What I'm Reading (or Watching) 4/11/2020 - Hopefully Learning Some Cybersecurity Lessons from Stanley McChrystal

Books -

Team of Teams -

Former general Stanley McChrystal held a key position for much of the War on Terror, as head of the Joint Special Operations Command. In Iraq he found that despite the vastly superior resources, manpower, and training of the US military, Al Qaeda had an advantage because of its structure as a loose network of small, independent cells. Those cells wreaked havoc by always staying one step ahead, sharing knowledge with each other via high-tech communications.

To defeat such an agile enemy, JSOC had to change its focus from efficiency to adaptability. McChrystal led the transformation of his forces into a network that combined robust centralized communication ("shared consciousness") with decentralized managerial authority ("empowered execution").

Now he shows not only how the military made that transition but also how similar shifts are possible in all kinds of organizations, from large companies to startups to charities to government agencies. In a world of rapid change, the best organizations think and act like a team of teams, embracing small groups that combine the freedom to experiment with a relentless drive to share what they've learned.

McChrystal and his colleagues explain their process for helping organizations embrace this model. They also share fascinating research and examples from settings as diverse as emergency rooms and NASA's mission control center. 

I participated in an online seminar with Dragos and Salt River Project on 4/8/2020 and this book was mentioned numerous times as recommended reading for cybersecurity professionals.  So...here it is.

Still working on: 

Network Forensics: Tracking Hackers Through Cyberspace

Wired for war: The Robotics Revolution and Conflict in the 21st Century

I shouldn't be taking this long on them but I am just finding it hard to concentrate on them for extended periods.

Blogs / News -

CBS News - Footnotes indicate FBI knew of risk of disinformation in Steele dossier -

The FBI was warned sections of the controversial Steele dossier could have been part of a "Russian disinformation campaign to denigrate U.S. foreign relations," according to newly declassified footnotes from a government watchdog report. 

...

Writing in the Wall Street Journal, Johnson said, "From the opening of the investigation, the FBI team kept accumulating exculpatory information. Yet rather than wind the investigation down, they ramped it up...Then it got worse. The FBI team excluded exculpatory information from its FISA application..."

Reddit - Windows Server 2008R2-2019 NetMan DLL Hijacking - All editions of Windows Server, from 2008R2 to 2019, are prone to a DLL Hijacking in the %PATH% directories? The impacted service runs as NT AUTHORITY\SYSTEM and that the DLL loading can be triggered by a normal user, on demand -

What if I told you that all editions of Windows Server, from 2008R2 to 2019, are prone to a DLL Hijacking in the %PATH% directories? What if I also told you that the impacted service runs as NT AUTHORITY\SYSTEM and that the DLL loading can be triggered by a normal user, on demand, and without the need of a machine reboot? Provided that you found some %PATH% directories configured with weak permissions, this would probably be the most straightforward privilege escalation technique I know. I don’t know why there hasn’t been any publication about this yet. Anyway, I’ll try to fill this gap.

Military.com - Pentagon May Relocate One of its 2 Navy Hospital Ships -

The Defense Department is considering whether to relocate at least one of the two Navy hospital ships deployed to support the COVID-19 pandemic response, as it works with the Federal Emergency Management Agency and Department of Health and Human Services to determine the next potential novel coronavirus hot spots.

Archive.org - Connections Episode 1: The Trigger Effect -

"The Trigger Effect" details the world's present dependence on complex technological networks through a detailed narrative of New York City and the power blackout of 1965. Agricultural technology is traced to its origins in ancient Egypt and the invention of the plough. The segment ends in Kuwait where, because of oil, society leapt from traditional patterns to advanced technology in a period of only about 30 years.

Slashdot - Snowden Warns Governments Are Using Coronavirus To Build 'The Architecture of Oppression' -

Smith talks to Snowden, who blew the lid off of the National Security Agency's surveillance of the American people in 2012. In the interview conducted from Smith's home in Santa Monica over video chat, the two tackle topics including the lack of preparedness in the face of a global pandemic, how long this will be a threat to humanity, and whether the power we're handing to global leaders will come back and bite us in the ass.

I have to say all the talk about mandatory social distancing, even after the crisis is over, and the talk of immunity certificates has my feeling concerned.  I mean after all who can complain about measures designed to save lives by preventing another pandemic.  The fact that it may prevent political gatherings, and restrict peoples movement, limit access to jobs, etc.  is an unfortunate by-product.

Tech Crunch - Chian's next plan to dominate international tech standards -

Our firm, Horizon Advisory, has translated and analyzed that report – and the past two years of planning that informed it. We find in it instructions to “seize the opportunity” that COVID-19 creates by proliferating China’s authoritarian information regime; to co-opt global industry by capturing the industrial Internet of Things; to define the next generation of information technology and biotechnology infrastructures; to export the social credit system – and Beijing’s larger litany of incentive-shaping platforms. We find an explicit global ambition that weaponizes commerce, capital, and cooperation.

...

The plan’s third prong is internationalization. The Main Points outline the intent to “give full play to the organizational and coordinating roles of the Chinese National Committees of the International Standards Organization (ISO) and International Electrotechnical Commission (IEC).” Reports from the National Standardization Committee explain that giving “full play” means shaping “strategies, policies, and rules.” Beijing is to bolster internationalization through bilateral and regional standards-based partnerships – partnerships like China and Nepal’s standardization cooperation agreement, ASEAN’s standards docking, and nascent efforts with Germany, the United Kingdom, and Canada, among others.