It was the best of times, it was the worst of ti... *ack*

The New Year is upon us. Happy New Years to all of you out there brave enough to read my blog. 2002 was a pretty challenging year for many of us, and I for one am looking to a better and brighter future in 2003. I wish you all the same success and prosperity in your personal and professional lives that you wish for me.

New Years Eve is always the turning point with new resolutions picked out on the spot, which we typically forget about a few weeks later. This year I truly didn't have any resolutions, as I already knew what was in store for me. And I think it is time to share that with you.

The first thing is that of my health. My doctor says I am in excellent health, except for the obesity. Kind of an oxymoron there if you ask me, but I guess its better than being stressed out with heart problems or cancer. (I send my prayers to you Kevin and James and hope you guys get through this well) My weight has been a challenge since my thyroid gave out, and its about time I quit whining about it and do something about it. Most of my problems are surrounded around the combination of bad eating due to negative stress and not exercising properly. So I have vowed to fix that with some lifestyle changes.

The first lifestyle change is to start exercising more. My wife and I have decided to begin a work out routine together in the evenings, 3 days a week. If anyone cares to know, my routine is as follows:

1. 15 minute tread mill walk elevating to 3mph on an incline ranging for 2-4. T
   his is to warm up the muscles and get the heart going for me.
   
2. 3 sets of 12 - squats
   
3. 3 sets of 12 - lat pull downs
   
4. 3 sets of 12 - bench press
   
5. 3 sets of 12 - bent over row
   
6. 3 sets of 12 - shoulder press
   
7. 2 sets of 12 - bicep curl
   
8. 2 sets of 12 - triceps pushdown
   
9. 30 crunches
   
10. Cool down
    

This is kind of tailored to my equipment I have here, and is the "Super 7" muscle blast I used to do when in the military and with my trainer. I may actually start out with 2 sets for items 2 through 6 and then 1 set for items 7 and 8. The reason for one less set is that the arms are already getting the workout from the other exercises and having positive failure won't do me very good if I am not isolating it. I would rather do focused and proper exercises for the muscles than to do it hap-hazardly and exhaust them without getting the proper workout for them. We will see how it goes.

I also plan on trying to play squash at least twice a week, hopefully three times. With Arcterex now coming out here three times a week and later five in Feb I hope to be able to hit him up for a few games a week, as well as Cuvarack. Top that off with a regular lunch game I hope to get started at the YMCA, I hope I can actually get this worked out. I really like squash, and don't really consider
it exercise. But it is. Quite a good one for me actually. The charts say due to my size and the amount of play, I burn around 900 calories per squash session. Thats truly awesome. And I ENJOY it... which makes all the difference. And I feel it... I am always sweating pretty hard and breathing pretty hard. I must be doing something right, since my body sure is telling me that.

The second key lifestyle change is actually a compounded one, or more to the point one that requires the other and ends up being two lifestyle changes. Lately I have been extremely stressed in a negative way, and it has caused me to eat in anger and frustration rather than for nutrition. And the eating has been of comfort food because of this, which has had me gain an extra 40 pounds this fall. Not good. Not good at all. I need to stop this. And the best way is to eliminate the negative stress... which I have now done. (I will get to that in a moment). As for the eating, I have had a chance to work with the hospital dietician and hopefully will now be on the right track. For me, its all about the caloric intake in conjunction with the amount burned. The normal foods I eat aren't the problem, its the frequency and amounts tied to the stress. With any luck I will now have that under control.

Which gets me to the third lifestyle change. I needed to eliminate the negative stress I have been having... which has been focused on my career. The closure of Merilus hit me pretty hard, mostly because of the devastation it caused so many people. Employees, other businesses, customers and even myself. I was left hanging with more money lost/indebted then you can imagine. Hell, it could pay off some peoples mortgages the amount of money I was owed or owe by virtue of the closure. I learned a lot about who were my friends and who were not after the closure. People who I respected highly and trusted ended up trying to take advantage of the situation and did more to damage their credibility in my eyes. I also made a few decisions that in reflection I wish I wouldn't have. I should learn from my past mistakes and found I didn't, making decisions based on friendship rather than business sense. I have been to trusting and that has hurt me both professionally and personally. The rekindling of NetMaster was a fight to make something out of the ashes, but that hasn't done so well. My vision of where the company was to go never took hold and after rebuilding the product and getting it to market, I have felt like a third wheel and can see from a management perspective that I will not be able to move the company forward the way I would like. The problem is not product... it is sales. And being that I am not in control of that, I can see this as a huge problem. There is a lot of value still in that company and I am still a major shareholder. I believe as a multi-branch office deployment system our software is in the right spot at the right time for OEMs. Unfortunately we have to chase them down, not the other way around. On top of that, over the past year my belief that perimeter defenses are not the key mechanisms in the process of digital security has me rethinking the way NetMaster works.

For the past few years I have spoken at security conferences and written in my book and in articles about layered defensive tactics on the network. Security has to have a defence in depth posture with multiple checkpoints to ensure protection of the information. When I designed the security infrastructure for my work at NetMaster I was focusing on opening ways to do this. The invention of the FireCard was my first attempt to move a firewall into a server, providing another level of defence around the critical resource infrastructure past the perimeter firewall. Costs were just to high to properly get this integrated into the network. It was funny, I was taking to a guy I know from the Communications Security Establishment a couple of weeks ago (better known as the CSE, the Canadian version of the NSA) and he told me that they took a really long look at our product. So did the US Navy. They really liked it but it was just too expensive to deploy across thousands of computers. And I get that. The Transmeta driven card was just too expensive. But the StrongArm and Geode versions just didnt have enough power. It was hard to find the right balance.

On top of that, it only was able to provide a peripheral amount of protection, as it could not provide cooperative enforcement with other technologies such as anti-virus, content filtering and biometric authentication. And once you got by the firewall, it was useless. With 70% of the digital intrusions coming from WITHIN the network (a quote from the FBI/CSI Security research report in 2000) the firewall was basically useless on a local network. Now top that off with all the new wireless access points that expose new risk and you can see that the traditional approach to firewalling won't cut it any more.

I have thought hard about this. Especially when I look at the landscape of computers and their users of today. Lets face it. As a Linux/Unix advocate I wish everyone would move to a more secure platform. (Personally, I think OSX would be the right move for many but Apple won't open the OS to other hardware) But it is just not practical for most organizations to move from Windows. Linux is not winning on the desktop. Over 90% of the users are still using Microsoft platforms. And Microsofts latest work with XP and Longhorn has come a long way. I no longer have a Linux desktop as my main system, which I did have for over 5 years. I use XP Pro, cleaned up and secured to my liking. (With a special flavouring of cygwin to get access to all my Unix tools) It took some doing to get my platform secured and that has me thinking.

Defence in depth has to be taken to the end point, which is mostly driven by Windows. But it has to be done in a way to be centrally managed. End users don't want the hassles of having personal desktop firewalls popping up all the time. And most of them are useless once you say "yes, allow access to port 80". What if you only wanted it for that session? Or if the policy changed? Or the application changes?

Personal firewalls suck. I tried them all. They all have some good points but they were not designed to be controlled in an enterprise network. Even more so when you start to expose Extranet remote users with VPN technology. They don't have real mechanisms to handle corporate security policies and push them out in real time without many hiccups. And to top it off it is still to easy for Trojans, worms and other virii to bypass the security measures if allowed just once.

Years ago I started some research on my own time to solve that. I think it is time to turn that research into a business. As such, to remove the negative stress in my life because of work I have decided it is time to leave NetMaster and form a company focused on solving this critical issue. For years I tried to make Linux solutions to solve defence in depth security issues to be used in Windows environments. Now, I am going to take it to the endpoint, and secure the desktop properly. Instead of complaining about the problems with Windows security, I am going to do something about it.

And I am not alone. Both the CSE and IRAP are interested in helping me out. The National Research Council's Industrial Research Assistance Program (NRC-IRAP) is Canada's premier innovation assistance program for small and medium-sized Canadian enterprises. Tapped into their experts as well as the Communications Security Establishment I will be releasing computer security software for the Windows platform that will be of the highest grade of quality and security. And I am doing so in a specific field where there are very few players. Firewalls are not enough anymore. The world needs software solutions at the endpoint to properly enforce corporate security policies in real time. Working with the CSE to build the system around the CCS (Common Criteria Standard) I expect to release security software that can be used at the highest levels in military, government and enterprise applications. And to boot, the design will allow small and medium enterprises to gain the security they need as well. I am going to be breaking the pricing barrier. This will be affordable for all businesses so they can properly secure their Windows environment. And more to the point, the infrastructure is expandable to also encompass Linux, OSX and basically any other kind of networked device that has a TCP/IP stack, including cell phones with data services.

I really am excited about this. Not only is the project removing a huge amount of negative stress I have had in 2002, I am doing something the way it SHOULD be done that is needed and wanted by people out there. One thing I have learned in the past five years is it doesn't matter how good the product is if you can't sell it. Knowing I already have a couple of agencies/companies willing to buy it assures me a good start, and I have the great luck to have a few mentors who are willing to work with me to finally get over the problems of sales and assist me in making this work. And that excites me more. Especially since these mentors have built companies that generate huge revenues and sold them for 10s of millions of dollars. Just after Christmas I had the luxury of meeting with them and I was excited at the people they have interested in helping me out. I already can see how this is the right time for me to refocus myself with people around me who I trust.

2003 looks to be an exciting year for me. It is going to be tough for the next 6 months or so as I build this, but I am sure I will manage with many of the friends around me for support. (You know who you are). The greatest thing is the fact that the stress is induced by me and is controlled by me. And as positive stress, not negative stress. I don't have to fret about others not reaching their milestones, or excuses on why they cant accomplish their goals. If this thing succeeds or fails... I need to look in the mirror... not at others. I no longer will leave my life in the hands of others that don't have the same vision or interest as me. And I have learned a great lesson about trust and professionalism in business in 2001 and 2002. Now that I have spent the last few years gaining that knowledge (along with all the other educational challenges I have had the pleasure of learning from) it is time to apply it and build the successful computer security software company I know is possible.

Wish me well. Today is the dawning of not only a new year, but also that of a new life with huge lifestyle changes.

Posted by SilverStr at January 1, 2003 06:47 PM