laws of Bureaucracy require each action to be accompanied by an arcane set of rules, multiple forms, and multiple levels of review.

Needless to say, all of this takes up most of February (at least if you're like me and have a good bit of people underneath you in the organizational chart).

In a way feedback on a promotion package can dovetail quite nicely into a mid-term evaluation because you can provide an employee opportunities to accept more responsibility in your organization if they don't like where they fall out in the mix of things.Unfortunately, even there you have to abide by the rule that you must break up the conversation into two separate conversations and get confirmation that the employee understands that it's two separate conversations. Not to mention, by the end of February supervisors are so addled-brained with this whole process, they can barely string words together or if they do it sounds like buzzword gumbo.

The good news...I'm writing.

The bad news...I'm not writing romance novels like I want.

Saying evaluation and promotion feedback is writing is like saying your letter to the editor counts as a publishing credit.

I did get a letter to the editor recently published though. Just saying. It's my name in print in the Jan/Feb 2013 issue of the Atlantic.Go ahead, look it up. I mean, it's still kinda cool that they thought my bitching was worthwhile enough to be considered for "The Conversation."


But anyway..."Writing on the Job"...doesn't that sound illicit? It would be if I could squirrel away enough time to pound out a chapter of erotic romance.

The fact is I do count this management hell as writing, even storytelling. How else do you capture what you've done in the last year for a wider audience, particularly when you're in a technical field like me and my employees? You have to get them with a hook!!

A quick lesson I gave my employees:

DON'T WRITE:  "I mowed the lawn."
DO WRITE:  "Tall grass was allowing gremlins to sneak into our house and break shit, so I mowed the lawn decreasing gremlin population in our house by 99.9%."

When management sees this, they're totally like "holy shit, gremlins!!!"  I kid you not, this is true. 

Not everyone can do this, which is why in my own promotion package I specifically pointed to my pursuit of a Degree in Writing Popular Fiction as a HUGE benefit for government as a whole.

Cue sly eyebrow raise & delicious grin.......mmhmmmm..........All of leadership should fear the gremlins!

Curious Morals

My first-grader and I...

Me: I thought you had a 100-day of school project you were supposed to do.

Jack: Yeah, I gave a girl $1 to do it for me. So then I only had $2 but the project was done. 

Me: …..

Jack: She wanted to do it.

Me: Or she wanted your money. Did you eat lunch yesterday?

Jack: I ate lunch.

Me: How much is lunch?

Jack: 3 or 4 dollars

Me: …..

Jack: I mean 2 or 3 dollars.

Me: So you ate lunch with your $2.

Jack: Yeah!

6-year-olds have curious morals, and Jack especially. I would think that's an age thing, but my other son Lincoln isn't usually as egocentric. A part of me thought, "it's wrong to not do your own work." But a stronger part of me was more concerned about Jack having enough money to eat lunch. 

In a way, I agreed with his decision. 

The project was to find 100 pieces of things and glue them to a piece of paper. Does that sound tedious? It sounds like a office temp job - GO, Copy, Collate, Staple, man-child scrub! Would I want to do that project? No. Would I pay someone $1? Absolutely!

The real moral of the story is....DELEGATE! Good leaders and managers do this! They have to. Need something done? Can't do it? Won't do it? Hire someone to do it!

Jack isn't a brilliant student, but he makes up for it with an uncanny charisma. When he plays "pick a hand," he doesn't always show you what's in the other hand. 9 times out of 10 it's a shell game. He might end up in showbusiness. A game show host, a comedian, a magician, a Ryan Seacrest, a Caesar Flickerman. And I would say...well, that just suits him to a tee.

Speaking of show business, this idea for getting a 6yo to tell a story is brilliant. Wish I thought of it. It has a moral of the story too. :)

the Scared is scared from Bianca Giaever on Vimeo.