The Intelligent Community Forum just completed its annual summit, which celebrates the Top 7 most intelligent communities in the world. These are the global leaders who have already made investments in broadband and in community building — and who are now looking to see how they can build on those advantages.
This year’s theme was innovation and employment, so I was asked to give the keynote presentation on the question of whether innovation destroys jobs and how sub-national governments should respond.
This is a summary. The video of the presentation will be available in a couple of weeks. [Note: there was a foreshadowing of this presentation in my earlier blog post "Are Jobs Disappearing?"]
Here I sit… In Mel’s Drive-In Diner, San Francisco, CA. I just inhaled the “El Ranchero Americano”, which I am sure to regret later, and am enjoying tunes from yester-year complete with Doo-Wop and Presley. You may ask, “Why do I care…?” Well, before this turns into an episode with Anthony Bourdain, I will let you know that I am in ‘The City’ attending RSA Conference 2013.
Allow me to give you a quick background. RSA’s goal is to connect security professionals from around the world in order to continue the growth and importance of security as technology aggressively expands. RSA started these conferences in 1991 when internet security really became a topic of discussion. Everyone who is anyone is here, from start-up companies to our own Cisco.
Again, you might ask “What’s the big deal?” I listened to a keynote by Vint Cerf, widely known as ‘The Father of the Web’, he gave an ‘If you can imagine…” speech. In this talk, he said if we could imagine our refrigerator being able to ‘talk’ to us… explore the internet for recipes in which the ingredients are what we currently have in the fridge and have a list of those recipes ready for us on the door or emailed to us. Pictures on our refrigerator being streamed live from our loved ones as they are posted on various social media sites, keeping us in the loop with our families across the world… It’s not ‘If’, it’s most certainly ‘when’… We are currently living in the era of the ‘Internet of Everything’.
With this, though, comes the most important element: Security. How? How do we secure all of our information as we move forward? How do we secure billions of people while maintaining a ‘free moving internet?’ That’s why we’re here. We are here to discuss current security initiatives, evolving ideas, discussing the gaps in our current security… We are here to protect you.
As we move forward, it is absolutely essential to protect our ‘freedom’ to use the internet anytime, anywhere, and on any device. There are professionals working tirelessly in order to maintain that connectivity, and conversely, there are just as many trying to take our freedom away by disrupting our service and ‘stealing’ our personal information for their personal gain.
In our progression to ‘work our way’ in every way, we must stay vigilant and always on guard. I don’t know about you, but I do enjoy my flexibility and I also know I can sleep well at night knowing that there are people invested in my cybersecurity safety.
As I wind down and get ready for Thanksgiving, I am thankful for so many people in my life. At Cisco, I have the opportunity to work with amazing people around the world dedicated to helping others. These people are the heroes who help, teach, heal, serve, and protect us.
At Cisco, we believe it is our role to help heroes around the world dedicated to public service. We share our vision in this short video titled “Being There.”
This will be my last blog of the month in regard to our Nations Cyber Security Awareness Month. I was able to attend a webinar, “Defending Cyber Borders -- Beyond the Virtual Maginot Line” October 25th, in which a panel discussed what CIOs, CEOs, and those who work in the virtual realm; pretty much all of us, need to focus on in regard to defending our virtual borders.
The panelists were as follows:
Rick Holland, Senior Analyst, Forrester: Rick is a Senior Analyst serving Security & Risk Professionals. Rick helps clients optimize security architectures and technologies to protect the organization from advanced threats. His research focuses on email and web content security as well as virtualization security. He also supports research in incident management and forensics. He is based in the Dallas area.
Rob Lee, Fellow, SANS Institute: Rob Lee is an entrepreneur and consultant in the Washington DC area, specializing in information security, incident response, and digital forensics. Rob is currently the curriculum lead and author for digital forensic and incident response training at the SANS Institute in addition to owning his own firm. Rob has more than 15 years of experience in computer forensics, vulnerability and exploit discovery, intrusion detection/prevention, and incident response.
Steve Martino, Vice President, Information Security, Cisco: Vice President Steve Martino leads Cisco’s Information Security (InfoSec) organization to innovate and adopt the most effective security technologies and policies, reflect them in Cisco’s people, products and services, and share them with customers. He has more than 30 years of high-technology experience in security, IT operations, product development and operations, marketing, and sales.
Shehzad Mirza, Director, MS-ISAC Security Operations Center: Shehzad Mirza is currently working as the Director of the MS-ISAC Security Operations Center (SOC). He is responsible for managing a team of analysts. Previously, he has worked as a principal consultant with Symantec Corporation managing various cyber security projects, and a technical trainer for New Horizons Computer Learning Center. Shehzad has worked in the security field for over eleven years and is MCSE, GCIH, GAWN, and CISSP certified. His main expertise is in network security infrastructure and assessment, firewall configuration, IDS/IPS configuration, PCI compliance, staffing and vulnerability assessments.
Rod Turk, Director and CISO, U.S. Patent and Trademark Office: Mr. Turk’s current position as the U.S. Patent and Trademark Office (USPTO), Chief Information Security Officer and Director, Office of Organizational Policy and Governance puts him at the forefront of the government’s effort on cyber security. Mr. Turk manages and oversees USPTO’s compliance with the Federal Information Security Management Act (FISMA) and implementation of IT best practices.
A major theme that resounded throughout the webinar was that everybody is a fighter in this battle. We, the end user at the device, are the ones who have to stop the intrusion first by knowing not to go to this website or click on this link from an unknown email. It was stated that many (possibly up to 97%) of these ‘fishing’ attempts can be thwarted at the end user level. It was also stated that the ability for those involved on the technology side of the house to integrate and create a relationship with the non-technology side is paramount. Together, lets to be able to teach proper protection at the end user level and create policy that is revisited, refined, and correctly implemented. Let’s not create an environment to where our “incident responders”, those who will aid in the detection, mitigation, and recovery phase, are wearing two or more hats. They have to be focused on the task at hand and be able to virtually isolate or quarantine that end user device from the network.
Rod Turk made the analogy of a hard chocolate covered cherry. The outside is protected, but once a bite, even the smallest bite is taken, and that first layer gone, the rest is just gushy and soft. He was using this to describe the security that most company’s put in place as far as protection. There has to be a focus from protecting inside out. Once again, the idea of the end user protecting or detecting malware and reporting such will allow for faster response and may also allow the responder to trace the malware back to a source.
So where do we begin? A focus has to be made in order to identify what is valuable that someone else would want? Why? Who? Why would they want to interrupt my operations? What’s important to me? What would they target? Identify those needs early and start with that. Go back to the basics in regards to solid policy and implementation; not only for end users but for IT professionals, too. Have good patch management, know what you have within your environment, you can’t protect yourself if you don’t even know what you have to protect. If you’re on a limited budget, no problem, just concentrate on what’s most important to protect right now and work from there.
Once again, the ability for the CEO, CFO, CIO, or CISO to be able to build a relationship and collaborate, I can’t stress this enough, is paramount. “Techie” talk isn’t sexy by any means, but it has to be understood on even high levels that everyone can be a stop gate or can be the catalyst to a massive intrusion. The barrier does have to come down and the old way of thinking, “I’m not a gadget guy, that’s someone else’s problem” has to migrate to the idea that this is an Asymmetrical Battlefield meaning a 360 degree fight. There are no ‘front lines’; everybody’s a target.
If you don’t get an opportunity to watch the webcast, I strongly recommend you do, then know this:
It starts with the human end user. We’re all in this toghether, so let’s be proactive in identifying what doesn’t look right, no matter how small, and report it.
Lean on your basic fundamentals either as an IT professional or the policy that outlines use of devices.
Create an environment that is conducive for incident responders to do their job by making sure their main focus is incident response
And lastly know that nothing will change if a proactive approach is not taken by both “Techie’s” and “Non-Techie’s”. Collaborate and Integrate.
It was great serving you this month! Please protect yourselves and help protect whatever agency or company you may be working for. Cyberspace is limitless and endless; we may never have a full grasp but we can start with a basic knowledge. You can check out MS-ISAC if you would like to know more.
It’s been over ten years since my last visit to the beautiful city of Washington D.C. It’s always great to visit all my favorite monuments and historical landmarks such as the Lincoln Memorial and Washington Monument. I wish I could tell you more about my wonderful dinners at the Old Ebbitt Grill or Brassaire Beck; but onto more important things.
As I walk through downtown, looking around, I was thinking to myself, how much things have changed since my last visit. Gone are the days of disposable cameras, brochures and maps -- everyone around me is using a smart phone to take photos, launching Google maps to find the Smithsonian, or scanning QR codes at the Smithsonian National Postal Museum to view additional factoids as they were walking about the museum. Everything is going mobile!
I’m here this week to attend the 12th semi-annual Telework Exchange Fall Town Hall meeting – “Mobility in the Fast Lane” focused on mobile IT and the mobile workforce. While I was here, my colleagues and I had the utmost pleasure to interview 9 government and industry leaders discussing topics such as security, standards, technologies and telework benefits and challenges within their agencies. It was fascinating to hear from these leaders how they are working in different ways to transform their agencies to better serve the American people, grow their workforce and create a balanced work-life environment for their employees. Read More »