My Interview with Luiza Nowak of the Polish Oracle Users Group. #AmazingLady

#GrowthMindset #Success #NeverStopLearning

Luiza and I get to discuss her path to success and happiness.

Posted in infosec | Leave a comment

#Blockchain and Supply Chain. Opinion

Over the past forty plus years I have seen people try to take a technology and force it on a business problem. Trust me on this one, if you want to waste money and time, go ahead; however the odds of you solving the business problem are somewhere between slim and none. The case of using blockchain to solve supply chain problems is just not there. The only thing blockchain and supply chain have in common is the word chain.

My professional world is technology and ensuring the security of information systems. Because of this I’m constantly reading and listening to see what is happening in my world and applying that knowledge to help my customers solve their problems. One publication I go to is the World Economic Forum for a broad picture of what’s happening. Most of the time I find their writing good, but this time they seem to have had some marketing intern write about how blockchain will solve the supply chain problem. Actually, what I see here is trying to get an emotional response (it’s hacking the human brain, that’s a subject for another day) to get buy in on a solution in search of a problem.

What is blockchain? Pretty simple, it’s a data structure that is designed that once data is put on the blockchain, it is difficult to change. Notice I said the word difficult and not impossible because you can change data in a blockchain. In Blockchain a primer, I said that a blockchain is immutable; that statement is incorrect and I need to go back and correct it and perhaps rewrite. Once hailed as unhackable, blockchains are now getting hacked. Some blockchains support “smart contracts” and some people say this is a feature. I say it’s a security bug; but I digress. This is not about smart contracts that have proven to be buggy. See the above link from MIT Technology Review.

So, what is blockchain good for? Recording transactions that you don’t want changed. Financial transactions, yea’ we’re doing it. I have also proposed using it in Criminal Justice Information Systems to record everything from the assignment of Judges to logging of evidence and Government Purchasing Systems to record Request For Proposals, Bids, and Awards. In short, blockchain is a good tool if you absolutely do not want the data to be changed. If you need something to fix the supply chain, first define what problem you are trying to solve. Again, forcing a specific technology on a business problem is ass backwards. First, define the problem, then look at the available solutions and select the one that fists best.

Now, if you see how blockchain will solve supply chain problems, I’m all ears and will be happy to listen to you. Until someone comes forward and offers specifics; I’m skeptical.

——-UPDATE 15 May 2020 ——–

I had a chat with a friend on this issue, he gave me one use case where blockchain can be used to track the supply chain. It involves high value goods or combating counterfeit goods. This is because there is a tipping point where the cost of putting something on the blockchain. Say we have coffee beans, are you going to scan each coffee bean? How about one kilo of coffee beans? Now 100,000 kilos of coffee beans? When do you start putting things on the blockchain? How about office chairs as this article mentioned? Does blockchain solve this problem, or do you use a well designed RDBMS system complete with a well built audit trail? By the way, Oracle 20c has native blockchain tables if you really want to go this route.

Posted in infosec | Tagged , , | Leave a comment

Interview with That Jeff Smith.

His path to becoming an Oracle Product Manager. Great story.

Posted in infosec | Leave a comment

Interview with Olesya Zmazneva, PhD. Associate Professor Moscow Polytech. Artist, and Journalist

My interview with an extraordinary lady and one of my favorite people Olesya Zmazneva. We get to chat about soft skills, social media, communications, saints, critical thinking, education, five times why, think like a child and so much more.

Posted in infosec | Leave a comment

Interview with Connor McDonald.

My interview with Connor McDonald, part of the AskTom team, we talk about everything from robotics, the Commodore 64 to the Cloud Perth born and breed, support nice guy. #Growthmindset #KeepLearning #Success

Posted in infosec | Leave a comment

Interview with Steven Feuerstein.

From punch cards to Oracle 19c. Author, Oracle developer advocate, PL/SQL guru and all around nice guy. My interview with Steven Feuerstein. #GrowthMindset #KeepLearning #Success

Posted in infosec | Leave a comment

Interview with Chris Saxon.

#Oracle #Success #Growthmindset #KeepLearning

Sarandipity, don’t accept magic, and keep learning.

Posted in infosec | Leave a comment

interview with Flora Barriele. An incredible young lady who is doing amazing things.

#GrowthMindset #Success #Oracle

Posted in infosec | Leave a comment

My interview with Cary Millsap.

Oracle #Performance #GrowthMindset Smart and all around nice guy.

Posted in infosec | Leave a comment

Interview with Debra Lilley

Interview with Debra Lilley, We get to discuss how she got into IT, advice to university students, and STEM. I’m still having some audio issues, there seems to be an echo in the audio.

#oracle #learn #growthmindset #curious #ACED #STEM

Posted in infosec | Leave a comment

Interview with Milena Gerova with the Bulgarian Oracle Users Group

Milena Gerova and I discuss the growth of the Bulgarian Oracle Users Group / BGOUG /, some of the challenges she’s faced, what she looks for in a team member and other exciting things. Now, us southerners are proud of our Hospitality; Milena and her team demonstrate a level of hospitality I have rarely experienced. She is indeed, one of my favorite people in the world.


#oracle #learn #growthmindset #curious #ACED

Posted in infosec | Tagged , , , | Leave a comment

Interview with #Oracle ACE Director, OCM, and member of the Oak Table Network Kamil Stawiarski

Kamil is passionate about IT, Oracle Databases, and information security. Kamil will be talking about how he got into IT, what challenges he’s facing, and what it takes to succeed. Tune in Friday March 27th at 1430 (GMT-5)

Posted in infosec | Tagged , , , , , , , | Leave a comment

Finland Security Meetup 2020

Tuesday February 4th 2020 there will be a security meetup in Helsinki Finland. I will be there speaking on Secure coding and the impact of emerging technology will have on security.

Julian Dontcheff will be speaking on “The Power of Autonomous Database Security”

Kamil Stawiarski will be doing two hacking sessions.

  • Oracle Hacking Session The live demo, presenting a real-life experience in penetration testing of the consolidated Exadata database environment
  • Oracle Hacking Session – part II. We believe so much in technology, that we stopped believing in people.

Hope to see everyone there, this will be exciting. https://www.ougf.fi/events/security-meetup/

Posted in infosec | Leave a comment

#Oracle Database Application #Security book is finally out. #infosec #encryption #audit #SecureCoding #PrivilegeAnalysis #OID #OAM #OIM

https://www.amazon.com/Oracle-Database-Application-Security-Directory/dp/1484253663/ref=sr_1_1?keywords=oracle+database+lockard&qid=1573050833&sr=8-1

It’s been a year long process now the book is finally been released. There are a few things I would have written different and a few other subjects I would have liked to cover. Perhaps that will come in my next book or future posts.

In this book we cover Secure Coding, setting up Encryption, and audit. We also dive deep into performing privilege analysis.

Posted in Audit, encryption, infosec, PL/SQL, Security, Trusted Path | Tagged , , , , , , , | Leave a comment

Emerging Technology Security Day 2019

Between ongoing data breaches and emerging technologies constantly coming out, you need to ask the question. “Is my information secure?” On October 11th we will be hosting a security day with Oracle Corporation in Reston Virginia.

When: October 11, 2019

Where: 1910 Oracle Way, Reston, VA, 20190

Executive level presentations on: Cybersecurity Challenges, 5G Security, Machine Learning and AI Security, Blockchain, Cloud Security, and Cybersecurity Maturity Model Certification (CMMC)

We will be having executive level and technical discussions on the information security challenges we will be facing from emerging technology. All talks are geared to Executives and Senior Technical Leads.

8:00 – 8:30   – Arrival and Registration

8:30 – 9:00  – Morning snack (pastries), Welcome, and Introductions

9:00 – 11:30  – Executive Sessions
9:00-9:30 Cloud Security
9:30-10:00 Governance and Compliance
10:00-10:30 Data Security
10:30-11:00 Emerging Tech Security
11:00-11:30 5G/Communications Security
11:30-12:30  – Lunch
12:30 to 2:55  – Track Sessions   Track 1:  Cloud Security
12:30-1:15 Multi-Cloud Considerations
1:20-2:05 Cloud Access Security
2:10-2:55 Mitigating Threats (Insider, lateral movement, exfiltration, spoofing, etc)
Track 2:  Data Security
12:30-1:15 Database Application Development Tools Security (SQL Developer)
1:20-2:05 Maximum Security Architecture (MSA) – Data Architecture
2:10-2:55 Data Encryption/Key Management
Track 3:  Governance and Compliance
12:30-1:15 CMMC/IDAM
1:20-2:05 STIG/Patching
2:10-2:55 NIST/FedRAMP
Track 4:  Emerging Technology Security
12:30-1:15 AI/ML, Augmented Reality Security
1:20-2:05 Blockchain Security
2:10-2:55 IOT/Connected Device Security
Track 5:  5G/Communications Security – 12:30 to 2:55
12:30-1:15 5G Security
1:20-2:05 SDWAN Security
2:10-2:55 Session Border Control, Hardware Security

Closing Discussion/Q&A with Experts – 3:00-3:30

Thank you to our Primary Sponsor is Oracle Corporation for helping put on this event.

Register Here.

Posted in AI, blockchain, encryption, infosec, Machine Learning, Security, Trusted Path | Comments Off on Emerging Technology Security Day 2019

“Free cheese is only in the mousetrap” #DataPrivacy #InformationSecurity #DeepFake

#DataPrivacy, #InformationSecurity all require critical thinking. Sadly, there is not a lot of that going around these days. People are purposely sending photos to have them aged without vetting the company they are going to. We are now have #DeepFakes that use AI to blend faces into composite images and video. Just google DeepNude, that uses AI to undress photos of women. The company based in Estonia closed its doors; however, if you check the website, they are now selling their product for someone else to make money off it. I personally don’t care what country data is stored in. I care about the stewardship of the information. I care about the manipulation and misuse of your data

To quote a dear friend of mine. “free cheese is only in the mousetrap.”

Posted in infosec | Leave a comment

On the road again. #QRS19 in Sofia Bulgaria. Secure Database Design

On Monday July 22 I will be speaking at IEEE International Conference on Software Quality, Reliability, and Security. https://qrs19.techconf.org/ This is going to be a two hour tutorial on designing and coding a secure database system.

I see a lot of effort put into network and end point security; however, at the same time many organizations are only giving lip service to database security. You database is the last line of defense of your organizations crown jewels. So come on out, I will help you wrap your head around database #infosec.

Posted in infosec | Leave a comment

Don’t fall for that scam. #crime #FinancialCrime #crook #con

If you get a message like this, don’t call back, hang up the phone. This is a scam. Police will not call you, they’ll knock on your door. Remember, a crooks primary goal is to separate you from your hard earned money.

Posted in infosec | Leave a comment

Secure your insecure information

Make sure your private information is not exposed. Your disk still has all your information even if you delete the data. When you delete information from your disk, what happens is the index pointing to your data is deleted, your data is still on the disk. If you’re like me, you have photos, documents, and emails. I don’t know about you, but I don’t like people reading my private emails to friends, customers, and acquaintances.

Blancco and data recovery company Ontrack performed a study of 159 disk drives purchased on ebay. Ontrack recovered information from 42% of the drives. Now, personally I don’t sell my used equipment; however you might do that. There is an easy and safe way to sell your old devices and not worry about exposing your information to strangers.


I use the free version of CCleaner. (Note: I have not received any compensation for this, it’s just the tool that I use) CCleaner has the ability to securely delete information on the disk and also keep your disk from getting cluttered with junk that windows does not clean up. Personally I run this about once a week.

When you select wipe free space, You’ll get a popup window that will tell you the process will take a long time. So, this is not something you want to run on a regular basis. When I’ve run it in the past, it has taken three days to run on the 1T drive in my laptop.

Once you’ve installed CCleaner, select Options, then under settings select the Secure Delete and in the pulldown select how secure you want your deletion. I use Advanced Overwrite 3 pass, this is pretty secure. This option will overwrite your deleted files three times with random data and if you select wipe free space, it will overwrite your free space three times with random data.


Posted in infosec | Tagged | Leave a comment

May, June, and July – 2019 Crazy busy. :-)

Love my life

This year has been busy, and I don’t see it slowing down anytime soon. Life is good. The my chapters are all finally in for the Database Security book, now it’s time to edit. After reading the audit chapter, I’m not really happy with it. Once I’m done editing it, the version APRESS gets back may not look a lot like v0.1.

This May my travels are going to take me to Kiev Ukraine, Chișinău Moldova, Helsinki Finland, Stockholm Sweden, back to Kiev, and home just in time to celebrate my 59th birthday (am I starting to get old?). I’ll be speaking in Helsinki at the Full Stack Developers Conference on PL/SQL Secure Coding Practices https://fsdc.fi/ then heading over to Stockholm to do a couple talks on Holistic Database Security, Secure Coding Practices, and discuss Privilege Analysis.

June is going to be a bit easier, I’ll be in Bulgaria for BGOUG to talk about Privilege analysis and Leadership; then back to Chișinău and Barcelona to take care of some business.

July, oh, that’s simple, back to Bulgaria again (third trip there this year) where I’ll be speaking at the IEEE International Conference on Software Quality, Reliability, and Security. https://qrs19.techconf.org/track/tutorials The topic, Database Secure Coding and Design.

Posted in infosec | Leave a comment

Heli From Finland – Full Stack Developers Conference

I’m going back to my speaking roots in May. Oracle Users Group Finland gave me my first opportunity to speak on database security many years ago.

This year we’ll see some of my favorite speakers in Helsinki.

First up, Heli From Finland. (she uses that because nobody can pronounce her last name.) Feel free to try at her last name Helskyaho, bet you can’t pronounce it either. Some of the things you may not know about Heli, she was a ballerina, travels more than me, and loves to show people her city Helsinki, is an Oracle ACE Director, and a PhD student. This year, she’ll be speaking on “The Basics of Machine Learning.”

To register for the Full Stack Developers Conference, follow the bouncing link. 🙂
https://fsdc.fi/

Posted in infosec | Leave a comment

Spring Conference Season. What’s coming.

This is my favorite time of the year. The weather is starting to get warm, the sun is shining, and my passport is in my pocket.


Olesya Zmazneva, Ph.D

We are in for a special treat. I had the pleasure to meet Olesya when I spoke to students at Moscow Polytechnic University last November. She’s one of those people you meet and immediately know she has her act together. Olesya’s super power is art, creativity, and the art of communication (check out her Instagram page @lezka) An associate professor at Moscow Polytechnic University for 20 years, she is responsible for soft skills. (If you’ve spent any amount of time in this industry, you know some people what could use some soft skills training.)

Olesya will be giving two presentations at BGOUG this June.
“Creative Thinking in Digital Cosmopolitans’ world” and ” Communication  Trends in Global Village: way to utopia or skepticism.” Part of her abstract for “Creative Thinking” says, “Think as…”strategy” (Think as a child, Think as a minimalist, Think metaphor, Think visually,”) I’m chomping at the bit to hear what she has to say. We are living in a time when things are changing fast; her message is vital to staying ahead of the curve. Can you tell, I’m excited about having the opportunity to listen to her? You should be too. Sign up for the BGOUG Spring Conference to have the opportunity to meet and listen to some of the top speakers in the world. (I have it on good authority that even Martin Widlake will be there) http://website.bgoug.online/en/events/details/103.html

Next week, April 4 – 5, I’ll be in Dublin Ireland for OUG Ireland 2019 https://ukoug.org/page/ougIreland2019 where I’ll be speaking on Holistic database security, and secure coding, followed by heading to Belgrade Serbia, and Sofia Bulgaria to give my talk on staying ahead in an ever changing IT environment. Sounds kinda anticlimactic compared to Olesya 🙂

Posted in infosec | Leave a comment

Don’t be a victim. #FinancialCrimes

I learned this morning a dear friends elderly relatives received a number of calls from someone claiming to be from their bank. I won’t go into all the issues; however there are some things everyone should be aware of. BTW: This not only applies to banks, this applies to any call you receive (Bank, IRS, Police, Insurance Company). There are a lot of criminals out there, please, don’t be a victim. For those who don’t know me, I spent twelve years at Financial Crimes Enforcement Network (FinCEN) I know a bit about this.

  1. Remember the criminals top priority is to steal from you.
  2. Your bank will never call you and ask for personal information. Sometimes this is hidden with, “we must verify your identity.” Bottom line, your bank will not do this. This is a trick to steal from you.
  3. It is very easy to spoof a phone number. Do not trust the phone number that is displayed.
  4. If you receive a call from someone claiming to be from your bank, get their Name, Phone number, and department. Then call the bank at a phone number you know is good and ask to be connected.
  5. If the bank can’t find that person, ask to speak with the fraud department. They can investigate.
  6. These call will try to create a sense of urgency, that you must talk to them now. Do not fall for it. This is just another trick criminals use to steal from you.
  7. Last piece of advice, Hang up the phone and block the number.
Posted in infosec | Leave a comment

Scams and criminals #infosec

This morning I learned of a young friend who was scammed out of some money online. Things like this always make me angry and I did not think I would ever have to post something like this because we all know these things right? Well no, some people have not been exposed to criminals and are trusting souls. This is for you gentle souls out there; and hope you don’t have to become callous and paranoid like me.

I spent about twelve years working in Financial Crimes (FinCEN), combined with being the Information Security Guy; you listen to me, this is something I know a great deal about.

Rule #1: I live by simple rules. Simple rules have kept me alive for almost 59 years; simple rules work.

Rule #2: When it comes to dealing with anything that has to do with money and the internet – be paranoid, be very paranoid. I always assume the person on the other end is a criminal, because there is a very high probability the person is a criminal.

Rule #3: If someone is offering to pay you money, they will not ask for any kind of payment from you. If you are asked for a payment, even a tiny amount this is a scam. You are dealing with a criminal who wants to steal from you.

Rule #4: If someone is offering you something of value for a service, opinion, survey, etc, they will not ask for any kind of payment from you. If you are asked for a payment, even a tiny amount, this is a scam. You are dealing with a criminal who wants to steal from you.

Rule #5: If you believe someone is a public figure and they are asking you for money or anything of value, it is a scam. You are dealing with a criminal who wants to steal from you.

Posted in infosec | Leave a comment