The Charisma Myth by Olivia Fox Cabane: Applicable to Infosec?

Charisma
These are the main points extracted from a talk that Olivia Fox Cabane gave in the Stanford's Entrepreneurial Thought Leaders Lecture Series. The question would be whether we can use these learning points to build an Infosec charisma.

- Charisma is an asset.
- Charisma let people trust you, like you and want to be led by you.
- Charisma is the result of specific behaviours.
- Behaviours that define charisma: behaviours of presence, power and warmth.
- Presence is the core of charisma.

Presence
- Charismatic people make you think that they are present, with you, fully with you.
- People can read facial expressions in 17 milliseconds. So, when you are not fully into what they are telling you, they will instantly notice. Your presence will diminish, appearing inauthentic.
- How to avoid it? One technique, focus on the physical sensation of your toes (yes, your toes!).

- Second technique. focus on the myriad of colours that your interlocutor's eyes have (but don't overdo it!).
- Charisma is how you make people feel about themselves.
- Let them impress you and they will love you for it.

Power
- We look for power signs in body language.
- Voice fluctuation and pitching skills are key,
- Powerfull people claim as much physical space as possible.
- When people adopt these poses, energy boosting hormones rise.
- Learn how to play Chemistry with your own brain.

Mental side of power
- The single biggest obstacle is lack of confidence.
- How to deconstruct the "impostor's complex". Recognise those destructive thoughts (e.g. I am not able to make it!) and consider them as graffiti on the wall and do not pay much attention to them.
- Learn how to read reality.
- We have a limited capacity of attention.

Warmth
- It is so closely tight to body language that you cannot fake it.
- Warmth comes mainly from your eyes and your voice.
- Don't act as if ... be that person, that character. Our brain cannot tell the difference between imagination and reality.
- Think of something really nice, open your eyes and link it with what you are doing right now.
- The area around the eyes is the most mobile area in the entire human face. Eyes will tell everyone the degree of warmth you are displaying.
- Never assume that your immediate assumption is the valid one.
- Choose a charisma-enhancing assumption. Re-write reality: Invent a story to alleviate your anger. Choose the reality that puts you in the most useful mental state. Don't control your body language, control your mind.
- What to do with conflicting interlocutors, think of three positive features you find of them (they can also be part of an invented story).

Practice tips
- Get your energy levels up.
- Improvise.
- Learn something that teaches you to own the space around you.
- Dance.
- But don't get charismatic with "the charismatic person".

Imagine applying even if it is only 10% of all this in your next meeting with customers.

Happy charismatic reading!

Infosec Charisma

Security site to bookmark: measurablesecurity.mitre.org

Makingsecuritymeasurable is an initiative of the U.S. non-profit organisation MITRE. The site is easy to navigate. It provides links to standard-related initiatives dealing with 15 closely interrelated security elements. I recommend visiting makingsecuritymeasurable to learn about current proposals to describe and exchange security information.

This site is based on three basic ideas:

- "We can't manage what we don't measure."
- "We need to share more information to succeed in our current challenges."
- "In order to share information, we need to use a common a language, a protocol, a mechanism of exchange."

It introduces five major themes in information security:

- Quality assurance in software development and applications.
- Threat analysis.
- Vulnerability management.
- Protection against malicious code and system & network analysis.
- Incident management and reporting.

Each of these five broad specialities presents three specific areas with useful links either to their basic principles or to current implementation initiatives. Browsing through all these pages, it is evident that, more than a common language, we need several different ones, such as those dedicated to vulnerabilities:

- The type dictionary (CVE).
- The evaluation system (CWSS).
- The vulnerability-based risk management framework (CWRAF).
- Classification of typical attack patterns (CAPEC).

Similar skeletons begin to be built for threats (eg STIX), malware (MAEC), attacks (OpenIOC) and incidents (MILE, IODEF).

In summary, the information linked from the makingsecuritymeasurable site can help formalise, measure and justify proposals to improve security for our customers and to share data between different industry players. The final question would be how many of these initiatives will mature and really become a industry standard? Time will tell.

A version in Spanish of this post will be located here in this publication. Stay tuned!

Happy browsing!

Making security visible

A security rucksack for Android

To start the year, I share a non-comprehensive list of security (or just handy) related Android apps that could constitute a sensible set of preventive security measures during our daily smartphone use & enjoyment:

To check what it is going on...
- Task Manager
- Network Monitor
- Antivirus (one of the handful of them)
- DroidWall 
- Virus Total
- Advanced Task Killer
- OS Monitor
- Startup Auditor

- X Ray
 
To prevent leaks...

- LBE Privacy Guard

To prevent losses...
- Titanium Backup

To save space...
- App2SD

To save energy...
- Juice Defender

To find files... 
- ES File Explorer

To avoid adds...
- AdAway

To find the device...
- Androidlost

A useful security suite (AV, antimalware, device locator - requiring GPS - and backup)
- Lookout

And to make space (sooner or later you'll need it)
- DiskUsage 

Thanks to all those who contributed to build this list.
Would you add other security apps to this list? Let me know.

Happy phoning!

Keeping information where it should remain

Android SDK and Ubuntu

Ever tried to communicate via command line from an Ubuntu machine to an Android phone connected via the USB port?
Here I write some tips that could facilitate this experience:

- First of all, we need to install the Android SDK in our Ubuntu box. I recommend to follow the Android Developer site. From there, we can download the Android SDK. The steps to have the Android SDK up and running are basically:

Two necessary elements that we need are the ia32-libs (if we have a 64-bit machine) and Java (sun-java6-jdk).

# apt-get install ia32-libs (if your box has a 64-bit processor)
# apt-get install default-jdk (the Java development kit)

Unzip the Android SDK.
Go to the tools folder and run $./android (a graphical configuration page will appear, just press install). It will add a minimum set of packages: tools, platform-tools and at least one (the latest) platform.


Configure the udev file as mentioned in this android page.

And that's about it! To test it, connect your android device via USB and you should be able to see it typing:
# platform-tools/abd devices

- Before focusing on the Android Debug Bridge (adb) tool, a few words on two important elements:
A mechanism to flash (here we mean write to the flash memory) the filesystem in Android devices, e.g. using fastboot (a tool that run with the Android SDK) or flash_image (this last one for a very specific purpose).

Actually this flashing tool will be used to install ClockworkMod (the Rom Manager). A powerful mechanism to, among many things, install new OS, make backups and mount filesystems in Android smartphones.

- adb shell provides a command line shell in the connected device and mounted filesystem (e.g. we can cd to a folder and mv to change file names).
- adb push allows us to copy files from our Ubuntu box to the system folders in the smartphone.

In essence, a Java-based development platform with lots of development potential.

By the way, some additional Android tips:

- Remember a previous Android related post!
- Android 1.x has a very simple file system structure compared to Android 2.x. There will be times when we first have to update to an image of Android 2.x with enough space in each of its partitions before even being able to install ClockworkMod.
- If you receive the following message: ADB: error: insufficient permissions for device then try with these commands as mentioned here:
./adb kill-server
./adb start-server
Now you should be able to run commands like:
./adb devices
./adb shell

- Sometimes you need to install an official image before daring making something with a pre-cooked rom. The way to install official Android images is slightly different and pointed out in this forum: You need to extract the zip file in your computer. Afterwards, copy the entire "dload" folder (resulting out of the decompressing action) into the root folder of the smartphone's SD card.


- Surprise, surprise... Changing an Android firmware could mean that the MAC address of the device changes ;-)!

For those who run out of internal memory, please have a read at the next 4 recommendations:

- If you re-partition the external SD-card, e.g. to make use of apps like Link2sd, after booting with the newly partitioned card, unmount and mount the card (via the android OS) to have access to the apps that were previously installed on the sdcard.

- Regarding re-partitioning an SDcard, my 2 humble cents, 50% space FAT32 and 50%ext2. This leaves the phone ready to use Link2sd.

- The use of App2SD before Link2sd is not recommendable. You would need to re-move the SD'ed apps to the phone memory to be able to use Link2sd, as it says in their FAQ. Link2SD moves not only the .apk file but data, cache and libs (which is a better deal).

- About using Link2sd to move (in Link2SD terms, that is "a link") system apps (like Keyboard, Google Play Store, etc.), just avoid it. 

And finally, remember to use ClockworkMod to create a backup of your phone (and copy the content of your SD cards) right before and after changes.

With all this soup of tools and commands, two security related reflections:
- Android market share could suffer from such a big OS versioning dispersion.
- The Android SDK is a great tool for developers... and hackers ;-)

Happy flashing!

Android or iOS, who will ring the bell?

Secure IT Up! Cyber-Insurance Due Diligence

In my first infosec book, "itsecuriteers", published in 2010, revealed how to create an Information Security team that enables business objectives. "Secure it up!", my second book, provides qualitative and quantitative insights that justify why the adoption of Information Security measures brings benefits to organisations and facilitates cyber-insurance due diligence processes.

In the world we live in, risk management and information risk management are complex fields under continuous development. If you need to justify why applying security to your organisation will provide value to your customers or you are involved in cyber-insurance due diligence engagements, "Secure it up!" helps you with a statistically sound quantitative study and a set of reputable literature references.

As I write at the beginning of the book, "now it is when information security can change the business". In a nutshell, here is why:

Three ingredients:

• The presence of a committed layer of management setting risk objectives and appetite.
• The development of a strong Information Security practice as part of a holistic Enterprise and Operational Risk Management function.
• The alignment of Enterprise Risk Management with the business strategy.

Will provide three benefits in your business:

• Increased stakeholder value.
• New business opportunities.
• Better governance.

Here you are two introductory comments both from academia and the business world:

"The recommendations in this book are simple but effective: managers will find them of practical relevance and easy to communicate.  They are based on sound empirical research which makes them go beyond consultancy speak." 

Jean-Noel Ezingeard,  Dean and Professor of Processes and Systems Management
at Kingston University, London.

"Secure it up combines a comprehensive analysis of existing literature and the results of surveys of subject matter experts to make the argument for combining Enterprise Risk Management (ERM) with information security practices."

Richard Stiennon,  Chief Research Analyst at IT-Harvest, Author of "Surviving Cyberwar","Cyber Defense: Countering Targeted Attacks", Blogger at forbes.com, Michigan.

Happy reading!
Happy 2013!