The episode number 7 of the Social Engineer podcast features an interview with Harvard psychologist Dr. Ellen Langer. This is a second post with learning points extracted from her words on mindfulness. Here you are (most of them are literal, or slightly summarised, statements from Ms. Langer):
Minute 20: Expectations. Someone publishes in a newspaper an ad asking for a 1 USD banknote. He made a lot of money. Many people just sent the dollar. They were expecting something nice in return. Actually, our brain is wired to expect that.
Minute 21: There is nothing better to provoke rejection than stating: " What you have to do is..." We do not like to be told what we have to do. However, we welcome requests.
Minute 22: The foundations of manipulation rest on offering a choice to the interlocutor. The manipulator's task will be to guide them through the choice. E.g. "[adapted]...If you would like your child to have eggs for breakfast, just ask her how would she like the eggs and not whether she would like to have eggs for breakfast".
Minute 23: A second opinion does not matter very much. We associate the word second with something less important.
Minute 25: If you need 20 minutes from someone who is really busy, start asking something along these lines: "Could you devote me two hours this afternoon?" They will answer "No way". And then you introduce your real request: "What about you give me 20 minutes?".
Minute 28: The question determines the answer. Compare these two questions:
- Why am I a failure?
- Why am I a success?
Minute 29: Another example of framing, look at these two sentences:
- You are wonderfully spontaneous.
- You are terribly impulsive.
We refer to a similar reality but within different frames. People always try to confirm hypothesis.
Minute 35: The role of people in messages, especially in messages asking NOT to do something. Two cases:
- Keep off the grass.
- Ellen says keep off the grass.
We tend to follow de-personalised messages (first case) more than personalised messages (second case).
Minute 37: (Almost) everything we experience is the result of a previous decision. Once the decision is made, most of those decisions are accepted mindlessly.
Minute 39: Mindlessness maintains the "status quo".
Minute 45: Information has no single understanding. This statement can be applied to fight against stress. Stress is a way to understand reality.
Minute 47: Learning conditionally: "This could be a table rather than this IS a table".
As mentioned already in part 1, this content is excellent - thanks to Ms. Langer and to the social-engineer.org crew!
Social engineering lecture by Dr. Ellen Langer (Harvard University) - Part II - Learning conditionally
Labels:
mindlessness,
social engineering,
status quo
Social engineering lecture by Dr. Ellen Langer (Harvard University) - Part I
Labels:
mindlessness,
social engineering
The episode number 7 of the Social Engineer podcast features an interview with Harvard psychologist Dr. Ellen Langer. I have noted down some learning points extracted from her words on mindfulness. Here you are the first ones:
Minute 10 - More than 50% of current attacks to information systems are done through social engineering (from the social-engineer crew).
Minute 12 - Most of us, most of the time, are not consciously "present", in a state of "mindlessness", i.e. we set our brain in a kind of automatic pilot.
Minute 13 - The value of "empty requests" and the power of the word "because".
If we go to an office and ask the question... may I use the photocopier? We will get a less positive answer than if we use the following question: May I use the photocopier to make some copies?
Minute 14 - By using common "cultural switches", such as ...may I use the photocopier to make some copies?.. communication emitters tend to produce in communication recipients exactly the "typical or common answer".
Applied to social engineering, this means that the social engineer needs to engage the victim into a "common and known routine".
Minute 15 - "When we are not there, we are not there to realise that we are not there" - A game of words to define mindlessness.
Minute 16 - An example of "mindlessness". Try this game: Ask someone next to you to add these numbers. Tell the numbers one by one...
- one thousand
- forty ... and she will reply 1040
- one thousand ... and she will reply 2040
- thirty ...and she will reply 2070
- one thousand ...and she will reply 3070
- twenty ...and she will reply 3090
- one thousand ...and she will reply 4090
- ten ...and she will reply...
... 5000 or 4100?
"When there is something familiar, we respond typically in a mindless way. The reason we do this is because we overwhelmingly seek certainty and certainly leads to mindlessness (...) We should be learning in a more conditional way" (Ms. Langer)
Thanks to the social-engineer.org site for this great podcast!
Happy April!
Minute 10 - More than 50% of current attacks to information systems are done through social engineering (from the social-engineer crew).
Minute 12 - Most of us, most of the time, are not consciously "present", in a state of "mindlessness", i.e. we set our brain in a kind of automatic pilot.
Minute 13 - The value of "empty requests" and the power of the word "because".
If we go to an office and ask the question... may I use the photocopier? We will get a less positive answer than if we use the following question: May I use the photocopier to make some copies?
Minute 14 - By using common "cultural switches", such as ...may I use the photocopier to make some copies?.. communication emitters tend to produce in communication recipients exactly the "typical or common answer".
Applied to social engineering, this means that the social engineer needs to engage the victim into a "common and known routine".
Minute 15 - "When we are not there, we are not there to realise that we are not there" - A game of words to define mindlessness.
Minute 16 - An example of "mindlessness". Try this game: Ask someone next to you to add these numbers. Tell the numbers one by one...
- one thousand
- forty ... and she will reply 1040
- one thousand ... and she will reply 2040
- thirty ...and she will reply 2070
- one thousand ...and she will reply 3070
- twenty ...and she will reply 3090
- one thousand ...and she will reply 4090
- ten ...and she will reply...
... 5000 or 4100?
"When there is something familiar, we respond typically in a mindless way. The reason we do this is because we overwhelmingly seek certainty and certainly leads to mindlessness (...) We should be learning in a more conditional way" (Ms. Langer)
Thanks to the social-engineer.org site for this great podcast!
Happy April!
Process explorer vs process hacker
Labels:
dlls,
network,
process explorer,
process hacker,
processes
I have been playing with process explorer and with process hacker. I initially wanted to select the best of the two but I will finally keep and use both to identify running processes (and compromised workstations). Why?
- Both tools are useful pilot light-alike tools for your e.g. MS Windows XP or 7 computers. They provide useful information on which processes are running real time on the machine.
- Both tools help identifying what a specific process does in the machine. They complement each other.
In process hacker:
- You can inject your own dlls on a running process.
- The network and the services tabs, in the main panel, help overseeing all existing network connections and services.
- You hace access to all tokens related to a process and to all registry keys in use (also in process explorer through the lower pane).
- There is even more process related information than in process explorer.
- You can create your own service and look for hidden processes.
- You don't need to install .net in your machine (since version 2).
- There is a portable app version.
But...
- You need(ed) to install .net in your machine. [Well, not anymore - thanks to Mantas for the comment]
In process explorer:
- In the process properties option, you can perform a strings command on the process (which is useful to identify specific pieces of code). You can also do this in process hacker but it is a little more hidden in the memory tab - search string.
- The "find process" functionality is really handy. Just place the moving target on the window you wonder which process it is and it identifies the process.
- There is also a portable app version.
- Less functionality sometimes means more clarity.
But...
- You have access to network information per process, but not in the main panel.
All in all, I am happy to rectify but I would say that process hacker provides everything that process explorer brings plus an additional set of goodies.
Happy March!
ps By the way, little note for the readers of this blog. If you are a passionate IT security professional, able to work in English and willing to relocate in Central Europe for some months while adding undoubtful technical Infosec value to your CV, please contact me (an email address always appears in this blog's main page).
- Both tools are useful pilot light-alike tools for your e.g. MS Windows XP or 7 computers. They provide useful information on which processes are running real time on the machine.
- Both tools help identifying what a specific process does in the machine. They complement each other.
In process hacker:
- You can inject your own dlls on a running process.
- The network and the services tabs, in the main panel, help overseeing all existing network connections and services.
- You hace access to all tokens related to a process and to all registry keys in use (also in process explorer through the lower pane).
- There is even more process related information than in process explorer.
- You can create your own service and look for hidden processes.
- You don't need to install .net in your machine (since version 2).
- There is a portable app version.
But...
- You need(ed) to install .net in your machine. [Well, not anymore - thanks to Mantas for the comment]
In process explorer:
- In the process properties option, you can perform a strings command on the process (which is useful to identify specific pieces of code). You can also do this in process hacker but it is a little more hidden in the memory tab - search string.
- The "find process" functionality is really handy. Just place the moving target on the window you wonder which process it is and it identifies the process.
- There is also a portable app version.
- Less functionality sometimes means more clarity.
But...
- You have access to network information per process, but not in the main panel.
All in all, I am happy to rectify but I would say that process hacker provides everything that process explorer brings plus an additional set of goodies.
Happy March!
ps By the way, little note for the readers of this blog. If you are a passionate IT security professional, able to work in English and willing to relocate in Central Europe for some months while adding undoubtful technical Infosec value to your CV, please contact me (an email address always appears in this blog's main page).
Book review: "Leading geeks" by Paul Glen
Labels:
leading geeks book review
I have just read the book by Paul Glen titled "Leading geeks". Following the spirit of expert book review sites, such as the one from Mr. Bejtlich, here you are some comments about "Leading geeks".
The subtitle of the book is "How to manage and lead people who deliver technology". It has been published by Wiley.
First things first, this review by no means replaces the reading of the book. On the contrary, I hope that by reading these lines, this book would have more readers. You can buy it, for example, here.
I summarise my view on this book saying that ... It is a book worth reading, Although the first half contains more aha! thoughts than the second part.
Mr. Glen starts with an interesting comparison between power and leadership. He defines leadership as "a special type of power relationship in which both leaders and followers are mutually influential for their mutual benefit".
I understand that his definition of geek is someone who works with technology. He continues with a splendid series of sentences: "...for a geek, to reason is to know, to know is to be certain, to be certain is to be right, and to be right is to be safe" (page 28). I like when Mr. Glen mentions that geeks use the "problem-solution" model (page 29) as a tool to tackle almost any situation. This constitutes already a first difficult point for geek managers (page 124): They need to perform some activities, such as facilitation and information sharing, that do not fit in the problem-solution model.
He also refers to the fact that geeks are not obliged to sharpen their social skills. Most of the value they deliver comes from actions that are not related to behaviour (page 13) . This is an important point that we, geeks, have to bear in mind (and improve).
"Geeks think self-expression is communication". You can read this on page 34. I invite you to reflect on this sentence and how current education systems promote this fact. Also an interesting point is the fact that most unprofessional behaviour happens when people are under pressure (adapted from page 134).
The author states that geeks judge colleagues in a swift and merciless manner. I doubt whether I entirely agree with this, but I certainly have this in mind when I hear some judgements around me coming from geeks.
I certainly agree with the statement that we, geeks, pay more attention to the way a system works than to what a system does (page 39).
Page 62 in the book shows also a critical difference between geek and managerial work. The former requires no interruptions and the latter is mostly based on interruptions. This is a second difficult point then for geek managers. They need to change their daily way of operation.
On page 76, the author proposes 12 competencies for geek or geek managers. It is interesting to note how the needs to manage ambiguity and time horizons are part of that list of competencies.
Especially interesting is his definition of politics (page 86): "The process by which a group of people makes a decision". I link this, first, with the recommendation that the author makes to provide clarity to the environment (page 174), so that geeks are able to understand what they work for. And second, I link it with how a decentralised manner to make decisions require information sharing (adapted from page 173).
All in all, I enjoyed reading the book. I could take several thoughts and models for daily professional geek work.
If there is an IT or IT security related book you would like a review about, please leave the name in a comment and I will endeavour to read it.
Thanks to Paul Glen for his enlightening book.
The subtitle of the book is "How to manage and lead people who deliver technology". It has been published by Wiley.
First things first, this review by no means replaces the reading of the book. On the contrary, I hope that by reading these lines, this book would have more readers. You can buy it, for example, here.
I summarise my view on this book saying that ... It is a book worth reading, Although the first half contains more aha! thoughts than the second part.
Mr. Glen starts with an interesting comparison between power and leadership. He defines leadership as "a special type of power relationship in which both leaders and followers are mutually influential for their mutual benefit".
I understand that his definition of geek is someone who works with technology. He continues with a splendid series of sentences: "...for a geek, to reason is to know, to know is to be certain, to be certain is to be right, and to be right is to be safe" (page 28). I like when Mr. Glen mentions that geeks use the "problem-solution" model (page 29) as a tool to tackle almost any situation. This constitutes already a first difficult point for geek managers (page 124): They need to perform some activities, such as facilitation and information sharing, that do not fit in the problem-solution model.
He also refers to the fact that geeks are not obliged to sharpen their social skills. Most of the value they deliver comes from actions that are not related to behaviour (page 13) . This is an important point that we, geeks, have to bear in mind (and improve).
"Geeks think self-expression is communication". You can read this on page 34. I invite you to reflect on this sentence and how current education systems promote this fact. Also an interesting point is the fact that most unprofessional behaviour happens when people are under pressure (adapted from page 134).
The author states that geeks judge colleagues in a swift and merciless manner. I doubt whether I entirely agree with this, but I certainly have this in mind when I hear some judgements around me coming from geeks.
I certainly agree with the statement that we, geeks, pay more attention to the way a system works than to what a system does (page 39).
Page 62 in the book shows also a critical difference between geek and managerial work. The former requires no interruptions and the latter is mostly based on interruptions. This is a second difficult point then for geek managers. They need to change their daily way of operation.
On page 76, the author proposes 12 competencies for geek or geek managers. It is interesting to note how the needs to manage ambiguity and time horizons are part of that list of competencies.
Especially interesting is his definition of politics (page 86): "The process by which a group of people makes a decision". I link this, first, with the recommendation that the author makes to provide clarity to the environment (page 174), so that geeks are able to understand what they work for. And second, I link it with how a decentralised manner to make decisions require information sharing (adapted from page 173).
All in all, I enjoyed reading the book. I could take several thoughts and models for daily professional geek work.
If there is an IT or IT security related book you would like a review about, please leave the name in a comment and I will endeavour to read it.
Thanks to Paul Glen for his enlightening book.
Increasing online availability levels
Labels:
availability,
persistence,
ubuntu 9.10,
USB drive
Confidentiality, Integrity and Availability. The CIA acronym is always present in Information Security. The three key security properties that any piece of information has.
This post focuses on increasing availability in a specific scenario: We need to access the Internet and we do not trust the hard disks (maybe they are infected by a piece of malware, maybe there is a keylogger already installed...) of our computer.
Ubuntu releases (e.g. 8.10, 9.04 and 9.10) provide the possibility to create a Startup USB drive with some persistent space to store configuration settings and documents.
The drawback of being persistent is that the risk of infecting also the USB drive exists. However, the advantage of persistence is that we can configure it beforehand so that the Ubuntu installation on it is already aware of our router and network configuration. This is specially welcomed if the ultimate user of the USB drive will be an IT layman.
How to do it? Download the iso image preferred to be installed in the USB, go to System, Administration, USB Startup Disk Creator functionality (option present in Ubuntu 9.04 and 9.10) and configure the wizard similarly to this screenshot.
Keep the newly installed USB drive in a safe place and test it every regularly. One unexpected day, it could become the key to have Internet access available.
Happy New Availability (and 2010)!
This post focuses on increasing availability in a specific scenario: We need to access the Internet and we do not trust the hard disks (maybe they are infected by a piece of malware, maybe there is a keylogger already installed...) of our computer.
Ubuntu releases (e.g. 8.10, 9.04 and 9.10) provide the possibility to create a Startup USB drive with some persistent space to store configuration settings and documents.
The drawback of being persistent is that the risk of infecting also the USB drive exists. However, the advantage of persistence is that we can configure it beforehand so that the Ubuntu installation on it is already aware of our router and network configuration. This is specially welcomed if the ultimate user of the USB drive will be an IT layman.
How to do it? Download the iso image preferred to be installed in the USB, go to System, Administration, USB Startup Disk Creator functionality (option present in Ubuntu 9.04 and 9.10) and configure the wizard similarly to this screenshot.
Keep the newly installed USB drive in a safe place and test it every regularly. One unexpected day, it could become the key to have Internet access available.
Happy New Availability (and 2010)!
Subscribe to:
Posts (Atom)
