The One In Five

I read in the Statesman at lunch that Ginny, former owner and chili/hot dog cook for the Little Longhorn died last Wednesday at 85.

Here’s a link to my overwrought description of an evening at the high stakes Chicken Shit Bingo tables before it became all touristy.

http://www.thehighhat.com/Detritus/003/bingo.html

My brother and his prom date in front of Whitehaven in Paducah, Kentucky. Probably around 1985 or 1986. And the 1961 Rolls Royce Silver Cloud II. The car belonged to my great uncle, a bauxite prospector. I never met him, but heard stories. He cemented a gold coin in the bottom of his pool, and he drove a Rolls Royce with his initials interrupting the red pinstripes the door handle. I got to ride in, and, periodically drive this beast. I remember the aroma as much as how it drove: wool, leather, and the ghosts of my great uncle’s cigars. It also prowled the streets and highways of western Kentucky and southern Illinois where my great aunt had her roots. But it was out of place, drew attention, not always friendly. Still, a cool ride. (I took my date to prom in a 1973 MGB, another story.).

I started a series of posts on Instagram on vehicles I’ve known. I’m moving some of these posts over here to put them in a more manageable location, and subject them less to the whim of the algorithm.

There will be discussions of machines and identity, and some chronicling of projects and maintenance.

My current machines include a 1982 Mercedes Benz 300D, a 2006 Triumph Bonneville T100, 2006 Genuine Stella, 2013 Moto Guzzi Griso, and a 1972 Alfa Romeo GTV. With 3 of the 5 currently running, I’ll chronicle some progress I usually just scribbled in notebooks.

On my way back from west Texas a couple days ago, I listened to the Willie Nelson’s Roadhouse satellite radio station.  The style and tone of the music was similar to when I made the same trip out there and back in a Jeep with only an AM radio.  Somewhere between San Angelo and Brady, the DJ played Red Sovine’s truck driving elegy from October 1965 “Giddyup Go.”  These four minutes of truck driving sentimentality have burrowed into my brain and established squatters rights.

If you want to share the experience, listen here:

Giddyup Go with a truck slideshow.

There isn’t much of musical interest to “Giddyup Go.”  To my ears, it seems like session musician noodling, ruminations in a wood-paneled key.  The mood is not quite melancholy, but redemptive and sentimental, as if there’s a country band, complete with a tinny saloon piano and steel guitar, playing at a road house.  With this backdrop, Red pulls up a stool next to yours, orders a drink, and starts telling you his mildly creepy story.

Yes, the story is creepy, and it hit me the first time I heard it.  The story hinges around the separation between the narrator and his son, but the wife/mother becomes an inconvenience.  So, as the song goes:

“And after about six years I got home one day and found my wife and little boy gone / I couldn’t find out what happened nobody seemed to know.”

At this point I knew Red was lying, or at least not telling the whole truth.  What did you do that the neighbors won’t tell you where your family went?  I can think of a few reasons why, Mr. Truck Driver, and they are all ugly.  So why don’t you pick-up your George Dickle and Ginger and make yourself comfortable a couple more stools down the bar.

But, no, Red lights up another Benson & Hedges, and the truck driving man drives the story to the sentimental conclusion.  I hoped for a violent turn when he warbles about his abandoned son: “I shook his hand and told him that I had something I wanted him to see / I took him out to the old truck.”

Maybe reactions like mine back in 1965 spurred the Nashville leviathan to spew out Minnie Pearl’s answer song, creatively titled “Giddyup Go Answer.”  The waitress narrating the song tries to fill in the blanks on the wife’s situation.  Oh, old man Giddyup Go was so handsome, said the wife, before her death, and I loved him so.  Nonetheless, the wife had to move to Arizona without leaving word to her husband for her health.  She voluntarily became a single mother, working as a truck stop waitress, for her health.  C’mon Minnie.  You should be waiting for old man Giddyup Go with a shiv rather than trying to engineer a tearful reunion.

Truck driving is a tough profession, with alienation and heartbreak built in.   A recent article on the trucker shortage quoted the 21st century version of Giddyup Go’s driver:

“I don’t recommend it to anyone who has a family. My kids are in their 20s now. I missed most of their lives growing up. They tell me they wish I would have been home more. I have been divorced two times because of truck driving. For a real perspective, talk to a trucker’s wife.”

So, yes.  I am looking for a grim and gritty reboot of Giddyup Go.  Taking suggestions for the dream team of musicians.

My case study examined Nameless Company,  a medium sized non-profit with the primary business to deliver services in partnership with a federal program.   Nameless worked closely with a US federal agency, and provided innovative technologies to provide better service to its customers.  The business model was generally stable, with subtle changes coordinated over time with its federal partner.

Nameless had created a large software development shop to create distinctive products for its institutional customers.  Its infosec compliance burden was reasonable, with FTC-regulated Gramm Leach Bliley requirements.  Nameless did have it brush with data breach infamy more than 10 years ago during the age of the lost laptop, but the impact of the event was fading in corporate memory.   Nameless leadership forecast changes to the regulation of the work it was doing for its federal partner, and began to implement a security program that used the NIST Risk Management Framework.  This framework would be required should Nameless pursue a federal contract.  It’s implementation was seen as guidance rather than requirement by both the information security and audit teams.

The forecast was correct, and Nameless’ federal partner terminated the program Nameless performed.  The federal partner then solicited bids for the new replacement program.  Nameless stepped up its FISMA compliance game, complete with consulting from Large International Consulting Firm, investments in new hardware and software, and an expansion of the security team, so it could be FISMA-ready should it win a bid for the new program.   The old program was still around, and would be for another ten years or so, but revenue would decline.

After a few years, Nameless didn’t appear to be closer to winning a part in the new replacement program.  There was a change in leadership at Nameless, and a corresponding change in strategy.  Nameless would build a new business, pursue new markets, and maintain the legacy program.  Significant staff reductions were made, primarily to the IT area.  The layoffs and sympathetic departures left the information security team barely there.

A couple months after the layoffs, Nameless’ federal partner published a letter to Nameless and other similar organizations.  “Y’know that FISMA thing you didn’t have to comply with?   Yeah, it’s a thing now.”  So Nameless now had to get serious about implementing a control catalogue, while significantly resource constrained.

At this point, my research question comes back around.  What will happen to the actual security outcomes?  Were they better when the compliance was optional and well-funded, or when mandatory and resource constrained?  Place your bets.

Stay tuned to find out!

Catch up on

Part 1 – Clinging to the Nearest Passerby

Part 2 – It’s Complexicated

As mentioned in Part 1, I was hooded and commenced on Saturday,  I learned that you can earn a graduate degree at UT Austin without knowing all the words to “The Eyes of Texas.”

Meanwhile, I had to sort two things to begin research solving the ultimate question of Security/Compliance.  I considered a boring old literature review, but the top-notch academic literature on this specific topic was scarce.  I also considered a conducting a survey, but that seemed to present significant administrative headaches for what may provide little new insight, especially when compared to the attractive alternative that presented itself.

I talked with some folks at Nameless Company who opened up some of their experiences in compliance and security with me, and I used Nameless as a case study.  Nameless Company was a small/medium business dealing a handful of interesting issues, one of which involved becoming FISMA compliance.  In talking to the IT, audit, security folks at Nameless Company, I saw the opportunity to see how they approached security before and after the required compliance.  Nameless Company was also going through significant strategic changes and upheaval. I was able to collect some qualitative and quantitative data for the years before and after the compliance event.

Once I had a case study selected,  I had to build a theoretical methodology for my approach.  After some agonizing and panic (primarily due to my unfamiliarity in how academic papers work), I selected complexity theory.  Complexity theory has been used to explain murmurations of sparrows and organizational behavior and cool Mandelbrot sets.  I was going to approach the research from the information transmission and rules/schema of the regulator, the organization, and the security team.

Now I was ready to dig into the data, the interviews, and the corporate financials and see what I could see as far as security & compliance in Nameless’ microcosm.

I’m the one in the middle with the big smile and ritual diploma substitute with the Dean of the Information School and the Director of the Center for Identity. 

Here’s some biblio:

Power, M. (2009). The risk management of nothing. Accounting, Organizations and Society, 34(6), 849–855.    (This paper lead me to the complexity theory – good & provocative.)

Mitchell, M., (2009). Complexity: A Guided Tour. Oxford University Press (What it says on the tin.  Makes no distinctions between Complex Systems and Complex Adaptive Systems)

Julisch, K. (2008). Security Compliance: The Next Frontier in Security Research. In Proceedings of the 2008 New Security Paradigms Workshop(pp. 71–74). New York, NY, USA: ACM.  (Emblematic of the sort of research in Security and Compliance – focused largely on the how rather than the why.)