http://en.wikipedia.org/wiki/CSI:_Cyber#mediaviewer/File:CSI-Cyber-Logo.jpg

This week was the beginning of a new CSI television series, CSI: Cyber. I am not a CSI fan by nature. In fact, I’m not a big fan of television dramas at all. I try to like them. I really do, but it’s hard for me to get passed mediocre acting and low budget explosions. However, I had to give CSI: Cyber a chance. After all, it promised to deliver on a theme that is near and dear to me, cyber security. Did it deliver?

To start on a positive note, I thought the technology aspects of the show were only moderately exaggerated, so kudos for that. I think it’s a positive thing that they are highlighting real world consequences of hacker activity. It is not a harmless pastime or a victimless crime. This show can potentially serve as a nationwide public awareness campaign. Hopefully, they will work in some useful reminders for viewers, like the importance of antivirus and the like, rather than simply inciting FUD (fear, uncertainty and doubt).

http://commons.wikimedia.org/wiki/File%3AMBP36_-_Digital_Video_Baby_Monitor_MBP36.jpg

With that said, the first episode was named Kidnapping 2.0, making reference to the next generation of kidnapping that incorporates hacking into internet connected baby monitors. The “baby auction” plot may be farfetched, but the idea of some weirdo hacking into your baby monitor is one based on fact. It happens, and for that reason I advise my friends to avoid buying an internet connected baby monitor unless they really have a need for it. Even the ones without Wi-Fi are relatively easy to access, but you need to be in physical proximity to the camera.

I thought the title of the episode, Kidnapping 2.0, was appropriate because they kidnapped one hour of my life with no remorse. The casting choice is just unreal. Lil’ Bow Wow is a rhyming hacker being rehabbed by the FBI. To quote my wife, “STRIKE 1.” The action star of the show is none other than the star of Dawson’s Creek, James Vanderbeek. I never thought I would live to see Dawson kick down a door, but network television has blown my mind yet again. The “best white hat hacker” in the world is a stereotypical “heavyset” gentleman and at one point the FBI director tells his staff that they can “go home to their parents basements.” Really? LOL.

All things considered, I will probably watch this show again. Not because it was a good show, but I find the random technical references extremely entertaining. I love how the writers jam technical jargon into sentences that do not require it at all. It’s just hilarious. And I find the security talk extremely entertaining. There is nothing better than hearing acronyms explained by bad actors. Unfortunately, I doubt the mildly entertained IT crowd can keep this series afloat for very long.

In any case, if you’re looking for a mediocre drama with a mixture of technical chatter and law enforcement, you’ve found it! I will let it record on my DVR and from time to time I’ll check out an episode. More so for a laugh than a thrill, but at the end of the day it served its purpose of entertainment…for one reason or another.

Note to Producers: This show can still be saved by adding a key guest star or two. Namely, Jack Bauer or Liam Neeson (he has a very particular set of skills).

Did you catch the first episode? Tell me what you thought in the comments below.

Thanks for reading and don’t forget to subscribe.

At our recent DoIT all-hands meeting, it was mentioned that thanks to my blog it is possible to know what I’m thinking about. That has been true to some extent. As I reflected on that statement though, I realized that most of this blog has centered around facts and ways to secure your computing environment. I haven’t really used this platform to share my viewpoints or opinions. That is partially due to the fact that I am not, by nature, a blogger. This blog was my first venture into sharing information in such a public forum and I’m still trying to strike a balance between opaque and transparent. After all, discretion is the better part of valor, is it not? Mostly true, but lack of discretion has a time and place too. By the way, for some reason I hate the word blog. Blog Blog Blog.

With over a year here on West Campus I thought today is a good day to break the self-imposed mold for this blog and talk about my thoughts on risk. No, not RISK the strategic board game. Risk as in “the potential of losing something of value.”

Did you know that risk has a formula? That’s right, my academic brethren. Here it goes: Risk = Threat x Vulnerability. Let that sink in for a minute. Read it again. Risk = Threat x Vulnerability. Which of those two factors can we control? The threat? Nope. We only have control only over the vulnerability aspects of that equation. Every organization has a risk posture. What is ours? What is yours? What needs to change?

What is our risk posture?

Before we talk about risk posture, we need to talk about risk tolerance. Some organizations are risk adverse and try to address every known vulnerability regardless of cost. Others tend to be more risk tolerant and allow certain inefficiencies to remain. Where do we sit on that spectrum as an organization? Well, most institutions of higher education tend to have relatively high risk tolerance. The extent of tolerance varies from institution to institution. Consistently, though, risk tolerance is decreasing across the board. The threat has changed. The world has changed. At Stony Brook our risk tolerance is decreasing in like manner. Is our tolerance decreasing as quickly as the threat is increasing? We need to move fast.

This blog is not the place to discuss our risk posture. Sorry to disappoint. I will say this, though. Our risk posture is strong in some areas and weak in others. That is true for all organizations. Then there are areas that have an unknown risk posture. Those worry me. There are too many of those.

What is your risk posture?

In other words, how are we doing as individuals in regards to assessing and managing risk. The sensitivity and tolerance to risk varies greatly. Let me give you a handful of character profiles found around campus and while you read it, try to honestly evaluate which one you relate to more.

• A researcher who proactively reaches out to the CISO at the start of a research project to ensure that the practices they plan on following are adequate.
• A researcher who is convinced that nobody in this world is interested in his/her research data and therefore security is not a concern.
• An IT support professional who knows the owner of each system on their portion of the network and is quick to respond to security related incidents.
• An IT support professional who provides support as requested, but otherwise allows faculty to manage their own equipment and therefore does not view security as part of their job description.
• An IT admin who always takes into consideration security and can justify why every security adverse decision is made and employs compensating controls.
• An IT admin who will always choose functionality and ease of use over security without giving any thought to risk.
• A faculty member who wants to use their computer to accomplish a given task over the next few months.
• A faculty member who wants admin rights on their computer so they can accomplish any task at any given time at some point in the future.

The list can go on and on, but those are some of the perspectives I’ve encountered on campus.  If reading this list put you on the defensive, ask yourself “Why?”

What needs to change? 

For starters, we need to start thinking and talking about risk more often. The decisions we make must be made with both eyes wide open. Lack of thought has no place in higher education. In my opinion, this improvement will have the single greatest impact on the security of our organization. Coincidentally, our meeting with Information Systems today centered around this very topic. They are acutely aware of certain risks within their purview and they want to formalize a priority-based plan to address them. This the type of thinking that will keep Stony Brook safe.

We need to recognize who has the authority to accept risk in behalf of Stony Brook University, or wherever you happen to be employed. It’s probably not you or I. If a decision is being made that exposes Stony Brook to risk, make sure the right administrator is accepting that risk and is fully aware of the implications. It’s for your protection as much as it is for Stony Brook’s. I have observed that the higher you move up the chain of command, the less tolerance there is for risk. Let the decision makers do their job.

When there is conflict between security and preference or ease of use, we need to default secure. As it stands now, it is not uncommon to default less secure until an incident. That mentality needs to change. If a security related decision is going to impact the business flow or ease of use negatively, there needs to be a well informed decision made by the appropriate person. Don’t default less secure, default more secure until otherwise advised.

In the past, there was no reasonable way to collaborate safely. That is no longer true. Responsible collaboration is possible and practical. We have to be willing to jump through a hoop here or there to operate securely. Connecting to the VPN before accessing something is not unreasonable. Put the organization’s safety before your own convenience.

Finally, we need to work together. We need to disagree and discuss it intelligently. We need to yield when a reasonable argument is presented.

Overall, I am optimistic about our security posture and our security trajectory. Let’s make a concerted effort this year to think and talk about risk so our posture will continue to improve.

Thanks for reading and don’t forget to subscribe!