GHC12: The Internet Enables All the Worlds Hackers to Attack Your Computers 24/7. Are we secure enough yet?

Susan Lincke (University of Wisconsin),starts out with the question: Are we secure enough, yet? Looking at all of the attack reports on the news - NO! If the big companies can't get it right, what are the chances for the little companies doing it correctly?

Dr. Lincke got a grant from the NSF to create a security workbook. A security how-to with goals that non-professionsals can easily use it. It covers things like code of ethics, risk assessment and how to protect this data. It's a workbook, so a lot of the items are skeletons that you need to fill in for your specific needs and gives you a method for calculating expected loss for all of these risks.

The workbook also introduces concepts like recovery time (interruption window, service delivery objective, and maximum tolerable outage) and terms (recovery point objective and recovery time objective).

It also helps with security classification guidelines for the data, like what type of stuff should be confidential? In a medical office, that would be data covered by HIPPA, for example.

The workbook covers concepts like network security and helps people define which services and data can leave the local network. The same concepts can then be applied to the physical security map - like, which rooms can a patient walk around unmonitored?

All of this requires an incident response plan - what to do if you get a virus? What lessons can you use going forward to prevent future infections or attacks.

I think this is a great idea - I think about a small dental office, which does need to protect patient data, but probably haven't considered this because the concepts are foreign to them and seemed too difficult to begin to approach.

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: Security and the Cloud

Susan B. Cole, Exceptional Software Strategies, Inc. started out with a great explanation of what exactly the cloud is and what goes into it (data, mostly). Advantages of the cloud? On demand self-service, broad network access, resource pooling, rapid elasticity and measured service.

Cloud is important - you're probably using it even if you don't realize it. Things like Dropbox and Google Docs are all cloud services. (note: I LOVE Google Docs! Being able o have multiple people modify a spreadsheet without emailing back and forth large files and constantly changing the name to add versioning is so nice!)

The problem, though, is a lot of people end up creating their own clouds out of necessity, but do not consider security - so, it's good to use large providers who have this built into their solutions already.

A big benefit of cloud: money savings. For example, the city of LA saved $1.1 Million per year by switching to Google Mail and Google Docs.

But, before you move to the cloud, make sure security and confidentiality are covered and get this is in writing! Service level agreements and contracts are required. You will no longer be in control of your data.  Look out for different tenants using the same instance of service but unaware of strength of the other's security controls, most SLAs do not have security guarantees, and once you're on the cloud, you are open to the world's hackers.

Ask where your data is? If your company is in Maryland, but your data ends up in California you need to be aware about California laws on data protection, as your local state laws will unlikely apply.

Can you get auditing from your cloud provider? HIPPA and PCI help with medical and financial cloud providers, but you need to even check those to make sure they are in compliance.

While you can do penetration testing on your own network, you can't do this against your cloud provider - the provider won't be able to  distinguish your test from a real attack and... what if it works and then you take down another tenant?  You need to get your provider to do regular security assessments and you'll have to ask for the reports.

 If the provider cannot or will not provide this data? You shouldn't use them!

Does your cloud provider encrypt the data between their network and yours?

You need to be in charge of asking these questions to protect your data - meet with your cloud provider regularly!

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: Leadership Workshop: Office Politics for People Who Don’t Like Politics

I always love every single Jo Miller, Women's Leadership Coaching, workshop so was so thrilled when I heard she was coming back to Grace Hopper Celebration of Women in Computing again this year!

The emerging leader's quandary: How do you get to that higher level position that requires more leadership experience than you have - but you can't get the leadership experience without the position?  A challenging question many of us have faced in the past - not just with leadership, either! Jo hopes to give us all skills that will help us become better leaders without necessarily leading a team.

Office politics - nobody likes playing this game, at least nobody in this room. But, would you be willing to join the game if it will get you the promotions and projects that you want to work on?  Could this be a skill, and not just an annoyance. "avoiding (office) politics altogether can be deadly for your career" - Erin Burt

Jo proposes that there is a way to navigate office politics in a way that is both ethical and advantageous for your teams.

Hard work alone won't get you recognized. So, work less :-)  Not exactly, but if you're always so heads down with working and never letting anyone know what you're doing.

"Get out of your in-box!" - Barbara Gee.  Get out and talk to people! Step away from the terminal..

Lets stop calling it office politics - such negative connotations. What about Organizational Awareness?  What does that mean? Being a savvy observer of the communication and relationships that surround you in your organization.

This isn't just about looking at the org chart - it doesn't tell you everything, like, who are the thought leaders, who gets things done, who's been over-promoted and are actually ineffective?   You need to find people that can happily help you get things done - the Shadow Organization. This isn't what HR knows, it's what you know.

Jo had us put together a chart of those people that we work with most frequently, adding solid lines for people that work well together and dashed lines for those that don't work work well together, adding arrows to show how influence flows. Once that is all done, we drew circles around coalitions - people that work well together. Once this was all on paper, we could better think about things, like how did those coalitions form?  Is one person excluded from all coalitions and perhaps everything?  Doing this will help you to gain perspective on your team

The final piece of this shadow organization is the verticals: people who are getting mentored and sponsored by their manager and passing this up. Like a ladder.

Doing this myself, I realized that my "shadow organization" includes many people that are not in my direct org.

Highlights of the Shadow Organization:

• Relationships
• Influence
• Coalitions
• Key Influences
• Verticals

After a group discussion, a couple of questions came up about people in their organizations who are separated from everyone due to something they did many years ago. Jo recommended really focusing over the next few months on rebranding themselves - keeping all work and communications positive to help overcome past mistakes.

How can we gather information to help map the shadow organizations?  Can you do this via face-to-face interactions? What about virtual teams?  A few audience suggestions included organizing "friendship lunches" where you just reach out to people in your organization and field of influence on a casual basis, don't open your laptop in a meeting - connect instead, invite people to coffee (and see who else is having coffee together), and never miss a happy hour :-)  For virtual teams, site visits and video calls, even if just occasionally, should be done, in addition to talking on the phone.

Sophie Vandebroek, CTO of Xerox, once told Jo: "It's not enough to have a bright technical idea. I have seen too many projects led by great, passionate people fail because they tried to be the lone influencer." Can we have stronger teams and more successful projects by building more relationships and coalitions? It sounds like it!

Every organization and every team has unwritten, unspoken "Rules of the Game". It's unlikely that anyone is going to tell you about it - but you can probably ask.  For example, in some teams, no work should start until consensus is reached - while in others, act now and ask questions later is the rule. To be successful - learn these rules in your org.

There are five ways to generate quick wins in office politics:

• In every organization, there is some who is great at navigating office politics - find them and ask them how they do it!
• They navigate well at all levels
• They are the keeper of the "institutional memory"
• They are good at reading people

•  Build and influential coalition
• It can be quicker and easier to get great things done from the grass-roots
• Be an advocate for others, support stuff that's important to them

• Don't like the unwritten, unspoken "rules of the game" - become a game changer!
• If you don't like them, you're probably not alone! This is where you can get those other like minded individuals to  help you to do so.
• For example, you can't make the late night "happy hours" in bars because you have to pick up your kids, or have other obligations - can you create a new social event that happens during normal work hours?

• Manage Upward
• Leading your leaders is easier than you think... 
• Think and act like an executive
• Understand their most important goals, their challenges, and how they make decisions.
• Remember - you're the expert in what you do, don't be deferential.
• Always have a talking point ready
• Executives have to make decisions quickly, be prepared to talk to them if you see them in the hall, in between meetings etc.

• Enlist senior-level sponsors and adocates
• These aren't mentors, but sponsors - someone that's going to promote and be an advocate for you. Someone who will argue your case behind closed doors.

 Again, sponsorship has come up. This seems to be so important. When looking for a sponsor, you want to find someone that is a senior leader with influence, well-respected and credible, familiar with your strengths, has a track record of developing talent, provides exposure and provides cover when you're under attack. Getting sponsors outside of your immediate organization is a good thing, too!

How do you get a sponsor? Turns out, you don't just go out and get one - you have to earn one, cultivate it. You can do this by outperforming, making your value visible, observe the protocols, and network across your organization. You can do a lot of these things by looking for projects and exposure opportunities working with or for senior leaders.

None of this will work, though, if you don't have clarity about your own career goals!  You have to know what you want to do or where you want to go, and make sure that these senior level people in your shadow organization are aware of those goals.

You can find the full slides on Jo's site.

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: Keynote, Anita Jones, Another Perspective

Anita K. Jones, is a University Professor Ermerita at the University of Virginia and a Professor of Computer Science in the School of Engineering and Applied Science, and was sworn in as the Director of Defense Research and Engineering for the U.S. Department of Defense in June 1993.

Dr. Jones was the keynote speaker at the very first Grace Hopper Celebration in 1994! I wasn't at that first event, so how cool to get o see her now - a woman that has a seamount in the ocean after her!

Dr. Jones starts by looking at the conference theme: Are we there yet?

Analyzing this phrase, we need to think about the we - many great things are done together, so it's important who you associate yourself with.

Today, there are 2 times more jobs in IT than all other engineering disciplines combined. In the near future, there will be 4 times as many - an ever growing field, more people to surround yourself with :-)

Electrification of rural America in the 50s, better sanitation practice and better access to water revolutionized America and nearly doubled our life expectancies. Can there be a software revolution with that much impact?

Dr. Jones believes it's happening. The spread of the Internet, the ability to visualize organisms and galaxies, all the way to just-in-time delivery enabled by RFID tracking devices.

We're now connecting with one another in ways we never thought imaginable: there are 5 billion cellphones in the world, and only 7 billion people! We have Facebook, twitter, Google+ (and Google in general), LinkedIn, etc - where we can connect with each other, keep in touch, meet new people. Something unheard of just 20 years ago.

Yes, I did make new friends on a BBS nearly 20 years ago, and I'm sure some of you met folks through your MUDD or CompuServe chat room - but we were the very few, the Internet elite.

If you want to revolutionize the world, do research - but pick a new topic, look for new ways to  help the world. It's always easier to write the first thesis on a topic, as opposed to the 20th.  Dr. Jones jokingly said she'd like us to do research into making it possible to order really nice shoes that fit your feet perfectly.

This years revolution? Massive open online courses.While not the same as a university offered curriculum, it's getting there. Harvard and other big universities are funding these courses.

These can't be really successful until three is automated grading, individualized assistance and a way to motivate the students to finish. Let's do research in these areas - we can revolutionize education!

Revolutions can be hard: For example, the Air Force was against pilotless planes, because who are the top guys in the Air Force? Why, pilots of course - they didn't like the idea of these drones because it took pilots out of the picture. But these drones can do things pilots can't - fly for 40+ hours, no need for a cockpit, loaded with sensors and cameras and without risking the lives of pilots.  The Air Force still wasn't interested, until the Army tried to order some. The air, though, is the domain of the Air Force - and they didn't want to give that up to the Army :-)

Technology can revolutionize all sorts of industries. Being a computer scientist and information technologist means you can steer the revolution. We can make the difference!

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: Plenary Session: Technology in Governemnt, Another perspective

Moderator: Dr. Francine Berman (Rensselaer Polytechnic Institute) Panelists: Andrea Norris (National Institutes of Health), Debora A. Plunkett (National Security Agency), Dr. Laura Stubbs (Department of Defense), Farnam Jahanian (National Science Foundation)

Dr. Jahanian stressed how important computer security, networking and robustness were to the government and will be areas of investment for the US Government in the coming years.

Ms. Norris emphasized how important things like the Human Genome project were - you can now buy a DNA sequencer for less than a $1000 thanks to that project. She encouraged research on bringing drugs to market faster (currently it takes an average of 13 years from beginning research to consumer).  Already, targeted cancer treatments

Ms. Plunkett mentioned that the NSA faces some of the toughest problems - providing information assurance to the entire country. Information assurance is a national priority, but is under attack as there are many entities out there that would like to have access to the US Government's secrets. New technologies are enabling greater access for employees with great mobility, but it does increase the attack vector.

Dr. Stubbs' said they have growing jobs at the DoD in the areas of cyber science and technology, engineered resilient systems, counter weapons of mass destruction and research around remotely piloted aircraft (you know.. drones!)

All of the panelists did a great job of explaining all of the fun ways you can use your technology degree in the government, quickly answering questions about getting started (you can do as little as a summer internship, a 3 year assignment at the NSF or make a life time career out of it). Check it out yourself at USAJobs.gov!

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: SRC Poster Competition: Graduate - Round 2

In this session semifinalist graduate students from the Wednesday night poster session are each given 15 minutes to present their work.

Jaya Kawale, University of Minnesota, presented on teleconnetions in climate data. I got to learn about dipoles that represented different classes of teleconnections characterized by anomalies. These are important, as they can cause temperature and precipitation anomalies throughout the globe. These anomalies can lead to droughts or monsoons, being able to predict them can help people better prepare for severe weather.

Kawale's research found that these weather anomalies had a partner event, so her research worked on correlating that and clustering the data.  By using automatic dipole discovery, most dipoles have been discovered and new ones are found quickly.  This data can also help with quantifying impact on land temperature.

Awalin Sopan, University of Maryland , started her presentation with a story about a series of crimes in a community. Where the police did not see the pattern, neighbors communicating online discovered the pattern and the crime was solved. This became Nation of Neighbors, a very successful way for neighbors to track crime in their own community.  Her team worked with them, along with social scientists, to find out what constitutes a successful community, classified by their tool ManyNets.  The tool itself is generic - it analyzes networks.

All communities have a lot of invitations, but successful ones had more reports. People tended to want to report things anonymously - but then how can you identify the top influencers?  They did it by looking at just basic activity.

More leaders in a community resulted in a more active and more beneficial community. Interestingly, very few of the leaders had anything to do with law enforcement, just concerned citizens that took on this role voluntarily.

Unfortunately, the researchers were unable to determine if the community became more safe or not after participation (no access to the data). Though, by participating, neighbors felt more safe.

Zalia Shams, Virginia Tech, presented her research on cross-testing. A pretty ingenious concept - when a CS class has an assignement, the TA needs to submit test programs to run against the programs, but then they also had the students submit their own test cases. Of course, most students will pass their own test cases, but then they would run other student's tests against another student's code - a great way to find bugs! (personal note: I always think that tests are better if someone else writes them. When you write your own tests, you'll miss your blind spots).

This isn't as simple as it sounds. Depending on the program, the test cases may need to be built against the submission, which lead to lots of compile errors. The researcher used late binding to work around this.

Just like in the real world, students weren't very excited about writing lots of test cases for their own project, but did like the idea of their tests cases being used against other students programs.  In one of their tests, they found that 0 submissions passed 100% of the tests. They had removed tests that were testing things that were outside of the scope of the assignment.

This is like crowd sourcing your tests. A fascinating idea, but unlikely to work outside of a university setting where you're forced to write many test cases :-)  But, I think this is a great idea to teach robust programming, and I do wonder how we could apply this to the industry.

This was all based on extending Web-CAT.

This post syndicated from Thoughts on security, beer, theater and biking!

GHC12: From Engineer to Executive: The Path Forward

Susan Zwinger, Oracle, is building upon Nora Denzel's keynote - here to talk about people.

Who is Sue? Well, she's an engineering VP at Oracle, but she's also a wife, a mother of two, daughter and frequent traveler.

Ms Zwinger didn't start out thinking she'd become a VP, with her degree in statistics. She started out as a software engineer, but quickly became bored and took a job designing a kernel internals course - where she got to travel all over the world to give the class.  She was hooked on the travel bug after that and looked for jobs that let her do that!

You want to choose a career that you can grow in, will increase your job satisfaction and improve your satisfaction. But, you need to figure out what your strengths and weaknesses are - and this changes as you grow.

You want to plan your career instead of just react - but that's not always possible. Ms. Zwinger's first husband committed suicide when their daughter was only a year old.  Initially feeling like everything was over, she picked up everything and moved to Tokyo. It taught her that she was strong and could find her way out of the worst circumstances imaginable.

Best ways to start planning? Figure out who you are - take a Myers Briggs test and do a 360 degree review (includes self review, peer rating, direct report rating, supervisor rating).

•  Myers Briggs test
• 360 degree review (includes self review, peer rating, direct report rating, supervisor rating)
• Her own 360 taught her that she's great at results and leading her team through change, her reports loved her - but her peers did not.  She has problems with people skills, leaving "bodies in her path". Something to work on! 
• FIRO-B  -  Fundamental Interpersonal relations Orientation-Behavior. 
• She learned from tis that she had a need for control (which she knew) but also had a big need for affection (surprise!)
• Coaches
• People that will tell you the truth about yourself!
• Sun paired her up with executive coach Steve Josephs
• Taught her to respect everyone - sincerely, not just going through the motions.
• when things are getting stressful or out of control, take a deep and slow breath.
• The Leadership Derailer helps leaders find which weaknesses require improvement to succeed?
• Management Skills Inventory
• Books: Think Positive, Lou Tice
• For Ms. Zwinger, this was applied to a simple thing: think about the positive parts of not biting her nails. Her fingers felt better. Focusing on that simple positive thought, she broke her long time bad habit.
• Inspiring person: Think Olympian, Marilyn King
• Injured for 9 months and could not practice for the decathlon, but thought through her training. Spent every day thinking about and watching the event. She ended up placing second in the trials.

A great and inspiring a talk, very relevant for me given my recent job change into management!

This post syndicated from Thoughts on security, beer, theater and biking!