The Tao of Security requires Effectiveness in All Skill Sets
I really enjoy reading the TaoSecurity blog by Richard Bejtlich. In fact I subscribe to several of his blogs in my RSS reader, and would encourage you to do the same.
I feel the need, however, to answer his post “Soft Skills: The End is Nigh.” Bejtlich makes a distinction between “Soft Skills,” which he describes as “policy writing, security awareness, risk assessment, C&A report writing, etc.” and “Hands-on Technical Skills.” On this subject, Bejtlich’s view is myopic.
So-called “Soft Skills” are the currency of business. That’s why they exist. Otherwise the sum-total of organizational security would be console jockeys heads down in network equipment. I’ve heard Fortune 500 CISOs claim that they’re just starting to feel like they “have a place at the (executive) table” because of Soft Skills. Soft Skills are beginning to have impact on business for infosec — not due to log analysis or equipment operation, but because of the ability to facilitate business case.
The fact of the matter is that the data owners, the people whose assets we’re charged to protect, don’t and won’t speak in Hands-On Technical Skills. They care about risk, policy and performance of enforcement. Can you imagine the CISO of a Fortune 500 sitting before the executive committee, asking for an eight-figure budget with nothing but raw log output? How about the marketing guy who wants to put open wireless in every retail store — is a Hands-On Technical Skill going to convince him that it’s a bad idea when he sees it available at the local Coffee Shop? Remember, of course, that drawing the distinction between a “Coffee Shop” and a bank or hospital is a Soft Skill.
Furthermore, it’s dangerous to create a such an attitude about distinction between “Hard Skills” and “Soft Skills.” CISOs have a hard enough time without people creating resentment or division within their working groups.
The key to a happy medium may be cross training. It’s been years since I read Theory Z by William Ouchi, but one of the things I believe I learned there was that Ouchi attributed some part of Japanese success in the later part of last century to Japan’s affinity for cross-training employees. The benefits of which were a greater understanding of how a disparate organization worked together as a whole. Similarly, I would encourage CISOs to invest in cross-training. Personally I’ve seen Project Mgrs with CISSPs go through SANS combined with some on-the-job experience and come out with a better understanding of controls, their roles, and their effectiveness. I’ve also seen hard-core engineers go through FAIR training and use it every day in their Soft Skill decision making, like determining the relevancy of scanner output, IDS alerts and Incident Response decision making.
At the end of the day these skill sets must work together for optimal efficiency and effectiveness. “Hands-On Technical Skills” without “Soft Skills” is simply gathering information. The process to turn information into data, and data into decisions are “Soft Skills.” Hands-On Technical Skills are useless without “Soft Skills.” Likewise, Soft Skills are useless without good information-gathering and processing. If Information Risk Management as a discipline is ever going to even approach the sophistication of a para-science and move towards the credibility of Economics or even Meteorology, then we’ll need to be very good at both.
Maybe Bejtlich would find Enlightenment if I put it this way: Hands-On is the “Yin,” Soft Skills the “Yang.”
Richard Bejtlich Aug 28
I agree with you to some degree — my blog post title was a little hyberbolic to encourage responses. However, keep in mind the definition of “soft skills” as listed by Alan: (policy writing, security awareness, risk assessment, C&A report writing, etc.). As far as those goes, they should definitely be marginalized as they have less impact on security than most people think.
Alex Aug 28
“they should definitely be marginalized as they have less impact on security than most people think. ”
You missed the point. They are inseperable. Most folks who do “Hands-On Technical” in the same breath are already doing “Soft Skills”, just not as well as they think. I offer the dozens of different Information Security books on your average bookshelf that confuse definition and terminology as proof.
To be fair (ahem, pardon the pun), Value and Judgement skills are a very new discipline. There are, what, 10 Universities with an InfoSec MBA? And none of them really have great Risk-based curriculum. There’s plenty of really bad “risk algorithms” and poorly developed processes out there. But I think that’s to be understood - after all, it’s much more difficult to process data into information than it is to collect it. But because something hasn’t worked well so far, there are plenty of people who are ready to throw the baby out with the bathwater. So given the fact that I know of maybe, five Fortune 500 companies that actually do have a clue, it’s not surprising that you might judge the ability to create a business case for security as having less value than “Hands-On” operation of the controls created by the business case.
wpn Aug 30
” …(policy writing, security awareness, risk assessment, C&A report writing, etc.). As far as those goes, they should definitely be marginalized as they have less impact on security than most people think. ”
Richard, Richard, Richard, how can you say such a thing?
Policy writing — if you don’t write down what the rules are, how are you going to make ANY security decisions, much less get your organization to follow them? Not to mention being able to prosecute …
Security awareness — one of the hardest tricks in the world is getting users to stop doing insecure things. Another is to make sure system administrators and developers are doing the right things. This all takes skill. And it’s users ALL the way down, don’t forget. Your security is COMPLETELY in the hands of your people. If they’re not trained, you’re hosed.
Risk assessment — you do this every time you decide to add a new firewall rule, for crying out loud.
C&A report writing — okay, I’ll give you this one. With any luck, you don’t have to do it that often.
Go ahead, give me three examples of major compromises where the breach couldn’t ultimately have been prevented by PROPER use of any of the above “soft” skills. I dare ya.
Jerom Dec 20
?/???/ ???/???? ???? ??/?
memyclePype Jan 15
Hello all!
It’s my first time I am here.
So i’d like to ask you if someone of you or your frineds was fired because of a financial crisis?
jobbercypr Feb 6
Hello, it’s a job offer. (Sorry if I post it in wrong place)
Cyprus company is seeking a Campaign Executive to assist with fundraising, presentations, various administrative and sales management duties. If you have fundraising and sales experience, plus intermediate computer knowledge, this job is for you! Apply with us today!
All applicants applying for U.S. job openings must be authorized to work in the United States. All applicants applying for European job openings must be authorized to work in European Union.
We are growing advertising and consulting company offering job opportunities ranging from executive and administrative assistants to customer service representatives, receptionists and general support.
NOTICE: we do not provide relocation, this position is online based, we are using progressive online administrative system. You will have to use a special online training program for free.
Requirements and skills:
1. Higher Education/College
2. 1 + Sales/Management (desired but optional)
3. Strong communicative skills
4. Must have MS Office installed (MS Word)
5. Must have citizenship or Work Permit
6. Adult age
Education and Experience:
1. Internet/MS Office/Outlook
2. Sales/Management/Marketing courses (desired)
Hours:
Mon-Fri; 9:30am - 12:30pm
Apply for this job now or contact our online branch support for additional information:
CV to e-mail contact@mygogreens.com
Goafbemofessy Feb 15
Hello.
I’m new there
Nice forum!
osobo Feb 17
????? ?????? ???????? ?? ????????? ?? ???? ????? ?. ?????
????? ?????? “????????” ???, ??? ?????? ??????????? ? ???????? ???????? ?? ?? ??????? ??????????? ?????? ???????? ?????????????????? ?????? ?.?. ?????.
?????????????? ?? ?????? ??????, ? ????-?? “?????” ?????????? ??????? ?????? “?????????” ??? ?????, ??????? ???????? ???????? ? ????????????? ???? ????????? ??????????.
???????? “????????” ? ?????????? ??????? - ??? ????????, ??????? ??????? ???????? ?? ?????. ????? ???? ??????????? “?????? ???????” ? ???????? ???????????? ??? ????????????? ????????????, ????????????? ????????? ?????, ? ????, ???? ??????????? ???.
????? ??????? ?????????? ?????? ????????? 1 ????? ??????????-????????? ????? ? 9 ?????????? ?? ????????? ????????????? ???? ?????????? ??????? ?? ???????? ?????????? ????????????? ??????? ?.?. ???????.
? ??? ??? ? ?? ?????, ????? ????????? ??? ?????? ???????? ?????????????????? ??????? ? ??????????? ???? ?????????? ???????? ?????? ? ???????? ???????. ? ??? ????? ??????? ????????? ? ??????????? ????? “? ???????” - ?? ?????? 11 ????? ?????? ????????? ?????? 25 ? 35, ?? ????????? ??????? ????? ?????????????????? ?????? ????? ????? ????????? ?????????-????????????? ???????????? ???????????.
?????, ?? ?????????? ???????????? ???????????????? ??????? ?????????????????? ?????? ?? ??????????. ? ?? ??????? ???????????? ? ????????????? ??????????.
????? ????, ??? ?????????? ????????? ?? ? ?????????? ???????? ??????????, ? ????? ? ???????? ? ?????????? ???????????? ????????????????
XRumerFinder Feb 27
Hey… sorry for my english, where I can download XRumer 5.0 Palladium FOR FREE??? Thanks!!!
It’s perfect software for promo and SEO, but cant find any crack for it((
cracked XRumer 2.9 and XRumer 3.0 are too old, Im need FRESH!
Preston Feb 28
We want passion for our business.. workers who can interpret and execute our mission, who want to build a career, not just take a temporary job.
****************************************
Use This Tool to Secretly Spy on Your Competitor
aspimifetrams Mar 4
x
x
madafakerimpresarionte
DaveCahonne Mar 10
Never underestimate the power of the internet. An increasing number of people use the internet
to search for a business or service so having a web presence is an important media for promoting
your company. Web design is a real skill and if your website is to not only look good but work well,
it should be constructed by a professional web designer.
If you are interested, you can contact me: hqwebdesign (AT) gmail (DOT) com
Beaulgeacouct Mar 22
I am sorry, if has written not in that section, has simply undressed this has seemed to me the most suitable.
Guys, the good site of acquaintances, type as here - 1st international marriage
is necessary but it would be desirable free of charge and more girls from CA.
thixenuerarie Apr 3
Mega Millions, Powerball, Lotto 6/49, Super 7, Euro million, New York Lotto - Be the Next Jackpot Winner With The Only Online Service That Enables You To Purchase Official Lottery Tickets From Around The World.
Huilo Apr 5
???? ?? ?????? ??????, ??? ? ???????? ??? ????, ??????? $20 WMZ: Z385450145510 ? ??????????? ????? c3m3t3ry@gmail.com ???????.
heexiasoosusa Apr 5
Find all alaska jobs.
waitokpaw Apr 16
VeriSupport has launched the world’s first SUPPORT RANKING PROGRAM
And it is available now! You can choose to buy from stores which are VeriSupport certified and ranked ensuring that you are protected from online breeches and fraudulent organizations. Look for the VeriSupport seal when you buy from an online store, as VeriSupport seal in a website tells you, the organizations ability to provide support like live customer service, technical support and other helpdesk functions before, during and after the sale; the ability to handle customer feedback and their reliability as a company.
VeriSupport’s Support Ranking Program provides a number of benefits to you including:
1. You can be confident that there is a support channel for addressing your issues and concerns,
2. You have the power to comment and rate in real-time about your experience.
3. You can be confident that you are dealing with a reliable business
4. Assurance that transactions are secure
VeriSupport helps your visualize support levels of the organization that you could deal with! and now its your decision choose VeriSupport certified organization for a hassle free experience!
Look for the VeriSupport seal provided by VeriSupport.Com, every time!
Arrerieldenly Apr 18
Hey, just i just wanted to remind, tha global I4oTuFskPCc4 is near.
Gaynor Apr 29
Horny twinks ass-fucking like sex-starved sluts and shooting cum all over their minivan.
gay teen pics sex unique
PeterS Apr 30
Greetings everyone, this is my first time posting here.
I hope to contribute good info to forum and hopefully learn somethings too.
Peace
Dyson DC25 Vacuum
.
fleersert May 2
I`m saving 75% on my cigarette purchases. useing it its much more cheaper and healtyer then the normal ones
if someone else is interesed to buy i got a discount coupon disc5-1245 on http://tinyurl.com/cuy2rf
CaryWZ May 6
expense report software
FeasableCase May 30
Hi all! Who wants to join me on twitter. I am into celebrity gossip. Check me out on twitter. My name is Barenipples
Huddysokswott Jun 11
Greetings,
What are the best dedicated server web hosting company?
I’m trying to set up a web site for my new business.
thank you in advance,
-Michelle
roopCerb Jun 13
Tired of a competitor’s site? Hinder the enemy? Fed pioneers or copywriters?
Kill their sites! How? We will help you in this!
Obstructions of any site, portal, shop!
Different types of attacks: Date-attack, Trash, Attack, Attack, etc. Intellectual
You can work on schedule, as well as the simultaneous attack of several sites.
On average the data, ordered the site falls within 5 minutes after the start. As a demonstration of our capabilities, allows screening.
Our prices
24 hours of attack - $ 70
12 hours of the attack - $ 50
1 hour attack - $ 25
Contact via ICQ: 588 666 582
CaseyFronczek Jun 21
I saw that Casey Fronczek is offering fishing trips now down in south Florida. Does anybody have any input on these trips or has anyone been on one of these trips before?
demonimoux Jul 5
Hi everyone
Nice site. I just added it to favorites
Thanks and see you
Szczecin hotele
Vesattive Jul 5
Become part of an elite crew of people who get paid to play the hottest unreleased games! OmegaGametesters makes it easy to get started as a video game tester. When you become a video game tester you get paid to play games, record your observations and report bugs. Your job is to “break” the games.
-College students & 09 HS Grads
-Wii, xbox360 and PS3 owners preferred
-All Ages 18 years and older
-Apply now and start now or after finals
-Limited spots
-Conditions apply
Salary/Wage: $10-15/hr
Education: H.S
Status: Full-time, Part-time
Shift: Nights and Weekends
EMAIL: omegagametesters@gmail.com
expexcipSoins Jul 7
http://extjs.com/forum/member.php?u=79374 guitar lessons
moosombFroste
vzx76 Jul 19
I am starting my Chinese lesson on my own, but I finad it not easy to teach myself…do you guys have any good recommendation where to go?
language school or program from univerhsities..
thankrs
jo2t2i
wearabletowelguru Jul 20
AOL, Glamour , women tribune
-NEW YORK FASHION-
“MUST READ”
First Name: CJ
Last Name: Arabia
Company: America Online
We Try It — As-Seen-on-TV Beauty
There are some inventions that seem, if not exactly brilliant, at least worth a try — until you do. Lemondrop had a few of its writers round up the best (and worst) As Seen on TV beauty products and give them a shot. We try before you buy.
First up: The Wearable Towel
Lemondrop Tests: Does the Wearable Towel keep you comfy in the summer?
Do you want to know how to meet tons of hot guys this summer? Get a http://www.wearabletowel.com . Trust me on this.
What is the Wearable Towel, you ask? It’s basically the summer version of the Snuggie. I got the Wearable Towel because I’m a total dork. I own just about every infomercial product known to man. The less I need it … THE MORE I NEED IT. But little did I know that when you go to a pool or beach party with the super-dorky Wearable Towel, each and every single person at the party will talk to you. That includes every single cute guy AND all of their friends.
I’ll tell you exactly why you need this stupid towel:
1. It’s very soft — the silkiest towel I’ve ever owned.
2. It comes in three patriotic colors: red, white and blue. With the election of President Obama it’s cool to be patriotic again so I suggest collecting all three. The only way it would be better is if it came in an actual American flag pattern … or black. Who doesn’t love black?
3. It’s perfect for the beach and pool parties. You don’t even need to wear clothes. It’s actually a cute little dress when it’s on. If you want to look fancy, just throw on a belt.
4. It comes in every size you can imagine. No matter how fat or skinny you are, they make a Wearable Towel in your size.
5. And most important of all, it’s the ultimate icebreaker. You will meet a ton of people if you are wearing a Wearable Towel. Every single cute guy at the party will come up to you at some point and ask you about the towel or make some kind of goofy joke about it.
You are always the center of attention in a Wearable Towel. It’s also the perfect excuse for further contact. When people see you in the Wearable Towel, and they see all the attention you’re getting, they will feel like they need one too … so they will ask you where to get one. If they’re ugly, tell them to Google it, and if they’re hot tell them you’ll email or Facebook them the link. Ba da bing — contact made, friendship started and the next thing you know the Wearable Towel has landed you a hot new boyfriend and/or booty call.
Get your stupid Wearable Towel now and thank me later.
Price: $19.95 plus shipping and handling
Rating: 5 out of 5 ShamWows
CJ Arabia is a writer living in L.A.
———————————————————————
Welcome to Glamour.com
slaves to fashion:
Move Over, Snuggie: The Wearable Towel Has Arrived!
The Snuggie did its part to keep you warm all winter (more than a few of you ‘fessed up that you were the proud owner of one or were hoping to become one!), and now that summer’s almost here, it’s time to say hi to the wearable towel. “Because robes are heavy and hot!”
The next generation of infomercial “fashion” has arrived in the form of the Wearable Towel, a terrycloth wonder with three arm holes that can be worn as a toga or a tunic, by men and women, and helps you stay covered up after showering or swimming. Just like with the Snuggie, I think the true brilliance of this product is in the marketing. Check out the infomercial now:
I must confess, I did have one of those towels with the elasticized tops in college, and I did wear the hell out of it while drying my hair and drinking Milwaukee’s Best in my dorm room. And this one can actually go to the beach, since it unfolds into a regular towel. And it comes in red, white, and blue, instead of the powder puff pink one of my past. Considering an infomercial gadget recently changed my sister’s life, I’m open to the possibility of a similar experience. Dare I say it–this just might be a stroke of product development genius. And all for the low, low price of just $19.95!
What do you think, dolls? Is this the heir to the Snuggie throne? Could you see this thing being of practical use to you this summer? Have you ever owned one of those Velcro topped-towels? Will you invest in a Wearable Towel? Discuss!
——————————————————
women tribune
Sick of Fighting with Your Towel?
Typically, once I get out of the shower I apply body lotion or body butter for the day, grab a towel, and then try to maneuver my towel to allow me to use my arms and hands effortlessly to apply makeup and do something with my hair. However, this hardly ever works because most of the time, the towel comes undone from around my body leaving me completely uncovered and frustrated, especially since I’m relying on that towel to absorb the water from my shower so after I’m done with my hair and makeup I can walk into my bedroom and get my clothes on and go about my day. So when I came across the Wearable Towel I was pretty excited, thinking about having a towel that would stay around my body after the shower, leaving me able to have full range of motion of my arms to get myself ready for the day.
The Wearable Towel allows me to go about my morning (or afternoon since I work from home and have the freedom to not have to get ready to start my day until the afternoon) completely hassle-free. I don’t have to fight with a towel or walk around the house holding it up so it doesn’t fly open or fall off. I will often get out of the shower, put a towel around myself, and come downstairs to get a mug of coffee to enjoy while getting myself ready for the day, so the last thing I want is my towel malfunctioning while I’m walking in front of the window. I also cannot tell you the amount of times I have had the UPS delivery person at my door while trying to get clothes on. With the Wearable Towel, you can just wrap it around yourself and hurry to the door to get your package before the delivery person writes one of those notes I always hate getting telling you they will try again tomorrow.
But the Wearable Towel isn’t just for after morning showers; it can also be brought with you and your family on vacation this summer to the beach or to the neighborhood public pool. It is made of 100% cotton and is very absorbent so you can wrap one around your child to get dry after being in a pool or the ocean and they are still free to run around and keep having a great time! And don’t worry about losing the fasteners to get the Wearable Towel to fasten around your body because there aren’t any. The Wearable Towel has arm openings allowing you to simply slip your arms into the openings and you’re completely covered and free to go about your day.
The Wearable Towel is not sold in stores, but it is sold online. Just go to the Wearable Towel’s website to order or call 1-866-618-6444.
Tags: Bath & Beauty, beach vacation, beaches, cosmetics, hair care, pool, summer, summer vacation, towels, Wearable Towel, Your
by Holly
Filed Under Bath & Beauty, Your Style
________________________________________________
NEW YORK FASHION
The Wearable Towel: Summer’s Snuggie?
If we’re wearing blankets with sleeves in the winter, we may as well wear towels in the warmer months. And alas, the summer Snuggie has arrived: the Wearable Towel. It looks like an ordinary towel, but it has holes on the edges for you to stick your arms through so you can wear it — like a shift dress! Or, if you’re a dude, a toga! Dealing with a tucked-in corner coming undone on an unwearable towel is just too much trouble when you’re grilling turkey burgers by the pool or washing your baby in a pot in the kitchen. Or when you get out of the shower and are so in need of the newspaper that very instant that you don’t have time to throw on clothes to go outside to get it. Allow the infomercial to enlighten you.
Wearable Towel: The Towel With Arm Openings
By: Amy Odell
Filed Under: summer or bust, snuggie, this will scare you, wearable towel
indiplyunutty Jul 24
I just wanted to say hi to everyone as I am new here. I look forward to speaking with everyone. As for me, I am a http://www.bocaratonpersonalinjury.org - boca raton personal injury attorney and would be willing to lend a hand to any locals out in need of some assistance.
gaurigabrinly Aug 23
Anyone know if Twitter Following software works like it says it does?
http://tweet-adder.net
Tippins Sep 5
Good evening
Whenever I try to burn a data CD on iTunes it starts making this odd clicking sound and doesn’t end up burning the CDRW.
I tried using the regular drag and drop onto the DVDRW burning folder itself and it still makes this odd clicking noise.
I’m using noname CD and they worked fine when I first got them then all of a sudden it’s doing this.
I’ve tried another brand of disk (sony) and it’s still making the same noise…
Any advice anyone?
_________________
Best fap turbo review
Heteequinee Sep 7
Hello
I am a noob when it comes to software. I acquired a kaspersky…application, that was from the college I will go to. And after that and a deep virus scan, I could no longer use internet explorer or jabber messenger. I manually deleted them and downloaded them again, rebooted my desktop pc countless times, but nothing is working. I keep getting a message that something needs to be done with my fire wall and HTTP, HTTPS, and FTP ports.
Recommendations someone?
_____________________
Number 1 zygor wow guide
sprintforfree Sep 18
Looking for a new cell phone ?
Get a free iphone*
or Blackberry
Save an extre $350.00 off the cell phone of your dreams
Sprint Coupon Code, lowest price assured!
http://www.allcel.sprintorders.com
or
http:/www.allcelaccessories.com
or call us at
877-744-5523