As some of you might have heard (and others not) my supervisor went home sick two weeks ago. I was not in the office that day, and so I was relatively unruffled when I heard he had a case of the Covid-19's. He is fine and recovering. When this post gets released by the automatic system (which failed me last time...) he should be pretty much fine.
I realize that the past few weeks I have posted items that are pretty technical, so for this post I want to do an introspection.
My supervisor and I together are the security department. Which practically means that if he goes home on sick leave (as he has been for two weeks now), then I am quite literally the complete operational security department. I have been with this company as part-timer for two years, and a few months as full-time employee, but this is kind of a tall order.
The first thing I realized when he was gone, was that he is a very good supervisor. He has an idea of what needs to happen, and asks me to find things out in order to make them happen or justify not doing them. I appreciate that, and so step one with my supervisor being on sick leave is to replace him partially in that regard.
- I know where my supervisor wants our security department to go
- I know what my supervisor expects me to learn, in order to add value to the company
- I know which processes were ongoing and need attention even in his absence
So from there I need to extract tasks that can be performed by me at least up to some form of completion, so that when my supervisor comes back he can simply approve or disprove and one click propagates his decision to the prepared items. Be it deploying a new setting, or deleting the self-same setting. Turn out this is hard, because when giving yourself tasks you look for what is something I can do and want to do.
It is the difference between the king directing the knight, or the knight having to figure out where the princess is for himself...
But all in all, I got things done. I successfully assisted our growth manager in automating some of our Microsoft office needs. I succeeded in preparing default settings for new employees. Both can be disabled with the click of a button, might they not be satisfactory. I also approved some software to be allowed in our cloud system, which was a risky move seeing how my supervisor normally makes these decisions. When I finally got a hold of my supervisor at the morning of me writing this, it turned out I mostly did it right (I forgot to document the decision by date. I did document it, but did not mark the date of the decision...)
So all in all, this was a huge success, and the key here was courage. Had I simply done the processes I already did, we would not have progressed. The growth manager would be stuck. The default settings would still be in alpha phase, while now they are ready to be deployed.
But instead I decided to assess what I knew about where we were going as a department, and decided to act accordingly. When I did, I found that a little courage goes a long way. Nothing blew up, nothing went wrong, the only downside is that I have to explain all my choices to my supervisor because, well, we need to document and approve everything in the end...
So what does this have to do with security? First of all, that is the department. Second is that sometimes security means that there should be no single point of failure. The only reason I could muster the courage is because my supervisor has been patient with me, and shown me things I did not need to know for my own sake, but only for context. This made it so that my supervisor was no longer a single point of failure, which really is to his credit and not mine. Thirdly I should really point out that, since security is a process, stagnation can be deadly. When in trouble, stop moving, assert the situation...
- Where are we going?
- What are we accomplishing?
- Which things need attention?
... and then do not hesitate to move again.
Stay safe out there!
There is so much more to this one chapter, but it is so good already!
I had to cut it short because guests arrived, but this should get you started on your own study :)
@calvinrempel Thank you once again for the Theology Tuesday you did, I refer back to it in this one :)
@JamesDerian Congratulations with your Marriage :)
Next time there might (almost certainly) not be a Theology Tuesday, so the official next one will be February 22nd! I have a marriage to attend. As the groom. Our home is still half a project.
Fun times!
Alc and I talk about my book that is now officially finished. This is part 1 of 2. Parts have not been neatly cut. Part two will air 5 minutes after part 1 for coninuity!
Hope you enjoy :)
This is the third corner to have persistent discussions and talks in. I love tech, but especially once it transcends hardware a little. I have two degrees; a bachelor's in Software Engineering and a master's in Information Security Technology. My graduation thesis focused on assembly-level optimizations (that is, one level above the hardware level) and my free subjects were in formal verification. This is why I love programming in the security corner, or maybe it is the other way around.
I started going down the Security path because I early on saw that the world around us would become a dangerous cesspool of badly-implemented and hostile tech. Now I am one of the people that understands the field around that mess :)
So in here you can discuss secure phones, weird programming languages, sad truths about internet-connected fridges. Also about malware, adblockers, and so on and so fort!
A lot of tech talk I do over at the @Lunduke community, where a lot of nerds hang out and it is ...
Much like the reading corner, let's have a music corner! A few rules for this one, since some music can be provocative. I don't mind much but let's keep youtube links with risque thumbnails out of here.
Other music I might also mind. "Do you find that offensive?" might someone ask. Yes, there is some music I choose not to listen on principle, and I walk a thin line there sometimes. But do not worry, I have a wide taste otherwise so feel free to share almost anything :)
Either way, here is the music corner!
Many times when we talk about security, we mean to say "Digital security". In essence we mean to say that our hardware and software that we use stays safe no matter what we do. And even though the ISO27001 standard (and by extension, for example, the NEN7510 standard) make it abundantly clear that security is a people-domain problem, we usually take that as a process-like truth. Meaning, we think that being secure is a matter of regulating people.
The truth is very different. For example, while writing this I am pretty shot. I slept five hours and I an under influence of a bunch of painkillers and some alcohol. Before you ask what I was thinking, let me mention that I have a genetic defect in my spine that I am dealing with right now by taking measured doses of all three (and yes, to get the Bible into this conversation, there is even a biblical ground for the inebriation with alcohol - see proverbs and the letters to Timothy - , although I did not use red wine. But hey, I am still on top of ...
