A 12 Year Quest -- My Story

On a quest, through the desert.

(credit: Assassin's Creed – Origins;
Thick Skin Side Quest –
Crocodile, Hyena, Vulture Locations)

Last week I started a new job as Principal Modeler for Cyber Risk at Risk Management Solutions (RMS).  This is HUGE, coming after a 12 year quest that was far from easy or certain.

I don't normally post personal stories on this blog (or elsewhere) but today feels like the right time for this particular personal story.  I'm writing this as a way of connecting to my community, many of whom have shared the ups and downs of this journey.  I don't have any big lessons or advice. Even so, some readers may find this story instructive or inspirational, even indirectly.  I hope so.

Caveats: In this post, I don't individually acknowledge and thank all the people who have helped me along the way.  There are so many, so I will do that separately, both in one-on-one communications and later blog posts.  I'm also going to discipline myself not to write about all the details, all the events, all the feelings along the way.  That would be too long.  I aim is to have a post that is readable and still specific enough to be meaningful.

Even so, it's a long blog post. If this suits you, the story continues below.

Several pieces of good news

Sorry I haven't posted in a while.  I've been pretty busy with research work -- writing papers for conferences, mostly.  But I've got some good news to report.

Cash will be flowing as nature intended.

First, I'm starting a full-time job at a Financial Institution* with the title Security Data Analyst/Scientist, which I choose to shorten to Security Data Scientist.  This is a big deal on many levels.  One of  the best things is that their capabilities are comparatively mature and the leadership is both visionary and pragmatic.  This means that I hope to do some fairly compelling analysis drawing on some rich data sources and previous analysis rather than having to start from scratch.

(* My Twitter followers will know.)

I'm continuing my PhD program part-time, with focusing on my dissertation.  I hope to complete that in 2014.

Also, I'll continue blogging here on all the same topics.

Second, I'm very happy to say that I've had a talk accepted at the RSA Conference in February 2014, co-presenting with David Severski:

10 Dimensions of Security Performance for Agility & Rapid Learning
2/26/2014, 10:40 AM - 11:00 AM

Abstract: Information security is an innovation arms race. We need agility and rapid learning to stay ahead of adversaries. In this presentation, you'll learn about a Balanced Scorecard method called the Ten Dimensions of Cyber Security Performance. Case studies will show how this approach can dramatically improve organization learning and agility, and also to get buy-in from managers and executives. 

This is a 20 minute time slot, and there's no way that I can compress my 60 minute or 45 minute versions of "Ten Dimensions" into such a short time.  Therefore, David and I are going to cook up an extended "trailer" that conveys the basic idea of double loop learning in practice (David is doing some neat stuff that we'll try to "fly through").  In parallel, I hope to have some videos, webinar, or other media that people can go to in order to get a proper introduction and survey.

Also, I've proposed a peer-to-peer session at RSA on a related theme: "Building a Quantitative Evidence-based Security & Risk Management Program".  I should hear later in November whether it's been accepted.  It will be an hour long session and I will only be facilitating, but it should be a good time for Q&A, sharing insights, etc.

Finally, I'll be presenting a SIRA webinar "Big 'R' Risk Management - from concept to pilot implementation".  This is basically the same talk I gave at SIRAcon, but some people couldn't attend that session (we had parallel tracks) and many people couldn't attend SIRAcon at all.  I think it'll be in December, but there isn't a date set yet.

I've got some good blog posts in the works, including Game Theory Meets Risk Analysis, several more Shades of Black Swans, a review of RIPE, some philosophy, and others.   Thanks for reading and thanks for your comments, both here and in other media.

--------

One more bit of good news from a completely different domain: the book Chasing Chariots is coming soon!  Includes most of the papers presented at the First International Chariot Conference held in Cairo in December 2012.  The evolution of technology in the Late Bronze Age became an strong interest (a.k.a. compulsion) of mine a couple years ago, with particular focus on the so-called "first revolution in military affairs" -- the war chariot.  Beyond just curiosity, I'd like to do some serious research in this area, but short of getting a second PhD, the only way it's going to happen is if I can find some collaborators (after I graduate!).

Periodically, I'll post some war chariot stuff here.  Bruce S. has his squids;  I have my war chariots.

Shocker!! I won Bruce Scheier's 6th "Movie-Plot Threat Contest"

I think the stopwatch on 15 minutes of fame just started.  From Bruce's blog:

For this year's contest, I want a cyberwar movie-plot threat [in 500 words or less]. (For those who don't know, a movie-plot threat is a scare story that would make a great movie plot, but is much too specific to build security policy around.) Not the Chinese attacking our power grid or shutting off 911 emergency services -- people are already scaring our legislators with that sort of stuff. I want something good, something no one has thought of before.

On May 15, I announced the five semi-finalists. Voting continued through the end of the month, and the winner is Russell Thomas, with this entry:  

Dream work spaces

I imagine that many golfers believe they would play their best golf at Augusta National (home of the Masters).  Maybe many musicians believe they would perform their best at Carnegie Hall.  For me, I'm inspired in my work by grand reading rooms in libraries.  I'm lucky to be able to use the Stanford Green Library's Lane Reading Room. It has a nice hallway with vaulted ceilings, which is a good place for monk-like pacing.

A place for pacing
(click for larger image in new window)

As nice as this is, my Dream Work Space might be the Library of Congress Reading Room.  I visited there last week to get two hard-to-find books.  I only spent a few minutes in the Reading Room itself before going into the copy room.  But I took a moment to imaging what it would be like as a daily work space.  Yowwza!

Library of Congress Reading Room.
View from above (click for larger image in new window)

View from the floor.  I'm sure I could think great thoughts here!
(Click to view larger image in new window)

I'm attending the the Trento Summer School in July

I'm looking forward to attending the 14th Trento Summer School in Trento, Italy, from July 1 to July 12.  The theme this year is "Modularity and Design for Innovation".  The summer school is hosted by the Cognitive and Experimental Economics Laboratory (CEEL) at University of Trento, as part of their Adaptive Economic Dynamics program.

Trento, Italy

View Trento in a larger map

Looks like I'm the only American student and also probably the oldest!  Should be fun.

One of the main lecturers is Carliss Y. Baldwin of the Harvard Business School.  I first met Carliss in 2000 at the Wharton Workshop on Complexity and Management,  where we were both presenters.  She presented a preview of her soon-to-be-published book Design Rules.  She probably doesn't remember me or my presentation, but I remember her.

Let the explorations begin

I think it's time to create a personal blog.  For a few years, I've been blogging at New School of Information Security about information security, especially risk estimation, metrics, and risk management.  I've used Twitter (@MrMeritology) for these and other topics, including various topics related to my PhD program and dissertation.  I'll still blog at NewSchool from time to time, and I will continue to use Twitter for community interaction and resource sharing.

The blog format allows for longer essays and maybe novel content (e.g. interactive animations).  I imagine this blog will be more open in terms of topics and ideas that interest me as I come across them.  I'll also be blogging my progress through my dissertation and my experiences with various tools and methods as I learn them.

The content will be mostly professional, intellectual, and technical, with some occasional philosophy and personal essays.

I won't be blogging personal or family stuff.