Information security threat models, folk & expert

I’ve written a pair of blog posts for Global Crossing’s “Defense in Depth Security” blog based on recent work by Rick Wash and by multiple people at Intel including Timothy Casey about modeling the agents behind information security threats. The first post is about non-expert home computer users’ “folk models” of the threats from viruses and hackers,which makes the point that seemingly irrational decisions about security may in fact be completely rational based on their conceptual understanding of the threat they believe they are combatting. Only by changing their understanding of the threat, which requires not just information but appropriately salient information and the right incentives, are we likely to see changes in user behavior. I point out an example of a recent news story that might help provide both elements with regard to one type of vulnerability, open wireless access points. The second blog post, which will appear tomorrow, is about expert models of threat agents–the Intel Threat Agent Library. Intel created a large set of attacker personas and identified their attributes, for use in matching against vulnerabilities and prioritizing controls as part of a broader risk assessment process. I’m happy to discuss these further either here or at the Global Crossing blogs.

March 31, 2011 · 1 min

Rep. Gabrielle Giffords shot at Tucson grocery store event

Rep. Gabrielle Giffords (D-AZ CD8) was shot this morning at an event at a Tucson grocery store, along with several other people. The Tucson Citizen reports that she was “shot point blank in the head." This brings to mind a previous gun incident at another Tucson event at a grocery store in August 2009. The image below is from Sarah Palin’s website, “Take Back the 20." The lower right target sight image on Arizona is Congressional District 8, which was one of the “targets” for candidates who supported the Health Care Reform bill to be defeated. ...

January 8, 2011 · 9 min

Global Crossing blogging

I’ve joined the team of Global Crossing bloggers–please check out my initial post at Global Crossing blogs, “Forget passwords!" (BTW, my friend and colleague Glen Walker independently wrote a blog post making a very similar recommendation.)

January 6, 2011 · 1 min

Books Read in 2010

[Actually published 2012-01-01.] This was a good year for getting a lot of reading done, including a number of fairly lengthy books, thanks to going back to school full-time for the fall of 2009 and spring of 2010. Books read in 2010:  David Aaronovitch, Voodoo Histories: The Role of the Conspiracy Theory in Shaping Modern History Daniel Ariely, Predictably Irrational: The Hidden Forces That Shape Our Decisions, Revised and Expanded Edition James Bamford, The Shadow Factory: The Ultra-Secret NSA from 9/11 to the Eavesdropping on America Mark B. Brown, Science in Democracy: Expertise, Institutions, and Representation  Vincent Bugliosi, Reclaiming History: The Assassination of President John F. Kennedy Werner Callebaut, Taking the Naturalistic Turn, or, How Real Philosophy of Science is Done Nicholas Carr, The Big Switch: Rewiring the World, from Edison to Google I. Bernard Cohen and Anne Whitman, Isaac Newton, The Principia: Mathematical Principles of Natural Philosophy Harry Collins and Robert Evans, Rethinking Expertise Michael J. Crowe, Mechanics from Aristotle to Einstein Heather E. Douglas, Science, Policy, and the Value-Free Ideal Peter Fenton, Eyeing the Flash: The Making of a Carnival Con Artist Charles Freeman, The Closing of the Western Mind: The Rise of Faith and the Fall of Reason Jack Goldsmith and Tim Wu, Who Controls the Internet? Illusions of a Borderless World Richards J. Heuer, Jr., Psychology of Intelligence Analysis (also on the CIA's website as HTML or PDF) Sheila Jasanoff, Designs on Nature: Science and Democracy in Europe and the United States Thomas Kuhn, The Copernican Revolution (re-read) Bruno Latour, We Have Never Been Modern Michael Lewis, The Big Short: Inside the Doomsday Machine James Menn, Fatal System Error: The Hunt for the New Crime Lords Who Are Bringing Down the Internet Naomi Oreskes and Erik M. Conway, Merchants of Doubt: How a Handful of Scientists Obscured the Truth on Issues from Tobacco Smoke to Global Warming John Allen Paulos, Irreligion: A Mathematician Explains Why the Arguments for God Just Don't Add Up  Massimo Pigliucci, Nonsense on Stilts: How to Tell Science from Bunk  Paul Provenza and Dan Dion, Satiristas!: Comedians, Contrarians, Raconteurs & Vulgarians Dave Pratt, Behind the Mic: 30 Years in Radio Benjamin Radford, Scientific Paranormal Investigation: How to Solve Unexplained Mysteries Chris Rodda, Liars for Jesus: The Religious Right's Alternate Version of American History, Vol. I Rebecca Skloot, The Immortal Life of Henrietta Lacks David Schmidtz, Elements of Justice Steven Shapin, A Social History of Truth: Civility and Science in Seventeenth-Century England David Shenk, The Genius in All of Us: Why Everything You've Been Told About Genetics, Talent, and IQ Is Wrong Clay Shirky, Here Comes Everybody: The Power of Organizing Without Organizations Adrian J. Slywotski, The Upside:  The 7 Strategies for Turning Big Threats Into Growth Breakthroughs Neal Stephenson, Anathem Cass Sunstein, Why Societies Need Dissent Margaret Thaler Singer, Cults in Our Midst: The Continuing Fight Against Their Hidden Menace (revised and updated edition) Carol Tavris and Elliot Aronson, Mistakes Were Made (but not by me): Why We Justify Foolish Beliefs, Bad Decisions, and Hurtful Acts Vernor Vinge, The Collected Stories of Vernor Vinge Richard S. Westfall, The Construction of Modern Science: Mechanisms and Mechanics Michal Zalewski, Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks John H. Zammito, A Nice Derangement of Epistemes: Post-Positivism in the Study of Science from Quine to Latour (Previously: 2009, 2008, 2007, 2006, 2005.) Historical Comments Hume's Ghost (2011-01-02): I've read two of those books: - Irreligion & Mistakes were made. I own three of those books: ...

December 31, 2010 · 4 min

Review of CMI's "Voyage That Shook the World"

John Lynch and I have co-authored a review of the Creation Ministries International film on Darwin which will be appearing in vol. 30 of Reports of the National Center for Science Education and which may be found on their website. My previous blogged review of the film is here. I gave a little more background on the film here. John Lynch has said more about it here, here, here, and here, mostly about the deception used to get interviews by prominent historians. ...

November 30, 2010 · 1 min

What to think vs. how to think

While listening to a recent Token Skeptic podcast of a Dragon*Con panel on Skepticism and Education moderated by D.J. Grothe of the James Randi Educational Foundation, I was struck by his repeated references to Skepticism as a worldview (which I put in uppercase to distinguish it from skepticism as a set of methods of inquiry, an attitude or approach). I wrote the following email to the podcast: I am sufficiently irritated by D.J. Grothe's repeated reference to skepticism as a "worldview" that I will probably be motivated to write a blog post about it.There is a growing ambiguity caused by overloading of the term "skepticism" on different things--attitudes, methods and processes, accumulated bodies of knowledge, a movement.  To date, there hasn't really been a capital-S Skepticism as a worldview since the Pyrrhonean philosophical variety.  A worldview is an all-encompassing view of the world which addresses how one should believe, how one should act, what kinds of things exist, and so forth.  It includes presuppositions not only about factual matters, but about values. The skepticisms worth promoting are attitudes, methods and processes, and accumulated bodies of knowledge that are consistent with a wide variety of world views.  The methods are contextual, applied against a background of social institutions and relationships that are based on trust.  There is room in the broader skeptical movement for pluralism, a diversity of approaches that set the skepticisms in different contexts for different purposes--educational, political, philosophical, religious.  An unrestricted skepticism is corrosive and undermines all knowledge, for there is no good epistemological response to philosophical skepticism that doesn't make some assumptions.Trying to turn skepticism into a capital-S Skeptical worldview strikes me as misguided.To my mind, what's most important and useful about skepticism is that it drives the adoption of the best available tools for answering questions, providing more guidance on how to think than on what to think, and on how to recognize trustworthy sources and people to rely upon.  There's not a completely sharp line between these--knowledge about methods and their accuracy is dependent upon factual knowledge, of course. I think the recent exchanges about the Missouri Skepticon conference really being an atheist conference may partly have this issue behind them, though I think there are further issues there as well about the traditional scope of "scientific skepticism" being restricted to "testable claims" and the notion of methodological naturalism that I don't entirely agree with.  Skepticism is about critical thinking, inquiry, investigation, and using the best methods available to find reliable answers to questions (and promoting broader use of those tools), while atheism is about holding a particular position on a particular issue, that no gods exist.  The broader skeptical movement produces greater social benefits by promoting more critical thinking in the general public than does the narrower group of skeptical atheists who primarily argue against religion and especially the smaller subset who are so obsessed that they are immediately dismissed by the broader public as monomaniacal cranks.  The organized skeptical groups with decades of history have mainly taken pains to avoid being represented by or identified with the latter, and as a result have been represented by skeptics of a variety of religious views in events of lasting consequence. Think, for example, of the audience for Carl Sagan's "Cosmos" and his subsequent works, or of the outcome of the Kitzmiller v. Dover trial. In my opinion, the distinction between skepticism and atheism is an important one, and I think Skepticon does blur and confuse that distinction by using the "skeptic" name and having a single focus on religion. This doesn't mean that most of the atheists participating in that conference don't qualify as skeptics, or even that atheist groups promoting rationality on religious subjects don't count as part of the broader skeptical movement.  It just means that there is a genuine distinction to be drawn. (BTW, I don't think atheism is a worldview, either--it's a single feature of a worldview, and one that is less important to my mind than skepticism.) Previous posts on related subjects: "A few comments on the nature and scope of skepticism" "Skepticism, belief revision, and science" "Massimo Pigliucci on the scope of skeptical inquiry" Also related, a 1999 letter to the editor of Skeptical Inquirer from the leaders of many local skeptical groups (Daniel Barnett, North Texas Skeptics, Dallas, TX; David Bloomberg, Rational Examination Association of Lincoln Land, Springfield, IL; Tim Holmes, Taiwan Skeptics, Tanzu, Taiwan; Peter Huston, Inquiring Skeptics of Upper New York, Schenectady, NY; Paul Jaffe, National Capitol Area Skeptics, Washington, D.C.; Eric Krieg, Philadelphia Association for Critical Thinking, Philadelphia, PA; Scott Lilienfeld, Georgia Skeptics, Atlanta, GA; Jim Lippard, Phoenix Skeptics and Tucson Skeptical Society, Tucson, AZ; Rebecca Long, Georgia Skeptics, Atlanta, GA; Lori Marino, Georgia Skeptics, Atlanta, GA; Rick Moen, Bay Area Skeptics, Menlo Park, CA; Steven Novella, New England Skeptical Society, New Haven, CT; Bela Scheiber, Rocky Mountain Skeptics, Denver, CO; and Michael Sofka, Inquiring Skeptics of Upper New York, Troy, NY). UPDATE (December 1, 2010): D.J. Grothe states in the most recent (Nov. 26) Point of Inquiry podcast (Karen Stollznow interviews James Randi and D.J. Grothe), at about 36:50, that he has been misunderstood in his references to skepticism as a "worldview."  This suggests to me that he has in mind a narrower meaning, as Barbara Drescher has interpreted him in the comments below.  My apologies to D.J. for misconstruing his meaning. Michael C. Rush (2010-11-20): You make some good points, but ultimately I am unconvinced, I think. It seems to me perfectly reasonable to use "skeptic" in a manner analogous to how we would use "cynic," "idealist," or "epicure" in the modern sense, as general categories expressing one's dominant tendencies in approaching and assessing the world without requiring absolute fidelity to some ancient philosophy or formulation. Being open to questioning everything does not, it seems to me, imply rejection of everything. As for the skepticism/atheism issue, I think a person could be an atheist without being a skeptic, but I think it would be pretty silly. A "faith-based" atheism isn't of much interest or use. Can a person, conversely, be a skeptic without being an atheist? Clearly, but not, I would argue, a very good one. ...

November 20, 2010 · 42 min

Does Vocab Malone understand the implications of his own position?

Vocab Malone, with whom I had a blog debate about abortion and personhood last year, recently came across this comment of mine on the Point of Inquiry podcast with Jen Roth, an atheist who argues for the immorality of abortion: Was Jen Roth ultimately arguing that personhood is something that a human organism has for its entire lifecycle? At what starting point? Conception, implantation, or something else? I find it completely implausible that an organism at a life stage with no capacity for perception, let alone reason, counts as a person. Nor that a particular genetic code is either necessary or sufficient for personhood. I think every point that she made was brought up in a debate I had with a Christian blogger on the topic of abortion, who similarly argued for an equation between personhood and human organism. I wonder if she has any better rejoinders. Does she think that IVF and therapeutic cloning are immoral? IUDs?Vocab claimed that my argument was a "Chewbacca argument," a smoke screen, or a slippery slope argument, but in fact it is none of these.  I posted the following comment in response to him: Vocab:The argument I made is not a slippery slope argument, it's a reductio ad absurdum.  Your position is that the human organism is a person and has a right to life from fertilization to death (and presumably beyond), so you've already gone down the "slippery slope" and must of necessity say that IVF, therapeutic cloning, and IUDs are immoral because they result in the destruction and death of fertilized ova.  My position is that it is absurd to think that these things are immoral, and if you were to avoid the slippery slope by agreeing with me, you would have contradicted a logical consequence of your own position--thus, a reductio ad absurdum by being committed to a proposition and its negation.A slippery slope argument is an argument that says your position is committed to some consequence because there is no criterion that you can use to draw a line to avoid.  For example, if I argued that your position committed you to giving a right to life to all animals, and required you to be a vegetarian, or that it required you to give a right to life to every organism with DNA, and required you to hold a position like the Jain religion that all killing is wrong.As it happens, you never did supply an account of just what it is about the human organism that gives it a right to life or personhood--you offered no constitutive account of what properties entail a right to life or personhood, other than a genetic one.  I made the case near the end of our debate that you are probably implicitly assuming that personhood comes from a soul, and that souls are connected to human organisms at the point of fertilization, but there's clearly no evidence for that position, scientific, philosophical, or theological.BTW, my argument is also clearly not a Chewbacca argument or smoke screen, which is a simple non sequitur.  To think that, you would have to fail to understand that the items I identified all result in the destruction of fertilized human ova.It's important to note that not all slippery slope arguments are fallacious--if there really is no criterion to stop the fall down the slope, the argument is valid.  As Vocab never did explain what it is about human organisms that make them rights-bearers, I think he does face the slippery slope argument I presented unless he can offer some criterion for distinguishing human organisms from other organisms with respect to having a right to life. M! (2010-11-17): Let me be concise and clear: I do think *most* forms of IVF (there's a way to do it that hypothetically would be ethical), therapeutic cloning, and IUD's (they act as abortifacients) are unethical. This is the only logically consistent position to take if one understands that the ontology of the human being is such that all humans are persons and all persons have inherent and inalienable rights, the foremost of which is the right to life. ...

November 15, 2010 · 7 min

Pamela Gorman edits her own Wikipedia entry?

Former Arizona state legislator Pamela Gorman, or someone claiming to be her, took issue with the following passage in her Wikipedia entry: Also in 2005, Gorman was one of several Arizona legislators who supported parental rights legislation which was also supported by the Citizens Commission on Human Rights. She attended the grand opening of the Church of Scientology's "Psychiatry: An Industry of Death" exhibition in Los Angeles in December 2005 at the request of Robin Read, President of the National Federation for Women Legislators.The edit, which was described as "clarification of falsehoods entered about me and other organizations" and came from Cox Communications Phoenix IP 68.231.27.68, added the following right after that text: It was a quick visit which did not include any meals or other "fluff." The goal of the trip was to determine what the Citizen's Commission on Human Rights was about, as they were becoming heavily involved in NFWL. The cost of the roundtrip flight for the small group to tour the museum was reported by CCHR, according to Arizona disclosure laws. Gorman's political enemies have tried for years to make a leap from her touring a museum as a favor to the president of her professional organization to her actually being a Scientologist. Further attempts to alter this page with falsehoods of this nature may be met with legal action.I'm not aware of any online claims that Gorman, who is an evangelical Christian, is a Scientologist, only that she was one of several Arizona legislators who sponsored legislation on behalf of a Scientology front group and accepted gifts from the Church of Scientology. It's good that Gorman was willing to give a bit more context, but it should be noted that this was not simple "parental rights legislation which was also supported by the Citizens Commission on Human Rights," it was a bill that was at least partly written by CCHR. As the Arizona Republic reported at the time, the original text required not only parental consent before mental health evaluations by schools, it required that parents read CCHR anti-psychiatry propaganda before signing a consent form: Another bill introduced this year would have required written consent from parents for any mental-health screenings in schools. The bill was similar to other measures passed in previous years and vetoed by the governor. Sponsored by Sen. Karen Johnson, a member of the commission's international advisory group, the bill had a bipartisan group of 36 co-sponsors. Still, it failed by a tie vote in the Education Committee, in part because of testimony of mental-health advocates. The original text of the bill would have required parents to sign a lengthy consent form that contained paragraph after paragraph of negative information about psychiatric practices.Information about CCHR is easy to come by on the Internet (e.g., at Wikipedia or xenu.net), so it's unclear why Gorman needed to accept a round trip flight to Los Angeles on the CCHR's dime to find out "what the Citizen's Commission on Human Rights was about," or why she sponsored their bill.

November 4, 2010 · 3 min

James Dobson's dog-beating story

In James Dobson’s 1978 book, The Strong-Willed Child, he writes about using a belt to beat his dachshund into submission: Please don't misunderstand me. Siggie is a member of our family and we love him dearly. And despite his anarchistic nature, I have finally taught him to obey a few simple commands. However, we had some classic battles before he reluctantly yielded to my authority. The greatest confrontation occurred a few years ago when I had been in Miami for a three-day conference. I returned to observe that Siggie had become boss of the house while I was gone. But I didn't realize until later that evening just how strongly he felt about his new position as Captain. At eleven o'clock that night, I told Siggie to go get into his bed, which is a permanent enclosure in the family room. For six years I had given him that order at the end of each day, and for six years Siggie had obeyed. On this occasion, however, he refused to budge. You see, he was in the bathroom, seated comfortably on the furry lid of the toilet seat. That is his favorite spot in the house, because it allows him to bask in the warmth of a nearby electric heater... When I told Sigmund to leave his warm seat and go to bed, he flattened his ears and slowly turned his head toward me. He deliberately braced himself by placing one paw on the edge of the furry lid, then hunched his shoulders, raised his lips to reveal the molars on both sides, and uttered his most threatening growl. That was Siggie's way of saying. "Get lost!" I had seen this defiant mood before, and knew there was only one way to deal with it. The ONLY way to make Siggie obey is to threaten him with destruction. Nothing else works. I turned and went to my closet and got a small belt to help me "reason" with Mr. Freud. What developed next is impossible to describe. That tiny dog and I had the most vicious fight ever staged between man and beast. I fought him up one wall and down the other, with both of us scratching and clawing and growling and swinging the belt. I am embarrassed by the memory of the entire scene. Inch by inch I moved him toward the family room and his bed. As a final desperate maneuver, Siggie backed into the corner for one last snarling stand. I eventually got him to bed, only because I outweighed him 200 to 12! Dobson's book is a promotion of corporal punishment in child rearing. This story is complementary to Jerry Falwell's cat-killing story, written at a time when Christian fundamentalists didn't seem overly concerned about abuse of animals--the 1970s.  It's also complementary to the story of Mike Huckabee's son killing a dog, and Mormon Mitt Romney's dog abuse story. Thankfully, most of us today recognize that abusing animals is a sign of psychopathy. UPDATED: To lengthen quote and correct source book title, as per Snopes.  The original 1978 hardcover version of the book is available for $0.01 on Amazon.com Marketplace. Historical Comments Bartimaeus (2010-09-28): They probably thought Sigmund's behavior was "cute" up to the point that he started biting them. Sad that he did not realize he was creating a monster and then resorted to physical violence as his first and only option. Even more disturbing that he uses it as an example for raising children. Here is an interesting post by someone who actually understands dogs better than most, just for a little contrast; http://cynography.blogspot.com/search?updated-max=2010-09-16T18%3A49%3A00-04%3A00&max-results=7 ...

September 13, 2010 · 4 min

Gun-toting, Scientology-supporting, Bible-thumping, climate change-denying Pamela Gorman wants to be elected to Congress

Former Arizona State Representative Pamela Gorman, whose promo video proudly proclaims her to be a gun-toting Bible thumper, spent some of her time in the Arizona legislature supporting Scientology front groups and denying the existence of human-caused global warming through her affiliation with the sleazy Heartland Institute. Here’s her video:

August 14, 2010 · 1 min
Mastodon Verification