I spend almost every day now reviewing breach data and analyzing threats to deconstruct vulnerabilities. Some of my more popular work recently has been to convince IT management that they need to improve their analysis of threats to understand them better.

Although there are many frustrating examples of negligence and ignorance when it comes to security, no one should feel satisfied to always blame the victim after an attack. That is why the security industry can help with more balanced risk analysis instead of pounding only on customer vulnerabilities and writing-off every threat as “sophisticated”.

After a presentation on cloud penetration testing at VMworld this week I was asked by a customer of a provider why their instance was constantly being broken into. First, I went over how they should pinpoint the threat and not just the vulnerability in their particular instance. That was because, second, I explained that if you have a nice house with big windows and live in a dangerous neighborhood when you can afford to move to a better neighborhood…the choices become more obvious when translated to a more familiar risk context.

A medical professional who injects a virus in a patient in order to test and build up antibodies, for another example, makes an excellent simile for penetration testing a cloud environment.

The viruses in the flu shot are killed (inactivated), so you cannot get the flu from a flu shot.

They say you can’t get the flu from a simulation of the flu, but we all know that the flu shot still carries risks.

There are some people who should not get a flu vaccine without first consulting a physician. These include:
[…]

• People who have had a severe reaction to an influenza vaccination.

In the same vein (pun not intended) I strongly recommend to anyone interested in the study of information security and the interruption of threats (to protect the vulnerable) that they watch this movie:

Note that one of the movie protagonists, one of the Interrupters, is the daughter of Jeff Fort. He was a notorious Chicago gangster convicted of domestic terrorism in the 1980s.

For years Chicago’s El Rukns seemed like the average urban street gang, dabbling in racketeering, narcotics sales and the occasional murder. But El Rukns (Arabic for “the cornerstone”) was far more ambitious than that. Last week a federal jury convicted five members of conspiring to commit terrorist acts against the U.S. The plotters, prosecutors said, expected to receive $2.5 million from Libya’s Colonel Muammar Gaddafi for bombing buildings and airplanes and assassinating American politicians.

[…]

In the late ’70s, the 100-member organization turned to political militancy and religion. The leader, Jeff Fort, 40, regularly presided over meetings from an immense, high-backed throne atop a pedestal, surrounded by outsize posters of himself and Gaddafi.

The daughter of this guy is now trying to stop the violence. I would point you to a Wikipedia reference so you could read all about this amazing and inspirational woman — Ameena Mathews — who has dedicated her life to saving so many others, but a Wikipedia administrator — Fastily — has just decided to delete her page.

This page has been deleted. The deletion and move log for the page are provided below for reference.

00:03, 29 August 2011 Fastily (talk | contribs) deleted “Ameena Mathews” ‎ (Expired PROD, concern was: Does not meet notability guidelines. Lacks citations to significant coverage in reliable sources.)

Uh, she has been written up in the NYT, The Guardian, NPR, PBS…just type her name into a search engine to see the citations. Take her interview in indieWire as an example of the “coverage” she gets:

…you’ve been meeting up with similar groups across America. How has that been?

We met up with a lot of groups that replicated the model. There’s a lot of people out there doing a lot of great things, helping the war on poverty, getting kids in school so they can put the guns down.

[…]

There’s purple hearts for those that are wounded in Afghanistan, but not much for those who do our work.

Hey Wikipedia, get a f-ing clue. The Interrupters and their work to stop threats should be the very definition of notability. Let this be yet another giant blinking warning sign of why you should not automatically trust the supposedly well-intentioned administrators of cloud services to do some basic checks before they act, let alone care about risk and the security of information.