How Leaders Hold Themselves Accountable



Tweet

Some of the weakest leaders I've seen use organizational silos as a defense for not fixing a problem. "Gee, I'd love to help but that problem is in so and so's organization." Nice job of stepping up pal. I'd much rather work with and for the person who instead says "That looks like a big issue over there. How can I help solve it even though it's not in my area?" You get the picture.This mindset pertains to all problems big and small. Whether it's a discarded soda can on the front walkway at your company headquarters or a large profit shortfall in a major business unit, you owe it to yourself and your team to help in any way you're able (even if that only consists of pointing the problem out to the true "owners" and asking how you can help. By the way, simply pick up the soda can and put it in the recycling bin. And if along the way, you find your company doesn't have a recycling program, well… you know what to do).

More:
http://www.thoughtleadersllc.com/2007/12/you-see-it-you-own-it/

Endpoint Security for Mobile Devices



Tweet

Endpoint Security for Mobile Devices

2012 NIST/OCR HIPAA Security Rule Conference

June 6, 2012 

https://csrc.nist.gov/CSRC/media/Presentations/Endpoint-Security-for-Mobile-Devices/images-media/day1-a2_dshepherd_onc-mobile.pdf

'Back in the day' we didn't scale and WE LIKED IT.



Tweet

I've been in web hosting since '95.  Back in the day I was the Tech Lead for IRS.gov (1998-2000). We had BIG IRON (hand me down HP K Class servers) from another failed IRS project.  They were big, literally 1 server per rack, and we had to build to support all traffic on Tax Day (April 15th). No cloud, few MSPs, Akamai was in it's infancy.  We had Cisco Local Director load balancers and grew to geographic load balancers (Alteons).  I personally had to forecast peak traffic and we built for peak load. 

Tax Day was always like that scene in Das Boot (1981) where the the U boat is sinking and the hull is being crushed by the pressure. That stress peaked on the 15th. For reference:  

Months of work and worry all come down to a single day.  No way to add more capacity, no way to slow the onslaught of late taxpayers.  To make it even more fun, numerous firms (Red Alert, Intuit, etc.) were tracking and reporting our response times throughout the day. There was no escape.  Just prayer that you made it through without crashing and burning.

Now we scale automatically, by default.  Yes, it's better, but not nearly as exciting.

AWS re:Invent 2017 - Guide of Guides - Updated



Tweet

I'm headed to AWS re:Invent this year.  Hooray!!

This is my first time and I've been reading everything I can to get a feel for the event.  I've been to some large conferences before (RSA, HIMSS, Atlassian Summit, etc.) but re:Invent looks to be a very different event.

Below are the the things I am reading to get prepped.  I'll update as I find more.

Leave a comment if you find it helpful. 
Let me know if you have others to add.
Thanks! 
--David

AWS re:Invent 2017 - Guide of Guides

Guide	Source	Date
A guide to AWS re:Invent 2017	Vault Solutions	12/19/16
AWS re:Invent review: Las Vegas 2016 and what to expect in 2017	Raygun	12/22/16
AWS re:Invent 2017 Guide – An Alternative Look	GorillaStack	06/29/17
AWS re:Invent 2017 insider tips for getting the most out of your week in Las Vegas	A Cloud Guru	07/11/17
Start planning now for AWS re:Invent 2017	A Cloud Guru	07/23/17
Get Ready for AWS re:Invent 2017	AWS Blog	08/08/17
How to get the most out of your time at AWS re:Invent	Cloud Assessments	9/20/17
* The ultimate guide to your first AWS re:Invent conference	A Cloud Guru	10/02/17
From Previous Years	Source	Date
AWS re:Invent 2016 Survival Guide	VividCortex	11/28/16
A Survival Guide for AWS reInvent 2016 -  -	Sumo Logic	11/15/16
The Top 5 Things to Avoid at AWS re:Invent 2016 -  -	2nd Watch	11/9/17

Updates:

• 10/02/17, A Cloud Guru Blog
• 
  

Many, many years ago I dropped this on the web



Tweet

The Comic Sans font selection was not my call...

https://web.archive.org/web/19961226170717/http://www.worldwidehr.hq.dla.mil/

My Lucky Heart Attack



Tweet

As the week draws to a close I am assessing all the ways that I am lucky. I had a heart attack on Monday. Yay me!  Not quite, but I am so lucky it happened the way it did. 

It could have happened when we were hiking to find Geocaches (on Saturday) or while searching for fossilized shark teeth in Calvert County, MD (on Sunday). It could have happened any day over the last few months that I have driven solo to work or up to Baltimore for stressful security assessment meetings. It could have, but it didn't. 

I had my heart attack at home, planting bushes in the front yard, while my sister-in-law, the doctor, was visiting. She had just come the evening before. By the time Rebecca got off the phone with 911 there was an ambulance at the door and I was on my way to the best Cardiac Care unit in the area. 

The simple truth is this: I should have been taking better care of myself. I should have been more in tune with my heredity and my risks. If you have the family history (my Dad died of a heart attack at 43), or high cholesterol, or more than a few extra pounds, etc., do yourself a favor. Make sure you see your regular doctor, get one if you don't have one, get a cholesterol test and find out what your risk is. I hope you are lucky like me, but...

I am home now and on my way to feeling and being much better. I have mixed feelings about the events of the week, but I have no questions about how lucky I am. That said, being lucky isn't a plan you can count on.

JOSEPH M. ZURLO



Tweet

An amazing man was laid to rest today at the US Naval Academy in Annapolis, MD. I was lucky to work for Joe for the last 8 years. Joe made a huge impact on my career and personal life. He will be missed by many.

http://m.legacy.com/obituaries/washingtonpost/obituary.aspx?n=joseph-m-zurlo&pid=169413979&referrer=0&preview=True

This is old, but there's still some good stuff.



Tweet

Safeguarding Health Information: Building Assurance through HIPAA Security

Briefing: "ONC Mobile Device Project"

Wednesday, June 6, 2012

Video:

Slides

Thank you all. A note from @sheffus, the @USCERT_gov account manager



Tweet

Fellow IT and Security folks,

This is the first and only tweet I, @sheffus, will make on this account. On August 2nd, 2013 I am officially transferring control of the @USCERT_gov twitter account to US-CERT/DHS.  I have been responsible for the account since I created it in late 2008.  I originally created the account (and numerous others) when I started exploring twitter and how it could/should be used by Federal Agencies.

I just want to say "Thank You" for following along and allowing me to provide this service.  I hope you have found some value in the feed.  This community has been incredibly encouraging and helpful.  Followers have even alerted me directly when there were problems with the feed.  For that I am truly thankful.

The back story, in case you are interested

How and why I became responsible for the @USCERT_gov feed

In late 2008 I started to explore twitter.  At that time I set up a number of twitter accounts sending out federal agency content. Many agencies had not yet jumped in to twitter and I was interested in getting their content broadcasted.  I set up accounts for DLA, EPA, the US Archives, USAID, DHS and a number of others. I also set up a few aggregation accounts for government news including USGovNews, UKGovNews and CanadaGovNews. Most of the individual Agency accounts were eventually removed by twitter and the Agencies that were getting their Social Media activities started.  The account I had created was in the way and, to be fair, I had no authority to set up the accounts in the first place. Most Agencies had set up official accounts, managed by dedicated professionals and were on their way to building communities of engaged and informed users. I was simply providing a placeholder service while they got their Social Media initiatives together. Also, I wasn't providing any interaction at all. I didn't want to 'speak' for any Agency.  I was simply pushing content from their RSS feeds to the twitter account.  I use twitterfeed.com (@twfeed), which is a wonderful, free service, to connect the Agency RSS feed(s) to twitter. I am glad that the Agencies finally got involved and started using twitter to engage with citizens. Twitter has offered citizens a unique and often very personal way to communicate. 

For whatever reason the US-CERT had not set up their own twitter account. Over time the account gained more and more followers and content was often retweeted.  Which makes sense, since the US-CERT content is always helpful and appreciated.

 

Handing @USCERT_gov over to US-CERT

On July 17th a follower contacted me via my personal account, @sheffus.  That user was @AnAHAmoment.  I searched LinkedIn and discovered that the user was a "Social Media, Web Presence and Innovation Strategist" working at the US-CERT.  Long story short: @AnAHAmoment and I discussed the @USCERT_gov account and the tools I have used to broadcast their content.  We also discussed the growth of the account (which was 100% organic) and the future of the account.  I offered to hand over control of the account which I think was unexpected. It has always been my hope that someone at US-CERT would officially take over this account. It is time for the professionals to start providing real interaction with the users.

I have high hopes that this is what is coming next.

Thank you all for your support. I hope to see you around twitter and elsewhere.

Respectfully,
@sheffus

Do This! Presenter view in PowerPoint for Windows



Tweet

I have forever loved the "Presenter view" when briefing from my Mac.  It really makes briefings easier when you can see upcoming slides and your notes on screen. It is the default presentation format on my Mac, but was never available on Windows. I just found you can do this from a Windows machine, if you know how.

Microsoft explains it well: "Using Presenter View is a great way to view your presentation with speaker notes on one computer (your laptop, for example), while your audience views the notes-free presentation"on a projector.

How do you do it?

Configure PowerPoint to use Presenter view with two monitors

1. On the Slide Show tab, in the Monitors group, click Use Presenter View.
   
   Note The Display Settings dialog box from Windows Control Panel may appear. If it does not, you have already set it up. If you still want to change the settings, see Microsoft Windows Help to locate your Windows Display Settings and follow steps 2 through 4.
2. In the Display Settings dialog box, on the Monitor tab, click the monitor icon that you want to use to view your speaker notes, and then select the This is my main monitor check box.
   
   If the This is my main monitor check box is selected and unavailable, the monitor is already designated as the primary monitor. You can select only one primary monitor at a time. If you click a different monitor icon, the This is my main monitor check box is cleared and made available again.
   
3. Click the monitor icon for the second monitor that the audience will view, select the Extend my Windows Desktop onto this monitor check box, and then click OK.
4. On the Slide Show tab, in the Monitors group, ensure that the monitor on which you want the audience to see your presentation, appears in the Show On list.

  More info is available here:

bcc: Anyone?



Tweet

How is it possible that a Dept of Defense IT service provider continues to send announcements (maintenance windows, outages, etc.) to a HUGE list of clients and simply adds all of the client email addresses to the To: line?

Seriously?

If I were evil I would farm that list for potential victims and also for an easy information set to use in a social engineering attack on the service provider.

Come on folks!

This is basic Operational Security stuff!

Sociopath Test | Sociopath Definition



Tweet

INTERESTING. 

I HAVE BEEN THINKING MITT IS A PATHOLOGICAL LIAR, BUT MAYBE THIS IS A MORE ACCURATE FIT. 

http://sheffuslinks.blogspot.com/2012/08/sociopath-test-sociopath-definition.html?m=1

How long would it take Mitt to 'harvest' the USA?



Tweet

Creepy...

A video from 1985 in which Romney, describing Bain's formation, showed how he viewed the firm's mission. He explained that its goal was to identify potential and hidden value in companies, buy significant stakes in these businesses, and then "harvest them at a significant profit" within five to eight years.

New CAC Maintenance Portal



Tweet

DMDC has recently moved their utility to update DOD issued CAC cards.
It was here:  https://www.dmdc.osd.mil/ump/umphome.htm, but that just gives a 404 now.

The new site is here: https://www.dmdc.osd.mil/self_service/

From the site you can:

• Add/Change email address to receive initial or new Email Signature and Email Encryption Certificates
• Add Personnel Category Code to the User Principle Name of the Email Signature Certificate
• Activate the PIV Authentication Certificate
• Download applications
• View/Update contact information

The first item is especially useful if you are forced to change your email address.

iOS6 speaks to me in a crisp British accent



Tweet

I have been playing with the Accessibility settings on my iOS6 install and I found this nice surprise.  If you use Speak Selection your phone will 'read', out loud, what you have highlighted.  I prefer the British English Dialect, but you should select your favorite.

How to do it?

Pretty simple.

1. Go into to Settings, select General
2. Select Accessibility
3. Select Speak Selection
4. Turn on Speak Selection
5. Turn on Highlight Words
6. Select Dialects
7. Select your favorite Dialect
8. Open an email, Select a block of text, Select Speak
9. Listen and follow along as the word are highlighted

Have with your new assistant!
Leave me a comment if you like this.
Thanks!

NIST updates mobile security guidelines



Tweet

I am only gonna bitch about this a little...

Is NIST really telling me to worry about C-I-A, as if that isn't a basic IT Security requirement?  And it is somehow different for mobile vs. everything else?

What is NIST paying for this good advice?

Co-author and NIST guest researcher Karen Scarfone said mobile devices need to have multiple security objectives supported, including integrity, availability and confidentiality. Companies that have these bases covered will have an easier time protecting sensitive information.

More:

http://www.centerbeam.com/news/news_categories/NIST-updates-mobile-security-guidelines--CBOID100947020/View.aspx

HOWTO: Fix your 'With Mitt' App



Tweet

The fine folks at the Romney campaign 'patched' their flawed With Mitt iPhone App, but they did a pretty weak job of it.

It turns out they left the flawed images with the "A Better AMERCIA" in the application.  If you have a jail broken iPhone and can move around in Unix/Linux, getting access to their mistake again is trivial.

1. Go get the application from iTunes.
2. Login to your iPhone via SSH.
3. Move to the the /User/Applications/ directory.
4. Find the correct directory (I use the command "ls -ltr" to find the newest directory)
5. Find the "With Mitt" App.  (The actual application is named "with.app"
6. Go to the /Users/Applications/43.....2D/with.app/overlays/ directory.
7. Copy the flawed images over some that are still being used.  For mine I used:

cp RFP-A-Better-America-Black-320x416.png RFP-DayOne-JobOne-Black-320x416.png
cp RFP-A-Better-America-White-320x416.png RFP-DayOne-JobOne-White-320x416.png

Voila!  We back to using Mitt's typo again.

Google makes a stand, for love



Tweet

By now you have seen the Google Valentine's Day video.

It is very sweet, check it out on Google today, or see it here


The really cool thing?
They end it with what appears to be a message that we should love whoever we want.

Milk can love a cookie,
a cat can love a dog,
a princess can love a frog,
an astronaut can love an alien,
a little white boy can love a little black girl,
and a man can love a man.

Go Google!

"He that lieth down with Dogs shall rise up with Fleas" -Benjamin Franklin



Tweet

Nice little ethical dilemma  via the MegaUpload issue

• MegaUpload was primarily hosted in Virginia by a web hosting provider called Carpathia Hosting. Carpathia leased more than 1000 servers with a total of 25 petabytes of storage to MegaUpload.

Source: http://gigaom.com/2012/01/19/megaupload-indictment/

I wonder how the Federal Agencies who host with Carpathia feel about this...

dsquery



Tweet

Hey,
This is actually pretty useful.

On a Windows server:

• dsquery group -name "Domain Admins" | dsget group -members

Returns the members of the domain admin group.

I know, it's a little thing, but very handy.

Almost like somebody is serious about wanting to be a real OS.