Just as Part I of the new series unfolded yes­ter­day like some sort of highly charged Preda­tor drone turn­ing a Sub­aru into a huge sink­hole in a dirt road, here’s Part II. See, for what it’s worth, 2011 has been per­haps the strangest year in the field of infor­ma­tion secu­rity ever since GOBBLES stopped mak­ing new comics and TESO dis­banded into some sort of mix­ture of gone-into-the-crowd indi­vid­u­als and Twit­ter secu­rity rock­stars obsessed with ele­va­tor music. But also of highly pub­lic, con­tro­ver­sial and, in more than a few cases, rather shame­ful inci­dents. The land­scape of threats has evolved from a highly dynamic sea of sharks, stingrays, starfishes and bot­tom feed­ers into a jellyfish-infested shore.

Some of the jel­ly­fish react vio­lently to any intru­sions of their “thun­der zone” (as in “don’t steal my thun­der”, whether it means “do not pub­lish any­thing even slightly related to this thing I plan to present in over nine thou­sand con­fer­ences world wide” or “I shot first”). They expel these heinous hypo­der­mic hooks, which inject all sorts of dis­taste­ful karma into unsus­pect­ing hosts. In this sea of jel­ly­fish, for­mer inhab­i­tants of the salt water realm find them­selves hes­i­tant on shar­ing ideas and find­ing poten­tial part­ners for both pro­fes­sional and per­sonal growth. Then you’ve got the other kinds of jel­ly­fish, includ­ing those that pen­e­trate into net­works for the shake of pub­lic­ity, even when they can’t read Russ­ian, Por­tuguese and whichever lan­guage their “loot” was writ­ten in.

Con­tinue read­ing →

It’s 2011 and still, prac­ti­tion­ers of the infor­ma­tion secu­rity trade deal with the often frus­trat­ing fact that so-called leg­ends exer­cise, in vary­ing degrees, influ­ence in the deci­sion mak­ing of secu­rity com­pa­nies. These “leg­ends” are per­haps the most inter­est­ing exam­ple of an inverted gen­er­a­tional con­flict. While in other indus­tries the young have it much eas­ier than the old, in our (mostly minia­ture sized) indus­try, it is the old who had it much easier.

The dawn of the uncon­strained address space, of eas­ily exploitable secu­rity flaws, bug rid­den oper­at­ing sys­tem releases, et cetera, hap­pened some­time in the late 90s. Take the wheel of time a step for­ward into the early 00s, and our present year, and we have mit­i­ga­tion tech­nolo­gies all over the place, far more secu­rity con­scious devel­op­ers, repres­sive crim­i­nal­iza­tion of the trade­craft, multi mil­lion secu­rity bud­gets in the pri­vate indus­try and a bloom­ing media & press drive fuel­ing the desires of flat­u­lent self-promotion. Flaws still hap­pen, but the bar has been raised. Com­puter secu­rity in the 90s was child’s play com­pared to the cur­rent land­scape. What we have now is an ever evolv­ing, highly exposed matrix of cir­cum­stances and fac­tors. Large mem­ory sys­tems, 64-bit archi­tec­tures read­ily avail­able, high band­width con­nec­tions and a boom­ing mar­ket for infor­ma­tion ser­vices. Cur­rent gen­er­a­tions no longer gen­er­ate rev­enue only in those things which can be weighed or val­ued per old guide­lines. They gen­er­ate rev­enue in ways which were unimag­in­able ten years ago. A sequence of bits trav­el­ing across opti­cal wire can be worth more than an ounce of gold.

The require­ments of effort and tech­ni­cal bril­liance nec­es­sary to achieve pro­fes­sional suc­cess nowa­days, are, in all senses, much supe­rior than those of the pre­vi­ous gen­er­a­tions of secu­rity pro­fes­sion­als. It is not a mat­ter of becom­ing obso­lete or fear­ful of the next waves of younger pro­fes­sion­als whom enjoyed a higher expo­sure to infor­ma­tion and learn­ing mate­ri­als, but also the fact that in present time, the aware­ness and hind­sight nec­es­sary to make con­sis­tent deci­sions, is often out of reach for the older pro­fes­sion­als hold­ing exec­u­tive or man­age­r­ial posi­tions. Just as bio­log­i­cal aging is inevitable, their nerve and wits aren’t in par with the aggres­sive state of the art of today. Oft forced to resort to the mem­o­ries of past times, deep within, they are aware of the fact that sooner or later, their influ­ence will come to an end. Call it pro­fes­sional extinc­tion. It’s hap­pen­ing, and there’s noth­ing that could be done to pre­vent it. It’s nat­ural, and it only serves progress.

If you are a young secu­rity pro­fes­sional, and feel frus­trated about your inter­ac­tions with older col­leagues in meet­ings, stop wor­ry­ing. We, old and not-so old farts, won’t be around for­ever. Our wits will wither off, just like our influ­ence, and we won’t be able to live off past glory in a busi­ness as com­pet­i­tive and unfor­giv­ing as this one. Take a look out of the win­dow, feel the fresh air, caress the hair of your lady and toast a cup of fos­sil fuel, for you will be kick­ing ass while these old farts run like cat­tle to col­lect their tiny pen­sions. And after that, enjoy the ride in a five fig­ure mus­cle car, know­ing they are in your tank, flow­ing to the com­bus­tion engine at full gas!

Le Roi est mort, vive le Roi.