I spend approximately 8-10 hours a day in front of a computer. That’s a lot of time staring at a screen. (I think a lot of other people are probably in the same boat.) And, yes, I’m sitting in front of a screen to write this. 🙂
So I’m mindful of ways where I can dive deeply into the analog world. I’ve found one activity really provides a great escape from all of that: analog music. Yup, an actual musical instrument. Lately, I’ve been playing the violin. It is so incredibly fun and there is so much to learn about it. Granted, if I want a tip from Itzhak Perlman about how to hold my bow, I briefly turn to YouTube for a quick tutorial, but then I’m right back to my purely analog endeavor. I also play guitar, cello and mandolin. All those instruments provide an excellent balance against computing.
For me, the vibration of an actual string, which is caused by fingers, hands and arms…and then the resulting sound dancing off my eardrums…is about as real as it gets. Sure, I can have my head in some sheet music, but I can also close my eyes and visualize the sound and have it connect with actual movements my body is making.
Also, I try to enjoy every note and try not to get to wrapped up in a whole piece or song being completed. Sometimes three notes are all you need, or a couple measures. Just ask the members of my household. I’m sure there are times when they wish I had a slightly more varied approach to my practicing. In my mind, though, practicing by definition is repetitive. Anyway, something to think about as an antidote to computing. Never too late to start!
How much of the world’s IT infrastructure is in the cloud now and much of it will be in the cloud in five years? I’m sure there is nearly solid data somewhere to answer those questions. Regardless, it is happening and it won’t be long until most IT infrastructure is in the cloud.
Oddly, though, in my conversations with other IT professionals, it seems like we’re finding we’ve arrived late to the party. With the advent of “the cloud” organizations are finding that there are all sorts of solutions out there that don’t necessarily need the involvement of traditional IT. In much of the IT world, our perception is that this process is more gradual when in fact it is accelerating.
So the real question is not whether “the cloud” is coming, but whether we see it coming. If we want to make sure cloud implementation is done properly and doesn’t completely hose our respective organizations, we must learn as much as we can in a very short period of time.
Nearly every day I find myself reading about cloud security risks right along side incredible cloud solutions for problems that would normally be much harder to solve. At the same time, many cloud solutions create problems that we’ve never seen before. With the flip of a switch something private can become public: see S3 buckets. And it isn’t so much that the cloud is insecure, but how we connect to the cloud, whether this is through our API infrastructure or open ports that maybe shouldn’t be…open. The only answer I have for all of this is that we need to learn, learn, learn, learn…and fast.
So, generally, the easiest way for hackers to get into an organization is by convincing users do to something: click on an email attachment or a link, make a phone call, share information, etc. For all the technological advances that have sprung forth in the past decade, this is still among greatest challenges faced by security professionals: figuring out how to keep people from following hackers’ instructions.
Our biggest vulnerability is also our greatest asset. We can make thoughtful decisions quickly. And sometimes our decisions aren’t so thoughtful because we’re in the midst of doing other things, or generally too distracted to slow down and think through what is being asked of us. This little glitch in our code is all an attacker needs.
Exploiting this human vulnerability is all an attacker needs to get us to act in a way that is not in our best interest. This is the nature of a hacker-victim relationship. But are there other ways that people are getting hacked that maybe aren’t as overt as this? Think of the decisions we make daily. How many of them are in our best interest or the best interest of our friends and family.
We make snap decisions all the time that aren’t really based on sound logic. I bet any one of us can look back over the course of the case and think about an action we took that wasn’t ideal. It’s a given. If we didn’t make decisions relatively quickly, our brains would grind to a halt and we’d become mostly ineffective at making our way through this world. But as technology gets better and better at humans hacking other humans (think targeted advertising through machine learning algorithms), we should pause to ask ourselves whether we’re on the right track. Will this lead us to a better humanity? Just throwing that question out there. It can go a myriad of different ways. Thanks for reading.
I’m one of the last remaining people in this world who don’t have a smart phone. I’ll often be in a group if fellow IT professionals and pull out my flip phone to check the time. “Is that a flip phone?” someone will ask as they lean forward in their chair and peer down at my hands, attempting to figure out what would cause someone who is steeped in technology every day to carry this sort of relic. As I lift it up, all heads turn my way, mouths open and nostalgic signs fill the air. Onlookers talk of a simpler time when we were free from 24/7 social media and and subservient to on-the-fly navigation from real maps and sheets of MapQuest printed haphazardly on white glossy paper, barely legible.
Because I don’t have a smart phone, I’m often looking for alternative ways of doing things that people normally do with smart phones. One of these things is MFA or multi-factor authentication. If you use AWS, it is generally a good idea to have MFA for your root account. They don’t allow SMS for their second factor any more, so I spent a few hours looking around for an option. I did look at some hardware keys like the Yubikey, which I may check out eventually, but I needed something cheap and now. Enter the “Authenticator Extension” (https://github.com/Authenticator-Extension), which you can get through your Chrome browser extensions.
It is TOTP compatible, which covers quite a few sites. I can use it for AWS, Facebook, etc. I probably won’t use it for LastPass because I’d like to have a paper backup of such a critical second factor. The “Authenticator Extension”, as it is so generically called, works great for me using my Chromebook, which often acts as more cumbersome, less convenient, and less connected Smart Phone for me. I recommend it.