Category: Work

Posted on

Password Expiration

For anyone who follows infosec, or even just basic tech, news–NIST has made a landmark change to their password guidelines:

Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

The change came last month, with the NIST Special Publication 800-63B.  Now, to clarify, NIST cannot enforce these standards upon the private sector.  However, as a general best-practice, businesses incorporate the NIST standards anyway–a decision with which I personally don’t find any fault.

But a consequence of this has been the eternal password debate.  I jested at the very-popular entropy argument, and offered my own thoughts on the matter, specifically that the mathematical models change depending on how one views a password’s derived length.  And while this argument still continues, as least now we can finally acknowledge that once a “good” password has been created, the human elements create enough points of failure as to render any advantages of regular password changes negated.

I therefore beseech you, my employer: can we now please stop with the mandatory 90-day password changes?

–Simon

Posted on

The Filename Doesn’t Match

I usually refrain from posting about my job because 1) There’s always someone with no sense of humor who takes things too literally/personally, and 2) There’s always a fine line between giving context and disclosing too much about things that aren’t public knowledge.

But I will attempt to traverse this line because in this scenario the story involves no widespread PR disaster, nor does it explain anything proprietary–simply basic technology.  All is paraphrased.  Here goes:

I notice an email campaign isn’t launching.  I ask the guy who schedules them with the FTP server why.

FTP Guy:  “The filename doesn’t match the email platform template, so the SAS code is sending data to the inactivate template.”

Me:  “Why doesn’t the filename match?”

FTP Guy:  “Because when you requested the original test file from the Data Team, you gave them the name of the old template.”

Me:  “Fuck.”

I consult a colleague.

Me:  “Why did the test files launch if the filename was for the wrong template?”

Colleague:  “Because the test files will still work for test emails, just not live data.”

Me:  “So I’d have no way of knowing the filename was wrong based on the test emails?”

Colleague:  “Correct.  You’d have to go back and verify a successful launch with the [generated report A] for each email campaign you manage.”

Me:  “I checked [generated report B], and it showed volume.”

Colleague:  “[generated report B] only shows activity between SAS and the email platform, which was sending files as intended, just to the inactive template.”

Me:  “So [generated report B] does not confirm live email activity?”

Colleague:  “No.”

Me:  “Fuck.”

I consult my manager

Me:  “So, this email didn’t go out because the filename mismatch caused SAS to send data to an inactive template.”

Manager:  “Why was there a filename mismatch?”

Me:  “Because I requested a test file for the wrong template, but it still worked for test emails so I didn’t notice.”

Manager:  “Why didn’t you notice that the email wasn’t launched?”

Me:  “I checked [generated report B] to confirm email activity, which I just found out only only shows activity between SAS and the email platform, and does not confirm emails go out.”

Manager:  “Okay, I will log this error.”

I go to inform the client liaison.

Me:  “So, this email didn’t go out because the filename mismatch caused SAS to send data to an inactive template.”

Client Liaison:  “Why was there a filename mismatch?”

Me:  “Because I requested a test file for the wrong template, but it still worked for test emails so I didn’t notice.  I checked [generated report B] to confirm email activity, which I just found out only shows activity between SAS and the email platform, and does not confirm emails go out.”

I get summoned to a meeting with my manager.

Manager:  “We have to put together a report and fill out this form explaining what happened, then discuss with your colleagues how to prevent it from happening again.”

Me:  “Okay.”  I fill out the form as follows:  “I requested a file for the wrong template, but it still worked for test emails so I didn’t notice.  I checked [generated report B] to confirm email activity, which I just found out only shows activity between SAS and the email platform, and does not confirm emails go out.”

I consult colleague for advice

Me:  “How do I regularly verify email activity?”

Colleague:  “You check [generated report A] for each email you’re managing.”

Me:  “Is there a quicker way to check all emails at once?”

Colleague:  “You can check [generated report C].”

Colleague shows me how to generate [generated report C].  I return to my manager.

Me:  “So in order to prevent this issue again, I will generate [generated report C] regularly to confirm email activity.”

Manager:  “How do you generate [generated report C]?”

I show my manager how to generate [generated report C].

Manager:  “Okay, I will add that to the report.”

I get summoned to a surveillance meeting to discuss the larger implications of the error.

Surveillance:  “What caused this email to not go out?”

Me:  “I requested a file for the wrong template, but it still worked for test emails so I didn’t notice.  I checked [generated report B] to confirm email activity, which I just found out only only shows activity between SAS and the email platform, and does not confirm emails go out.”

Surveillance:  “Why did you not notice the email didn’t go out?”

Me:  “I checked [generated report B] to confirm email activity, which I just found out only shows activity between SAS and the email platform, and does not confirm emails go out.”

Surveillance:  “How will you check for this in the future?”

Me:  “I will generate [generated report C] regularly to confirm email activity.”

Surveillance:  “How will you prevent it from happening again?”

Me:  “I now know how to properly request a test file for the right template, that test emails still generate with a filename mismatch, and that [generated report B] does not report email activity.  I will now generate [generated report C] regularly to confirm email activity.

End of meeting.

The above chain of events has been greatly shortened.  Bureaucracy is a consequence of large groups of people all performing specialized roles, and since this is a large company, it’s inevitable.  But one thing is certain, and that’s that I won’t request a file for the wrong template, thus creating a filename mismatch, ever again!

–Simon

Posted on

Like a Record, Baby

Standing desks are hippie-dippie crap.  Just because you want to lessen your chances of fatal cardiac arrest one day, I have to hear you and your stupid call as you talk way too loudly over the cubicle walls.

That is not the topic of this post, but a mere introduction.  I, too, feel my fragile physical form atrophying as I sit in a chair for hours.  And so, partially out of concern for my musculature, partially because I can’t bear to hear standing desk guy talking loudly on his eternal call anymore, I venture forth into the harsh and unforgiving wilderness that is the paved perimeter of the building.

I started taking walks whenever I had the time very early in my employ at this company.  And now, years later, I again went walking, but this time with someone else.  I’ve done that before of course–I’m not an antisocial weirdo.  But apparently I always take the lead, for on this occasion, upon our mutual egress from the edifice, she turned right–a direction I had never considered.  She wished to circumnavigate the building in a clockwise direction.  I implored her to rethink her rash and unwise decision, but nay said she, for the wild called to her in that direction.

Actually I think she just said she wanted to go that way, followed by a rhetorical question along the lines of what the hell was wrong with me.  And I, being the eternal gentlemen, acquiesced.  Then, 10 steps into the walk, I collapsed from an anxiety attack.

Which brings me to my question: why are sporting events which involve circular autotransference always done so in a counterclockwise direction?  Once again I sought the Holy Oracle for its wisdom of the collective consciousness.

Google quickly directed me to several sites, wherein the answers were many.  Explanations included but were not limited to: Coriolis effect, faster movement in relation to the planet’s rotation, more natural for the majority right-foot dominated athletes, and the interpretation of chronology as athletes moved from left to right from the perspective of the spectators.

But I recall an X-Files episode in which a buried naval antenna, miles long, generated ultra-low frequency radio waves for communication with deep-sea submarines.  Except, this being the X-Files, there were unanticipated consequences, and local residents suffered some sort of explosive decompression of their inner ear if they stopped moving–some sort of bone-resonance in relation to the antenna.  The guest actor was the guy who played the Breaking Bad dude.  Anyway, things didn’t turn out so well for Breaking Bad dude, the navy denied any wrongdoing but mysteriously shut down the antenna, and Mulder got the usual berating from FBI Assistant Director Skinner (or maybe it was his new boss after he was officially removed from the X-Files).

It is therefore my preferred theory that my panic attack was not due to some simple neurological disorder like OCD, but rather that, let’s say, the gel in my inner-ear is in resonance with the earth’s rotation and it causes me physical pain to travel clockwise.  One day, I will travel to the southern hemisphere to confirm this theory.

For now, let’s take a walk, and turn left dammit!

–Simon

Posted on

Thirteenth Floor…and Others

Last year, my employer flew me to their office in St. Paul, MN.  Sometimes I wonder why we end up with offices where we do.  I’m sure a geographer had a hand in it.  But anyway, ever notice how some places add an odd degree of drama to what would otherwise be benign circumstances?  Like someone had to come up with compelling narrative?  The office was in a suite, on the 6th or 7th floor–I can’t remember which–in downtown, in the First National Bank Building.

The building was apparently involved in some 1930s gangster-type shenanigans, and at one point the bank’s vault was the victim of an attempted robbery.  Supposedly the corridor leading to the vault is still riddled with Tommy-gun bullets.  But, the vault isn’t open to the public so I couldn’t verify this firsthand.  Nor did I take the time to verify the building’s backstory.  Maybe I will, after this.

Upon arriving at said building, like most normal people, my boss and I took the elevator.  This is what the panel looked like:

It gave me pause, more so than it would have had the numbers simply stopped at 7.  I brought this oddity to my boss’ attention, who responded with complete disinterest.  Then again, all he wanted to do in his off time was sit in his hotel room, so maybe some people are just generally uninterested with the world as a whole.  But not I!  This mystery needed investigation.

During our meetings, I made it a point to ask every group–the people who went to that office every day: What was on floor 16?  The responses were all of a similar variety.  No one knew, no one had thought about it, and no one had gone up there.  They saw this panel every day and not once did a single person push the button to floor 16.  It seemed that I would have to find out for myself.

Back in the elevator, on our way to the hotel, I pushed the button.  Now my boss’ indifference edged towards open irritation, but I ignored him.  My curiosity moved from just floor 16 to all the intermediate unlabeled floors as the elevator display also stopped listing numeric designations en route.

Upon reaching floor 16, the doors opened into a mysterious fog.  Not really.  They opened into a completely innocuous floor.  The doors, also devoid of numbers, taunted me with suspense as they were all locked.

I thought I might try for the stairwell and explore the unlabeled mystery floors below, but upon this suggestion, my boss threatened to abandon me.  I was, of course, capable of navigating my way back to my hotel room alone, but he was also ready to get food and I started thinking about what kind of dinner I could charge to the company card.  I left the building, possibly forever, none closer to a satisfying answer.  So if anyone finds themselves in St. Paul’s First National Bank Building, go to floor 16 and complete my unfinished saga.

–Simon

Posted on

My Outlook: Office Doesn’t Excel

Do you know what they improved between MS Office 2013 and 2016?  NOT A DAMN THING!

Okay, to be fair, there were some totally awesome improvements, like…window stacking?  And new Excel graphs.  And there’s this map function apparently.  And better database integration support.  This would totally be worth buying a new license.

Of course, that’s not their MO anymore.  I realize it’s clichéd to blame Millennials for things as I’m apt to do, but it’s totally their fault.  They expect software to have no upfront cost, and to be completely cloud-based.  So now, Microsoft pushes subscription services instead.  Yay, just like DRM!  You never actually own anything anymore.

On the business side, we have the same thing: perpetual contracts, even when the new software adds no value.  So what did Office 2016 change?  Well, they moved all the functions around so I had to find them again.  And now, repeated keystrokes cause some type of application layer panic and everything crashes.

excelcrash
How about you just let me CLOSE the program?

Rant complete.  But I’m not one to complain without suggesting a solution.  I offer you an alternative: LibreOffice.  It’s an open-source fork.  So while you may be forever forced to use Microsoft products at work, you can still make a choice in your personal computing needs.

Now I’m going to get back to work and see if Excel launches.

–Simon