Category Archives: Uncategorized

Emergency Classroom/Workplace & Travel Planning

Below is relevant emergency classroom (or workplace) and travel planning information to consider:

  • Review with the students classroom and building exits at least once each semester to improve fire alarm response. Students are unaware of room and building details, such as rooms with emergency exits (e.g., behind podiums).
  • Personally review the Run-Hide-Fight response training. If you have not had a chance to participate in this training, below are related reference materials:
  • DHS active shooter PDF
  • Run-Hide-Fight training video
    1. https://youtu.be/5VcSwejU2D0
      1. Produced by Houston Mayor’s Office of Public Safety and Homeland Security, and promoted by the FBI, dramatizes an active shooter incident in the workplace
      2. Note: Video is alarming in the beginning. Optional to begin at 1:30 mark: https://youtu.be/5VcSwejU2D0?t=1m30s
  • “Run when it’s safe to run.  Hide where it’s safe to hide.  Fight if you or others around you have no other options.” (Albrecht, 2014)
  • Expect immediately disabled elevators, and diminished cell service. Silence cell phones to protect location. If returning to room to shelter-in-place, expect police knocking and confirming identities through closed doors.

Heartbleed Action List For End-Users

Most likely you have heard of the “Heartbleed” vulnerability that plagues websites using a common open source application.  Web site administrators are busy implementing patches to remove the vulnerability.  However, since the Heartbleed exposure had continued for the past two years, this message offers suggestions to web users to protect personal security.

What is Heartbleed?

Heartbleed is not a malicious software virus, but rather a bug or “glitch” in many websites that used the OpenSSL application to exchange confidential information, such as passwords.  This popular XKCD cartoon illustrates how a website with the vulnerability could be “tricked” into revealing private information.

What websites are vulnerable?

It turns out that a millions of password protected web sites used this helpful open source application. Security consultant Bruce Schneier has said that on a scale of one to ten, this breach is an eleven!  The websites using OpenSSL for password exchange have exposed those passwords to disclosure.  A specific examination of popular websites reveals that sites such as Facebook, Yahoo, and Google (including Gmail) are included.  Although many bank and government sites were not affected, it is possible that the same password was used at multiple sites.  The affected websites are currently in various stages of patching the OpenSSL application to remove the problem.

What should end-users do?

Web users should take this opportunity to address specific Heartbleed exposure, as well as to improve password security in general.  The recommended steps include:

1.     Install the Heartbleed extensions available for Chrome and Firefox.  These will alert the user if a site is still vulnerable to Heartbleed.  After installing the browser extension, vulnerable sites such as (currently) https://tricider.com may be used to test these Chromebleed or Foxbleed extensions.  Figure 1 displays the Chromebleed pop-up on vulnerable sites.

Figure 1 Chromebleed display for sites vulnerable to HeartbleedScreen Shot 2014-04-16 at 7.57.54 AM.png

2.  After verifying that your password protected site is no longer vulnerable to the Heartbleed bug, it is time to change your password. 

3.     Now is the time to improve password security by NOT using the same email or username and password at multiple sites.  It has even been suggested that not repeating passwords is more important than using complex passwords.

4.     Attackers do not need to be very creative to test login information obtained from one site at other sites, such as banks.  Since this means you will need to keep track of multiple passwords, consider using a password manager, such as Lastpass or Keepass.  A search of “best password managers” will provide other suggestions, such as this review by PC Magazine.

a.     Be aware that users, for various reasons, are advised NOT to store passwords in browsers.

b.     Security questions are also problematic, as the “shared secret” is often easy to discover by an attacker.  Consider using fictitious or misspelled information that you can remember.

5.     Be creative with your password.  Attackers do not begin with random or “brute force” guesses.  It is far easier and quicker to use abundantly available hacker dictionaries of frequently used passwords.  For example, the top twenty-five passwords of 2013 were led by “123456” and “password.”

6.     One option is to use a web or app-based password generator, such as http://passwordsgenerator.net/.  Another option is to use the first letter, including capitalization and number, from a favorite lyric or even a phrase such as “In 2008 I graduated from Chicago High School” to create the password “I2008IgfCHS.”  Replacing some of these characters with symbols may increase security.  It is specifically discouraged to use English words, or even English words with predictable substitutions, such as “pa$$word.”

7.     Consider using “second form authentication” (SFA) or “2-step verification” when it is offered, such as by Google, Yahoo, and Facebook.  With SFA, access requires something the user “knows” (e.g., password”), with something the user “has” (e.g., a cellphone).

Finally, do not be surprised if you find yourself having to replace passwords in the near future when the next vulnerability is revealed.  Improving steps for this breach will streamline future demands!

Further reading

Penn State Proud

If you are one of the many in our Penn State family struggling to make sense of recent events, consider the advice from an unlikely source — an Ohio State University Buckeye!

In “An Open Letter from  a Buckeye to a Nittany Lion,” Jonathan Franz reminds us that first and foremost we need to remember that the true victims here are the children.  We must not waiver in the attention to their needs, including thoughts and prayers.  Next we need to do all possible to prevent such atrocities, whether through our action or inaction (i.e., see my previous blog post “What WILL You Do?”).

Finally, we need to be–and this is hard right now–“Penn State Proud.”  We need to be proud for all that Penn State has done and can continue to do.  Make us proud now in front of the world that watches.  If you are a football fan, go to the game this weekend and cheer passionately for the players that work so hard to make us proud.  As Franz say:

 

Not because you support the coaches, because you support the men on the field.  Not because you endorse the administration, because you believe in the University as a collective whole.  Penn State University has always been (and will always be) about one thing and one thing only: making life better.

 

Be the best that you can be, in all that you do, now and forever more.  This only you can control.

Algorithms Among Us

“Algorithm” is a term most often associated with software programming.  The concept, however, can be fairly universal, since it basically just describes a set of rules that, if followed, will yield a predictable outcome.  Since a cooking “recipe” also shares these features, recipes are frequently used as examples when teaching algorithm concepts to programming novices.

Naturally occurring algorithms are also found in and around us.  Our morning routine of waking, going to the washroom, and preparing breakfast, for example, is a “getting ready” algorithm for humans.  Flowers blooming in the spring is “nature’s renewal” algorithm. 

Similarly, every microprocessor includes manmade algorithms that control computer reactions to states of nature.  A modern automobile, for example, has more than five microprocessor controlling the radio, climate, engine combustion, traction, and airbags.  Algorithms can execute linearly, loop (i.e., “keep doing this until, or while…”), and, if needed, “jump” to other pieces of the code. 

A very simple algorithm politely opens the supermarket door automatically for you after stepping on sensors hidden under its black mat, or in the elevator that takes you to your floor on request.  Wal-Mart uses more sophisticated algorithms to anticipate shopper interests, such as strawberry Pop-Tarts when a hurricane is imminent, or to anticipate the devastation from Hurricane Katrina and order trucks of water be shipped to New Orleans. 

Mistakes when creating algorithms, and associated controls, can be disastrous.  For example, dozens of children were suffocated in accidents involving poorly designed automobile window switches. 

Algorithms are increasingly used to augment human decision making, especially in situations where the inputs are too great for human sense making, or where delays needed for human comprehension creates disadvantages.  As such, Wall Street’s “time is money” creed quickly became a hotbed for automated trading.   

Although carefully crafted investing algorithms can be quite lucrative, they can also lead to nonsensical outcomes.  For example, it is believed automated “program trading” (i.e., rapid computer stock trades based on inputs such as related security prices) mayhem led to the “Black Monday” market crash of October 19, 1987.  In one day the Dow Jones lost 22.6 percent of its value, its largest-ever percentage loss. 

The solution to trading computers running amuck was to create an offsetting control algorithm.  Software “circuit breakers” were developed to step in and halt all trading if signs of trouble began to emerge.  This seemed to work until the “Flash Crash” of May 6, 2010 caused the Dow Jones to drop nine percent in just a few minutes.    

Similarly, book-pricing algorithms can also run amuck.  Shipping was NOT included when Amazon’s algorithms decided to price a book on flies at $23,698,655.93.

What we are seeing is an increase in boundary-blurring between naturally occurring algorithms and those that we create.  This is the thesis of Kevin Slaven’s popular Ted Talk video (below), and his warning that algorithms need “adult supervision.”  This was suggested somewhat in the January 2007 Youtube video, “The Machine is Us/ing Us.”

There is no doubt in my mind that we are at the early stages of the intersection of nature, culture and software algorithms.  The “Wal-Mart Effect” describes the retail giant’s role as cultural gatekeeper, partly enforced by size, and partly by algorithms.   I do not think there is a need for alarm yet, only a call for vigilance. 

Business Strategy & Decision Making?

Discussions of strategy in business are probably less than 100 years old, getting a big spike from research published around 1980 from Miles and Snow, or Porter, for example.  Strategy in military history, however, is much older, and usually includes the influence from military strategy authors such as Sun Tzu and von Clauswitz

On of the key thoughts in business strategy is that deciding what your organization (or “enterprise”) does, depends in part on what your competition is doing.  For example, in the late 1920’s the application of strategy concepts helped Alfred Sloan and GM surpass Ford in car sales.

Below are some images that I use in the classroom to introduce enterprise foundations and the application of strategic concepts to influence decisions, such as Information Security practices.  Note that the enterprise can have more or different functions (every organization is a bit different, especially when it comes to housing the Information Systems group).  Also note that the enterprise can be extended, as in supply chain studies, to include supplier and customer “functions.”  The bottom line is that the day-to-day operations of each business function should be performed – and managed – under the guidance of overarching strategic thought.

I’m posting this partly out of a desire to distinguish what I perceive to be slight nuances between Mission, Vision, Values, and so on.  Part of the ambiguity posted on the web sites I visited is probably due to common business neglect of these concepts.  While this thinking may not be important to all businesses, I suspect it does make difficult appropriate solutions to fairly ordinary business problems.  Perhaps this contributes to the relative fragility (Collins, Senge, Businessweek) of the average business enterprise? 

EnterpriseMatrix_Page_2.jpg

 

Mission2Operations_Page_1.jpg

Using Gmail for PSU Email

Undergraduate Lena Bradley posted “Converting from Webmail to Gmail” to help students set up a Gmail account and then forward PSU email to this account.  The first two parts of this tutorial refer to Lena’s English 202C assignment.  Part III has been added to protect student privacy (and instructor compliance with FERPAFamily Educational Rights and Privacy Act) when replying to these email.

____________________________________________________

  • Part III Example: Set Gmail “Reply To” address to be PSU

Figure 1 (below) shows the “accounts and imports” settings that a student should edit in Gmail.  Although not required, it is a good idea to click “make default” next to the PSU email account.  Otherwise, the student will need to remember to change the “from address” to the PSU account for each email sent that relates to course work. Also, check the box “Reply to same address the message was sent to.”  Replying to PSU email, for example, will automatically use the PSU account as the “reply to” address.

Figure 1:  Gmail Accounts and Imports Window (click to enlarge)

GoogleAccountsAndImport.jpg

Scenario:  Student Sends Gmail to PSU Instructor

In Gmail, student clicks “Compose Mail.”  If PSU account as been made default (Figure 1), email will already include PSU return address information.  Otherwise, student will need to remember to click the dropdown box next to the compose email “From” window to select the PSU account.

 

Scenario:  Instructor Replies to Student Email Sent From Gmail

Instructor should see student’s email “From” address as “xyz123@gmail.com; on behalf of; Student Name [xyz123@psu.edu].”  When instructor clicks “reply” the email will maintain privacy by going to “Student Name [xyz123@psu.edu],” and NOT directly to Gmail.   Part II settings (above) have Penn State forward the email to student’s Gmail account.

____________________________________________________

 

India’s Novel Use of Brain Scans in Courts Is Debated – NYTimes.com

http://www.nytimes.com/2008/09/15/world/asia/15brainscan.html?_r=1


Great article on the “new” science of decision-making.  The fMRI machine (functional magnetic resonance imaging) is finding new applications, including as forensic evidence in India.  I am curious whether this will grow in trial acceptance.

(Related link on the history of forensic science)

Military Deluged in Drone Intelligence – NYTimes.com

http://www.nytimes.com/2010/01/11/business/11drone.html

 "Air Force drones collected nearly three times as much video over Afghanistan and Iraq last year as in 2007 — about 24 years’ worth if watched continuously."  Next issues, similar to information overload in business, is to manage and "fuse" the diverse sets of military data.  Still no substitutes for human-interpretation of the data, though.


Full List – The Top 10 Everything of 2009 – TIME

http://www.time.com/time/specials/packages/completelist/0,29569,1945379,00.html


I’m a sucker for top-10 lists. My favorite in this 2009 list is viral videos. It is interesting to witness changing technology reflected in such lists (i.e. videos and video sharing is not that old, while the concept of “viral” videos is even newer).

Don’t forget the one that got away – the major league baseball catch by a fan who gave the ball to his daughter only to see her promptly (appropriately?) toss it back on the field. MLB nixed (and missed) a major league pubic relations coup – that was so 2008.