EXCELLENT report by ENISA

The European Network and Information Security Agency released publicly today

Proactive detection of network security incidents, report

This report describes available external sources of information and internal monitoring tools which can be used by CERTs to improve their capabilities to detect network security incidents.

This is one of the best reports I've read in a while. Bravo Zulu (that's Navy for great job!) to the authors!

This report is co-authored by a number of folks that I recognized immediately.. many are FIRST (maybe all?) but one of the best things in the report is how CERTs share information, detailing the pros and cons. In the end however, the document calls out data sharing as the most effective way to proactively stop attacks before they're allowed to occur. Powerful stuff. Easier said than done however. 

Data formats must be lite and low in false positives;
Legal constraints are ALWAYS an issue;
Trust between participants is critical... tech feeds without knowing who's on the other end don't work;
The right information must be share in the right way... protected;
Information sharing organizations are less effective when the memberships don't know each other.


It's a long read, but a must read. 
Great job to the authors.


Jeff

Survey - Smartphone security

Please take a moment and answer this one question survey for me? I'm interested in understanding public perception of smartphone security.

http://linkd.in/vGeahI

Thanks,
Jeff

Red Sky Alliance is growing!

The Red Sky Alliance is growing!

• Three new companies are expected to join us -one more large bank, one small bank, and a nuclear energy plant have all committed and are in various stages of entering the membership.
• One new executive has been added to the ranks of our advisory board. A more formal announcement will be made later, the but our newest board member is an EVP with a Fortune 100 financial institution and currently serves as their head of their Threat and Intelligence organization.
• Red Sky now has a LinkedIn Group, and with only a few days online, boasts an impressive constituency of nearly half from the Infosec CXO and VP ranks and a rest, a few hand selected consultants (for their ability to add real value to Infosec disussions).

So please, jump in. The Red Sky Alliance is only as good as the membership it serves. You can join the group, follow us on Twitter (@redskyalliance), or check out our website (www.redskyalliance.org).

I look forward to seeing you in the boards!
Jeff

Red Sky® Alliance named Industry Partner of the CISO Executive Network for Private Information Sharing and Collaboration

This is great news! As many of you know I've been doing a bit of consulting to the Red Sky Alliance. The Alliance is a private social networking site where members can talk to each other in a trusted forum (The theme song to "Cheers" is  running through my head right now). The site is set up with mature rules for vetting new members, and complete peer review for anyone participating. Enjoy private instant messaging, running forums, even private groups (that don't show up in search results) inside the system that may be used for out of band communications for, well, choose your occasion.. incident response perhaps?

That said, building trust online begins with building trust in person. The CISO Executive Network has done amazing work in bringing CISOs from all kinds of companies into trusted forums in person, and is now recommending the Red Sky Alliance as a venue to extend those relationships online for private collaboration.

Press Release:

11/21/2011 - Red Sky® Alliance named Industry Partner of the CISO Executive Network for Private Information Sharing and Collaboration


Red Sky® Alliance is happy to announce that it has been named an Industry Partner of the CISO Executive Network.

Building trust between companies starts with building trust between people. “CISO Executive Network has done amazing work in developing trusted relationships among information security executives,” said Jim McKee, President, Red Sky® Alliance. These relationships are central to the trust required when sharing highly sensitive threat information in the Red Sky® Alliance private networking environment. “We can’t begin to emphasize how important these personal relationships are when building collaboration among companies,” notes Bill Sieglein, Founder and CEO of CISO Executive Network. “We are pleased to recommend Red Sky® Alliance for private collaboration among our members.”

About CISO Executive Network: The CISO Executive Network is a peer-to-peer organization dedicated to helping information security, IT risk management, privacy, and compliance executives to be more successful. It accomplishes this mission by providing opportunities for those professionals to meet periodically in their local cities to share with one another and hear from industry experts.

======================================

More to follow later on Red Sky Alliance, but for now know, we've got world class analysts in the backend to 'keep the conversation moving', analyze activity (and malware), and help companies strategize on how best to cope with the new threats.

www.redskyalliance.org

Cheers!
JLS

Blackberry Playbook.. Number 8 turkey? Not in my book!

It's Thanksgiving morning. I'm watching the Macy's parade and had vowed that I wouldn't open my computer. Well, we know how that goes.. it's like crack. And speaking of crack, I just read an article that offered up the ten 'turkeys' of 2011. Most I agree with except one... (this is where I get to the crack part)...

The Blackberry Playbook. My crackberry only better. I'm here to tell you, this is one of my favorite tech toys. When I used to carry my MacBook everywhere I went (I'm a crazy Mac fan.. have been since WAAAYYYY before it was cool), I now leave the MacBook at home and carry the Playbook everywhere I go. Let me tell you why... For $300 I bought a device that mimicks my favorite phone -the Blackberry Torch 9810 --the 4G model. Between the two devices -my phone which tethers to the Playbook as a 4G modem and the Playbook with a slightly larger screen, I get 4G speeds on the same plan as my phone (I could have cracked it with free 4G but chose not to). So it falls under the same all you can eat plan I had before, all of the applications of the Blackberry Torch (which I also love --mostly the tactile touch of the keyboard) and now full functionality of a tablet with 4G, an incredible display, and at a great price. Last, as a long time Infosec guy, I got to see the OSD Deputy CIO speak at the ACT/IAC Executive Leadership Conference in Williamsburg last month. Rob stood in front of an audience of about 800 of us at lunch time and told us how and why he believed Blackberry to still be the safest mobile platform. I'm not going channel Rob or try and recount the quotes, but I've seen the presentation a couple of times now. I'm a believer.

Ok, it's off my chest. I love my Macs, but I also love my Torch/Playbook combo. 4G ( ...yes, I know what the H+ means on my display), all of my blackberry apps, the tactile touch of the keyboard if I get so frustrated on the glass that I absolutely MUST have it, and the ability to manage/edit documents on a slightly smaller more convenient platform than others --all wrapped in a more secure platform (as described by sources I tend to believe) to be more secure than the iPad and Android platforms? I'm a happy guy.

Happy Thanksgiving everyone! I'm going back to the Macy's Parade :)

JLS

Infosec and beer! It's a hit!

A bit of a hickup last night. In my invitation I called out the Westin but gave the link to the Sheraton. The hotels are side by side up in Linthicum Heights. None the less, it was a great turnout and happy hour was terrific. It was really good seeing many of you again! Who knew Delta flight crews were so Infosec savvy?

Anyway, next time we'll pick a non-hotel venue.. I'm thinking maybe Max's Taproom in Fells Point? Any suggestions?

Jeff

Happy hour tonight?

Sheraton Linthicum Heights, MD

http://www.starwoodhotels.com/sheraton/property/overview/index.html?propertyID=1495

5:30 ish?

See you there!
Jeff

Three days of CISO summits...

I've spent the last three days in two different information sharing forums, having no less than four industry segments talk about what's happening in APT in their environments. Tuesday and Wed were spent with about 150 of my closest DIB, banking/finance, and communications sector friends, and yesterday with healthcare CISOs at the CISO Executive Network Annual Healthcare Summit.

My sample size is only about 100 companies across the four sectors, and not exactly scientific in my methods, but here's what I found out:

1. Every CISO wants to do the right thing.
2. Most know about APT, but only a few actually have the resources to protect themselves.
3. The hype can be overwhelming. While many know, APT means a lot of things to a lot of people, including now a subset of APT - Anti-Exploitation Threats (AET) --those anti-forensic techniques taken by attackers. I'm not sure they're actually different, but I am sure a new name is being tossed around.
4. CISOs don't know how to talk their management about APT, and therefore can't articulate the need for resources.

Here's the good stuff:

1. There was an entire presentation yesterday about how CISOs can articulate gaps in defenses using compliance language and graphics. I learned something new, and will probably call the company for a demo!

2. CISOs want to do the right thing!

3. Information sharing works! When CISOs can get in a room, either physical or virtual, without threat of oversight, regulatory pressures, etc., they talk! And when they talk, everyone gets something.

Before I leave.. I've got a few RSVPs for Happy Hour on the 15th. Drop me a note!

JLS

In search of Infosec talk and beer... two of my favorite things!

It's Saturday morning. I'm having coffee and doing my required reading looking for opportunities to have happy hour next week with a few information security folks in the S. Baltimore area. Thought it might be fun to get a small group going to share insights over a beer and wings.

My first stop was LinkedIn. I have to say, I love LinkedIn. I'm a long time user. Don't really care for Facebook or the others but I like LinkedIn.  I thought I might send a note to a few of my contacts who are close enough to not have to go out of their way, but also who might actually have fun sharing information and experiences with others in my network. So I pulled four names from my contacts list. I'm generally pretty good about vetting those with whom I connect with, so those names are rock solid. They're all either CISOs or have been CISOs, but all have mad analysis skills, and frankly, are just plain fun to talk to!

Then I thought it might be fun to expand my search to figure out who might be in local groups that might share similar experience. While I'm not really interested in having a full blown morning conference, it might be fun to at least see who's around that might be fun to chat with another time. What'd I find? I found great stuff -I'm a daily reader of Cyber Aurora. Love it. I also found some not so great stuff. I'm not sure I'd like to out groups -they seem to thrive, but there's just SOOO much crap out there. In groups that would seem like no-kidding groups of smart folks, the marketing hype is knee deep! I remember once seeing someone with their arm over their head. I asked what he was doing. He replied he was saving his watch because the crap was rising fast (he used a different word!). It's what I'm seeing in many of the Infosec groups, and much of the noise we're hearing from vendors, a ton of startups, and seemingly in the news. One news guy I used to know (a CNN guy) used to say "If it bleeds it leads!". APT bleeds. One might also add to that... "If it bleeds it leads, and generates revenue!". I believe most vendors (based on personal experience in hearing the pitches) don't have any experience fighting APT. I'll tell you, I heard one L7 content monitoring and filtering (a data protection company) tell thirty CISOs in a conference room that his product (and his product alone) could stop all APT exfiltration. Hmmm.

So here's the deal. I'm looking for a few folks to pull together a local happy hour meet-up. Heck, I'll buy the first round. Here's what I'd ask.. Be a commercial infosec practitioner (I talk to government people all the time!). Have an opinion! I'd love to hear your thoughts on infosec (especially APT), trends you're seeing, products you use..

Join me? I'm looking at Tuesday 11/15 about 5. Location TBD.. I'm open to suggestions.

Jeff

Information Sharing... part 3/3

This is the third part of a three part post. I started with "you don't know what you don't know" moved to "pick one!", and now I'm moving into sharing of information.

I built, and now operate a cyber information sharing organization. While I can give you a 100% guarantee that I've not gotten it 100% right (yet), I know from recent feedback that every one of them enjoys the broadened situational awareness and each and every one has improved their security postures. They share cyber analysis, stories, and data. More than that, the vast majority now run 24/7 security operations centers who look for and act on data coming from the information sharing environment and each other! Sharing information helps the tactician identify and act, it helps the manager allocate resources on the most pressing issues, and it helps senior managers measure themselves against baseline. Best of all? It makes you safer by knowing what the other guys are seeing and allows you to take advantage of strengths/skills in other organizations that you may not be able to fill yourself.

Bottom line? If you're not talking to your peers, you're already two steps behind in this cyber environment.

So where can you go?

Immediate thoughts:

• SANS Internet Storm Center has been around since Y2K (I was there! I was one of the first watch standers keeping vigil and maintaining comms during the transition). The Storm Center is one of the better places to share information, although data can be time-late. The ISC is a free service offered by SANS.
• The Information Sharing and Analysis Centers (ISACS) represent nearly every segment of industry and are operated through membership fees. One issue I have with the ISAC structure is the requirement to anonymize all submissions. This results in the loss of ability for an analyst to actually ask questions of the originator.
• Red Sky Alliance is a newcomer. I've watched from the sidelines and offered a bit of pro bono consulting in the past couple of weeks. I also sold them a trademarked name and domain ;) I like the idea. The thought is real time sharing of information in a private setting with a trusted membership and a small cadre of back-end analysts to keep things moving. Again, Red Sky Alliance will be operated through membership fees. I don't believe the company has the site operational yet, but there is a video and demo site running and I know they've been signing on Founding Members. I'd expect to see them go live sometime in November of this year.
• The Forum of Incident Response and Security Teams (FIRST) and Government equivalent (GFIRST) have also been around for a long time. I was an early member of FIRST during my days as an analyst at the Navy's Fleet Information Warfare Center in 1996, and again as the head of Cyber Threat Analysis and Intelligence at Northrop Grumman from 2007-2009. FIRST hasn't changed much. They require an up-front inspection of your security operation, issue a PGP key, and let you participate in multiple lists. I'm not convinced FIRST has kept up with the times in terms of information dissemination but they get the word out and do share information.. and they offer a pretty cool technical conference!

In many worlds, the phrase "publish or perish" rings true. Many careers have been made and lost on the publish or perish paradigm. I'd suggest publish or perish is also going to hold true in information security as we move forward and APT threats become more and more ubiquitous. Publish, talk, compare notes with your peers and others. Don't be afraid to go outside of your peer group for information that you may not have been exposed to.

Talk, publish, listen, compare notes, protect your environment. 

JLS

Pick a standard and stick to it

Over the course of the last 15 years, I've watched information security grow and mature as a practice. One thing I've come to realize however is that the process end of the infosec business is more important than ever - especially in light of the new APT landscape.

Here's the story of two companies:

Company A and B are Global Tech companies.. Four years ago both companies were worth approximately $16B each.

Both companies suffered APT attacks over the course of the last four years.

Company A stuck their head in the sand hoping it'd go away.

Company B developed world class process using ISO for their infosec guidelines. They participated in information sharing with their peers, built a SOC, practiced response. The company created amazing process, practiced them, measured everything and fine tuned them until they got it right. When the attacks hit, they were prepared. The global organization is now wired for information security.

What happened?

Company A is still alive, but struggling. They lost the lions share of their stock value!

Company B is landing contracts all over the world, teaching others how to do best practice information security.

Who would you rather be? Not Company A you say? Take the following lessons learned and and go do it starting today!

Great information security organizations invest in three things...

    •    People
    •    Process
    •    Technology

People: My tale of two companies is very similar to another as told by Alan Paller of SANS. Alan talks of the "Story of Two Agencies".  I've seen it a couple of times. In short, he talks of two teams, both hit by APT actors. One team had solid technology but didn't have operating guidelines, training, analytic curiosity, or direction. The second team had basic technology with a highly trained, very curious team with practiced incident response processes... who do you think faired best? The second team of course! The team stopped the attacks with minimum damage, shared indicators with their peer community and was able to quickly implement controls to stop future attacks. Team one was completely owned. I hear this story repeated at least weekly, and heard it again today from companies I've been working with for the last couple of years. 

Process: Great process leads to great results. It's that simple. Information security teams who know what to do under 90% of the circumstances they will encounter -and have practiced those actions operated under the premise (a military phrase) "command by negation". Command by negation means that during conflict commanders can do whatever needed according to predefined rules/processes and have a pre-specified deep, practiced understanding of how they must execute. Information security teams must also have this same pre-specified deep, practiced understanding of how they must execute, and must not allow variance in process during times of attack. Pick your infosec model. ISO, NIST, ITIL, whatever.. just pick one. Then build your organization using sound process around one of these models. Do it right from the start. Get management buy-in, find your early wins, and don't stop normalizing the way you do business.

Technology: Tools and toys don't cut it. Knowing how to get the most out of your current tools by understanding exactly where they fit in your strategy, and as importantly where your gaps are, are critical. Find places where technology can replace repetitive manual processes (SE/IM, manual correlations, lookups, etc.), and leverage your people where they're strongest -analytics, response, operations.

How do you create a mature organization that can survive the fog of war created by persistent threats? By creating an organization who knows what to do every time. Plenty of options exist today... ISO, NIST 800, or ITIL are great places to start. For my day job, I 'matured' my organization by using the Capability Maturity Model Integration Services provider model (CMMI-SVC). Over the course of the last two years we undertook an aggressive process engineering and training agenda. When we started this undertaking, it took my team over 44 days to perform a single triage analysis of an APT event. Today it takes less than five and we're heading quickly to 72 hours with added automation.  For me, the recognition that we were a service provider of information security analysis services (we do only APT analysis in a public/private information sharing organization) lead me to the belief that process was every bit as important as the technologies used to manipulate data, and that if I didn't have people curious enough to work the process, nothing else matters. My team will fail. I've also watched CISOs in some very large organizations (approx 60 of them) go through similar process engineering exercises. Those who picked a standard (for information security) and implemented solid, repeatable process around those ISO, NIST, ITIL, etc., practices, are FAR more successful at battling APT today than those who don't. Don't be fooled into thinking you can survive without it. You can't. APT actors practice solid command and control and process. You must as well.

 More next time!
JS

On Information Sharing... Most companies don't know they've been had!

I saw an interesting piece of text from Mandiant the other day. It was prepared for testimony (I'm presuming to Congress) discussing APT. It went something like this...


“More than 90 percent of the breaches Mandiant responds to are first detected by the government, not the victim companies.” (Kevin Mandia, CEO of cyber security firm Mandiant Corp., in prepared testimony).

Dozens (probably more) examples prove this statement. Search the news. Generally companies fall into two main categories when they find out.. denial, or they fight. Denial rarely works, and fighting it results in rapid escalation. Regardless, your business is in danger.

So what's a company to do? Start thinking strategically. Come up with a plan for mitigating current badness already in the environment, WHILE maintaining business operations, AND planning for future strategies for minimizing or mitigating future attacks, AND ensuring you'll be able to operate in your new-found understanding that your networks are now untrusted.

This is where we start thinking about steps two and three in my previous post...

2.  Build solid process (for operation and incident response). Pick a model and stick to it.
3.  At this point you MUST start talking to your peers, and others. You wouldn't try and sell a product without knowing what your competitors (peers) are selling (what sells, and what doesn't). Why would you try and implement strategy without knowing how well your chosen processes will work (what works and what doesn't, before you spend any money!).

For now, start looking around... there are lots of public sources of information.. SANS, NCFTA, FIRST, and a newcomer, RedSkyAlliance.org. From a government assistance perspective DHS/US-CERT.

Be prepared. It's not a question of 'if', or 'when'. It's 'what are you going to do when someone tells you there's a problem?'

More next time.
JS

On Information Sharing...

Going to tell you.. I'm a long time straight stick IT guy, gone Intel/Information Warfare then Information Security (for the last 15 years or so?), and I've not had so much fun, nor realized the value of Information Sharing until my last three years running an information security sharing organization wrapped around a CERT and Analysis shop. I'm not going to take a lot of time to tell you what that is. You can check out my bio and look at the web page; rather I'd like to take a moment and tell you about the value proposition I've come to realize over the course of my tenure.

Not a day goes by without a new story in the news depicting company losses from (ahem) Advanced Persistent Threats (APT) - a term coined by a guy named Greg Rattray several years ago during his active duty career. At the time, the term APT seemed pretty spot-on. Since however, those APT threats have become far more ubiquitous, and now I'm more convinced they should be called  Omnivorous Persistant Threats --OPT. Malware, computers beaconing, and bandwidth consumed is becoming more common than not, and most importantly, the vast majority of companies don't even know they've been successfully attacked!

I'm here to tell you, the most valuable information security lesson I've ever learned has been learned in the last five years --INFORMATION SECURITY PRACTITIONERS MUST STOP LISTENING TO VENDORS AND START TALKING TO EACH OTHER. Vendors want to sell you stuff. Your peers are working hard to stop the same attacks you are. More importantly, the threats change as your ability to protect yourself changes. Even the most sophisticated shops lack the 100% capability to foil every attack.

I'm preparing to speak at a conference for healthcare CIOs. I'm going to give them three words of wisdom:

1. Most companies attacked by APT don't know it until someone else tells them they've been owned.
2. Pick a standard infosec model, implement solid processes,  do it well, and don't shoot at protecting everything. Protect that information most important to your organization and build solid controls around the rest.
3. Talk to your peer companies. They're getting hit with the same things you are. Lone wolves starve in the cold. The packs survive.

More next time. I've got to update the block list in my UTM.

JS

ISC(2).. really? REALLY?

You HAVE to check this out:

ThinkTank: Building a Better Mousetrap – Tracking and Catching the Cyber Criminal

It's a talk by RSA and Capella University on catching cyber bad guys.

I'd be happier with lessons learned from RSA. Any chance of that? Probably not. It seems RSA isn't talking, rather continuing to market. I'd rather have them simply own the issue, and come clean on how they are remediating (and winning back the trust of their customers).

JS

Carbon Black

I've had the opportunity to test a new-comer to the forensic market, and while young, I like this product.

Carbon Black is developed by a company called Kyrus. Can't tell you where these guys came up with the name, other than it's taken from Greek mythology for luck and opportunity. In this case, I'm not convinced there's any luck involved, but more opportunity and simple smarts.

Carbon Black is a two piece application --client and server; the server currently hosted and operating in beta as a SaaS with the client loaded on my Bambi Windows 7 machine in my lab. Push a client to your machine, and CB identifies the host, reads running processes, and begins to look for file changes and modifications. It took an initial reading from Bambi for an upload of about 30Mb, but after the company realized I was pushing a thick milkshake through a tiny straw (their rate limiting) and opened up the bandwidth, all went well.

So it's been running for a couple of weeks. I just rechecked and yes, lots of files modified --many I'm sure from the AV running on the machine, but what's nice is it auto generates the hash values of the modified files, libraries, etc., to allow fast correlation to known bad guy files. While not perfect, it shows promise. There's no noticeable performance hit from the client and the server side operates quickly and without glitches.

I've got a few invitations left. If you're interested, leave me a comment or shoot a note over. I'll push one out.

Good stuff. I'm not a real fan of SaaS for security tools. Can't wait to see the final enterprise product where everything resides inside the environment.

Any questions, leave me a comment.

Jeff

Hey Southwest Air! Please! Charge me bag fees!

So here's my gripe...

I fly SWA almost every other week between MHT and BWI. Been doing it for about six years now.

SWA just changed their (ahem) reward system, and it frosts my butt. Here's why:

SWA used to require 8 round trip flights for one reward. One reward is one round trip. Credits were earned by paying for a flight. For each flight segment (a one way flight). Therefore, if I were able to book a $69 flight, it counted as one segment. More often than not the flight was at least $100, and in most cases I booked business class (I generally arrive minutes before the departure time. Business class gets me right on.. SWA has really become my subway!).

Ok, so we went from 'buy one flight get one award segment'. Get 16 and earn a free round trip.

SWA has now moved to a point system, whereby every dollar spent earns a certain number of points. For example, my last round trip cost me $371 (up from $282 six months ago). For $350, I get roughly 4400 points (where'd that number come from?). To earn a round trip between MHT and BWI, I now need 21,600 points each way or pay $180 per segment.

So SWA, let me understand better. For the purchase of a $370 round trip I get 4400 points, but to purchase a $370 trip with points I need 43,200?

Please, charge me bag fees! I'm going to have to start flying USAIR ($218, with a short stop in Philly)!

Sorry SWA. You're pricing yourself out of my wallet.

Jeff

Final HKS post

Morning all.

I'm back at work, but wanted to take a moment and chat about a couple of things:

1. This experience was easily the best training I've ever had.

2. On my first day back, I was asked if I wore my new lapel pin to show everyone I went to Harvard. I answered back that I wore the pin to remind me of what I'd learned.

3. I have new tools in the toolkit. I have reminders in a Harvard logo'd binder on my desk next to my monitor, so when I need a refresher, it's right there. Inside I placed a few of the most important tools I'd previously lacked, with my handwritten notes from class.

That's it. I'm posting the remainder of the pictures:

 Steve Kellman's comic

 During my walk back to Soldiers Field.. my last night

 The gates into the dorm courtyard

 My study group

 Dinner at the Harvard Faculty Club

 Jeff, Paul, Nat and Mike

 More inside the Harvard Faculty club

 The walk from the Faculty Club.. Wrapping up on St. Patty's day. 

This was the start of a great night!

 John Harvard - do you recognize any of the faces in the

stained glass? I'll give you two of them.. Nixon, John Lennon

 The RedLine -- the second St. Patty's Day event. For those

who rode the bus from the Faculty Club, the bus dropped

everyone off here. Some stayed, some went back to the dorms for

some well needed rest. Obviously I didn't go back just yet!

 Me with Simon and Ibrahim

 A night of well mannered frivolity!

 Melancholy moments on my final walk to the dorm.

I'd just left the Friday 'reflections' class; a new graduate SEF.

 When it was nice, the walk along the Charles was the best.

 ...including the view of the woman's rowing teams!

OK all. That's it.

Harvard, out.

Wrapping it up at the Kennedy School

It's Thursday afternoon, 3:45 and we've just wrapped up our final class.

That means roughly 120 sessions of 45 minutes crammed into four weeks. Most professors used 90 minutes and taught two. Regardless, it's been a hell of a journey. Today we wrapped up by 3:30, and don't have any readings for tomorrow, but we need to pack out and be ready to check out of the dorms by 9:00 tomorrow morning. Unfortunately we have final sessions and reflections starting at 8.

...four weeks. I'm going to tell you, this is a life changing experience. Everything about the program is first class. It's hard to explain how these guys do what they do, but the program teaches leadership, history, personal accountability, lessons from the Presidential offices (from people who advised the Presidents), and more. In addition to the coursework, they really do everything possible to immerse you in the higher level thinking and culture of Harvard. Again, hard to explain. I'll do my best in actions when I return.

Besides the coursework and culture, one of my friends suggested I bring extra bourbon for the study groups at night. We used all of mine, and more from others. During the Balcony Summits, we solved world hunger, the crisis in the Middle East, we've fixed Israel, and know how to best assist Japan. Does anyone by chance have Hillary's phone number? I'm sure she'll want to know what we've come up with!

OK all, probably one more post tomorrow with pictures from tonight... final dinner, business attire at the Harvard Faculty Club.

Jeff

Tuesday morning.. week 4

Well, we're in the home stretch! It's Tuesday morning and I'm wrapping up my readings for the day and getting my case study prepared for the after-SEF project I'll be working on with my group.

It's been a hell of an experience! We wrapped up last week with a trip to the JFK library, but only after a week of reading, case studies, reading, and more case studies. The schedule is been hectic. They keep us busy from 8AM to early evening most days, with one study groups before class in the morning and many times dinner speakers.

Last night was Jeff Frankel. Jeff was an economic advisor to Clinton. While I didn't necessarily appreciate the message (he was very doom and gloom), nor the slant (he blames everything on everyone but Clinton), it was still interesting having him here, speaking to us over dinner. An interesting thought though... 1/5 of our current budget goes to pay for interest on money borrowed from the rest of the world to pay our bills. I've not confirmed the number, nor audited our budget, but if this is right, it's amazing that we can continue to operate.

We discussed the current budget mess and the continuing resolutions. He told us that even if the planned cuts went through, it accounted for only 6% of the current issue (with the implication that it wouldn't do much good). I'm a bit concerned by this. I had a woman who worked for me in a startup a few years back. She was my most junior person -an intern from a local college. When we started running out of money in the end, she requested to not take a paycheck. She told me "it takes a lot of drops of water to make an ocean, but every one counts.". 6%? That seems like it'd pay interest at least don't you think?

OK, now for more fun topics... pictures of the JFK Library and dinner. We had a great time!

General Odiermo, HKS Forum, Cyber...

I had the privilege of getting one of the very limited tickets to see General Ray Odiermo speak tonight.

Gen O is the current commander of the Joint Forces Command in Norfolk, VA. He's an impressive guy to hear speak, but more fun for me was that he speaks very passionately about Cyber!

I am a cyber guy, and work by day at the DoD Cyber Crime Center, and being the only cyber pro in my class at the Kennedy School, found this to be incredibly good stuff.

So this guy has got to be 6'5" and as broad as a bull dozer, with a rack of ribbons that pushed his combat infantry badge WAY up on his shoulder, but he speaks of Cyber like it's the next front. He's informed, smart, well spoken, and his last word on the subject --after speaking for almost thirty minutes --was that cyber is the thing. My classmates all looked at me, knowing I was the only cyber guy int he class, and knowing that I also am not afraid to speak, and they knew --we're working hard in this area. I don't talk much about what I do in class, but many know of DCISE and read our products. It's an amazing thing. Many of my classmates have even commented about how much is going on in the area. My roommate -a former P3 pilot and now Navy civilian commented that every high ranking official that comes through speaks of CYBER!

It's a good time to be a geek, and Harvard is creating in me a self-aware, bigger thinker.

I hope to be in this game for a long, LONG, time!

Jeff