Another word for stakeholders

This is probably more worthy of a tweet (funny how tweeting has cut down on my blogging) but Alex Payne writes about the challenges of securing twitter (a relevant topic given my Twitter usage lately)

The thing about security is that it requires stakeholders. I have a security background, but Twitter’s security isn’t my job. In fact, my job is pretty much the opposite: I open up as much of Twitter’s functionality as I can without (hopefully) making the system insecure. So while I’ve usually been a “first responder” to security incidents because of my background, it requires a major mental context switch from the work I normally do.

Several months after I joined Twitter in early 2007, I suggested to the team that we do a full internal security audit. Stop all work, context switch to Bad Guy Mode, find issues, fix them. I wish I could say that we’ve done that audit in its entirety, but the demands of a growing product supported by a tiny team overshadowed its priority. Now we‘re in an unwelcome position that many technical organizations get into: so far into a big code-base that’s never seen any substantial periodic audits that the only way to really find all the issues is to bring in some outside help – something I sincerely hope we end up doing, but is not my call.

This post is depressing on a number of levels, mainly because it reminds me of the attitudes (and my own personal frustrations) from back in the early years of doing product security at Cisco.

I hear thing have actually have improved (however slowly) there, but obviously in the supercool world of 2.0 and social networking, they are still pre-2001.

Stakeholders, yeah I'll tell you another word for stakeholders: people that give a shit.

I remember a certain Director of Marketing in the Security & VPN BU. These guys have long since cashed out their options (and the product is killed off), so I don't feel any reservations about blogging about it. Yeah, he was a stakeholder all right, he told us (a small, understaffed, security testing team with no power or authority) that his remote access VPN product was a communication product so security didn't really apply. (Leaving out the far more interesting & cynical quote from a GSR Director of Marketing)

So I understand the frustration, but the idea (that even even if you are a developer, product manager, system administrator) that suddenly you put on your security security hat, stop the presses, fix everything is a quaint notion alongside that 20th century concept that your application, device, or TCP/IP enabled Kleenex box (a big shout out to the Hewitt appsec crew!) is behind a firewall (or not on the Internet) so therefore security isn't a big deal.

You are the stakeholder. And to paraphrase The Wire, "Is you up or is you not?"

Security is not about losing the big battles. It is about winning the small ones. The one's you can win. You do what you can and don't whine about it. If it is not your call, then it is not your problem. Worry about what is your call. That is all you can do.

Been there and done that, you are wasting a lot of time and energy. Trust me.
If you don't believe me, read Unfettered. Bless his heart, Joe is still preaching (nobody gets it, nothing is being done, etc.) the same way he did the first conference of his I attended on SCADA security back in 2003.

Either they get it or they don't and maybe if they don't appear to get it, it is because it really isn't that important in the grand scheme of things. Or maybe you aren't explaining it well enough. If it is really important it work itself out in the long run.

Cutty and the Parable of Two Sons

Cutty/Dennis is one of my favorite characters from The Wire and I was reminded of this scene in a sermon I heard today on The Parable of the Two Sons.

Just How White are You?

Washington Journal (on C-SPAN radio) is just too depressing these days so I've been listening to Elliot in the Morning during my commute and I heard an interview with Christian Lander. Some pretty funny stuff but I guess I'm out of it because I hadn't heard of Stuff White People Like.

Not all of them are funny but some of them are, and many of them are spot on. Unlike Central Austin, Skokie was not a big white people (meaning Liberal white yuppie) places. New Market is very white but it is pretty "country" and not "white" like Seattle/Austin "white."

But anyway, we are guilty as charged with #85: The Wire

If you need to impress a white person, tell them you are from Baltimore. They will immediately ask you about The Wire and how accurate it is. You should confirm that it is “like a documentary of the streets,” the white person will then slowly shake their head and say “man” or “wow.” You will be seen in an entirely new light.

and high school especially the bit about The cure:

If you cannot properly gauge the type of music a white person liked in high school, you should always say that you were really into The Cure. All white people know that liking The Cure in high school is an invitation to be tortured by the cool kids. This will bring about instant sympathy and respect.

as well as Not Having a TV.

The number one reason why white people like not having a TV is so that they can tell you that they don’t have a TV.

Yeah, I have almost every Cure CD before 1995. And we don't currently own a TV, and we watch The Wire on iTunes & Netflix and I have only communicated with one person I went to high school with in the last 20 years!

No More Suit/Tie in Indiana

A while back, my wife and I were talking about what it is that sounds fundamentally different about the way Obama, Bill Clinton (and Reagan, for that matter) speak and the last few Democratic candidates such as Gore, Kerry, and Hillary.

Whether they actually are or not, the latter sound like they are talking down to you, like they are patronizing you, lecturing you. And when try to talk "at your level" they sound inauthentic, scripted, stilted. I think is one of the factors why Kerry (and Gore, if you believe he actually lost) were beaten by a W.

Hillary knows this and this and she wants to paint Obama like Dukakis and Kerry were painted. This is why Clinton (channeling Rove, attacking strengths not weaknesses) attacked Obama as an elitist. I don't know much about community organizing, but I know that most people that have had non-elite jobs, those that have not had the upper advantages on their side from day one. I'm talking about public school teachers, the police, like those serving in the military (even as an officers) that have force you to be exposed (and work alongside, even when in a position of authority) folks from all walks of life -- do not talk this this.

Then of course there is a regional/dialectal element as well Gore is Southern but the patrician, old money South. Kerry, Dukakis, and Hillary are "Yankees" (as my wife would say) and just they can they can lose this from their identity that no more than Stringer Bell or D'Angelo Barksdale could lose the street.

Prez & Pedagogy on The Wire

I wouldn't know about policing or politics (although all the SIGINT doesn't seemed too far-fetched) but in Season 4, much of the school story line is spot on. Or at least based on my 3 years teaching in a Middle School.

Of course I wasn't in a failing inner city Middle School like Mr. P (coincidentally, so many of my kid's teachers here on the Chicago North Shore have have even more unpronounceable Polish names, but I digress...) but a lot of it still rings true.

After college (think Netscape IPO time), I taught 7th and 8th in a school that implemented many of Ted Sizer's ideas on school reform on the Northwest side of San Antonio, where kids lived in the same gated community as David Robinson and George Strait.

Although I had my share of "challenging" kids not I can't remember being told to Fuck Off like Mr. P and the only blood I ever saw in the class room was from bloody noses.

And although I left teaching (for tech) over ten years ago, so many of the scenes in the latest (meaning what we are watching now) season take me (and my wife, who was also a teacher) back to our frightening "first year" and give me a sick feeling in my stomach.

Stuff like getting your classroom ready. Never being prepared enough. That awful silence in the morning that will soon be broken when the door opens. The perceived weakness and lack of confidence that let's your classes get out of control (relatively speaking, of course). The older female teachers that get the respect you wish you could command -- and the fear, which you hope you never will. The making it up as you go along, figuring out a month in what you should have done the first day (like come up with a classroom management plan). And then there's the good stuff, too. Creating that fragile bond with your students. And the humor and the tragedy. We've just finished Disc 2 so it will be interesting to see where this ends up.