Mythic Monday – Orpheus
- At February 02, 2009
- By Josh More
- In Mythology
- 0
So, you all know the story of Orpheus, right?
Short form:
Orpheus was the greatest musician in the world. He had a wife named Eurydice who died. He went to the underworld, played for and charmed the Lord and Lady of Death (Hades and Persephone) into letting him bring his wife back from death. The one condition was that he not look back on his journey back to the lands of the living. Being a Greek tragedy, he looked back and saw his wife following. She then faded away, and was gone forever.
Longer (and better) versions can be found here and here. I mostly want to look at one main theme.
Trust
While, most people seem to have a general idea of what the word “trust” means, there has been considerable debate in the computer security field as to how to build it into systems. They raise questions about levels of trust, webs of trust, calculating trust, and how to handle the fact the trusted relationships can change over time. These questions can be very fine grained and particular, but you’re probably not interested in the academic nature of these discussions. Instead, let’s look at a couple examples.
Scenario 1: You partner with a large company.
Suppose you enter into a business partnership with a company that is much larger than yours. Odds are that you have to fill out a contract and commit to specific items (usually based on revenue). You are then granted access to specific resources at the large company. In IT, this is usually in the form of internal-use licenses.
In this model, you trust the company to provide you with software that doesn’t steal your data and the company trusts you not to resell your licenses to others or otherwise negatively impact their revenue. So, what happens if the trust model is violated?
Well, there are really two variants. If you break the trust relationship, you will likely be faced with, at minimum, the severing of partnership and, at maximum, legal action. However, if it turns out that the large company is not to be trusted, what can be done? Legal action may not be much of an option, and if you terminate the partnership, how much would it hurt you versus the large company?
Is the partnership fair?
Scenario 2: Trusted people within a business.
In security discussions, the second hardest discussion is trying to convince a client that inside attacks are a real and present danger. Of course, the hardest discussion is after the trusted insider is discovered to have been embezzling money or selling private data, so it’s often worth the time to have the first discussion.
Simply put, businesses don’t function well without trusted internal people. If there are too many rules, work can’t get done. However, the more lax an organization is, the more risk it faces. In time of economic difficulty, this risk increases.
Why? When people don’t get bonuses and raises, they often take it personally. They may be in a position where valuable data (or even just money) passes through every day. They may stop and think “gee, with all this money around, who is going to miss a little tiny bit” then they’ll have the big thought of “besides, they owe me”. Sometimes, they wind up in personal difficulty, and it starts as a little “borrowing” that gets out of control.
This happens all the time: police sergeants, booster club presidents, priests, vice presidents, and more.
Yeah yeah, I know, you’re different, your people can be trusted.
Maybe, maybe not. . . probably not.
Do you have any systems or procedures in place to catch this type of activity?
Conclusion
In the story, Hades and Orpheus had an agreement. Sure, it was an agreement with an odd condition, but that’s not exactly unusual in partnerships. In this case, who was trustworthy and who was not? Also, how were the individuals impacted?
Hades: Got to hear some lovely music.
Orpheus: Lost the love if his live TWICE.
The cost of being untrustworthy is awfully high, isn’t it?
So, what could Orpheus have done differently? Might the agreement have benefited from some additional clarity, so that his nervousness could have been alleviated? Could there have been some procedure or technology used to make it more difficult for him to violate the agreement?
Look at the trust relationships at work within your business. Consider what happens if you wind up being untrustworthy. Consider what happens if your partner isn’t trustworthy.
Is there anything in place to validate and maintain the trust?
Should there be?
Grinnell and Giving Followup
- At December 28, 2008
- By Josh More
- In Business Security
- 0
About a month ago, I made a post calling out to former Grinnell students to stand with me to get some changes made.
Well, while that post was one of my most widely read, no one stood with me. I somewhat expected this. Also, Grinnell isn’t making any reactive changes. I also expected this.
What I did not expect, however, was to receive a phone call from Jim Hess, the Director of Alumni Relations at Grinnell College. We had a good talk and followed this up by meeting in person and talking for a few hours. I also talked with Dan McCue, the Assistant Director of Alumni Relations. Dan was kind enough to send me the following (links changed to be made clickable):
Josh,
Thanks for stopping by the office last week. I wanted to share some sites that detail the issues you addressed:
1. Admission to Grinnell is need blind and financial aid has been increasing as necessary already. (A brief explanation can be found on the Admission website: here.) We have already limited loan within need to $2K per year. (Details available from the Office of Financial Aid: here.) This change was instituted this past winter, prior to the current economic downturn: here. An article also appeared in the Spring 2008 issue of The Grinnell Magazine.
2. We have many post-grad fellows, but we’re not a grad school. Information about post-grad fellowships is online at the Office of Social Commitment: here. Grinnell also funds the Grinnell Corps program: here.
3. The senior opportunity scholarship buys-down debt of deserving seniors. Visit here for more information.
4. Our pay-grades are $7.25, $7.50, $8.25, and $8.85 – dining is $8.25 and they have job openings.
5. The Career Development Office continues to work with any alumni who call. CDO can assist alumni with resume critiques, interviewing tips and share job search resources. Visit here for more information.
So, in considering my challenge from earlier:
1) Either discount tuition for the Senior year (to keep them in school) or institute a tuition freeze for all current students (i.e., no tuition hikes for current students).
This was not done, but I had been previously unaware of the senior opportunity scholarship. I think that this partly counts, so I’m going to award them a half point. I also had the $2k debt limit explained to me. The college really prefers this to be called a $2k loan limit, but I must admit that when I first heard this term, I had thought that they were lowering financial aid, not raising it. What it really means is that, at the end of a student’s four years, they should be left with no more than $8000 personal debt, which I think is a very reasonable way to manage the situation. They get the other half point for this.
2) Boost the number of on-campus student jobs by at least 30. and 3) Raise the entry-level wage for student jobs by at least $1.00/hr
Since there are openings that are not being taken, and they are at a comparable rate, I’m going to call these “close enough”. I still think that Grinnell should create some more jobs, especially since there are worthwhile projects out there that would help both the students and the school, but if current students aren’t taking the current job openings, there must not be sufficient need to push this.
4) Offer free classes to alumni on getting a new job, covering interview, and resume techniques. Ideally, these classes will be available online so that non-local alumni can attend them.
I’ve long heard that the CDO will work with any alumni who call. However, I view this as a far cry from actually providing classes. Classes are about education and learning and are strategic in nature. The method currently offered by the CDO is reactive and tactical in nature. I’d still like to see a program around helping people target new opportunities, craft a marketing plan for themselves and pursue the opportunity. The days of simply sending out resumes and interviewing on chance are over, so I do not perceive this as taking a leading position. (If you’re with the CDO and wish to disagree with me, comment here or give me a call.)
So, no points there.
In the end, It looks like Grinnell got 3 points, or $300. Dominican University therefore gets $100. In any case, I’m out $400.
But, you know what I got for that $400? I got an amazing first hand look at branding and marketing.
Now, I am sure that I am biased, but I have known about Grinnell for many years, as have many of the people I’ve talked to since I’ve graduated. In contrast, the response that I got from friends and associates when I mentioned Dominican University was a universal “where’s what? / who are they?” It seems that Grinnell has done a good job of branding. Seemingly (at least in my area) a better job than Dominican University.
However, and this is the very interesting bit, I got a very fast reply from Dominican within the same medium as my message. I got a contact from Grinnell that was effectively out-of-band. I had no idea what Grinnell had been up to before I was contacted, but I found out what Dominican was doing almost the same day they did it, without my altering my daily routine at all. In short, Dominican is embracing social media and Grinnell is not (I have been informed that this will be changing soon). So, while Grinnell has a stronger brand than Dominican, Dominican has better marketing than Grinnell.
The other interesting observation was about communication. I heard from a few Grinnell alumni that I should have checked better what Grinnell was doing before I posted this, that I should have checked here and there (at which point they’d send me a list of obscure links). All of these communications were personal and emailed directly to me. All of them came from people still working in academia. What’s interesting here is that I’ve transitioned to business. My communication style is many/one-to-many, not one-to-one. Sure, I could have looked up the base rate that students were being paid, the number of jobs available. I may have even found out that limiting loans to $2k isn’t a bad thing (doesn’t limiting the loan amount sound bad to you?).
However, to do so, I would have wasted at least half a day finding the right people. The Dominican information came to me, as I follow news relating to education. I do not follow news that is specifically Grinnell-focused, but anything important that touches on education and liberal arts should come my way. Dominican managed to release the information in a way that was concise, easy to understand, easy to propagate and timely. Grinnell’s information was not – even though I get emails and letters from them, I was unaware of certain things that they were already doing.
In my discussions with Jim Hess, it was clear that this is something that Grinnell is working on. In fact, there is a chance that I may be allowed to work on it with them, as the project that they’re pursuing to make this happen has some potential. However, as my work with other schools has shown me, “the wheels of academia turn slowly”. I find this a sad thing, as it’s that very slowness that could cause a weakening of Grinnell’s brand position and allow (relative) upstarts like Dominican to overtake them. Clearly, being a graduate of Grinnell, I’d prefer that this not happen (sorry, Dominican) and will put forth some effort to help them out.
In any case, it’s $400 that gives Grinnell and Dominican students a bit of help, gives me a valuable lesson and hopefully allows me to pass the lesson along to you.
I consider that money well spent.
Grinnell and Giving
- At November 25, 2008
- By Josh More
- In Business Security
- 3
I know I’ve not been blogging much lately. I’m working on that, but until I get to the business and security content that so many of you come here for, I have to share this. It’s about my alma mater, Grinnell College.
When I set foot on Grinnell’s campus, it felt like home. My four years there were focused on education. Not necessarily the academics, but education nonetheless. While I did learn a lot about Physics and Art, I learned a lot more about friendship, adversity, pain, love, and how to get along with others. It was where I stopped being a child and started on the path towards being an adult. It was a time of transformation and metamorphosis. Of all the times in my life, it is the one I point to when I need to say “This is when I really started to be me.”
Since that time, I have worked a few jobs and have learned a lot about adult life and the working world. I’ve begun to look upon Grinnell with new eyes.
Since graduation, I have been irritated when I get calls and letters from Grinnell asking for money. This is not because I think poorly of my time at Grinnell, quite the contrary. It is because the administration of Grinnell seems to have been working very hard to ensure that the experiences that I had there could not be repeated in the future. I’ve heard about the exorbitant salary for the college president, continuously skyrocketing tuition, and the erection of larger and larger buildings. It appears to me that the college is attempting to grow and, through growth, become something other than what it was to me: a small, incredibly liberal arts college where students are free to experiment, make mistakes, and become adults.
My fear is the Grinnell has gotten lost in the pursuit of college rankings and the cost of the college experience. As such, I cannot justify giving any of my money to the college.
Today, I heard about Dominican University. It’s similar in size to Grinnell. It’s a small Catholic university located in Northern Illinois. I don’t know their politics or academic record. However, I do know something about their values. Detailed in a press release, they are addressing the current economic situation as follows:
1) To encourage students staying in school, all seniors graduating in January and May 2009 are granted a tuition reduction towards Masters-level tuition.
2) They are expanding the number of on-campus student jobs.
3) They are raising the entry-level wage for student jobs.
4) They are offering free classes in resume writing, interviewing, and finance management to all alumni that need them.
5) They are offering scholarships to parents of current students who are between jobs and wish to gain education.
I am astonished that the little school about which I knew almost nothing prior to today is taking such an active role in promoting education in society. I am impressed at their creativity and attention to their values. I am deeply deeply ashamed that my own school is not leading the effort.
So, what am I going to do about it?
I am not skilled in political theory or sociology. I do not have an incredibly deep understanding of economics or history. Grinnell did, however, teach me about systems and to be a moderately skilled writer. I know about physical, biological, technological and business systems. I know that the lifeblood to an institution like Grinnell is money and that the lifeblood to a college student is the assurance that they can stay at Grinnell to complete their education. I know that a great many people that attended Grinnell have skills that vastly exceed mine in their own areas of expertise.
Therefore, I am going to put my money where my mouth is. I challenge Grinnell to meet Dominican University and lead that way, proving that education and raising responsible adults still wins out over political games and attracting high-profile donors. I am setting aside $400. It’s money that I had earmarked for something else, and not having it will hurt. I think that this is very important, however, so I’m going to do it. I give Grinnell four challenges to meet by February 1.
1) Either discount tuition for the Senior year (to keep them in school) or institute a tuition freeze for all current students (i.e., no tuition hikes for current students).
2) Boost the number of on-campus student jobs by at least 30.
3) Raise the entry-level wage for student jobs by at least $1.00/hr
4) Offer free classes to alumni on getting a new job, covering interview, and resume techniques. Ideally, these classes will be available online so that non-local alumni can attend them.
For each point that the college can meet, I will give the college $100. For all that haven’t been met by February 1, I will give $100 to Dominican University. I am not Catholic and suspect that I would disagree with their politics, but I have to support these particular values. If my alma mater won’t adopt them, I’ll support the school that will.
Similarly, I challenge my fellow classmates to join me. Work within your own areas of expertise to spread the word. Come up with other ways that the college can help the students, not just the rankings. Put up what money you can afford so that Grinnell can see we’re serious. Either challenge Grinnell directly or donate with an earmark towards “reducing the economic burden on current students”. Post this or an abbreviated rewrite (I do tend to go on) on your blogs/facebooks/myspace/livejournals/etc. I may not be skilled in “getting the word out,” but I know that some of you are fantastic at that.
Do what you can
Help us help the next generation.
-Josh More
Grinnell Class of 1999
Certification – Conclusion
- At July 29, 2008
- By Josh More
- In Business Security
- 0
Well, if you got this far, you should have everything that you need to pass your certification with flying colours. Once you have it, take a few weeks to relax (and gloat, if you are so inclined). Then, work on maintaining it and look for your next challenge. Try not to rest on your laurels too much, or someone will pass you up. It’s always easier to maintain a lead than to catch up to someone else or a changed industry.
I hope that this helped.
Certification – Test Types
- At July 24, 2008
- By Josh More
- In Business Security
- 0
There are generally two types of tests. Those which you can go back and look at questions once you’ve answered them (generally paper-based) and those where you cannot (generally practica or “live” tests). Each of these have different strategies to win.
Paper-based
If you are taking a paper test, go through it as fast as you can and answer everything that you KNOW. If you don’t know, skip it. You should be done very quickly. Then, go back through the test and look at the ones that you didn’t know right away. If it’s multiple choice or true/false, find the answers that you KNOW are wrong, and cross those out. You’re not actually answering questions at this point, you’re just eliminating possibilities. Then, go back through and see if you KNOW any of them now that you’ve eliminated the ones that were obviously wrong. This also should not take much time.
By this point, most of the test should be answered, and the good news is that these answers are things that you know are correct, and with absolute certainty. Now you get to actually start thinking about the remaining questions. This will be hard, but you have to keep in mind that you have already answered most of the questions right. It’s OK if the hard questions are hard, just do the best you can. If you’re stuck, try to think of a real-life scenario involving the question and ask what you would do. You can also flip the question around and see what you would do if the situation were reversed. This may make the correct answer more obvious.
If there is an essay component to the test, do NOT just start writing. First, take notes of what you want to say. Then, categorize the notes by putting a letter in front of each key item. Then, within each category, prioritize the importance by putting a number in front of the letter. Then, write an introduction and segue into point 1A. Once you’ve addressed that, go to 2A, to 3A and all the way until you’re done with the As. Then start with 1B. At this point, your essay has become a game of connect the dots, and you can just write until you’re done. Don’t worry about style, the examiner is looking for correct information, not a brilliant expression of ideas.
Live Tests
As computers advance, these tests are becoming more popular. They allow the test to adjust itself to your level. Sometimes this is used to give you challenging questions, sometimes it’s used to drive you into an area that you do not know so well. On tests like this, you have to know the scoring. Keep a mental tally on how you are doing and how much of a penalty you may get by skipping questions. Then, allocate time based on what you need to do the best. It’s often better to take more time on each question than on the paper tests, because of how wrong answers can impact the questions that you get later.
Practicum
When taking a practicum, you cannot use strategy to manipulate the test system to your advantage. You either solve the problem or you do not. Luckily, there are often multiple problems to solve, so start with the ones that you know best. However, do NOT assume anything. Do not make any changes that you cannot test. Test before a change and then test after, to make sure that your change did what you think. If you have to restart a service, test after the restart, to make sure that your changes persisted. On many systems, it is easy to forget that some changes only affect the running system and are lost on a reboot. (Cisco is tricky this way.)
Also, use proper diagnostics. Test at the boundaries or interface layers. On modern systems, this is often the TCPIP stack, so use tools like netcat and telnet to ensure that the interfaces are responding properly.
Most systems also come with built-in reference documentation. Whether it is a commented configuration file, the documentation that came with the package, or a man/help page, know where to find the information and verify that you understand what you think you do.
Lastly, at the end of a test or scenario, RETEST everything that you’ve done. Make SURE that the problem is solved. It’s much too easy to break one thing when you’re fixing another.