I've Got Brain Ache

I'm very busy on the work front at the moment, both in my day job and with the internet business.

In my day job I'm involved in a major, very complex, government PKI project. PKI stands for Public Key Infrastructure and is basically a set of systems that can be used for issuing and signing digital certificates that can be used for encryption, authentication and other security type things. The thing about PKI is it's all about trust. If you're going to use a digital certificate to encrypt your communications, or use it for authentication (such as to gain access to a website, or even to a building by putting the certificate on a building access card) both you, and the owner of the systems, need to have confidence that the certificate hasn't been compromised in any way.

What this means is that every aspect of how the certificate is created, issued, renewed, revoked, used, and stored has to be managed in a way that covers all the potential security risks.

My job is to create a framework of rules around the entire PKI, covering everything from the physical security of the buildings and servers which will host the PKI, the security procedures for the operation of the PKI, the HR procedures to ensure the people operating the PKI can be trusted, to the technical security controls of the particular systems.

The framework has to be specific enough so it covers all the risks, but generic enough so that the PKI can be future-proof and used for multiple different purposes.

I've also got to write the audit procedures so that they can get an outside auditor to come in and carry out annual audits of every Certificate Authority that wants to operate under the PKI (of which there may be many covering multiple government agencies) in accordance with the procedures I've written.

To say it's making my head hurt is an understatement. There's particular international standards that I need to make sure it complies with, as well as fitting in with government standards around authentication and identity management.

My little brain is struggling to cope!

As for our internet business. IPChitChat is doing pretty well. We've had some good feedback on the new site, and most importantly, revenue was up for last month considerably from Sept 2007. We're still some way from making a full-time living out of it but it's growing, slowly but surely.

We've also launched EzeeQuit, which is more of an experiment than anything else. Probably won't be a long term venture but it demonstrated we can now react to new opportunities and get an e-commerce site up relatively quickly.

We've also changed the name of our company. We originally registered the company as Autonomy Business Solutions Ltd when we had the idea of creating an IT Managed Service for medium to small businesses. Our business model has changed considerably since then and we're now concentrating on building internet-based brands.

We're really interested in the whole new phenomenon of cloud computing, the whole idea of applications moving away from the desktop to being purely web-based. With that in mind we've now changed our business name to NetCloud Ltd, which we believe better reflects the ethos of the business. We couldn't get netcloud.co.uk so our domain name for NetCloud Ltd is www.netcloudgroup.co.uk. This is ok as NetCloud will effectively be a group of companies under the netcloud banner. There's not much on that website yet but it will grow as our underlying businesses grow.



So our existing websites are keeping us busy, there's day-to-day management of the site, marketing and development of more features, as well as troubleshooting the odd issue that comes up here and there. I'm currently putting together the next newsletter for IPChitChat which you can sign up for on our site.

And of course there's the development of our next sites. The social networking site I've mentioned previously has been completed (to some degree) by the developers we hired in India, and I'm now working on developing features and content. Not sure when we'll get this one off the ground as it's a major project but it's certainly an exciting prospect.

We also have a couple more ideas for e-commerce sites that we're investigating.

All in all life is busy on all fronts.

Home for a Short Weekend

I'm currently sat in the departure lounge at Canberra airport with a 3 hour wait for my flight. Luckily I'm sat at a table that's near a bar, and also has a power socket I can use, so the combination of my laptop and Crown Lager should see me through. It feels weird travelling home on a Saturday though. There won't be much of a weekend left when I get home.

I'm glad I stuck around for today's exercise as it was really enjoyable. The hacking exercise was a lot harder than I expected. The goal was to capture 4 flags. These were basically text files called flag1.txt, flag2.txt etc that were stored on the each of 4 servers on the target network. Each of the flags had a 'phrase that pays' and the end goal was to get the full phrase that pays and be the first person to whisper it into the ear of the instructor. Two of the servers were Windows servers and two were Linux. I was fairly confident I'd be able to handle the Windows Servers (I did used to be a Microsoft Enginner after all) but it was the Linux Server that worried me. My Linux skills are quite rudimentary and there were some really experienced techies in the class who I new I had no chance of beating. Suffice to say I didn't win the competition. Nor did I manage to get all the flags in the alloted time. I did manage to get 3 out of the 4 though.

The Windows servers turned out be fairly easy to exploit. The first one that I managed to connect to had the old null sessions vulnerability so I was able to connect to it using an anonymous account. Once I had a netbios session I was able to enumerate the accounts and grab a copy of the SAM password list. I then used a password cracker to crack an account that had admin privilages and then simply mapped a drive to it. Easy peasy.

The other servers weren't that easy. One of the servers had some firewall or routing restrictions so it was only accessible from one of the other servers. So I had to compromise one server and then use that has a launching pad to compromise the other server. To make things trickier still, it turned out that one of the flags.txt files was hidden. There's a thing called NTFS Alternate Data Streams on Windows where it's possibly to hide a file in the data stream of another file or directory. So when you browse the file directory it's completely hidden. You can't even use file comparisons to detect the hidden file has it doesn't affect the file size or checksum of the file that it's attached to. After a few hints I did manage to find it using a tool that discovers these hidden data streams, and also found a few other hacking tools hidden within the same directory that I could use to compromise one of the other servers.

One of the other servers had a buffer overflow vulnerability so I used Metasploit to exploit that server and get a command shell.

That's about as far as I got. 3 out of 4 isn't bad but I didn't get the full phrase. After the instructor explained how to do it I realised I could have been at it for days. One of the exploits was ridiculously hard. It involved carrying out a cross-site scripting attack (XSS), but it wasn't as simply as launching the attack from my PC against the server. No, it involved compromising one server, generating traffic from that server to another server, and then sniffing the traffic off the network to grab the session cookies and then using the session cookies as part of the attack. That would have took me days to figure out!

Anyway, the day was very geeky but thorougly enjoyable and challenging. The 6 days course has been great but no one can really come out of a 6 day course and become a professional hacker or penetration tester. We've covered dozens of hacking tools in the 6 days so of course there's a limit to the depth that you can go into for each tool given the alloted time. Now I have the fundamentals I'll need to dig into the tools and techniques in detail and keep practicing to hone my skills. Luckily these days with VMWare I can easily do that by simulating an whole network on my laptop. All week I was running Windows XP and Red Hat Linux in virtual machines as guest operating systems whilst still using my Mac OSX Leoopard operating system as the host, and didn't have any problems - basically running 3 different PC's on my one mac.

One of the things that I'll take away from this course is that it doesn't take the latest and greatest malware (viruses, etc) to compromise a system. Some of the best hackers simply use the in-built administration tools already resident on the systems. That way there's little danger of triggering off the anti-virus software or intrusion prevention software. For instance, the WMIC (Windows Management Instrumentation Command-Line) tool resident in all modern versions of Windows is a fantastic legitimate windows scripting tool that can be manipulated to do all sorts of nasty stuff.

Anyway, hopefully I'll be able to put some of these new skills into practice on some real clients some time soon.

Hacking in Canberra

This week I've made my first visit to our nation's capital - Canberra - for a 6-day course in Hacker Techniques, Exploits and Incident Handling.

Canberra is a strange little city. It seems to me to be a cross-between Washington and Milton Keynes, in that it's clearly a Government town; the Federal government being the largest employer in this capital city which has only a population of 300,000. Yet like Milton Keynes, Canberra has an artificial feel to it. You can see the planning and design - it's not a city that has grown organically like most others. It's even got some of the same 60's carbuncles as Milton Keynes!

I've come to Canberra completely ill-prepared for the freezing temperatures. It's about 13 degrees C in the day but it drops down to zero at night. I new what the temperatures would be before I arrived and I thought I'd be ok, after all I am from the UK! However, I didn't realise how much I've acclimatised to the Queensland weather over the past year. 13 degrees C feels to me like -5 did in the UK! All I've brought is a thin jacket and some jeans and t-shirts. I didn't even pack a jumper.

Because it's so cold, tonight has been the first evening that I've dared to venture out. I had a gander around the city centre (which isn't much bigger than Doncaster town centre) and then went to the flicks to watch Hancock. I had planned to see the Indiana Jones film but the timing didn't work out very well, so then it was a toss-up between Hancock and Sex and the City. No contest - I couldn't bear the thought of sitting through 2 hours of self-obsessed women talking about shoes and Prada handbags.

I was pleasantly surprised with Hancock. I thought it was just going to be just another dumb superhero movie but it was actually really good. Of course the action scenes and special effects were good, that's a given, but this added in a really funny script, as well as some character development and a few twists and turns to boot. Definitely one I'd recommend for 90 minutes of pure escapism. I plan on seeing Indian Jones tomorrow night, If I can be brave enough to go out into the cold again. I'm not expecting anything great from Indian Jones and the blah blah whatever-it-is as most of the reviews I've read have been pretty damning. I'll try and keep an open mind.

Being holed up in the National Convention Centre each days means I haven't had chance to take in any of the sights of Canberra. All the things I'd like to see are only open during the day. I'll probably come back here sometime in the future with Rach & Lauren. In particular I'd love to take a tour of Parliament House and the National Museum of Australia.

As for the course, i've really enjoyed it. Over the past few months I've been quite dissolusioned with my career and frankly have been getting bored to death of doing security compliance work. This course has re-awakened the geek inside me and allowed me to get back to my technical roots. Learning the technicalities of how to break into systems is much more fun that just learning how to defend them!

As much as the content of the course has been really good and up-to-date, the best bit about the course so far has been having access to the knowledge and experience of our tutor - Bryce Galbraith. Bryce is very much an expert in this industry and is a contributing author to the bestselling book 'Hacking Exposed: Network Security Secrets & Solutions'. He has worked with a ton of Fortune 500 companies and has also worked on Foundstone's world renowned Attack and Penetration team.

Of course I had a decent knowledge of hacking before I came on this course (you're not much of a security consultant if you don't know how the bad guys exploit the vulnerabilities you're telling companies to fix), but this course has significantly enhanced my knowledge and brought it up to date with the latest exploits and attack vectors. I'm looking forward to Saturday when we get to put all we've learnt into practice with a live 'capture the flag' exercise - where we all compete to hack into a system.

I tell you, there's some scary stuff happening out there and there's a good reason to be paranoid about your computer security. A lot of the myths around security have been dispelled this week. Do you think I can't get around your personal firewall? Think again! Do you think I can't sniff your traffic on a switched network? Think again! You think your wireless network is secure because you've enabled WPA2 instead of WEP? Think again!

It's a shame this damn code of ethics prevents me from using my knowledge for evil. I could be rich in no time!

PCI QSA

This week I've been in Sydney on a training course to become a Qualified Security Assessor (QSA) for the Payment Cards Industry Data Security Standard (PCI-DSS).

The PCI-DSS is a standard jointly devised by VISA, Mastercard, American Express, JCB and Discover that details the security controls that must be in place to protect credit card data from electronic or paper theft. Any company that processes, stores or transmits credit card data is now obliged to be compliant with PCI-DSS, and any company that isn't compliant are at risk of losing their merchant status (ability to accept credit cards) and suffering a fine. As you can imagine, losing merchant status would mean end of business for many companies so this is a very big thing.

As a QSA I will be carrying out audits of the larger merchants and providing a Report on Compliance (ROC) to their aquiring bank to testify whether or not they comply. This is something I have to take very seriously because if I report that a company is compliant and then they get hacked, any fine incurred by the merchant could be passed on to my company if it can be proven that my report was innaccurate. So any company that choses me as their QSA should not expect to get an easy ride!

Only the larger merchants have to be audited by a QSA; smaller merchants can submit a completed Self-Assessment Questionnaire (SAQ) to their bank. However, if the bank is unhappy with the answers in the SAQ they will tell the merchant that they are non-compliant, as many merchants are now discovering.

It's not just merchants that I'll be able to audit either. The banks themselves, classed as Service Providers, and other companies that process payments up the chain from the merchants could also be subject to my microscope.

The requirements of PCI-DSS are quite stringent and for smaller merchants can be highly complex. In the last couple of years I've been helping companies implement compliance programs to meet the requirements of PCI-DSS and accurately complete their SAQ. Becoming a QSA takes me to the next level and authorises me to audit companies on behalf of the Payment Card Industry Security Standards Council. Although I'm a QSA I only retain my status as a QSA whilst working for a QSA Company (QSAC). Vica-versa the company I'm working for will only retain their QSAC status whilst it has QSA's in its employment, which at the moment is me and one other.

I'm not quite there yet, I've sat the course and met all the other requirements, and yesterday I sat the exam, from which I'll get the results in the next 2 weeks. I'm also waiting for my police checks to come back. I'm not expecting any problems (I'll have some explaining to do to my company if I've failed either of them!).

The course itself was quite interesting. I was already familiar with a lot of it as I've been working with the standard for the last 2 years but it did help clarify a lot of questions I had over the grey areas in the standard. I also learnt a few cool tricks such as how to find credit card numbers and a formula that can be applied to discover whether or not a number that you're looking at is in fact a valid credit card number or not. Quite a nice party trick (for a very geeky party!).

I'm on a 6-day hacking course in Canberra next week so that knowledge combined with my PCI knowledge should make me a valuable resource for the Russian Mafia. Just kidding!

AusCERT 2008

On Wednesday I attended AusCERT 2008. AusCERT is an annual conference for the IT Security industry organised by the Australian Computer Emergency Response Team. Held at the plush surroundings of the Crown Plaza Royal Pines Resort on the Gold Coast, the event is a chance for vendors such as Check Point, Microsoft, Symantec, CA, and the likes to show off their wares, and also a chance to hear presentations from industry leaders, as well as get some free training to boot (although it's not free). Representatives from such luminaries as the US Department of Homeland Security and NSA were also in attendance.

The event is similar to an annual event I used to attend in the UK - InfoSecurity Europe - which is held at the London Olympia. Although AusCERT is not nearly the size of InfoSecurity Europe.

I was pretty disappointed by AusCERT 2008. I thought I might have made a bad choice with the presentations I attended but after speaking to others the general consensus was that it was pretty crappy all round. There were a couple of gems in their but mostly it was presenters telling me stuff I already new. A lot of the presentations were too high-level to be of any value.

Every year you find that there's a new theme - a new subject which is getting the industry in a flap. This year it was web 2.0 security. This is not surprising really with the amount of stories you hear about privacy issues around Facebook, MySpace and other similar social networks that are able to harvest vast amounts of personal data. I advise everyone to be very careful about what information they put on social networks. Even if you set up your privacy settings properly it doesn't necessarily mean that your data is safe.

A combination of factors means that your data could still be at risk. The look and feel of Facebook is slick because it uses AJAX - a web scripting language for which hackers keep finding new vulnerabilities. Also, many of the applications that you may add to your Facebook, such as FunWall, aren't built by Facebook, they are built by third parties. Meaning that these third party applications, that Facebook has little control over, is also accessing your private data and could be doing anything with it, as this BBC article explains.

The one presentation that I did find interesting was presented by the Standard Chartered Bank and was an overview of their project to roll-out two-factor authentication for their customers across 15 countries. I know many banks have been trailing this for a while now but not many banks have actually implemented it due to the cost and administration issues around issuing and managing tokens. However, this is set to change as they slowly get over the issues; and as the take-up of internet banking continues to increase, so does the risk of internet fraud.

So if you use internet banking you're probably likely to find that the way you log-on is set to change in the next couple of years.

Two-factor authentication means that when you use internet banking, instead of just presenting your username and password, and maybe some secondary information like the 1st and 4th character in your PIN (this is all classed as one-factor authentication - something you know), you will also require a second factor of authentication, such as something you have, or less commonly, something you are (biometric identification such as fingerprint, face scan, retina scan, etc). The most common implementation of two-factor authentication is using a token that creates a One-Time-Password. The bank would issue you a token which displays a randomly generated number, This number is usually either generated when you press a button, or it's a number that constantly changes every 60 seconds or so. By entering the number displayed on the LED screen on your token, you're proving that the person authenticating to internet banking is the person that was issued the token, i.e. you, or so the theory goes. Obviously it's not fool-proof, but it does add another level of security to the process.

Many companies use two-factor authentication for employee remote access to their networks. One of the big issues with token-based two-factor authentication is the cost of the tokens and the management of them. This is particularly a problem when you're using it in a business to customer (B2C) environment like a bank, when you may have to issues tokens to 1 or 2 million customers.

To get around this, another option is to use the customer's mobile phone as the 'something you have' device. So for instance, when entering internet banking a text message could be sent to your mobile phone with a random number that you would enter into the internet banking login screen. Alternatively, there's a thing called IVR callback, which basically means that you would receive an automated phone call from your bank which would say something like 'Someone is attempting to log on to your internet banking account, if this is you, press 1'.

None of these methods are fool-proof - they all have an element of risk. For instance, when it comes to using mobile phones for two-factor authentication you're then relying on a third party - the telecommunications provider - as part of the process.

Anyway, the findings from their surveys were quite interesting, as was the story the presenter told about banking fraud in Malaysia.

Some of the other presentations were dire though.

One presenter, who was doing a presentation about the security risk management lifecycle, I swear must have based her presentation skills on David Brent in The Office. At one point, to the amazement of all of us, she actually picked up a bag full of some stupid plastic keys that they were handing out to everyone with their branding on it, and dramatically threw them across the stage. As they scattered everywhere across the stage she shouted 'You see people, how on earth can you get a grip of your network if you're having to manage that many applications' or something like that. I was gobsmacked and had to stop myself from laughing out loud. What did she think she was proving by that display? Didn't she feel a bit stupid that she now had to go and pick all of those keys up?

The good points about the day was 1) we got served a really nice meal at lunch time, and 2) I came home with some freebies, although one of these was a Microsoft t-shirt which has the words 'Microsoft: Our Security Rocks' printed on it, which I thought was a bit ironic given the awful reputation of Microsoft's security.

All Work and No Play

The last few weeks have been work, work, work unfortunately, hence the lack of blog posts. However, there's light at the end of the tunnel - this weekend sees the arrival of my parents for their first visit to Oz, and I've made sure to arrange plenty of leave so I can get back into holiday mode again. In fact, we're all off up to Palm Cove in Far Northern Queensland to spend a week on the Great Barrier Reef. Before that though, I've got to make yet another trip to Sydney. The bummer about this Sydney trip is that I've got to go on the day my parents arrive. They arrive Sunday morning and I fly to Sydney on Sunday evening, coming back Thursday.

The reason I've been so busy is due to a combination of factors that have coincided. On the work front we had a major turnover in staff, leaving me as the only member of the Security Compliance team. So as well as having to juggle existing client work I was the only one available to take on new client work. It didn't help that my main existing client work has been at a critical point in the assignment meaning they needed a lot of attention.

Adding to that, the first of the two website that I'm having developed in India, which I previously wrote about here, has finally been handed over to me, which means it's now all on me to get the site ready for go-live. Due to a number of factors, of which I'm not going to go into now but suffice to say things didn't go exactly to plan with the web development company we used (that's an whole other blog post), there's still a lot of work to be done before the site can be launched. The current plan is that go-live will be sometime in June/July and I'm doing all I can to meet these dates, if not sooner.

Thank god I managed to wangle a 4-day work week. They're sure getting their money's worth out of me during the 4-days. With all the work they've put on to me it means I've been having to work during the evenings to keep on top of it - time I would have otherwise spent on the business. At least I've managed to draw a line and not let it run into my weekend time. That 3-day weekend is sacrosanct and has meant I've managed to make some good progress on the website - mainly reverse engineering what the dodgy web developers have done so I can improve it.

It's a slow process but I'm getting there. This time next year we'll be mill... we'll maybe the year after!

Office Move

We moved into new offices today at work. The company I'm working for as outgrown our previous office so had to look for new premises. The problem is, because of a rise in rental prices the company could no longer afford the lovely CBD (Central Business District) location for the office capacity that we now need. So we're now moved to Fortitude Valley.

I now have to get the train to Brunswick St station for work. The train service is pretty good, it's not overcrowded (I was able to get a seat easy enough this morning), and the commute time is roughly the same time as before. The problem is, Fortitude Valley is not one of the nicest places. When I leave Brunswick St Station to walk to the office I now pass sex shops, peep shows, strip clubs, druggies and drunken aboriginals sitting on the street corner yelling abuse at everyone who passes. There's a lingering stench of marijuana on the streets and you get the sense that you could be mugged at any moment. I'm sure I'll get used to it. At night I've been told Fortitude Valley (or The Valley as it's known to locals) is one of the best places in the city for nightlife, which isn't much of a consolation.

I've just been out for lunch to explore the area. I was nice and settled at our previous location but now I need to find new places to eat / withdraw cash / get my haircut / etc.

That's the moan over with. On the positive side the actual offices are much nicer with lots more space than we had previously. Plus my desk is positioned quite well so that I can at least have some privacy now.

As work goes I've just passed a major hurdle. The first Australian client that I'm taking through ISO 27001 certification has breezed through the stage 1 audit. So everyone is pleased with the work I did. I've been in Sydney every week for the past month but I've got a break now - I don't need to go back until the 18th March, in preparation for the Stage 2 audit which will hopefully result in a certificate. The break from traveling is greatly appreciated.

Blogging from Sydney

I'm currently in Sydney for a couple of days meeting with a client - my first business trip of what I'm told will be many for my new employer.

I flew up yesterday afternoon with a colleague who I'm taking over from on this particular client project as he's leaving next week. We're staying in the Bayview Boulevard in the Woolloomooloo area of Sydney. The hotel is actually pretty good - it's recently been refurbished so everything is shiny and new, and I've got a partial view of the Sydney Harbour Bridge from my room, as the photo below shows (taken with my camera phone).


Last night we went for a walk about and stopped off for a meal at a really nice side-street Italian Trattoria. I had Black mussels as an entree and a home-made fettuccine concoction for main. Finally had a decent Italian in Australia!

After the meal we went to a pub and caught the last 30 minutes of the Sydney FC v LA Galaxy game. David Beckham had managed to draw 80,000 to the Sydney Olympic stadium - unheard of for a 'soccer' match in Australia. They even showed the match live on Channel 10 (one of the main channels in Oz). Beckham pleased the fans scoring with one of his trademark free-kicks, although his side lost 5-3 in the end. I couldn't believe all the plaudits by the commentators after the game, and then on TV this morning. Beckham mania is still alive and strong, at least in Sydney anyway.

Mike, my colleague, has recommended a nice steak restaurant this evening so we'll be going there shortly. Don't you just love company expenses!

My First Day

Today was my first day in a new job - what will hopefully be my last working for someone else.

The role and work I've been given is much more like what I'm familiar with - security compliance. The first project I've been given is to help a client - a subsidiary of a well-known Japanese car manufacturer - achieve compliance with Japan's Financial Instruments and Exchange Law, which is Japan's equivalent of the US Sarbanes-Oxley Act (SOX).

The Sarbanes-Oxley Act was brought in after the well-publicised financial reporting scandals involving the likes of Enron and WorldCom. The aim of the Act being to strengthen requirements regarding corporate governance and internal control. Amongst other things this means that companies listed on the US stock exchange must be able to demonstrate strong internal controls that can prevent and detect fraud. The Japanese equivalent, nicknamed J-SOX, was also established after scandals involving listed companies in Japan and has similar requirements.

My job is to help the client address the high-priority security weaknesses that have been identified and establish controls for these before March 2008 - when J-SOX comes into effect. What this means in practice is that I'll be carrying out interviews with different areas of their business to understand exactly what security controls are in place now and provide recommendations on additional controls. My company is then hoping that the client will ask me to help them with implementation - which will mean writing security policies and procedures, giving them guidance on securing their IT systems, as well as helping them implement new security systems where required such as Intrusion Prevention technology - the aim being to try and cross-sell as many of our companies' services and solutions as possible.

It's not the most exciting job in the world but it pays the bills.

My 4-Day Week is Starting This Week

The project I'm working on is running out of money so they've asked me if I'd mind only doing 4 days a week for the remaining two weeks. Too right I don't mind!

So I'm already half-way through the working week. Well kind of, I'll be working on my business on Fridays but I don't count that as work because I'm doing that for me not someone else. Plus, no doubt some of the Friday work will be spent sat out on my balcony with a beer, or maybe in the swimming pool. I wonder if you can get waterproof laptops?...

Another Step Closer Towards My Goal

I've been offered a new job and I've accepted. What's more, I've got them to agree to a 4-day week!

The project I'm working on for my day job is due to hand over to Operations in November, meaning my involvement would end at that point. Last week my employer called me in for a chat to discuss the future. Their Security Compliance arm of the business is really taking off and they need to strengthen the team to cope with the growing volume of work. They asked me if I'd consider joining their Compliance consultancy on a permanent basis.

I'm contracting at the moment and since becoming an IT Contractor I vowed I would never go back to being a 'permie'. However, circumstances have changed. Here's my thinking:

1. IT Contracting is not a lucrative proposition in Australia like it is in the UK. For a start, the rates mean I only get paid roughly the same as a permie, and secondly the legal and tax situation is different meaning I can't get the same financial benefits working under my own company like I did in the UK. Basically, contracting here is just like being a casual employee.
2. Christmas is not too far away and the company I work for shuts down for two weeks over xmas. As a contractor I don't get paid for holidays and sickness. Even if they found me another project straight away, if I stayed with them on a contract basis I would have to take 2 weeks unpaid leave over xmas. Signing on as a permie I get two weeks paid leave!
3. Everyone keeps telling me that their is a skills shortage in Brisbane but whenever I look on the job sites a) I'm not seeing much contract work, and b) most of the work seems to to be on the network/firewall side of things, similar to the project I'm assigned to now, which doesn't really interest me and is not my core expertise.

With all that in mind, I decided my best option would be to try and find a way to guarantee a decent income for the foreseeable future, but also reduce my hours doing a 'proper job' so I could devote more time to my Internet projects.

So, when they called me in for a chat I made it clear that I would consider going permie only if I could reduce my hours to four days a week.

Yesterday they made me an offer. They met my salary expectations and they've agreed to the four-day week. I love it when a plan comes together!

I cut over to permie at the beginning of November.

How not to run a business

Two examples, in my view, of business stupidity:

1) The project I'm engaged on at work now has, get this, 5 project managers. There is:

• 1 x Principle Project Manager
• 1 x Project Manager
• 1 x Project Manager - Quality Control
• 1 x Project Manager - Risk, Issues and Finance
• 1 x Project Manager (representing the consultancy I'm working for)

Therefore the main project team is comprised of 5 project managers plus 2 technical consultants - me and Ken, and I'm really only there so that there's cover for Ken when he goes on holiday next month. The phrase 'too many chiefs..' comes to mind. So that's 5 project managers, each of which love to have separate meetings and need constant status updates, all of which takes time away from myself and Ken actually working on delivery of the technical solution which is the reason for the project. Crazy!

2) Tomorrow, I'm taking Rachelle to the airport to catch a 6:30am flight to Sydney for a meeting. She's not actually going into Sydney itself. The meeting is being held in the Quantus lounge in Sydney airport, after which she's flying straight back again. So her company is flying the branch managers from each corner of Australia to Sydney for a meeting and then flying them straight back again. Have they not heard of tele-conferencing!

TGIF

The weekend is here!

I can't believe I've just completed my first full week of work in Oz and I've done absolutely nothing! The client I'm working for still hasn't sorted me out a PC or account to access the systems. Nor do I have a swipe card yet to get physical access to the building. I have to tailgate in every day, which doesn't say much for their physical security, or their security awareness training for employees as I haven't been challenged once yet.

The building is pretty nice though:


No one seems to mind that they're paying me to do nothing. They even keep apologising. I've been bored to tears to be honest. Hopefully things will be better next week.

I scared myself today. I caught myself saying yip instead of yes, just like the aussies. I was determined that I wouldn't pick up the accent but I guess it's inevitable when everyone around you speaks differently. I've already had to adjust some of the terminology I use at work. For instance here they pronounce the word Router like the Americans do, i.e rowter - row as in 'they're having a row'. There's a good reason for it though. Root and rooting, as we poms pronounce route and routing, means something very rude over here. Dealing with network security every day I obviously have to say router a lot and I cringe every time I say rowter, it just doesn't sound right to me. Like the yanks they also say darta instead of data.

I dread to think what we'll sound like in 5 years time from now. One guy I work with has spent half his life in South Africa and the other half in New Zealand before coming to Brisbane. His accent is well screwed up. He keeps talking to me about an application and because of his accent I can't tell whether the application is called Dennis or Dynis.

I luckily got to spend this afternoon at my employer's office, rather than the client's office where I'm based full time. It was much better. They've got a small team of about 20 working their in a cosy office. Everyone has a laugh and come 4pm they opened up the fridge and started passing around the beers in the office. It's so nice not having to drive home from work anymore!

PC Support, how may I help you?

I must remember next time I move into a new house not to tell anyone that I work in IT. When someone asks me what I do I'll have to say Business Analyst or something - nobody knows what they do!

Already I've had knocks on the door from 2 different neighbours to help them out with their PC.
Our next door neighbour has just bought a new laptop installed with Windows Vista, and while he was running through setup he somehow managed to set the system language to French. While my French is not that great I at least was able to guess the translation for Control Panel and go in and change the System Locale settings. I changed everything to English (Australian) and rebooted but it still came back up in French. I messed around with different settings and the best I could do was get some of the applications to come up in English, but still Windows itself came up in French. Thinking the procedure might be different for Vista than it is for XP I went on the Microsoft Technet pages and followed their instructions to the letter but still it didn't work. It must be a bug in Vista I reckon. There's always problems when Microsoft release their latest and greatest OS. My advice is to wait until the first Service Pack before you even touch it!

The other problem I had to deal with was for a neighbour who had just bought a 3G USB modem so he could get online. Everytime he plugged the modem in to any USB port his computer blue screened. Again, I didn't have much luck with this (I must be losing my touch). It was obvious something was causing a conflict somewhere. I disabled the usual suspects (firewall, A/V, etc) but it didn't make much difference.

A few years ago I might have spent hours trying to figure both these problems out, as I hate being beaten. These days though I think sod it, if I can't sort it within an hour that's what technical support lines are for!

I may be a Microsoft Certified Systems Engineer but that's on Windows NT4. Things have moved on a bit since then. You tell people you work in IT and they immediately think you're a PC whiz. Yet it's been years since I've had to fix a PC for a living.

If you want to know how to secure a PC I'm your man. Be warned though, I'll have to charge my standard consultancy rate!

Work and play

Lauren visited The Gabba today while some of us had to work. The Gabba is Brisbane's cricket ground and home to the Brisbane Lions AFL (Aussie Rules) team. We're into the school Winter Holidays now and as we're both working we've had to put Lauren into Vacation Care with her school. It costs money but they've got a really good schedule of activities on. It seems every day they're doing something different and fun.

I can't say I had much fun at work today. As per usual when I join a company, they haven't got my account set up on the network yet so I haven't got access to the systems to actually do anything. So I've spent all Friday and Monday reading through technical documentation. My head is buzzing! I was bored to tears today - it's not exactly like reading the DaVinci Code!

I've been promised it will improve tomorrow and I'll actually be able to get stuck into some work. I'm not holding my breath that my accounts will be ready but I should at least be able to take some tasks and get some meetings going with the client to move things forward.

The project I'm working on is a Secure External Access project. I've had plenty of experience with this type of thing before but it's a little more complicated this time as it involves 3 different companies sharing a common infrastructure. So I need to create and implement security policies so that 3 different companies can allow their users to access the network externally over the Internet into the shared infrastructure, but it needs to be completely segregated so users from company A cannot access systems at company B. What makes it complicated is that there's lots of different components involved and for each component the 3 companies have slightly different requirements and different security models.

What makes it even more complicated, for me, is that I'm not just helping design the solution and advising on security as I have done in the past, I also need to physically install and configure the different components, and understand how everything works in case there are any problems and I have to provide technical support.

It's 8:30pm now and I'm ready for bed if I'm honest. I'm not used to these early starts. This morning was the first morning when we had the hassle of Rach starting at 6:30 so we all had to be up at stupid o'clock. Oh how I miss being able to work from home.

Lucky Me

People often tell me that I'm lucky. I'm starting to believe it may be true. Things just kind of work out for me. I have a completely laid back attitude to life - I very rarely get stressed or worry about things. I take the odd risk now and again and it near enough always works out well.

Take this emigrating lark for instance. After selling our house and paying off our large mortgage we didn't actually come here with much money at all. We had no jobs lined up and no assets to speak of. We new that without some income it wouldn't be long before we'd start to find ourselves in dire straits. Yet within just 4 weeks we both now have good jobs, we quickly moved into a nice rental in a nice area, even though many others on BritishExpats.com are reporting that they're finding it a nightmare. We've sorted out a car, and a school for Lauren with pre-school and holidays child care. And when it comes to my job things couldn't have worked out better.

I came out of work today, hopped on the CityCat, and as I was cruising down the Brisbane River slipping quietly under the Cook Bridge passing the riverside mansions on either side, watching the sun set over the city, I couldn't help but smile.

Normally with contracts, they're paying a large day rate so they expect blood in return. They usually set deliverables and expect you to quickly deliver, with very little supervision and certainly no training. They expect you to provide the skills that they are missing.

In this case, I've been given a project which is highly technical, involving systems that I have very little experience with, and certainly no 'hands-on' experience, even though I was completely honest with them in the interview and told them that the technical side of the project was outside my expertise. And yet they're completely fine with it. They're providing me with full training, which will enable me to add a skill to my CV that's extremely sought after in Brisbane, and for which if I was to take a professional course to learn would cost me $$$$, and all they expect in return is a little help with documentation and operational procedures.

I've even been lucky with the documentation. The project mirrors another project which has already been completed, and for which full documentation has already been produced. All I really need to do is amend the existing documentation to relate to the new solution. I'm struggling to see what's in it for them. OK, I will be expected to take charge of the solution for two weeks in August while the guy I'm shadowing is on leave, but 6 weeks is more than long enough for me to be fully up to speed with the technical side. It feels like they just want to keep me on their books. Fine by me!

I've felt that guilty at work today being paid to simply learn new skills that I even offered to make contributions that aren't in the project plan - mainly documentation that I would expect if I was the client. Stuff they hadn't thought of. They seemed pleased with that so maybe it might delay them coming to the realisation that they don't in fact need me.

The location where I'm working couldn't be better (unless of course I could work from home). I'm working out of the client site in one of the big skyscrapers overlooking the river, right across from Eagle Street Pier, and only a 2 minute walk from the ferry terminal.

This contract might only last a few weeks before I'm out of work again but while it does I'm certainly going to make the most of it.

Am I speaking a different language?

Here's an example of the kind of battle I have on a daily basis trying to get people into a security mindset:

Me to Relationship Manager (RM): Can you please ask the client to complete the attached Business Impact Analysis (BIA) template so we can understand how valuable their data is in order to assess whether nor not the existing security measures are appropriate to the value of their data. It's important that they look at this from the perspective of what it would mean
to the business if the data was lost, disclosed or changed, based on worst-case scenario and irrespective of the likelihood of it happening or the security measures currently in place to prevent an incident. At this stage we need to understand the possible impact of a security incident, not the risk of an incident occuring - the likelihood and current mitigating security controls will be taken into account in the next stage.

(I also followed this up with a telephone call to ensure the RM clearly understood what I was asking for)

RM to Me: Please see the attached completed BIA

Me to RM: Thanks for that but can you please ask the client to amend the BIA to reflect the value of their data and impact of it being lost, disclosed or changed, without considering the likelihood of an incident occuring or the existing security controls in place. They've put in the summary notes that they have based their conclusions on the fact that they haven't had an incident in the past year (to their knowledge) and they have processes in place to mitigate the risk. Again, at this stage we're not considering existing security controls because we purely want to know the possible impact to the business in terms of financial loss, reputational damage, legal/regulatory penalties, customer impact, etc (as per the template) if the data was lost, disclosed or changed - we need to know the value of the data not the risk of an incident occuring.

RM to Me: I added in the extra comments - not the business. we just tried to add some common sense to the process - i.e. how the system actually works. If they had answered everything on a 'worse case scenario' then every answer would have been red, which I don't think helps anybody.

Me to RM: But that is the point, if it's all red it needs to be all red, you can't just change the value of their data because it doesn't help us. Again, this is the Value not the Risk, whereas the value would be all red, the risk value, taking into consideration existing controls and the likelihood of an incident might bring it down to Amber or Green, but at the moment I just need to know what it would mean to the business if their data was lost, disclosed, or changed, not the likelihood of it happening.

Finally the Relationship Manager understood what I was asking (even though I talked her through the process on the phone at the beginning and she made out that she understood).

You need a lot of patience for this job!

Where does the time go?

I just thought I'd do a bit of research into the job market in Brisbane, and suddenly it's 3 hours later and I'm even more confused than when I started!

Everything I'm reading tells me that Sydney, Melbourne, and Canberra are all better for IT Security jobs than Brisbane. That doesn't mean to say there aren't any IT Security jobs in Brisbane, there are - they're listed on www.seek.com.au and www.jobserve.com.au, there's just not as many as in the other cities.

I'm also getting the picture that the agencies aren't quite as efficient as the ones in the UK. Apparently in Oz many recruitment agents don't see it within their role to keep you updated - you have to chase them - constantly!

The general consensus is you're either lucky, and pick up work straight away, or you'll end up applying for about 100 jobs and have to wait 4 months before landing one. I just hope it's the former, because if it gets to 4 months I'll be starting to twitch and Rach will be in full-blown panic mode!

Contracting doesn't to be as lucrative either, so it looks like I may have to go back to being a permie (heaven forbid!), and permanent rates don't look that attractive either. Oh well, money isn't everything.

No seriously, it is standard of living, not income, that counts. All I'll need in Oz is a bit of petrol money to get down to the Gold Coast every weekend, or up to the Sunshine Coast, or over to North Stradbroke Island. Oh, and the big house with swimming pool, and sailing yacht moored at the bottom of my garden of course. I can but dream!

Is this the most boring task ever?

All in all, the project I'm working on at the moment is quite interesting. However, the task I've been working on for the last couple of days nearly made me lose the will to live.

I'm providing IT security consultancy for a project that's rolling out over 6000 new PC's across the company, with an upgraded operating system and standardised build comprising approved operating system settings and 'rationalised' applications. One part of the project is to implement a standard 'Group Policy' structure which completely locks down each PC to reduce risk.

The task I somehow ended up with this week was, as part of the comms plan, to give a detailed explanation of every group policy setting and the rationale behind why we're implementing it. The problem is, there's hundreds of them!

Of course, the answer to the blog post title is no, it's not the most boring task in the world. I appreciate some people have much more boring jobs, and don't get the remuneration for it like I do. Even so, it does make me wonder about my career choice!