Josh More – Starmind Blog

Autotomy is the fancy name that people give to the well-known tendency for certain lizards to throw off their tails to escape predators. The theory, is that the tail will thrash around and distract the predator, thereby giving the lizard a chance to get away. It must be noted that other critters like octopuses, crabs and some starfish also do this, as do sea cucumbers. (Though the sea cucumbers eject their internal organs instead.)

So what does this mean in the business/IT world? Well, the obvious analogy is to distract an incoming attacker by abandoning your resources and letting them go nuts while you relocate your business to Sri Lanka. However, some might consider this approach somewhat impractical.

However, if we stretch the analogy to the point of breaking (much like a lizard's tail), perhaps it makes sense to build a business strategy around distracting attackers. There are some technologies that could assist with this. A honeypot is often used to trap attacks so that people can learn from them. This has become even easier now that virtualization has become prevalent. All you have to do is join one of many projects and you'll have a nice fake network to distract attackers.

Another technique is tarpitting. This technology looks at incoming connections, and if they are not approved, it doesn't reject them right away, but instead extends the time before the connection is closed. Thus, attackers are delayed and, in theory, you gain the time to build a defense.

In practice, of course, you need to actually be watching for the attack and take defensive action. This technique wouldn't work very well if the lizard dropped it's tail and then stared dumbly as the dog wrestled the tail into submission, ate it, digested it, napped for a bit, woke up, got a bit hungry than then saw a nearby tasty tailless lizard. So, if you decide to go after this option, you have to remember to "run and hide". In other words, keep an eye out for the attacks and be ready to block them.

Related posts

• Security Lessons from Nature – Glow Worm Cave (1)

The Blue Glaucus, also known as the sea swallow, blue sea slug and blue ocean slug ('cause one name just isn't cool enough for this sucker) is, as Wikipedia says, a pelagic aeolid nudibranch, a marine opisthobranch gastropod mollusk in the family Glaucidae. Which is fancy sciency way to say it's a slug that lives in the ocean. (If you like to geek out on sciency stuff (like me), read this, and this and this.)

What makes this little critter particularly interesting is that it eats Portuguese Man o' Wars (should that be "Men o' War"?). Not only is it immune to the venom, but it also has the ability to absorb the stinging cells (sciency term: nematocyst (aka cnidocyte, 'cause they're cool too)). It can then concentrate the cells of all the Portuguese Mens o' Wars it eats and thereby pack a stronger wallop than the original predator.

Business-wise, our friend Glaucy basically performs a hostile takeover, absorbs the general features of the acquisee (proteins) and concentrates that which make them unique (nematocysts/cnidocytes). The lesson here, I think, is to look at what makes others unique and not necessarily one what you have in common. That's not to say that commonality isn't important... no acquisition is going to work out if you don't share common proteins. However, a strategic acquisition isn't going to be massively successful unless you can take advantage of and preserve the uniqueness.

The same holds true of employees. If we hire employees, it is presumably because they have skills that set them above the rest. (After all, everything else can be automated these days.) Does it really make sense to push them all towards the same lowest denominator? Wouldn't it make more sense to give each the tools they need (both technical and cultural) to maximize their success? By doing such, you have effectively turned them into little stingers that can pack quite a punch. Then, the trick would be to set them up in teams, so their punch can be concentrated.

Of course, the other lesson to learn from Glaucy is that it's not just a mass of stinging cells. In order to be a successful organism, it must still move around, hunt and eat. Thus, priority one is successful operation (not uniformity), and priority two is concentration of attack/defense. I often find myself falling into the trap of forgetting about operations and trying to promote uniform environments and tool consolidation in the name of security. After all, that's best practice right?

Wrong.

Best practice is protecting the business. That means making the business as successful as possible. I'm afraid that we security practitioners often mistake the process for the result. Uniformity is a tool to promote control and control is a tool to promote security. However, as soon as the costs of uniformity and control get in the way of the success of the business, they harm security instead of benefiting it.

Related posts

• No related posts.

Happy groundhog day.  In honor of this special day, you get a picture and a scatter-shot of groundhog facts:

• The groundhog is also known as a whistle-pig, due to its tendency to make a whistling noise when predators are near.  Much as monitoring systems will send SMS or email messages when an attack occurs.
• Groundhogs have two layers of fur, both a soft undercoat and a guard hairs.  This is a classic defense in depth strategy, against both cold and damp threats.
• Groundhogs mostly eat plants won't pass up the occasional delicious grub or bug.  This allows them to supplement their dietary needs without having to track down the rare vegetative high-protein source like nuts or beans, which are needed in small quantities at various points in their lives.  This is much like an organization hiring a 1099 resource as needed.
• They are one of the few creatures that truly hibernate and are generally utterly non-responsive for four to five months... which has no direct correlation to business, but there are days when I wish it did.
• They have a wide range of predators, including owls, dogs, bears, bobcats and coyotes.  Younger ones are vulnerable to snakes and hawks.  Much as a security program is constantly evolving and loses vulnerability to some threats but not others, the successful groundhogs grow large enough to be immune to the snakes and hawks.
• When predators strike, groundhogs will escape them by running to emergency burrows (hot site) or up a tree (cold site).
• Groundhogs are mostly solitary but also live in small communal burrows.  This allows them to share the alerting responsibilities and leverage one another's expertise... in much the same way that small teams can work most effectively in a small conference room where they can collaborate.
• The groundhog is in the Sciuridae family along with the squirrels (and a fragment of their genetic code can be found here (as part of the SequenceJuxtaposer project (which has nothing to do with security, but is still pretty neat))).

Image in the Creative Commons and is courtesy of ~Sage~ on Flickr.

Related posts

• No related posts.

Those of you that have seen the series Planet Earth are probably aware of the glow worm cave. (Those of you that have not have some TV watching to do.) This is a cave full of cute little glow worms that make a light pattern on the ceiling of the cave that is reminiscent of the night stars. It's a beautiful sight to stare up at those little glittering pinpoints of lights.

Of course, that's the tourist spiel. In actuality, the "glow worms" are larval gnats that produce mucus and spin out long threads to entrap moths. When a moth becomes deluded by the mights and becomes trapped in the sticky threads, the larvae pull up the moth and liquefy and suck out their internal organs. After secreting mucus and dining upon moths for up to a year, they transform into gnats whereupon they mate and die... which seems like a lot of work to me, but then, I tend not to be consulted in matters such of this.

However, the lesson here is a good one. Namely, it's probably not worth travelling all the way to New Zealand to visit the the phosphorescent snot worm cave. However, a deeper lesson is that light attracts bugs. (Sure, I could have blogged about the moth and the candle, but then I'd not be able to talk about glow worms.) If you want to know something about the insects that inhabit a cave, just put out a light and see what comes visiting.

We do that in I.T. security to help identify the attackers that are on the Internet. We call them honeypots, which is likely a reference to Winnie the Pooh (I hope), but since I am not (yet) linking children's literature to security, we'll ignore that bit for now. Instead, we'll take a quick look at the value of Lepidopterisy. Just as a scientist can look at the types of moths ensnared in sticky mucusy silk and learn a lot about the ecology cage, a security researcher can examine the malware and attacks found within a honey pot and learn a lot about the sorts of attacks that they may be subjected to.

By creating your own honey pot, you get a chance to deal with attacks before (hopefully) they impact your production systems. However, just like fungus gnats larvae don't ignore the moths that stumble into their "webs" (strings, really), in order for this to be effective, you can't ignore what gets caught in the honey pot either.

Related posts

• Security Lessons from Nature – Autotomy (0)

Poison dart frogs are, not surprisingly, covered with poison. I could go off at length about how different species have different levels of poison, and how not all of them were used to poison darts and how many of them are going extinct due to a nasty fungus that's only vulnerable to an eyewash solution... but that would be a bit too rambling even for me.

Instead, I'm going to talk about ants. I'm not going to go off about how they are communal, have some interesting chemical signals or even how they are vulnerable to some very interesting fungi that take over their brains (despite how unbelievably cool that is). No, the important thing is that the frogs eat the ants.

Boring, I know.

See, the poison dart frogs don't generate the poison themselves. Instead, they eat ants and push the poison from the ants out through their skins. Not only is that an awesome example of how a predator can turn a prey's defense into a defense for the predator while simultaneously rendering it useless for the prey (smart little froggies!), but it's also an example of the importance of operations.

See, an interesting side effect of this method of defense, is that if the ants go away, then so does the defense. Domesticated poison dart frogs aren't poisonous (which would make them dart frogs (which, since they neither throw darts nor are tailors, is a horrible name for them)). In order to keep the defense, they have to keep on acquiring ants.

Which gets me into mergers and acquisitions... which is where I wanted to go the whole time. When you conduct an acquisition, as the acquirer, it is often tempting to go for economies of scale and try to get the acquiree to do things your way. This just makes sense. After all, that's why you bought them, right?

Well, kinda.

Unless you bought them to kill them as competitors, they probably bring another value to the table as well. If you buy a poison dart company and then tell them "Now that you're part of GlobalConglomeratedWidgetCoInternational, you have do things our way... and we eat our own dogfood!" you'll definitely merge them into your organization... but if they're eating dogfood, they're not eating ants and you just have a dart company.

When merging operations, pay close attention to the operations of the other company and try to understand why they do things the way they do. There's generally a good one. Then the question would be whether the loss they face by doing things your way is outweighed by the operational efficiencies, and whether it's all that important that the darts be poisoned.

Related posts

• Security lessons from Nature – Fire ants and lizard evolution (0)