Complicated Solutions

I am currently in the middle of a work project that continues to get more and more complicated and that has me somewhat frustrated. We have a number of groups that we want to onboard to our data platform. Back when I first started my career, that could be as simple as giving someone a user name and password. Thanks to hackers and everyone discovering that data is more valuable than gold, we have had to engineer safeguards to keep our data from falling into the wrong hands.

One of the first barriers we created is locking down the network. We have a system where users of our data platform have to be on our internal network before they can even log in. That is a good start but it is not foolproof. Someone can spoof IP addresses and make it look like they are on our network and so there are several other precautions we have taken to keep bad actors out of our data.

Sony is a large company and sometimes we purchase smaller ones. I am working with a recent acquisition and their network does not meet the company's high standards and so we need them to log into our network. At first I thought it would be as simple as having them log into our virtual private network or VPN. That sounds great except it also opens a number of security vulnerabilities. Instead we need them to log into a virtual desktop interface or VDI. This is the equivalent of logging into a new desktop computer. That allows us to tightly control what software is allowed on it and instantly wipe the computer clean should we discover a security breech. This extra VDI is turning into a major issue for me as I have to support getting all of the new users onboarded and figuring out who to charge for it.

Once I get everything working, I will still have other issues to work through. Using an extra VDI has the potential to slow things down. It also creates a layer of complexity. Imagine downloading a document. While you think it may be on your local machine, it actually resides on the VDI. If you need to get it to your laptop, there is an extra download step. Sometimes it gets confusing and people give up trying to get things to work.

Ultimately today's computing environments require vigilance when it comes to security. The downside is that solutions become more complicated. The upside is your data remains safe and that makes the extra precautions necessary.  

Time For Annual Security Training

As a Sony employee I am required to run through an annual 30-minute training course on computer security. In the past the training has seemed to be the same as previous years. Today I ran through the training again discovering it has been updated and it seemed like a whole new course, which I appreciated.

The course had the usual warnings against clicking on links in e-mails and verifying URL's before going to the sites. This year, they provided some more details that helped understand how different character sets can be different than the regular Latin letters we are used to in English. The example they provided is that a Cyrillic V looks like the letter B. Someone could then create a mischievous website using the Cyrillic V for something like the Better Business Bureau and you wouldn't know you are going to the wrong site. Having a concrete example like that really helped underscore how subtle character substitutions can cause havoc.

A new entry in this year's training highlighted mobile device security. I prefer a full-sized keyboard and so if I can keep my phone in my pocket and use a computer instead, I do. I am not normal though as the average person uses their smartphone 6 hours a day. My usage is down around an hour per day. The training pointed out a number of helpful tips to keep from clicking on malicious links that could open your device to malware and other bad actors. I decided that by doing as much as I can on my computer, I reduce my risk for security issues. Should I get a nefarious text, I now know what to look for.

Finally the training had a section on how artificial intelligence (AI) can be used to create more realistic e-mails. Bad spelling and grammar used to be dead-giveaways of scam e-mails. Now those e-mails can be created to sound exactly like your supervisor or manager. They also warned against voicemails that can sound like the people you work with. That is a sobering thought.

The point of this post is that there are some persistent thieves and crooks trying to get access to your computer, online accounts, and smartphone. It is a good practice to review security best practices to remind you to remain vigilant against those bad actors. If you are not required to run through a 30-minute training session, you might want to find a trusted resource on the Web and do your own training.

Quantum Computing

A few days ago I had an old friend reach out to me on LinkedIn. He asked if I knew anything about Quantum Computing among other topics and I had to confess that I didn't really know much. Today I came across it again as it relates to machine learning and so I did a bit more research.

There is a different vocabulary associated with Quantum Computing and that takes a bit of getting used to. With traditional computing you have a bit which represents either the number 0 or the number 1. Quantum computing uses qubits which can be either a 0 or a 1 at the same time. Now string a bunch of bits together and you can represent things like numbers or letters. If you have two numbers you want to add together, you can add their bit representations and you have a single number as the result. With qubits, you add two representations of numbers and have all possible sums for all possible inputs with a single operation. So if you have an 8-bit number, you can count from 0 to 255. Assuming you have space for the results, adding all possible 8-bit numbers results in 512 operations. With Quantum Computing you can get all 512 results in a single operation.

Now start thinking about really large numbers. The larger the numbers, the more operations it takes to come up with all possible outcomes. This idea starts to open up a number of very difficult problems that can now be solved.

If you can do addition on a computer, you can also do multiplication. If you can do that multiplication very quickly then you have something that will help with encryption and decryption of confidential information. Some worry that Quantum Computers can be used to hack into secure banking systems. Fortunately there are secure encryption and decryption techniques using Quantum Computing that are unbreakable and so the moment the technology becomes viable, we will just need to change our current security protocols.

Some scientists believe that Quantum Computing is still a ways off. Others see it as being much closer. The real question is what will the applications be. If we go back 50 years and try to come up with possible uses for traditional computers, we couldn't possible imagine how they are being used today. The same will be true for Quantum Computing and that is what makes it interesting.

Time to Change my Password Again

This morning I got an automated e-mail telling me it is time to change my password again. I have been getting them for the past several days and if I wait until tomorrow it will be too late. I have written in the past about ideas for passwords and I got another good suggestion today.

The password for my laptop has remained relatively the same for the past 10 iterations. I use something like "ThisIsVersion1ofMyPassword." It is a long sentence and all I need to do is change the version number to the next one in the sequence. It works well except I didn't want to start adding 2-digit numbers. One of my colleagues suggested using letters. At first I thought that would be a horrible idea because "ThisIsVersionaofMyPassword" just doesn't make as much sense. Sure it is easy to remember and I definitely think it makes it more difficult for people to guess my password. After all, what does "a" represent?

I thought about it a bit more and remembered the line from the movie "The Martian" where Matt Damon has an epiphany with hexadecimals. For those that don't know, hexadecimal is a base-16 numbering system. Instead of creating new symbols for the numbers between 10 and 15, you just use the letters a, b, c, d, e, and f. The letter a is equivalent to 10, b = 11, c = 12, etc. If you ever take a peek at your computer or phone's MAC address, it is stored in a hexadecimal number. So to me, "ThisIsVersionaofMyPassword" is really equivalent to "ThisIsVersion10ofMyPassword" but with one less character.

While saving one character in a really long password is not that big of a deal, I have discovered that typing a single letter is significantly easier than typing a number. Don't get me wrong, I still include other numbers in my passwords to make them more difficult to guess. Reducing the amount of them makes my password easier to type. Hopefully you will find this trick useful with your passwords as well.

Constantly Changing Passwords

I have a number of systems that I log into for work and all of them require passwords. The majority of them enforce some periodic changing. Usually I don't mind, however this week something strange is happening. About once a day I get locked out of my account because some automated program is trying to log into my e-mail with the wrong password. After a certain number of attempts, the system just locks me out. I have to call our help desk and have them unlock my account. This has me questioning rules in general.

As I started out with, I have a number of passwords I have to remember for work. Off the top of my head I can think of about a dozen. Generally I like to keep most of my work passwords the same. However since I am forced to change some of them on differing intervals, they are now out of sync. In fact they all seem to be different right now and that creates a problem: I can't remember which one is which. This requires me to request a new password. It seems to me that resetting passwords is yet another security risk.

I have to ask if requiring me to reset my password every 90 days is really an effective security protocol? If I only had one password to remember, I think 90 days is a reasonable amount of time. Considering I have a dozen passwords, I think 90 days is too short. Perhaps those responsible for security should consider that as they set policy and take a broader view instead of just the simple case.

Virtual Private Networks

Recently I worked a deal with my current employer that allows me to work from my home in Utah one week a month. While my home is in the Salt Lake area, my office is in the San Francisco area and requires that I travel every Monday and Friday. This is the week I am home and I have to say it is a welcome change.

Computers greatly facilitate working from home. Since I spend most of my time in front of a screen in the office, it only stands to reason that I could just as easily spend that time at home in front of a similar screen. The only thing missing is the interaction with my co-workers. Fortunately for this week, that is a bonus as I have some software development to do and really don't want to be bothered by anyone.

Security is a key part of my job and so one of the technologies that allows me to work from home is a virtual private network or VPN. When I first start my computer in the morning, I have to run a simple program that asks for 3 different passwords. One is the usual password I use to log into the network when I am in the office. The other two are groups of numbers. The first number is a personal identification number that I have memorized and the second comes from a small electronic device I keep on my key chain. It generates a predictable-random number every 30 seconds. Once everything is entered, I click the connect button and my computer looks like it is part of my work network. My connection is only good for 8 hours. At the end of that time period, I get automatically logged off.

I like being able to work from home one week a month. It gives me more time to do those things that are normally done in the evening, like playing catch with my son, or replacing the fog light bulbs in my car. However there is a weak link with my VPN configuration, if I ever forget any of my passwords or lose my key chain FOB, I won't be able to work. OK, I don't really worry about my passwords, but I do worry about that little FOB. So far it seems fairly indestructible as I have accidentally taken it swimming and discovered it is waterproof. For the record, it wasn't an accident that the FOB was in my pocket, it was an accident that I went swimming wearing my street clothes. Sometimes that happens when you live part time on a boat.