Security Governance Ripples from Target Breach

You know the saying, if you want a different result, best not to keep doing the same thing. In this case, the result was the massive data loss breach involving loss of the records of 40 million customers at mega retailer Target.

In its wake, CEO Gregg Steinhafel stated that he is "elevating the role" of its chief information security officer and hiring outside the company to fill the position.  According to this NY Times article from early March, bringing on a new CISO will help Target centralize the company's security responsibilities.

And while the timing is coincidental, I owe Schweitzer Engineering Laboratories' Sharla Artz thanks for pointing out that Wisconsin based electric utility Alliant Energy Corp just made a similar move. For me, there are several promising parts to Alliant's announcement at the recent EnergyBiz conference that it had just:

Created an executive-level opening ... for overseeing cyber and physical security. The position was designed to bring cyber issues out of the weeds of the IT shop, where CEOs generally don't tread.

What I like best about this is:

• The company didn't have to endure a huge security incident to justify this change to the org chart
• The position is clearly not going to be buried in an IT silo, so it should have authority to set security policy across IT and OT
• Reflecting a convergence that's happening in many energy enterprises, this new security exec will oversee both cyber and physical security

Hopefully we'll see more utilities make similar moves ... and soon.

Image credit: Michael Durham at fineartamerica.com

The Rolling Question Game

(Beg.s > Pre-Int)



You are going to  

• play a revision game


• practise and revise vocabulary by answering questions

Teacher's note. I uploaded this here as, along with the Rolling Word Game here,  it has been very popular with my younger classes.

You can start or finish at any point depending on the level of the class. The questions are more or less ordered according to level from beginners vocab through to prepositions, present continuous, simple past, comparatives  etc





Instructions

1. Throw 1 or 2  dice.


2. Click the page forward according to the number on the dice.


3. Answer the questions


4. Continue. Play in teams. You can get a point for each correct answer. More points can be given if the answer requires more information.

Rolling question game from David Mainwood

Download as ppt file here

More

Rolling Word Game Elementary, Games, Intermediate, Kids, Speaking, Young Learners

Games and Quizzes EFL SMARTblog list

MEETING NATURE: On Our Way to the Duck Pond

Some time ago when my granddaughter was visiting, we took a walk in
the park as we always did. Caitlin loved the duck pond and we usually made a
brisk beeline straight to the ducks. But that day was different. The flowers
caught Caitlin’s eye, so we stopped to explore…

At
first I stepped back to watch as she crouched to meet the flowers up close. Her
fingers reached out instinctively to touch a daisy. I told her how much I liked
that she was gentle with the flowers because we want to keep them safe for
everyone to enjoy.

Like a
little bumblebee, she buzzed from flower to flower gathering new information,
insights, and ideas, while I did my best to keep up, adding the words she didn’t
have to describe her floral journey.

I
marveled at the different flowers in the bed, narrating as she touched each
one… yellow, pink, white, orange… lilies, daisies, poppies, roses, gladiolas. 

I wondered
what the flowers smelled like. She leaned in and sniffed each flower, the
pollen sticking to her nose.

I
couldn’t decide which were my favorites, so Caitlin helped me choose.

It
turns out, I love roses and lilies the best!

I
pointed out a garden beetle strolling by, using the flowers to stay cool in the
shade the way we play under the maple tree to keep out of the sun.

I
wondered what the flowers look like to the beetle. We laid down and peeked up
at the flowers from our beetle’s eye view. Have you ever seen a bed of flowers
from the bottom up? The petals are perfectly gathered into the cap of the stem,
then splaying up and out towards the sun. The delicate petals let the sun shine
through, creating rich and vibrant patterns of color pitched against the bright
blue sky. 



It
turns out, beetles are very lucky to live in the colorful shade of the flower
bed.

Just
then, a caterpillar started inching his way down the flower stem right towards
us. We laid very still, and as he drew closer, I reached up and put out my
finger to him. He graciously accepted my invitation.

Caitlin
petted the caterpillar, studying his boneless, little body. He was bright green
and furry all over. In time, he inched his way right into Caitlin’s hand and paid
a gentle visit.

It
turns out caterpillars tickle!

Then I
wondered what it would be like to move like a caterpillar. Caitlin wanted to
show me how, so we carefully returned our little green friend to his flower
bed, and the two of us created great grass stains playing Caterpillar Crawls on
the cool grass.

And like
an old friend, it turns out, nature never disappoints.

MAKING INTRODUCTIONS

Wherever
they go, young children encounter things they’ve never seen before, and as we
know, first impressions are lasting impressions. So, here are a few concepts I
use when introducing children to new things…



Follow,
don’t lead.
Whatever interests them is what you should spend time exploring. (Caitlin chose
the flowers to explore, not me.)

Wonder
aloud… When you
wonder aloud, kids take up the idea and run with it.  This is a great way to draw them in AND draw
their own conclusions about things. (I wanted Caitlin to explore all the
flowers so said, “I wonder what colors they are?” “I wonder what they smell
like?”)


Recognize
the positive behavior you want, not the negative you don’t want. With new things, children
won’t necessarily know how to behave. Focusing on positive behavior is a great
way to give them the guidance they need. 
(I didn’t want Caitlin to pick the flowers so I told her how much I
liked how gentle she was being with them.)


Use
YOUR Imagination.
Try to imagine what it’s like to have never seen this before, and try to find
new ways to explore it so that you’re seeing things for the first time too! (I
had never seen flowers from the bottom up before.)


Physicalize
New Ideas. If
you have the opportunity, help children grasp new ideas by getting them to put
their whole body into it. (I asked Caitlin, “I wonder what it feels like to
move like a caterpillar?”)

CATERPILLAR CRAWLING

To
start, have her lie on her tummy and raise her seat up and down. Once
she’s got the hang of it, show her how to raise her seat up, then inch forward
as she brings it back down to the ground to create an “inchworm” forward crawl.

CATERPILLAR WALKING

For an
older child, have her stand and reach down, walking her hands out in front of
her. Then walk her feet up to meet her hands.

Enjoy!

An Eerie and Early Visualization of the Internet of Things (IoT)

I've got a short story to recommend to you. It's cerebral without being overly literary. It's got action, though no cyber-physical grid attacks. There's no shooting. No lives lost. No outages. But is there ever a lot going on! In fact, I'm pretty sure it's a parody of sorts of what may be coming our way in the not-very-distant future.

Titled "Water,' it was published last year by author and futurist, Ramez Naam.

Here's what the ad-free, neural-implanted main character experiences walking down a street in NYC:

Civic systems chattered away. The sidewalk slabs beneath his feet fed a steady stream of counts of passers-by, estimates of weight and height and gender, plots of probabilistic walking paths, data collected for the city planners. Embedded biosensors monitored the trees lining the street, the hydration of their soils, the condition of their limbs. Health monitors watched for runny noses, sneezing, coughing, any signs of an outbreak of disease. New York City’s nervous system kept constant vigil, keeping the city healthy, looking for ways to improve it.

And there's a nice IoT breach for you, too, with extra padding for general readers:

In a windowed office above the financial heart of Manhattan, a tiny AI woke and took stock of its surroundings. Location—check. Encrypted network traffic—check. Human present—check. Key . . . . Deep within itself, the AI found the key. Something stolen from this corporation, perhaps. An access key that would open its cryptographic security. But one with additional safeguards attached. A key that could only be used from within the secure headquarters of the corporation. And only by one of the humans approved to possess such a key. Triply redundant security. Quite wise. 

Except that now the infiltration AI was here, in this secure headquarters, carried in by one of those approved humans. Slowly, carefully, the infiltration AI crawled its tiny body up the back of the silk suit it was on, toward its collar, as close as it could come to the human’s brain without touching skin and potentially revealing itself. When it could go no farther, it reached out, fit its key into the cryptographic locks of the corporation around it, and inserted itself into the inner systems of Pura Vita enterprises, and through them, into the onboard processors of nearly a billion Pura Vita products on shelves around the world.

Cyber and physical consequences ensue and cascade. You can and should read the whole 5K word story HERE.

While I've got you in the mood, less creative but still informative is a non fiction article I found via Twitter this morning: "Internet of Things is 'Scary as Hell'".  In short-strokes, it's more "insecure by design" coming our way. And see if the expert guidance on what to do in your home doesn't faintly echo IT/OT power sector security advice:

Secure your environment. And don't have your alarm system, your heating and air conditioning system, on the same internal network as your PCs. If they are easily hacked -- and they are -- and attacked, you don't want them to be on the exact same network.

Many people seem excited about what's going to happen when everything talks with everything else. Me, I'm no luddite, but even without taking the manifold security and privacy considerations into account, I'm not sure IoT represents a step forward for our species.  Anyway, no matter, it's coming soon to a theater near you.  And maybe "Water" will be too.

A Social Summary of SANS ICS Security Summit 2014

Since I went solo there's been less time for blogging but I hope to catch up a little with this mega post on the just-concluded, 9th annual SANS ICS Security Summit which took place in the Contemporary Hotel at Disney.

Where I can I'll include Twitter IDs, as for many of us, Twitter is how we stay abreast of what we find interesting and what we're thinking about in between real world meet-ups. (Note: I only include these when they're unique to the individual and not shared by a company or org.)

I won't cover all the talks because I didn't attend all of them, and I apologize to those presenters I don't cover here. Nor was I at "Game Night" (though I wish I was) which from what I heard later was a fantastic and grueling hack-fest that extended into the wee hours before champions finally emerged.


For those of us lucky to be at the hotel Sunday night, and to know what was going on, a four-act play called "Exposure to Closure" or "The Heist" penned by Ben Miller @electricfork was really something. With MC Tim Roxey @ScubaNuke providing intro's, transitions, and running commentary, all injected with equal parts wisdom and levity, and a cast of characters from the really-not-ready-for-prime time-SANSICS players, for me it was the highlight of the trip, even before the conference officially started.

The audience got to see, in four acts and sixteen scenes, the full sequence of an attack on a utility control center, the confusion, analysis and corporate squirming that ensues, and how it resolves relatively peacefully (in this case) in the end. Mark Fabro stole the show with a swift and spooky transformation from dweebish uber-geek to a credible threat to another actor's physical security.

Chris Sistrunk @chrissistrunk and Adam Crain @automatak kicked things off smartly as twin fuzzing brothers from different mothers providing an overview of the many flavors of fuzzing, and the DNP3 protocol and how it's being made more secure (less insecure).  At one point, Chris noted that with much of the initial badness having been attended to, "We're starting to look at the back yard and are finding it a bit overgrown. Some things are turning up there - like cars." They make a great instructor duo.

Then we had an analyst panel, moderated by John Pescatore @john_pescatore and including Bob Lockhart, Sid Snitkin and myself.  It seemed to go pretty well.

Eric Byres @tofinosecurity followed by thoroughly excoriating the concept of patching ICS systems and transitioned to a tour-de-force explanation of deep packet inspection (DPI) that, like a good Bugs Bunny cartoon, communicated on many levels.  Meaning: I think I understood most of it, but the more experienced folks around me seemed to get insights from it as well.

The presentation by Marc Ayala @ICS_SCADA and Eric Forner demonstrated an attack on a mini water pump which turned the stage momentarily into Sea World, serving as a warm-up act for Kyle Wilhoit's @lowcalspam real-world honey pot presentation the next day documenting how global bad guys pursued what they believed to be the control system of a far more substantial pump, constructed by Kyle, at a municipal water tower. We all learned a lot from these two presos.

Nadya Bartol @NadyaBartol presented on ICS supply chain security issues and by the time she was done, the scope and complexity of supply chain challenges to ICS became all-too-clear.  Ernie Hayden, sitting next to me, tried to lighten my mood by informing me that there are 127 BIOS vendors alone.

I missed the presentation on the new Global Industrial Cyber Security Professional (GISCP) certification, but in case you did too, I've put a link to it HERE.

The first presentation I made it to on day 2 was "Cybersecuring DoD Industrial Control Systems", during which Michael Chipley provided more content, pound for pound, than all of Monday's presenters combined. Each of his many slides was a universe in and of itself, and there were a multiverse of them. But that's the DoD we know and love, and Michael did a great job of plotting its progress, in which he plays no small part, from DITSCAP to DIACAP to the NIST CSF structure in which they're inserting, among other other things, the most up-to-date guidance on control system security.  As masterful conference MC & Chairman Michael Assante said afterwards, "leave it to DoD to build a model where elevators and anti-ballistic missile systems are in the same category."

I had a good lobby talk after that preso with Michael and Chris Blask @chrisblask. We were keying on how the I in ICS serves to exclude a big chunk of the systems and devices we all care about, and mused on whether the term would eventually transition to something more all-encompassing like Cyber Physical Systems (CPS), Internet of Things (IoT, though that's not quite right) or simply, control systems.

Then we had another panel session, this one on the framework of the moment, the NIST Cybersecurity Framework and its relationship to DOE's Risk Management Process guide and C2M2 family. The group included Ed Goff, Jason Christopher @jdchristopher and substituting for the snowed-in Samara Moore, Nadya Bartol. These three did a great job and now we all understand perfectly how these guidance documents fit together. Moderator Michael Assante pointed out, more than once, that Nadya's cogent and succinct statements qualified her for service in the Executive branch of government.

Air Force Lieutenant and famous writer Robert M. Lee @RobertMLee, author of the I-call-'em-like-I-see-'em 2013 article "The Failing of Air Force Cyber," and its companion piece SCADA and Me: a Book for Children and Managers, basically stole the show at this point. Not an expert, but rather a "lifelong learner," Rob reviewed the book's simple messages, and highlighted some of the more disturbing reactions to it, including:

• A Pentagon General who told him "I keep your book on my desk and share it with management." Which led Rob to suggest to the SANS audience: "At some point in your career you must admit that YOU ARE MANAGEMENT." 
• He also shared a one-star Amazon review along the lines of "I've been a nuclear engineer for 10 years and I got nothing out of this book."

Towards the end,  Rob said the book has been translated into multiple languages and then flashed the cover of SCADA y Yo: Un Libro Para Niños Y Directores. I'm not sure why that was so funny, but it sure was.

I mentioned Kyle's talk earlier, so that brings us to the penultimate preso, Stacy Cannady's overview of how OEM's can improve the integrity of their products despite the many threats they face, and vulnerabilities they can't help but include. It was very well done.

Of my own preso on Security Governance at utilities, all I can say is I wish it went more smoothly.  I should have known better, following a presentation on trusting and not trusting devices, that the slide-advancing pointer in my hand might turn against me.  I've got a solution though: I'm going to cut my slide count from 30 to 1, and who knows, maybe 1 is 1 too many these days.

I highly recommend you block off your calendar for the 10th annual version of this event next year. It's going to be on 1 April or thereabouts if I heard Mike right. This one was more educational and more fun than any conference I've been at in recent memory.

Andy @andybochman

Big Art Day and other happenings

 Thursday was Big Art Day in Texas.

Big Art Day is an art happening to raise awareness of art education and art as a creative force in our communities on a BIG statewide scale. It is an attempt by the Texas Art Education Association (TAEA) to engage all art educators, their students and communities in a single day art event.

In our classroom we used Skype to connect with another art room! 
We shared our class pets who had been "decorated" for Big Art Day!
Bunbun got some rainbow chalk highlights!

In other classes, we finished our clay hearts,

this one says," I'll love you till Earth is Venus." The artist who made it LOVES science! I asked him what his Valentine meant and he said,  " If the atmospheric conditions continued to add more carbon dioxide in our atmosphere the conditions of Earth would become like Venus...but it will never happen." 

We added ribbon and students took them home

Kinder is using watercolor pencils to draw the Van Gogh sunflowers and design a frame with gold paint pens on black paper!

3rd grade made camouflage 3D chameleons using oil pastels! They did so good, that you can hardly see them!!