It's the first week of the month and so I have a number of tasks to do, but it's also a quarter and a year so the administrative piles up. And of course my system crashed. There is so much to relate since my last entry over here.
I have some technical goals for the year, many of which have to do with hacking and security. Essentially, I have put together a vision of the future which involves my working in several capacities beyond what I am doing now. I expect that my current company will grow with the idea. So here's the idea. My nickel says that five years from now, there will be a global systems integrator specializing in building 'enterprise' applications and migrating current such technologies to the Amazon Cloud. It will be the equivalent of the Cambridge Technology Partners of the 90s. In other words, really sharp, really reputable and really profitable. And shortly thereafter it will morph into something massive and more mediocre, like Avenade or the old Andersen Consulting. In other words, cloud computing is on its way to becoming standardized and cheap (first with AWS) and then big CIOs will take the leap. Developers with API programming skills, network guys with security skills, database guys with infrastructure skills, these will be the core movers and shakers in global enablement. I'm doubling down on the cloud by incrementally adding to my security props. Why?
Because *this* year I'm going to be doing instant data warehouses, limited only by the reluctance of people to give up the data. So I'm going to have to get fairly familiar with what attackers do and what processes insure data integrity. So when we go big at Full360 I will be well along the full enterprise migration practice path.
So I am spending a lot more time with technical meetup groups.
The first discipline that I will have to master is the end to end usage of VMs. At Full360 we have created a gem that takes some generic images and makes them usable locally through VMWare Fusion and/or VirtualBox - Vagrant. So a little ubiquity of VMs is a good start as we can run our Chef configurations on them locally or remotely hosted on Amazon. The next step is getting some portability with these VMs from local, to local region to international region. The recent addition of an EBS Snapshot Migration capability to the AWS bag of tricks (not quite standardized into the awscli or into right_aws) allows me to conjure up a VM on my laptop, configure it locally (free) then formalize the Chef recipe, recreate the same thing on a micro instance in an AWS US region (free) then move it over into the EU or Australia or elsewhere for basically the cost of data transfer.
I have yet to get some objective statistics on exactly how much of a difference it makes to run queries against a local vs international region (I suspect it's not a whole lot depending on the heaviness of the query) but it's a strong selling point to be able to move a customer stack to and fro. Not only that but it will make cross-regional applications something else we can do, another level of DR.
This weekend I got a head full of security and paranoia, which is my general heading for understanding the evil that men do. I ran into a guy who sits in NOCs and figures out where the bad guys are likely to hit. His hardnosed attitude was a refreshing wakeup call, and forthrightly more useful than any number of Hak5 videos. Not saying that Hak5 isn't useful, they very much are, but only when you talk to a security professional can you get an idea of what can't be said nicely on a freely available YouTube. A lot. What M reminded me was that in the military, a 'threat' is always considered a possibility because a threat assessment deals with enemy capacity regardless of intention or liklihood. So threat assessment is very different from risk management. Risk management is guessing what can hurt you if you do X. Threat assessment is dealing with what your worst enemy can do to you no matter what you do. Managing risk is small peanuts compared to handling threat contingencies. Or to put it more crudely, risk management is guessing which skirt is a bit too short to wear to the party. Threat contingency planning is practicing plunging the knife into the throat of the rapist when he's on top of you.
So part of the security business talks about stuff that sounds like FUD, until you see it. That's what new in my world this week. I saw it. I watched a tool snatch a password out of memory in 2 seconds flat, in plaintext. I saw a tool that.. well to save a lot of noise, I saw a small fraction of the Backtrack Linux suite in action. It's faster than Alka-Seltzer. And even if you think you are an uninteresting target (which I probably am considering the people who may have (deniably) already hacked me), seeing these tools being worked by a pro is kind of awesome scary.
I also got a taste of what goes on in dox attacks, which is a kind of second stage mayhem that may be put upon you once your box has been owned. Or, maybe you don't have to have had your network penetrated - there's plenty enough free and easy information to get on you via various services, and a world of not so free information that can be gotten for the price of a little deception.
In all of these matters, what's fascinating are the tools. Tools like Pipl, Nesus, Intellus, Freemind, Armitage/metasploit, nmap, Maltego, KnowEm, Ancestry, Expose, Monav2.. and a bunch of others flavors of kiddie candy that I'm a little silly about at the moment.
I've also had the decent fortune to do more administrative tape-ape kind of work of the sort I guess most college kids get nowadays, but I never did. Don't ask me why my college had NOS and little to no UNIX that I ever saw, but that was the 80s. I always thought that admin type duties were grunt work, but I'm seeing the use of grunting. It's no longer enough for me to know all those two letter commands, I've got to see what they do in odd combinations. So I got a pretty thorough hash through ssh this past week, learning just a bit more than I think you can learn from a book. So now a bit of that tunelling and reverse shell stuff makes a bit more sense - I can review it now.
The school of hard knocks continues. What fun!
