I’ve been doing information security stuff for over 20 years now. My consulting/training company just turned 5 years old. One thing I’ve seen repeatedly is how often we (security folk) make the same mistakes.

In my eSecurityPlanet/Datamation column this month, I address that problem and provide a couple of pointers to help us learn from history a bit. Hope you find it useful.

Cheers,

Ken

I'm a huge fan of GPS. I've used one in my car for 8 years now; I have one on my mountain bike (principally to track my workouts, not to navigate). They're awesome. What a magnificent product for consumers, and it came from the U.S. military. However, while today's consumer products can help many drivers, I've seen them make some drivers worse. WAY worse. Here's how...

I often use a sedan service to get to/from airports when I'm traveling. I've noticed in the last year that my service provider has outfitted all of their cars with dashboard GPS devices, like the ones from Garmin, Tom Tom, and Magellan. Great stuff, and they're finally at a price/usability point for many average consumers.

The problem comes in when the driver follows the directions given by the GPS too closely, and fails to exercise common sense -- like reading the traffic signs. There's one BIG intersection, in particular, near my house that drives me insane when I get one of "these" drivers. It's the highway intersection of I-95, I-395, and the DC Beltway, I-495. This intersection, also known as the "Springfield Mixing Bowl," has recently gone through an EIGHT-year redesign.

You guessed it, most GPS devices still know the OLD "mixing bowl," not the new one.

TWICE now, my driver has followed the GPS directions precisely only to take us on a significant and unplanned tour. Today's drive to Dulles airport included a drive in DOWNTOWN DC, past the Lincoln memorial. This detour added close to 30 minutes to my drive. If I hadn't planned for a long airport wait time, I could well have gotten into serious timing problems.

But more to the point, in each case, the highway signs clearly (to me) indicated where the driver should have gone, but the driver listened instead to the GPS. THIS is the problem.

GPS is great, but they work best for drivers who already have a fair "feel" for the vicinity and know more-or-less where they're going. When you blindly follow the GPS directions, you're bound to go places you hadn't intended, and perhaps didn't want.

So yes, it still helps to be a good human navigator if you want to use a computer to help. The GPS software is improving rapidly, so perhaps some of this will improve with time, but for now, pay attention to the street signs FIRST and THEN to the GPS.

Cheers,

Ken

For my birthday, I got a really neat book about the wine cork industry from my brother-in-law. Great stuff. And wow, were the points made in the book brought home for me last night?!

We went out to dinner at a local Italian restaurant. Nothing fancy, but pleasant. In fact, we were largely there to root for a band that featured a co-worker/friend of one of our friends. I was in charge of making the wine selection. I found two interesting wines on the list, by one of my favorite Tuscan producers, Cennatoio. (We visited the winery when we were in Tuscany in September, 2003.) I ordered a simple sangiovese, their "All'omo il Vino," a nice 100% sangiovese IGT.

Out came the wine... The waiter poured me a small amount to taste and...you guessed it, it was corked. I explained this to the waiter and he seemed dumfounded, so he called over the manager. To my shock and horror, the manager insisted on tasting it also. He (seemingly reluctantly) agreed that it was "off," but said it was their last All'omo, so I'd have to select a different one. (I was preparing for him to say it was fine, but that would have resulted in a situation neither of us would have enjoyed.) He pointed me to what he called a comparable "sangiovese" on the wine list, but it wasn't a sangiovese at all. So I pored through the list myself and decided on the All'omo's big brother, Cennatoio's Chianti Classico Riserva from 2001. A bit more expensive, but I didn't mind if we got a good wine.

Same process, same taste test, same results... I said to the manager, "you're going to hate me for this, but this wine is equally corked". By now, I could tell the manager was not a happy guy, and he again insisted on tasting it for himself. Again, he reluctantly agreed.

Two corked wines in a row. Two wines from a superb winery that were undrinkable because of an industry that has a roughly 4-5% failure rate. I've had both wines numerous times, and I know I love both. But in their wet cardboard TCA-tainted state, they were horrid.

I don't blame the restaurant for anything except the manager's bizarre performance of second-guessing his customer. And I obviously don't blame Cennatoio.

Corks are evil. The sooner we all realize that, the better off we'll all be. TCA, the chemical responsible for most "tainted" wines, is a blight on this otherwise wonderful industry that cannot and must not be tolerated. Corks are almost always to blame. We MUST demand better.

Some wineries and even countries have been leading the charge to move from cork to other stoppers. Try finding a New Zealand wine that's not sealed with a "Stelvin enclosure" (that's fancy wine-speak for "screw cap"). Although those not in the know may scoff at screw caps, you're FAR less likely to have a TCA-tainted wine from one. (It can still happen, if the TCA is introduced during the wine making or aging process, but the likelihood starts to approach zero now.)

So, next time you look at a wine that's sealed with a screw cap or a synthetic cork, please join me in saluting the winery's courage and support them in their efforts to rid the planet of corks. Corks are evil.

Cheers,

Ken

I've found the most significant danger on the road or trail.

I'm a mountain biker. I try to ride pretty much every day when I'm not traveling, and generally end up going between 20-25 kilometers over some pretty hilly roads and trails here in the Alexandria, Virginia area.

Living just a couple miles outside the DC beltway, things tend to be pretty crowded on the roads as well as the trails. There are cars everywhere, joggers, other bicycles, and parents walking kids, just to name a few.

I've always been really careful around the cars, as they seem to be the most serious threat to the cyclist, but lately I've come to realize there's something even worse. Pedestrians with music players (generally iPods and other MP3 players).

That's right, these people are far more dangerous to the cyclist (and to themselves) than anything else I've found.

Cars generally stick to some semblance of traffic rules. I keep a safe distance from them and we all get along fine. Pedestrians with iPods, however, are another matter.

I try my best to be respectful and courteous to pedestrians. I always say hello. I always give them the right-of-way -- often going well into the grass to give them safe passage. When approaching them from behind, I always call out "passing" from a safe distance. All the things that you'd hope for from a cyclist sharing the road with pedestrians.

And there in lies the rub. I come up behind pedestrians and look for earphones now because I know they're more than likely to not hear my "passing" notice. Worse yet, they're apt to change "lanes" without notice. They're apt to panic when they eventually see me, often getting into more danger than they would have been otherwise.

I haven't hit one (yet), but I know it's a matter of time. For now, when I see earphones, I slow down and go *way* out of my way to avoid them. They're deadly.

So, way back on 9 May 2005, I posted an entry here saying that I'd gotten and was very happy with SunRocket's Voice over IP (VoIP) service. Last week, while I was traveling on business in Mexico, I saw a headline saing that SunRocket was going out of business. I immediately signed up with one of their competitors (Vonage) and, as of today, my account is active and my old number has been transferred over.

Here's the thing. Well, maybe more than one thing... As a very (!) small business owner, I have grown to rely on VoIP for my business phone line. They're relatively cheap, easy to work with, and overall very good. My opinion on that has not swayed, despite this bad experience with SunRocket. I wouldn't advise many/most people to get VoIP as their ONLY phone service at home, however. But, as a second number, they're fabulous.

Well, they're as good as your broadband is. I'm fortunate to be in an area where my cable modem speed is superb -- I regularly measure 20 Mbps download and 2 Mbps upload. VoIP has NO problems with that.

And I can sympathize with SunRocket's circumstances. They were heavily VC-backed, and their VC investors were unwilling to put any more money into the company. I've been there, done that. But wow, they sure handled the situation in a horrific manner. The fact that I learned of their demise from a magazine headline is inexcusable. The fact that I had to turn to another provider and make arrangements myself to transfer my service is inexcusable. I really wish I hadn't given them any of my business, but that's water under the bridge.

I do hope that their actions haven't tainted the entire VoIP community, though, but I think the damage has been done.

As anyone who actually reads this web site knows, I travel quite a bit, both on business as well as for pleasure (whenever possible). What's more, for various reasons (primarily convenience), I tend to fly mostly on one airline -- United.

Now, United isn't the best airline -- or the worst -- without a doubt. They have more than their share of warts. But, as an "elite" (1K) flyer on them, when something goes wrong, I tend to get it resolved pretty quickly and easily. Usually.

But I just got back from a trip to Rome yesterday. (See this link for some pix.) My customer tried to pinch a few pennies and I ended up on US Airways instead of United. Mistake #1.

I left Washington Reagan airport on the day after a northeastern US snow and ice storm. Not surprisingly, things were delayed. I'm completely understanding of the situation at this point.

But US Airways had, I'm told and have verified via news reports, recently upgraded one of its main computer systems. Not sure what went wrong behind the scenes, but at the front counter, it was pandemonium. The check-in line at DCA was hundreds of yards long. No kidding.

After a couple hours in line and nearly giving up, a couple US Air employees came through and grabbed those of us who might still make today's flight. I was among the lucky. Got to Philly just fine, but ended up missing the Rome flight.

Then -- and I have to give due credit here -- a couple of wonderful US Airways employees in the US Air Club helped me re-route my trip via Munich. Looks like I made it. But more delays...

I ended up in Rome without my bags and had to go to my customer site in smelly, dirty jeans/rugby without a change of clothes. Bags finally arrived late Monday.

But that still wouldn't get them into my Never Again Club (NAC).

On my return from Rome yesterday, I picked up my bags in Philly. Everything was on time. Two hours in Philly to catch my connection to DCA. No problem. Get to DCA and, you guessed it, no bags.

In fact, not only were my bags lost, but about 2/3 of the people on my flight were stranded without their bags as well. We waited pathetically at the baggage carousel only to have about 10 bags come out from our flight and then the carousel shut down. No more bags.

I just can't believe this. How could an airline be so blatantly mis-managed to make this kind of mistake over and over? It just boggles my mind and forces me to spotlight them here, for all that's worth ;-\, in my Never Again Club, with honors.

Oh, and I'm typing this the morning after I arrived home. No bags yet, and I'm waiting for my ride back to the airport to leave on yet another business trip (on United!). I've had to pull together a replacement dop kit and such, but I'll make it. And I'm confident that United will live up to my expectations, but who knows.