“Sapiens” and Economic Value

To some extent, Economics is the study of how people produce more (both variation and volume) when they work together. Most of the time people have a place in the world’s economy when they provide value, which is measured by money and credit…mostly.

The book “Sapiens: A Brief History of Humankind” by Yuval Noah Harari has me thinking differently about economics. Harari takes us into critical transitions in human history; like the years just before and after the invention of “credit”. According to Harari, “credit” is anchored in the belief that the future will be better than the past. For most of human history, people assumed the reverse. The future was no match for the glory of the past.

Once credit took hold, however, both for good and ill, it allowed for a greater and more frequent transfer of value. Humanity could start to build a future together. And value could begin to be sought out in all corners of the globe. Trade and credit meant that we could do more together. And the more humans worked together to produce what they needed (or wanted) the more the economy grew. With all the benefits of economic growth, humans also witnessed exploitation and abuse of this system. Individuals and institutions figured out how to steal value from others who weren’t in a position to know better or defend themselves.

Unfortunately, trading on stolen value still happens today. But in the greater scheme of things, I find myself wondering about how we’re going to manage value and economic growth in the future. We’re moving from exploiting people to simply eliminating them from the equation all together. If people are not providing direct value to the global economy, will they be able to participate? Will there be huge swaths of people who can’t take advantage of all the value being created because they won’t have anything to offer in exchange for it?

Think of the countries or societies that are generating value and those that aren’t. Countries that don’t generate value fall victim to crime and exploitation. The further they get from full participation in the global economy, the further they get from the benefits of modern society. Disproportionately they end up on the downside of the world’s value systems.

As a result, with no value accessible to them, citizens in these countries migrate toward countries where value is accessible; where they have a chance of participating and producing value of their own. These value destinations, however, have responded by restricting their borders. Also, they attempt to control the flow of value by forcing their hand in trade deals. But these kinds of restrictions are antithetical to what actually makes a global economy work in the first place. We generate value when we work together.

Sure, there’s competition, but ultimately the real wins happen when we engage countries and societies who have been left out. And we all win when we help them generate value. The more overall participation we get, the better we’ll all be. Both because we’ll benefit from what these countries have to offer and because they won’t become feeders for crime and violence.

‘The Cloud’ is Still New

It feels like folks have been talking about ‘the cloud’ forever. But levels of cloud utilization in the form of IaaS, PaaS, etc. have really only ramped up significantly in the last couple years. The tendency is to think that there are ‘cloud’ people who were just born knowing ‘cloud’ and that the chasm between ‘cloud’ and ‘on-prem’ is so great that the ‘on-prem’ folks simply won’t understand this new realm.

Fact is, ‘the cloud’ is still new. And no one is born knowing anything, especially not best-practices around cloud utilization, security, and architecture. Herein lies both risk and opportunity. If we can all just put down our pretensions around cloud know-how and get busy learning, we might actually be able to build, configure and secure our cloud environments in a way that delivers consistent, beautiful results.

But the first step is remind ourselves about how new all of this is, and how revolutionary it is. Organizational leaders, instead of saying, “Hey what do you know about cloud? Oh, you don’t know anything? Okay, bye.” Need to say, “Hey let’s get learning! See what you can find out about the cloud that will help us meet our goals.” Because the reality is, most of us don’t know everything there is to know about the cloud. It is still new! And it is going to still be new for a long time!

If leaders don’t charge their teams with learning, these same leaders will have their business strategies singularly handled by vendors — well meaning as they may be. And the best solutions and the most remarkable features of ‘the cloud’ will never arrive. Innovation happens with a sense of ownership and dedication. This is less likely to happen when innovative work is attempted by 3rd parties who have ample room to over promise and under deliver.

The cloud is still new! Let’s respect that fact and don’t presume that the best solutions live elsewhere. Bring your teams into this new world and get ready to be blown away. Give them a chance to learn and innovate; don’t write them off. Sometimes the best innovations are right under our noses, but we can see them because we’re blinded by the glare of shinny, well-marketed solutions that can be low on substance.

Security Hygiene is Boring and Critical

This has been said many times before by people many times more credentialed than me. There are sexy vulnerabilities out there that take considerable expertise to understand. Then there are vulnerabilities or configurations that are the equivalent of leaving your car door unlocked.

The calculation so often made goes like this: “it hasn’t happened before”, or “I’ll only be gone for a few minutes”.

Oddly, many who have an incredibly honed financial sense about them and who understand that ‘past performance does not equal equal future results’, have great difficulty extending this concept elsewhere. But nowhere is it more applicable than in security. Past performance does not equal future results! (Or you may have been hacked in the past and you don’t know it.)

The oversight that causes an organization to get hacked in the first place is likely something simple. Are you missing two-factor authentication? Are you still using a default login? Is your password “Spring2019” and do you use it everywhere? These are security concerns that don’t take heaps of expertise to understand; they are boring and critical.

Attackers don’t want to work hard to steal data or install ransomware, so they’re likely to look for simple vulnerabilities or poorly configured networks in order to get the job done. Don’t sweat the small stuff, sweat the simple stuff.

“The Pain Chronicles” by Melanie Thernstrom

Yesterday I finished reading “The Pain Chronicles: Cures, Myths, Mysteries, Prayers, Diaries, Brain Scans, Healing and the Science of Suffering” by Melanie Thernstrom. I’d heard about it in an episode of Radiolab titled “Loops”. (A very fascinating episode, btw.)

Thernstrom suffers from chronic pain. Her book is a journey through the history of pain; not just pain as we typically understand it, but its historical baggage. How we experience or interpret pain, for example, can change how we suffer in relation to it. And we interpret pain based on a host of contexts: religious, spiritual, through relationships, and our own understandings about ourselves, etc.

I don’t suffer from chronic pain, luckily (she discusses ‘luck’ in her book), but I do think it is important to try and understand what it might be like for people who do.

“The Pain Chronicles” reminds me of another book I read some time ago called, “The Noonday Demon: An Atlas of Depression” by Andrew Solomon. Both Solomon and Thernstrom bring the reader with them in their search for healing.

For some reason, this kind of book, where the author researches the very thing that ails them, appeals to me. These authors don’t have the luxury of distancing themselves from their subject matter, yet they have to push forward anyway and seek objective observations whenever they can. This balancing act is what creates tension and makes their work much more meaningful.

I especially enjoy Thernstrom’s look at the placebo effect and a term I’d not heard of before, its evil twin, the nocebo effect. (The nocebo effect involves psychological and psychosomatic factors that can have a detrimental effect on one’s well-being.) Admittedly, with either effect, it only lasts as long as someone believes in its efficacy. So the challenge, at least in the case of the placebo, is to trick the self into continuing to affirm its reality, which is a tall order.

Thernstrom doesn’t have the luxury of getting a consistent benefit from the placebo effect. Neither do many chronic pain sufferers, but there is hope that some day the kind of understanding that comes from this research might lead to healing for chronic pain sufferers. This particular topic is one small piece of her very thorough narrative, however.

She follows several subjects on their respective journeys and, at times, provides fairly harsh criticisms of the doctors who treat them. These are as much criticisms of the doctors themselves as they are of how the medical profession as a whole addresses chronic pain.

Consider reading this book if you want to learn more about chronic pain and the experiences of those who suffer from it.

“The Cuckoo’s Egg:” An Old Story – New to Me

Two weekends ago I finished reading “Tribe of Hackers: Cybersecurity Advice from the Best Hackers in the World”. (Please read previous blog entry to learn more.) I was amazed at how many of “Tribe of Hackers” contributors recommended an old book, “The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage,” which was written by Clifford Stoll in 1989.

The story actually begins at Lawrence Berkeley National Laboratory in 1986. I won’t go into too many details about the setting or the time. In computer years, it was ages ago. So my question: “How could such an old book about tracking down a hacker be so routinely recommended by a slew of highly knowledgeable and well-respected info sec professionals?”

Turns out cybersecurity hasn’t changed much. In “The Cuckoo’s Egg,” the hacker who is being tracked by Stoll, an astronomer, is aided by of the following: 1) default credentials, 2) processes that run as root, but shouldn’t, 3) well-known vulnerabilities, 4) the fact that folks can be fooled into entering their credentials into fake sites, 5) the desire of organizations to not share information, 6) the fact that various US agencies described this sort of attack as not their ‘bailiwick’, 7) the fact that various agencies don’t have the expertise to fully comprehend the risk to their data and network infrastructures, and 8) that organizations could not possibly imagine someone actually penetrating their ‘high security’ environments. I’m sure I’m missing a few, but you get the idea.

Besides being a great old book, published when I was a curious, modem tapping, BBS surfing adolescent, it’s an excellent primer on the foundations of modern cybersecurity. Sure, the technology has changed, but fundamentals haven’t moved an inch. Maybe all cybersecurity professionals have heard of this book except for me, but if you haven’t, consider reading it. Even if you’re not after the education, it’s wonderfully entertaining.

“Tribe of Hackers” Wins the Day

It’s weird how I found out about “Tribe of Hackers: Cybersecurity Advice from the Best Hackers in the World”. I saw a photo on Twitter of a fellow Luther Collage alum, Ben Tomhave, showing that he was featured as one of the ‘tribe’. “What’s this about?” I asked myself.

As it turned out, this was a book soon to be released by Threatcare, a firm that is an active, generous purveyor of learning and community building in cybersecurity.

I love books and learning learning, and I’m relatively new to cybersecurity. Though I would hazard to guess that a majority of people in this field feel like they are ‘relatively new’. For people like me, books like this are pure gold. (I can’t say I’ve read many books like this one, however.)

Jeshua with books.

The crowning glory of this recent publication is thought-diversity. (Yes, I just hyphenated those two words together.) You can read a chapter by one contributor who says that ‘user security awareness’ is the biggest bang-for-the-buck toward improving organizational security. The next will say ‘asset inventory’. I love this.

The bang-for-your-buck question is just one simple example. There is a WHOLE LOT more going on in this book than that. It’s loaded with practical advice on building your career, getting along with others, and learning from your mistakes. Sure there is a lot varying ideas, but they all lead to a few core truths. One of these core truths is that cybersecurity is all about PEOPLE. That is even if you like the term ‘cyber’ which one author explains ‘holds no real meaning any more’. I love this too.

This collection of industry wisdom is a rare find. Hats off to Marcus J. Carey and Jennifer Lin and all the contributors who had the fortitude to put these reflections down on paper for people like me. 🙂 “Tribe of Hackers” wins the day! Check it out: https://www.threatcare.com/tribe-of-hackers/

Discovering “2600 Magazine: The Hacker Quarterly”

Not long ago I did one of those “Strengths Finder” assessments put out by the folks at gallupstrengthscenter.com. At the top of my “strengths” list was the designation “Learner”. It essentially confirmed what I already almost knew — that I enjoy learning or getting to a point of understanding on a variety of topics.

Recently a colleague at work recommended that I consider taking at look at the 2600 Magazine. So I did. I read the Kindle version of the most recent edition. What I really enjoy about reading the Hacker Quarterly is that it is filled with articles written by people who love to learn and understand things, specifically related to computers and technology.

Also, as someone who works in cyber security, it is exceedingly helpful for me to understand the types of vulnerabilities that are written about in Hacker Quarterly articles. For example, I read an article by an individual who was able to ‘investigate’ a very larger number of routers in Malaysia. Initially, he had resource constraints, but discovered that by using a Spot Instance at AWS he could considerably broaden his reach at a very low cost: ten dollars. I’ll be seeking to understand these AWS Spot Instances and the impact they may have on the security of organizations in the future.

By and large the spirit of the “Hacker Quarterly” is centered around learning and understanding. And the culture of the group is such that criminal activity is frowned upon, though they do skirt the edges of legality from time to time. To have a window into this world is marvelous. I’m now reading through a whole ‘digest’ of issues from the past year. And if you’re a “Learner” like me, I suggest you do the same. Here’s their website: https://www.2600.com/

Hive Mind and a Missing Cerebellum

This morning I read an article in the Economist about a kid who was born without a cerebellum. Learning to walk, among other things, has proven to be much harder for him than it is for other kids his age. He has had more success than kids who merely have damaged cerebellums. This is partly because other parts of his brain have compensated for the part of his brain that is missing, which can be harder than if it is missing completely.

Another reason why he’s seen success and exceeded the expectations of medical experts is because of his parents. The Economist article illustrates how it is that his parents acted like a cerebellum for him. Repeatedly, they pushed him to stand up when he would have rather crawled. When he totters off a trail while walking through the zoo, they pull him back on. He’s momentarily agitated, not entirely sure why, but then he gets back on track, mentally.

This is an exaggerated case, but what it and other cases like it show is that if a human brain can use other brains to aid its processing power, it will. And that, as humans, we tend to rely on this distributed processing power. Whether this is in a family, a social group, or even in the workplace, I think it is important to understand our own distributed processing. If groups aren’t communicating or are in separate work silos, this will significantly reduce the value they bring to an organization. On the flip side, if these distributed systems are able to interface with each other, we can expect to see considerable value added to innovation supply chains.

We often relish rugged mental individualism, but by ignoring our distributed models of thinking, we decapitate our true potential of generating value within an organization. It is true that we can and should “put our heads together”. My son calls this “Hive Mind”.

Organizational culture and the analogy of machine learning

These days efforts to revamp company culture are in vogue. I’m going to attempt to articulate what I see as a connection between machine learning and efforts to change company culture. Stay with me here a bit because the analogy doesn’t show up until the fourth paragraph and I need to share a little bit of background first. 🙂

One group leading the charge to change company culture is Partners in Leadership (https://www.partnersinleadership.com). They use a tool that identifies the following flow toward changing results. It’s a pyramid that moves from experiences to results in the following steps: EXPERIENCES >> BELIEFS >> ACTIONS >> RESULTS. According to the model, you start with the results you want to see as an organization and then move backward until you’ve arrived at the experiences that you need to create. The thinking is that experiences shape beliefs, which shape actions, which shape results. They maintain that you cannot simply skip ahead results until the rest of the house is in order first.

As for the experiences, they actually need to be high quality experiences. Partners in Leadership breaks these experiences into four types (big paraphrase here): 1) Easy to interpret, 2) Needing work to interpret, 3) Very little meaning, so there isn’t much to interpret, and 4) Experiences that, well, kind of did the opposite of what they were intended to do.

Now it is time for the machine learning analogy! Boiled down, machine learning is essentially learning from experiences (data) in order to shape beliefs (trained statistical models). These beliefs/models turn into actions (acting on the outcome of a model), which leads to results. Critical to this process is the experiential data and its interpretation (the model). We train our models by feeding data (experiences) into them. Why am I making this connection? Because organizations are really struggling to understand machine learning. Why not piggy back off of something that they’re learning already? Results from machine learning algorithms are no different results gleaned from an organizations’ cultural change initiatives. What data do you have that you can use to shape your statistical models? Which actions do you need to take to get results? You can change your culture and understand machine learning at the same time!

Jeshua

Analog Music as an Antidote to Computing

I spend approximately 8-10 hours a day in front of a computer. That’s a lot of time staring at a screen. (I think a lot of other people are probably in the same boat.) And, yes, I’m sitting in front of a screen to write this. 🙂

So I’m mindful of ways where  I can dive deeply into the analog world. I’ve found one activity really provides a great escape from all of that: analog music. Yup, an actual musical instrument. Lately, I’ve been playing the violin. It is so incredibly fun and there is so much to learn about it. Granted, if I want a tip from Itzhak Perlman about how to hold my bow, I briefly turn to YouTube for a quick tutorial, but then I’m right back to my purely analog endeavor. I also play guitar, cello and mandolin. All those instruments provide an excellent balance against computing.

For me, the vibration of an actual string, which is caused by fingers, hands and arms…and then the resulting sound dancing off my eardrums…is about as real as it gets. Sure, I can have my head in some sheet music, but I can also close my eyes and visualize the sound and have it connect with actual movements my body is making.

Also, I try to enjoy every note and try not to get to wrapped up in a whole piece or song being completed. Sometimes three notes are all you need, or a couple measures. Just ask the members of my household. I’m sure there are times when they wish I had a slightly more varied approach to my practicing. In my mind, though, practicing by definition is repetitive. Anyway, something to think about as an antidote to computing. Never too late to start!