Author Archives: enicaise

Setup a proxy server on a Synology

| 2015-01-24 | English, Uncategorized
Synology's Proxy Server Package
Synology’s Proxy Server Package

If you have an office network or a home network, you might be willing to use a proxy server to cache and speed up your Internet surfing. More you have machines connected on your network, more likely it is that you will request multiple time the same files (Just imagine how often the Doodle from Google is uploaded on a network with 10 machines on it). A proxy is also a good way to add restriction allowing you to prevent your users to go to undesirable websites or to use unsafe protocols. It can also allow you to request a user authentication before being allowed to access the Internet. Or, it can also allow you to channel all traffic through a privacy protection service like TOR.

Whatever is your reason, if you have a Synology server, setting up a proxy server becomes much easier these days.

There is two parts in setting up a proxy:
1° Install the server
2° Ensure the users will use the proxy.

For the first part, on a synology, it is now really easy. Go to The Packet Center, click on Utilities and select Proxy Server (from Synology inc.). Click on Install, that’s it.

You will have to configure it: Just provide your email address if you want your user to be able to contact you should they have a problem and set the port address on which the server will listen. You can use 8080 but any not used port will do it. Noticed that it is likely that port 80, 443, 5000 and 5001 will be already taken. Usually, we advise not to use port numbers between 1 and 1024 as they are already reserved and assigned to specific services. Above 2048 is even safer. 8080 is quite common for web services or proxy servers. Activate the cache and the connection, check “Activate Automatic Proxy Discovery” in proxy deployment and leave the other parameters by default.

That’s it, your proxy is up and running. Congratulation!

Now you have to tell your computer to use this proxy to navigate in HTTP or HTTPS.

Hopefully, you clicked on activate automatic proxy discovery and it will help.

The first possibility, if you have a standalone computer, is to go to the network settings (it can be through your Internet Explorer or Chrome settings) and set Use a proxy.

To make it easier, you can configure your DNS and/or your DHCP to provide automatically the proxy setting to your client computers using a PAC file (Proxy Automatic Configuration). When clicking on the proxy distribution address, this file was automatically generated and configured for you on your synology.

For the DHCP, you must add the DHCP option 252 (text or String) with the url to the wpad.dat file (example: http://192.168.1.254/wpad.dat)

For the DNS, its even easier, the webserver on which you have placed the wpad.dat file (in the root folder of the server), likely your Synology server, must be know by the allias wpad.your_network.com (where you replace your_network.com by the domain name of your network as define in the DNS server). When configured on Automatic Proxy Configuration, browsers will look for a set of possible variant of http://wpad.my_network.com/wpad.dat. When the file is found, it is used by the browser to configure how it access the Internet using a proxy.

Be sure your computers are set on Automatic Discovery of Proxy settings (in network settings).

Sometimes, the default wpad.dat file generate by Synology will not work perfectly as it might try to use the proxy to access computers on your own network. You can edit the file using an editor (the file is located in the root folder of your web server on the synology) and type something like this:

function FindProxyForURL(url, host) {  
if (isInNet(host, "192.168.1.0", "255.255.255.0")) 
{  return "DIRECT";  } 
else 
{  return "PROXY 192.168.1.254:8080" ;  } 
}

In that example, 192.168.1.0 is the network address of the local network. 192.168.1.254 is the IP address of the Synology and 8080 the port defined for the proxy server.

Be really careful with wpad.dat file, it is extremely sensitive to misplaced whitespace or the absence of trailing “;”.

That’s all folks!

Have fun!

Effective security management: 20 tips to change your audience’s behaviour

| 2013-12-07 | Communication, English, Information Security, Security Governance

How do we implement security efficiently in an organization, small or big?

Although some security officers seems to still believe that having security policies and a plan to implement expensive controls like IPS, IAM or DLP (you’ll notice the common use of nice marketing buzzwords and acronyms to make you believe that you should know what an Intrusion Prevention System, an Identity and Access Management or a Data Leakage Prevention system are, like everyone else is supposed too, and maybe does. But does it mean it’s the solution to your problems?) are the solution, it is not! You can believe me on this, I was thinking the same way years ago, I saw it failing too often and now, I took another approach. And that’s probably one of the reasons why I still have a lot of work as a consultant.

So, what is the first thing we should care for?

When Kevin Mitnick, one of the most famous hackers, was still hacking PABX in order to have the possibility to do war dialling on all available modem in a region for free (yes, it was a long time ago), the weakest point for most computer security systems was already between the chair and the keyboard. Whatever you do, there is always a human involved somewhere and human are harder to control and less predictable than human (even if it might not always be the case). Bottom line, a good security starts with a good communication and training plan, like for any transformation journey, as it is the only good way to change users’ behaviour (depending where you live, you might also think about torture and brain washing but in as I live in Belgium and moreover due to my philosophical convictions, I exclude those from the equation)

Is it really necessary to have a communication and training plan?

The first Palo Alto axioms of communication states that we cannot not communicate (yes, I know, double negation are complicated). Let’s rephrase it: whatever you do or do not, you communicate. So, if you don’t communicate about your security, in fact you just communicate that it is not important or that you don’t care or that you don’t have the budget to communicate. It’s BAD! If you communicate poorly, you might in fact give the same message and even worse as you might give the false impression that security is useless or even boring. Really Bad too! And as you probably know, we just have one occasion to give a good first impression. So, don’t miss it. The basic reason for any communication is to change other’s behaviour. So, if you just want to write policies for yourself and don’t bother about the others behaviour, indeed, you can skip he communication plan.

What makes a communication efficient?

If a communication is intended to change other’s behaviour (or ideas), an efficient communication is the one that will change the highest number of person’s behaviour. How can we assess that efficiency? If you do security and risk management, you should know the PDCA cycle. So, you just use it, like scientists. When you do something you try to measure the effect of your action. Fortunately, there is already a lot of people having tried different paradigms and measure their efficiency. That’s what social psychologist and marketing researcher do. And on the specific risk communication issues, Amos Tversky and Daniel Kahneman, two economy Nobel prize winner psychologists, have developed the theory of perspective, highlighting the numerous biases affecting the human when taking decisions about a risk. Lucky for you, you won’t have to read and understand all those books and articles, I am about to give you a cheat sheet to prepare your next communication.

So, practically, how do you do it?

  1. First, you have to remember the 3 basic rules of education: repeat, repeat and repeat again.
  2. Then, you have to remember that if you repeat too often a signal, it tend to be ignored by your brain. When you put your socks on your feet, you start ignoring the sensation of the fabric on your skin after a few seconds. The same way, you don’t notice most of the object in your office that are there for so long. But, if you move it or change the color, interrupt the pattern, you will start noticing again. So, the basic education rule might become something like: repeat, explain and do it again differently.
  3. Keep it simple, stupid and sexy (KISSS): use terms and analogies that everybody can understand. Your target is not a group is security experts.
    Ex.: “Security is wearing belt and braces for your first date“
  4. Give many concrete short examples: give examples that are relevant for your audience. Use their vocabulary, the process they already know, things they do for a living.
  5. Use examples allowing people to identify themselves to the story
    Ex.: « The new employee walk into the printer room and find a confidential document on the printer, as he remember the security training, he brings the document to the security officer»
  6. Ask questions and mostly questions creating a knowledge gap, meaning your audience won’t have the answer, or at least, not the right answer.
    Ex.: “How long will a 8 characters long password last again hackers attack?“
  7. Use positives sentences (people have difficulties with negative form, they tend to forget the negation)
    Ex.: prefer « You will take care » to « You will not jeopardize »
  8. Use emotion and feelings to describe situations, it will make it more memorable (you can also add references to sensations, sounds, colors)
    Ex: “Alice is afraid of loosing her beloved grand-mother gold ring”
  9. Explain to your audience as if they were your kids or grandparents
    Ex.: “You may see Risk as the cost resulting from an incident (like having a car crash) multiply by the probability of this incident occurring“NB: I know, I Repeat myself, but what we call the knowledge curse, meaning believing the others understand what we are saying, is really killing most security communication
  10. Use precise numbers, it will be perceived as more credible
    Ex.: “You have 2.13 times more chance to die from self-inflicted injuries than from transport accident“
  11. Naming your sources will also add credibility? (if they are credible).
    Ex.: « as stated in the Federal Statistic Death Cause report of 2009 »
  12. Link important concepts to images, Preferably known locations and persons. Use unusual associations (incongruence) to increase the remembrance.
    Ex.: “Ghandi walks into a computer shop and ask for a computer bringing serenity“
  13. Spot the « victims » of the incident or the persons impacted by an incident. Give a face, a personality, to the victims.
    Ex.: « Alice, Bob’s secretary, is affraid of being fired after she disclosed confidential information »
  14. Provide multiple examples of the same risk. it will create an illusion that the risk is higher, helpful to trigger action & compliance
  15. Use yes sets (A set of affirmation that will be acknowledge by most people (Yes) preceding an affirmation we want them to acknowledge): As they acknowledge the first affirmations (priming), they are more likely to acknowledge the last affirmation.Once acknowledged, not complying with this affirmation will likely trigger a cognitive dissonance (inconsistency) in their mind, increasing the probability of compliance.
    Ex.: “As many, you like to keep your secret secret. You understand the risk of disclosing such information. So, You will probably keep this information secret.“
  16. Use double “No” or paradoxical sentences:
    Ex.: « You don’t want us to take such a risk, don’t you? », « As you care about our security, you will classify the document adequately. No? » or « You may give your password to your colleague and be responsible of all his mistakes. No? »
  17. Make it look like normal: Make your expectations appear like something normal, that we should do as part of our normal behaviour
    Ex.: “As most of your colleagues, you take care of your customer’s information…”
  18. Provide a meaning to your expectations (appeal to our inner trends to make things right)
    Ex.: “Keeping our customers’ transaction confidential prevent insider trading…”
  19. In the military, it is known that no plan survives the contact with the enemy. To circonvene this, always think to provide the CI (Commander’s Intent) that will allow people to take judgmental decision.
    Ex.: “The main goal is to ensure our CRM applications remains available between 7 to 20“
  20. If you make a presentation, speak slowly, pause for a second after important information, it will be perceived as more charismatic

Ok, I stop here. There is of course more to say but you have already more than enough to make your communication at least 3 time more efficient. Combining all these advices, you may change the odds of behavioural change from 21% to 78%! Can you do better?

The lost meaning of our (professional) life

| 2013-08-07 | English, Happiness@work, Perspectives

First story

Not so long ago, I met a young and intelligent lady working as a student in a big organisation. A Monday morning, she was tasked to review the translation of some official documents. Around 10.30, she was already nearly laying on her keyboard, her head between her hands, whispering that she wanted to be on Friday. Not because she had a special event planned, just because she wanted this week to end.

If you compare her to other students having a holiday job, she was supposed to be lucky as she was actually doing the job she was studying for instead of counting hardware pieces in a store or delivering mail.

At some point we started a discussion and I took the opportunity to ask her:

– What are you gonna do with your life?

– Translator, she answered.

– You are here, doing the job you are preparing yourself to do the rest of your life and after one week, the only thing you can think about is not doing it. Are you sure it is what you want to do with your life?

– It is all I can do!

– Is is what you think or is it what it is? Which evidence do you have?

– None, but I don’t know what else to do!

– Maybe you should figure out that first?

Obviously, it is not the only thing she’s good at and it is not what she really want to do in her life. But somewhere, she became convinced that she had to follow this path and that it was the only one possible. At around 20, she was already in autopilot mode, following a path that is not her but the one her environment offered her.

A few days later she came to me and told me that she will use her time abroad (she was going to study abroad for a few months) to discover what she really wants to do.

 Second story

In a rock festival, I discovered a Belgian New Orleans’ jazz band called Big Noise. The 4 musicians played like if they were possessed or in transe. The drummer was so into it, playing an “infernal swing” that he looked like he was drunk or on drugs. But, evidently, his drug was his pleasure to play. To play music, to play whit friends, with the audience, to have fun, a lot of fun. And the public was seduced, sharing the nearly shamanic transe, powered by the music and the magic of this group sharing the same love for music. From where I stood, at that moment, they had the best job in the world, the one making them happy.

Third story

I discovered recently the new Aaron Sorkin TV show called “The Newsroom”. The series is set behind the scenes at the fictional Atlantis Cable News (ACN) and centers around the team of idealistic journalists working for the news, seeking the truth and aiming to educate their audience. As it was the case before with “West wing”, Sorkin’s wrote again some of the most intelligent scenarios and dialogs ever. I was captivated by the show and found myself excited by each episode. As images of the series where present in my mind the next day, I wondered what was so appealing to me in the show. Obviously, I was probably projecting myself (in the Freudian acceptance of the term) in the show. Something was talking to me. But what? Fortunately, meditation helps a lot to make your mind clear and it became rapidly evident to me that it was the commitment of the characters and their values that was stimulating my soul. These characters are devoted to their work, or, should I say, to their cause. In fact, they don’t work, they do something they believe in it, they live their passion and they stick to their values. They are committed to their life, not someone else’s life.

 Last story

More than a decade ago, I was running a company with my associates and, at the same time, I was coaching young children from 5 to 7 years old to teach them how to swim. Surprisingly, although my daily job was very interesting and I was successful at it, I happen to wait all the week for this moment, on Fridays, when I was in the water, teaching those kids how to float, dive, breath or jump into the water. At first, I tried to ignored this and managed to have so busy weeks that I couldn’t even think about it or anything else than my work and my occupations. Fortunately, at some point, my mind or my body (or both as they are one) found a way to pass the message. And it was clear: something was going wrong in my apparently picture perfect life. Unfortunately, the root cause of this “unhappiness” was not as evident. As I didn’t understood at the time what was laking me unhappy, I started to change nearly all aspects of my life, private and professional. During the process, I was lucky enough, as I often am, to cross the road of wonderful beings that helped me to understand what was missing in my life. At a bit more than 30 years old, I decided to go back studying and found myself on the way to the University to pursue a master in Psychology. It was a very long journey during which I continued to search for the meaning of my life as a sense on “un-achievement” was still haunting my mind. It took me a while, and a lot of these blessed encounters with wonderful people (sometimes through books, sometimes during a very short time or sometimes for a long lasting and beautiful journey) to understand that the meaning of my life was not the goal, the end of the road, but the road itself. I found my direction, my path, my identity as I was able to accept myself as I am, with my paradoxes and my weaknesses as much as with my strengths and my values. I finally understood the true meaning of Steve Jobs saying, in his 2005 Stanford commencement ceremony address: “for the past 33 years, I have looked in the mirror every morning and asked myself: “If today were the last day of my life, would I want to do what I am about to do today?” And whenever the answer has been “No” for too many days in a row, I know I need to change something.” or the “Carpe Diem” from Dead’s poets society. I discovered my values and found my balance to integrate all aspects of my life. Writing this, even if you are just a few hundred to read it, should it even be only one person, is a part of it. I

 Epilogue

Our society is very good at picturing a way of life and making us believe that we must fit into this scheme. Unfortunately, in some aspects, our society has lost her values, or, to be more accurate, I cannot recognise myself in some of these values and, maybe, you don’t either. As Jiddu Krishnamurti once said: “It is no measure of health to be well adjusted to a profoundly sick society.” And unfortunately, our society and most corporations, are so complex that it become difficult to understand what is the goal, the meaning and the role we have to play. And the pace imposed by our “modern” way of life do not often leave time to think about our values, our dreams, our expectations. We must be artists, philosophes or even fools to dare thinking about our purpose, the meaning of our lives or, more simply, what really matters for us, deeply inside. “Stay hungry, stay foolish” was the closing sentence of Jobs’ 2005 speech. Tomorrow is the first day of the rest of our lives. We can be foolish too for this commencement. We can demand the meaningful life we deserve. It is often not so far from where we stand. A few centimetres close even. It is not necessary to change everything, we can just change what is not in line with our values, with the direction we want to take.

According to recent studies, people with a purpose in their life, with a meaning, are happier and are also in better physical condition (less stressed). Corporation, society, should think about the meaning of what they do and the meaning of what their people do. If everyone could find a true meaning (money is obviously not one, as such) at what it does for leaving, nobody would have to work anymore, or at least, we would not have to call it labour because it wouldn’t be labourious anymore.

 

Stay foolish!

 

http://news.stanford.edu/news/2005/june15/jobs-061505.html