David Fraser's Blog

Why I left a Good Job to Work for WaMu

davidfraser — Tue, 17 Feb 2009 05:50:31 +0000

It comes down to these reasons: 1) I believed in the company 2) I had the opportunity to work with great people 3) I thought it would advance my career.

As a Seattle native, Washington Mutual has been a household name for almost as long as the city has existed. My mom took me to WaMu when I was eleven to open a bank account to put my paper-route money in. We got both our mortgages from WaMu because in the housing frenzy, I thought they were an institution I could trust. When the opportunity came up at WaMu, I was dubious about the health of the company, so I talked to many people. Most felt as I did- that the worst had come to pass. A company called TPG also believed in them and invested $7 billion. I knew things would be tough, but understood the strategy to drive down costs and felt I had a good role in it. I only ever heard one person float the idea of a run on the bank- my new boss. I thought he was crazy. Instead, it was visionary. I had many great experiences and met many great folks at WaMu in my short time there. I will always value my time at WaMu and hope the risk I took is valued by future employers.

SecureSeattle 02-06-09 Notes Part 2

davidfraser — Mon, 09 Feb 2009 22:44:33 +0000

The most interesting presentations for this little conference came from a guy named Brandon Dunlap on behalf of a company called Brightfly which he described as “Kind of like Gartner- only more ‘free’”. Well, sounds good. It seems like Gartner’s formula is pretty much the same regardless of the topic: 1) establish that whatever the topic is- it is VERY difficult to do correctly 2) most firms don’t do it right, so you won’t do it right 3) Hey! whaddya know! we have some great folks that could help you with that!

Brandon held forth over several sessions on all manner of InfoSec Management, and man was he singing my song. He spoke on the overly-complex formulas that firms apply for risk management, and the over-agonization people put into picking a framework and mapping them with other frameworks. The difference in language and detail not-withstanding, the key to me is to PICK A FRAMEWORK. This allows you to speak a common language with internal and external parties. It doesn’t matter if the implementation of a control is too vague within the letter of the standard or specification: it’s up to us as InfoSec professionals to justify how and why we implement something. Brandon also mentioned the “Unified Compliance Framework” which is meant to be something of a Rosetta Stone between all the various InfoSec Standards such as ISO, PCI, HIPPA etc, etc. In my opinion, they all resemble one another at their foundations, and they are typically driven by things we SHOULD be doing. Kind of like diet and excercise. If you are still looking for a silver bullet that excuses you from the basic, but at times tough practices requiring disciplined follow through, then you are probably continuing to live with higher than necessary risk.

Brandon also cited one of my favorite tools for organizing thought: Porter’s Value Chain analysis. This model is used to develop systemic thinking across the lifecycle of whatever given service is at hand. It puts you in touch with whatever is hitting you from upstream, and what you are impacting downstream.

But what really set Brandon apart is that he was able to talk about these things in a coherent, interesting and ENTERTAINING manner. It was almost disorienting how much fun it was to listen to someone speak so fluently about Information Security. Definitely a skill I am working to master.

SecureSeattle 02-06-09 Notes Part 1

davidfraser — Mon, 09 Feb 2009 22:07:02 +0000

The downside: 8 hours of InfoSec Info-mercials. The upside: free, 9 CPEs, and at times, pretty interesting. A lot of discussion about how Application Security continues to be a weak link, and continued root cause assignment to lack of training/interest on the part of development teams. Those incorrigible developers! Also presentations on network monitoring and Identity and Access Management. Another theme here of course is that systems are so complex, no mortal can adequately inspect them, and so tools are needed to automate monitoring and management. Well known app inspection software Fortify mentioned that input validation is the #1 consideration for protection. 30% of firms surveyed by Fortify considered themselves secure, but when examined closed, Fortify only considered 10% of these firms secure. Now look, we can all scoff at this by pointing out that of course a vendor in the business of finding problems is going to say this, but just go with it and ask ”what if” what if they are right? If you think they are wrong, what do you know that they do not? Fortify also believes that 90% of issues come from app. security, as did my former CISO, Ed Amoroso of AT&T.

What’s more is that in the face of budget cuts, one speaker believes that security incidents will only go up. Not exactly a bold prediction, but how do you feel about that? Presenting a business case for Information Security projects seems to be among the most difficult to perform concrete CBA on. I obsess about this sort of thing.

Some other AppSec comments: Chinese hackers are coming for you, pen testing isn’t enough, do security testing as part of QA, XSS is the most common of the OWASP top 10- and they are getting more clever.

IT Asset Management

davidfraser — Fri, 23 Jan 2009 23:37:24 +0000

Some thoughts: ITAM, EAM, ITEAM, IAITAM, IAM, PAS 55, Asset Tags, RFID, Report Writing, Asset Registers, integration with general ledger, depreciation, integration with procurement process, complexity issues introduced by virtualization, automated discovery, intentory managment, lifecycle management including disposal, warranty issues. WHAT DO YOU THINK IS THE MOST DIFFICULT ASPECT OF TECHNOLOGY ASSET MANAGEMENT?

Re-regulation Coming?

davidfraser — Mon, 22 Dec 2008 19:34:18 +0000

What will the aftermath of no corporate oversight be? In spite of SOX, and high profile failings like Enron and various telecoms, PLUS the collateral damage to firms such as Arthur Andersen, we find ourselves in a historic period of economic downturn traced largely to a lack of oversight. Is this because oversight doesn’t work, and therefore isn’t worth attempting? Or does it mean a recommitmant to enforcing the regulations already in place? I hope for the latter. But more importantly, I hope for a renewed interest to common sense and long-term sustainability.

Secure World, Bellevue WA 2008 (Pt.1)

davidfraser — Tue, 04 Nov 2008 05:58:33 +0000

I finally made it to this little trade show/training bonanza. It was great to see many familiar faces I have worked with through the years. I got to see an Application Security presentation that had some great ideas, including the concept of employing a “Technical Mentor” of whom anyone could simply go to ask questions and bounce ideas off of. I know this works, because I have worked in environments where this role has been filled both formally and informally. Hours spent researching a topic can be boiled down to a 15 minute conversation. Critical to the role is trust. You have to feel safe to ask the questions you think might be stupid.

So I know this works if you have a PERSON filling that role, but what about if you have an APPLICATION filling that role? That’s what the presenter’s company offers- an app called “TeamMentor” from Security Innovation. Anyone check it out? I will try to an let you know what happens.

Looking for Work

davidfraser — Mon, 03 Nov 2008 20:02:41 +0000

Do you have an opportunity for an experienced IT Manager skilled in Program Management, Information Security, and Vendor Management? I will be employed at JP Morgan Chase through March 2009, at which point I will become part of the workforce released as a result of the WaMu acquisition. I would be more than willing to relocate to the San Francisco Bay area. The ideal gig would be negotiating security language in contracts, building a vendor security program based on ISO 27002, or simply performing project management.