FreeMind and Flash

I have been investing quite a bit of time lately looking at various tools that can help me better organize and correlate information. In the mind mapping camp, FreeMind is making a concerted comeback after a period of arrested development since the last major release in 2005 (v0.8). The new and upcoming features are quite impressive for an open source development, and FreeMind may yet rival more professional tools such as MindManager.

One of the interesting features in the current version of FreeMind is the ability to publish interactive mind maps onto web pages using a Flash plugin. The FreeMind wiki contains a gallery showing many uses of mind maps rendered with the Flash plugin, and I have added a map I brainstormed on Issues in Publish and Subscribe systems for content distribution (this is a biggish map so right click the central node, selecting fold all from Node, to start from the main topic).

You can also find the mindmap used to write Anonymity on the Edge in an interactive Flash format here.

I often use mind maps as the first stage in defining the scope of a risk or threat assessment. There are several interesting examples of security mind maps available on the web on including threats to mobile devices, ISO17799:2005 areas, general IT security, and a colourful map on password awareness.

Related Posts

• FreeMind and Flash #2
• Three Security Mind Maps
  

Does IT Security matter?

In November last year I was invited to QUT in Brisbane to give a talk on a topic of my choice. I finally decided upon Does It Security Matter?, a play on the well-known book from Nicholas Carr.

My main message was (and remains)

• There is a dependency between IT and IT Security but not a strategic relation
• IT and IT Security are good neighbours but not good friends
• IT Security is one area competing for attention and funding, amongst many
• If you don’t make IT security matter, it won’t
• Focus on securing business processes not the process of securing
• •Excel is your new best friend - make your spreadsheets work with their (business) spreadsheets

You can find the full powerpoint here.

The No Tricks Blog Name

When I was in grad school, some time ago, my office mate showed me a cartoon of two businessmen - one American and one Japanese. The American was big and fleshy with a cigar, while the Japanese businessman was slender, stylish and alert. The American basically asked "Why are you guys doing so much better than us?". The Japanese businessman is shown extending his fingers and counting off as he says "Your managers are greedy, your workers are lazy, and ...". But before he can finish even just the most obvious reasons, the American interrupts impatiently and says "I know, I know! But what's the trick?"

Marcus Ranum expressed a similar sentiment during a recent interview when he said that IT people will practically do anything to make their network secure except design it correctly. He compared this perverseness to people who will do anything to lose weight except diet and excercise. What's the trick? No tricks.

And last month, John Pescatore of Gartner reiterated his Security 3.0 position that prevention is better than cure, and that we should have a strategy for fixing bugs at source. I take his recommendation, which could easily be made 10 or 15 years ago, as a statement that security professionals need to return to the basics. This will not be particularly useful news for "what's-the-trick?" IT managers, but by now even they must realise that their hats are rabbitless and that their sleeves are aceless. What's the trick? No tricks.

Entrust PKI v5 Overview

A few years ago now I was working quite intensely in PKI, in particular with the Entrust PKI product suite. The team was having some conceptual difficulties in following the intricacies of PKI and their deployment in Entrust v5 so I wrote an overview document. The paper contains quite a few diagrams and protocol flows, which can help to understand how the product functioned in v5. I had hoped to be given something like this when I attended the formal Entrust training.