Cool as McCumber

My Amazon Kindle has been quite a conversation starter on airplanes lately. Sadly, that was not the reason my wife bought me one as a gift. I am actually depressed about it. When I'm on a flight, I usually have work to do, or I may decide to quietly revel in some light reading, or if I really feel like wasting time, I may watch a recent movie release. What I do not want to do is converse incessantly with a probing, chatty seat mate. I don't care that you are going to see your son and daughter-in-law in Phoenix. He's a big shot lawyer? So what? Your grandson made the traveling soccer team? Good for him. Your daughter-in-law won a Nobel prize? Who hasn't? Leave me alone. I have an article to write.

As a defensive tactic, I have perfected some comebacks to preclude intrusive questioning from curious neighbors. When the inevitable, "What do you do?" question is raised, I tell them I own a slaughterhouse, or perhaps I sell used cars. I used to claim to be a Congressman, but now that real representatives are being assaulted for making such an admission, I stick to the tried-and-true standard: I'm Ozzy Osbourne's valet.

Unfortunately, they now see my Kindle and say, "Hey, I'm thinking about getting one of those things. Do you like it? Is it better than an iPad?" I may as well have a cute baby or a puppy on my lap. Why are you asking me? Do I look like I'm on the editorial staff at Wired? Of course I like it. If I didn't, my wife would be pissed. If you promise to stop talking to me, I'll pay the $9.95 charge for you to use the aircraft's broadband hook-up, and I'm sure some rudimentary Google-fu will locate an article by some opinionated geek to champion whichever doodad you have already decided to buy. Oh, me? I'm a Congressman. Ouch! Stop that!

The trip I'm on now was perfect. I got the Kindle inquiry, and was obliged to show the screen to Ms. Inquisitive. She put her glasses on the end of her nose, and instead of simply giving the device a quick once-over, she decided to actually spend a few moments to see if she could read the page I had open. Fortunately for her, it was the start of a new chapter, and thus had a large type font. However, unfortunately for her, the chapter I was reading was titled Sexual Predators. She pursed her lips, shot me a steely glare from the corner of her eyes, pulled off her glasses, and feigned sleep from San Diego to Detroit. Nice. That page is a bookmark.

Just so you know I'm not a complete weirdo, the book was recommended to me by one of my students. He suggested I read it because of its discussion of a "risk continuum" - a concept I found compelling as a security practitioner. It is a tome written by a couple former LEOs (that's Law Enforcement Officers for you n00bs) that describes their work with criminal predators. It was interesting, and being written by a couple red-blooded law-and-order types, it has the requisite war stories from their days on the force and in the bureau, if you are hip to what I'm saying.

In addition to the risk continuum, they kept claiming that to help minimize your risk, you should always "expect the unexpected." The authors must have really thought this tired, old adage a profound insight, because the book is peppered with this repeated "advice" - expect the unexpected.

The example they gave was a branch bank manager who experienced an armed robbery. The perps (that's perpetrators, greenhorn) did the usual "bank robbery" things like brandishing pistols, jumping around like fleas and screaming loudly at everyone to stay calm. Ironically, nobody stayed calm - except the branch manager. He worked to assure the robbers he could care less about the money (it wasn't his), and he was happy to comply with their dreams of large sums of currency if they left everyone unharmed. Bottom line: robbers get large amount cash from all the drawers, no shots are fired, everyone is safe, crooks leave and are arrested five miles away when their getaway car runs out of gas.

The authors commend the branch manager for his "expect the unexpected" attitude and ability to facilitate a safe and efficient robbery. Everyone lives. However, I found myself confused. Why would a branch bank manager NOT expect an armed robbery? The classic John Dillinger quote comes to mind: "I rob banks because that's where the money is." As far as I'm concerned, any branch bank manager who has not prepared himself and his staff for an armed robbery should be fired for dereliction of duty - unexpected, indeed.

If you are a security practitioner, you should never be blindsided by the unexpected, simply because you must expect and prepare for bad things to happen. Every security practitioner should have a plan. Unless you're a Congressman like me. Hey, lady, I said stop hitting me. Ouch!

John McCumber is a security and risk professional, and is the author of "Assessing and Managing Security Risk in IT Systems: A Structured Methodology," from Auerbach Publications. If you have a comment or question for him, please e-mail John at: