People are very poor at risk analysis. As such, people “in the biz” come up with metrics to determine ROI. This might seem cold hearted. Since money is not infinite, we need to have some tool that we can use to measure the effectiveness of each dollar that we put into mitigating risks.

Let’s imagine that your mom had been killed by a falling piano. If we could mitigate this threat and it would cost 2/3′s of our budget, would you? What if random lunchmeat explosions costs 2/3′s of the budget to mitigate as well? What if falling piano’s claim 10 people a year, and random lunchmeat explosions claim 100,000?

When you look at events with the correct lenses, it’s possible to start to understand what’s really going on. These are the tools that actuaries use to model the world. It’s also the tools that security folks should use to model their spending against threats.

Continue reading ‘Risk Analysis and Spending’ »

So, I’ve had this curse since I was a kid. I just cannot sleep sometimes. I’m still really tired and groggy, I just can’t sleep.

It’s really times like this that get the mind running into some of it’s darker corners. This is that mystical point, where good ideas flow, and right when I get a head of steam up on an idea, I fall asleep.

One of the things that came out of our rails bugmash team and time at Blue Box Group was that the real time killer was a lot of the prep work. Installing 3 databases, and all of the other tools and goodies can take hours which could be used mashing bugs and racking up points.

Continue reading ‘Railsbridge BugMash VM’ »

One of the things that I really like to do is to cook. I’m going to start to post new recipes as I come up with them. So this should be the first of many articles in this category.

Continue reading ‘Snappy Chicken and Veggies’ »