Thursday, December 19, 2013

Security Credit

Bottom line up front the way the generals like it.  I take on vulnerability, all the additional threat is against me, and I assume all the risk.  Just to have my job.
Executive summary because the bosses who wear stars on their camouflage at the office like those, too.  There's a bit of utter stupidity to being a government employee.  In my job I am required to hold a government travel card and government passport.  That's right, I am required to increase my attack footprint [pdf] to have my job. 

Extra Credit

The points against the credit card are simple and straightforward enough for even a Treasury Department employee to understand.  Even though this card is For Official Use Only [pdf], the government has no financial risk in this credit card.  Externalities, they call it.  It's open credit on my report, not theirs.
It isn't common, but if the government doesn't settle travel expenses in a timely manner, it hurts my credit.  Just having it as an open account hurts my credit.  And not just the temptation for me to use or misuse the account as that linked article is concerned about.  It is yet another valid account for an attacker to break into and use for fraud.  The card itself, that stupid chit of plastic, is an identity document which can be counterfeit.  Speaking of misuse, done by me or anyone, it hurts my credit not my employer.  If some waiter skims the card I have to dispute the fraud or it's my credit rating that gets destroyed.  And yes, cards can and are misused in that very way even though they are clearly marked, "For Official Government Travel Only."
The entire program is adds vulnerability to me and I am required to assume all of the risk.  I've voiced this to management as an employee and a security professional but the program and the requirement for employment remain unchanged.

Papers, Please

Whether I travel outside the United States or not, frequently or not, I am required to hold an official government passport.  An identity document which can be misplaced or stolen between trips or while traveling.  And, just like with the credit cards, having a valid passport means an attacker can counterfeit a valid identity document for an attack.

Bottom's Up

Bottom line at the bottom the way the generals like it.  The entire pile of externalities, forcing the employee to assume all this additional risk as a condition of employment, should be redirected back to the organization.  

Friday, December 13, 2013

Free Bird

My grocery store was having a sale just before Thanksgiving.  Spend over a hundred dollars and get a free turkey.  I didn't know about the sale when I went in for some routine stuff.  I already had plans for the holiday that didn't involve my own turkey but it was a dozen pounds of ice so I accepted.  Since the bird was frozen I put it into my freezer to keep for after the holiday.
After I got back from holiday travel I took the turkey out to thaw.  If you've ever hosted a Thanksgiving dinner of your own you know that thawing the turkey is a traditional and oft-neglected critical step for many families.  Anyway, after this chemical process of changing phase from ice to meat was completed, the turkey was ready to cook.  I decided not to do another garbage can turkey, though.  This gobbler got grilled.
Grilled Gobbler
Grilling is a simple chemical process to convert meat into delicious through the application of heat.  I use a pretty simple set up with indirect heat in a worthless generic kettle grill best grill ever made.  An indirect heat set-up has the meat in the center over a drip tray with the coals on either side.  I also wanted a mesquite smoked flavor because that's traditional so I made arrangements for that.  There's an accessory for my grill that holds wet wood chips.  The wood for smoking is wet so it smokes instead of burning, of course.  Then close the lid, leave the vents open, and enjoy responsible beverages for a few hours while the turkey cooks.