John Syers

The color blue, something forgotten, and sex

As I was running, I was thinking about my inability to explain some things to my children about the things of God. God reminded me that this isn't because of some shortcoming on my part. At some point words fail in explaining spiritual things. Just like words fail in trying to describe the color blue to a blind man, words fail in describing spiritual things to someone who is not spiritual. If you don't have that sense to provide reference, you just can't understand.

I've forgotten the second thing that came to me as I was cooling down...perhaps it will come back to me.

When I was on the porch, somehow my thoughts drifted onto the fact that when we lose sight of the purpose of a thing, we get in trouble. I forget how I got onto this particular line of thought, but sex is where it led. Oh, now I remember, I was thinking about abortion, and how the controversy boils down to right to life. But the reality is that we want sex without consequences. But reproduction is the purpose of sex. The pleasure is just a bonus. Just like eating. The purpose of eating is to fuel our bodies; the fact that we can enjoy food is just a consolation. But when we put the enjoyment of food over its real purpose, we are setting ourselves up for trouble.

It seems like I am shooting myself in the foot, here, but the truth is the truth. So does that meant that we should not have sex unless we are trying to reproduce? Hmm...

Conscience?

I know its been forever since I've posted, but since thoughts were brewing in my mind and I'm already at the computer, I decided to start typing. I am reading Hebrews 10. Verse 22 says, "Let us draw near with a true heart in full assurance of faith, having our hearts sprinkled from an evil conscience, and our bodies washed with pure water." So what is an evil conscience? I looked up the word in Strongs, and the word conscience derives from its homophone conscious. Conscience is moral consciousness. So my line of thinking is thus: we utilize our five senses to know that we are conscious, to provide awareness of where we are. We use our conscience to know where we are morally, to provide moral awareness. And if we have an evil conscience, its like a broken compass. It gives us false information, points us in the wrong direction, so that we never really know where we are.

Current Musings

I came down with some kind of flu bug last night. Not something terribly vicious, but enough for me to wuss out and not study today. I just finished reading Randy Alcorn's Deadline. Strangely enough, I read his latest novel, Deception, first. I was in a bookstore in Florida looking for something to read since I wasn't really into the beach thing like the rest of the family. Deception caught my eye, but when I realized it was part of the series, I looked at the earlier books. After looking briefly at what the other books were about, I decided to go with the one that got my attention in the first place.

Anyway, my thoughts now are not so much of the book, but I guess just kind of about Christianity in general. Or my Christianity. Or me. It started a couple of days ago. I started thinking again about who I am, and why I am this way. I'm thinking that its not by accident. God has shaped me into the person that I am on purpose. But to what end?

I've always felt that I was different. And not necessarily special, better than everyone else. Just different. Despite the spectacular shortcomings of my walk as a Christian as a young person, I can remember that I actually did want to serve God. I can remember making a sincere dedication to Him. I can remember reading the scriptures, and wondering why I didn't see anybody doing the things I was reading. I remember telling myself that it must be okay, but not really being convinced.

And now thinking of this, I am convinced that there are more people out there like me. Obviously there have always been people that have a heart bent towards God, you can find many of them in your local church. But there must have been others like me, who didn't have the same upbringing that I did, not born into a God-fearing, church-going family, but still had that inner inclination. And just like my young dedication became stifled in lukewarmness and materialism, there are no doubt many others who experienced the same or worse, depending on how many seeds were actually sown into their life.

This is an aside, but its a good one, because it ties into the thing I was thinking about when Steve was preaching. God has called us to be disciples, to MAKE disciples. And now I am thinking that's not the same thing as the thing we call soul-winning. The bible also says that we are to compel men to come in. Freely we have received, and we should freely give. But God is pro-choice. And many men have made their decision. The wonderful thing about decisions is that we are allowed to change our minds. But so many people in our culture have already heard the good news and aren't interested. Its very discouraging sometimes. But I'm thinking that I should always be on the lookout for that one among many, that person that has that thing in their heart. Of course I'm also remembering that the bible says we should cast our bread upon the waters, so that it doesn't mean that I should be stingy with the word of God, but the bible also teaches us to have discernment. If we cast pearls before swine, we shouldn't be surprised when the result is exactly what the bible tells it should be. But we were swine at some point too. Okay, I'm going in circles now, but I guess I'm thinking that there are times that we just cast out our nets and see what happens, and there are times when our efforts are much more deliberate and precise.

But back to the original thought: who am I? I am a guy who really does want to please God, and I want to do whatever it takes to fulfill the calling he's called me to. In some areas I have a decent degree of detachment to the things of this world, and yet there are some things in this world I am very attached to, some more than others. Sadly, over the past decade, I've undone a lot of the progress of detachment that had been done when I first started walking this walk. I've definitely accumulated a lot more things, which isn't necessarily bad, but some attachment has come along with some of the things. It seems harder to let go of the things of this world than it did back then, but maybe that's just an illusion. It certainly wasn't easy back then either.

I see that I am very much attracted to fiction and fantasy. When I back off from them, they start to permeate my dreams, and I find myself not wanting to wake up because I'm as engrossed in my dreams as I would be in a television program. I can't do anything about my dreams, can I? Maybe the whole thing isn't as unhealthy as I've been thinking? But anything becomes unhealthy when excess is involved. And for me that seems to be the case. Even now, with me reading a Christian novel, once I start reading, I don't want to stop. I will read into the wee hours of the morning. I'd never thought much about it before, but that can be just as distracting as if I had been watching TV, at least as far as my schedule is concerned. I can be just as grouchy if someone wants to me to do something that would pull me away from the book. And with books, I actually end up spending much more time reading than I would watching TV.

But still, I'm now considering the possibility that the fiction thing may not be bad, but I still have to control it just like everything else in my life. Like eating. Eating isn't bad, but right now its one of the biggest struggles in my life. Just because something is good doesn't mean that you don't have to but boundaries and restrictions on it, and keep it under control. Just because you have problems with something and have to put boundaries and restrictions on it, doesn't make it bad.

Somewhere down the line, I became open to the idea that totally removing things from my life, that seem irrevocably linked to our culture, was a viable option. Thinigs like television. Now that I'm thinking about it, I didnt think that doing those things proved that I was some kind of superchristian, that I was better than everybody else. I actually thought it was because I was weaker than other Christians, that they could handle watching TV without being totally glued to the set, while I can't. But there were other thoughts too. I guess one of them was maybe self-congratulatory that I would even consider such 'radical' moves in my Christian walk. There has also been the influence of legalism in my life. Carolina and I had this talk awhile back. There has long been this thought on the edge of my conscious thought that legalism was bad, but it wasn't as bad as license, because at least you were trying, at least you were doing something. Now I see that as false. In fact, as Carolina said, legalism is probably worse, because it is the breeding ground for self-righteousness, which is terribly destructive because you can get off the path and still think you are right.

I have pretty solid admin skills. I've worked as a clerk and seriously considered human resources as a career. Also thought about accounting, as I'm at home with numbers. I've had a love for computers since I was seven years old. I still don't know half of what I want to know, but the fact that I've got four computers in this house right now, one of which is at my feet with the cover open and the power supply pulled out, kind of shows where I am in that regard.

I'm in the Army. I learned how to fly helicopters. I joined because it seemed like the right thing to do, a win-win situation. Serve my country and gain skills in the process. I wasn't particularly interested in leadership, management or operations, but up until recently that was my entire Army experience. Now I've shifted into a more technical field.

I am interested in theology. Just like computers, there is so much more about Christianity and God that I want to know. I kick myself that I haven't take the time to take formal classes to learn more. I've thought about being a Christian counselor. I think that I know how to listen to people, and I like to help people solve their problems.

Communications wise is a mixed bag. I think that I've gotten much worse in speaking than i used to be. My brain is like hard drive that needs to be defragged. I get stuck in the middle of sentences because I'm looking for the perfect word. Or I have to start sentences over again because the word I wanted to use doesn't come up. I feel like I sound pretty stupid. When I have prepared speeches, people say I have a very soothing voice. Does that mean I put them to sleep? I have been complemented on my reading. I've been told I have a radio voice. I used to envy the voice God gave Victor Boutte, a voice that you just could not ignore, but I did learn long ago that God made Victor to be Victor, and he made me to be me, so I shouldn't be envious about what God gave him.

But I guess that's what all this is about. It seemed pretty obvious what God called Victor to, but it hasn't been clear to me where God is calling me. I realize that one reason is because I haven't been listening. I've been distracted, sidetracked and to be blunt, I've been in bondage to sin for many years. But in those moments of clarity, I usually find myself asking, 'So what am I supposed to be doing now?'

And yeah, I got it. My immediate mission is to be a husband and father. To raise a godly family. But I guess I'm wondering what else. Every husband and father has that mission. I'm looking at where life has taken me, how I've been shaped, and thinking there's more to it than just that.

Bace Ch 7: Technical Issues

I just couldn't get into this chapter at all. The gist of it is that there are issues that degrade the performance of instrusion detection systems. The issues discussed are scalability, management, reliability, analysis, interoperability, integration, and user interfaces.

Bace Ch 6: Vulnerability Analysis: A Special Case

Bace talks about Vulnerability analysis because it relates to intrusion detection as being a static analysis scheme. Basically vulnerability analysis is taking a snapshot of the system looking for security problems, checking against some predetermined configuration and reporting to the user. COPS is discussed up front. Bace makes a distinction between credentialed and noncredentialed approaches, acknowledging that others prefer to call them passive and active. Basically the difference is that credentialed approaches work inside the system, and noncredentialed appraoches work outside the system. The latter basically is attacking the system itself--testing by exploit.

SATAN is discussed near the end. Just what I read about SATAN reminds me of Nessus. Password cracking is also discussed.

Bace Ch 5: Responses

Somehow I never got around to talking about chapter 5 yesterday despite the fact I finished it and started on chapter 6. Chapter 5 is a very small chapter, which is somewhat disappointing considering the fact that the focus of my thesis is the response part of intrusion detection.

The note on page 122 talks about the people who are the standard users of intrusion detection systems: network security specialists, who are generally experts in security, but maybe not in the underlying systems that are being protected; system administrators, who out of necessity have to be conversant in both security and underlying systems; and security investigators, who may not be conversant in either, but are experts in conducting investigations in general.

There's some general talk up front about how design comes into play. The environment, the purpose of the system and regulatory requirements all come into consideration when considering exactly what the response of the system will be and how the information is communicated to the user, if at all. Active responses fall into three categories: take action against the intruder, amend the environment and collect more information. Bace points out that the first is the one that captures people's imagination nowadays. Passive responses are: alarms and notification, and SNMP traps and plug-ins.

The point is made that while the intrusion detection system should be generating alerts, the alerts should not be visible to the intruder, and that the intruder will be looking to intercept and do away with the responses. Lastly the chapter talks about the actions a user should take after receiving a response, ordered by "time and criticality of the activities."

Limiting children's computer time

Apparently I have created a monster. It seems like all my children want to do is spend time on the computer. I also have to face facts though. For some reason I have been wanting to think of a computer as a business machine, a productivity machine, when I have a computer in the living room! That's not for business, that's strictly for entertainment. But my daughters spend a lot of time on it, and they get beastly if they're interrupted from their reverie. We don't have television per se, as you can't get any stations on our TV, but now the girls are watching television shows directly from web sites, so its the same thing.

All of a sudden it hit me, there's probably software out there to limit the amount of time that kids can be on the computer. This thought hit me immediately after the thought that I could probably write some kind of code to accomplish this. That shows how lazy I am. Anyway, I got online, and I found a website called Software Time, that markets a program called Computer Time. It seemed to do what I was interested in, so I plan to talk to Carolina about it. They also have a 14 day trial, which is good. We are currently using Glubble, but it leaves some things to be desired. This Computer Time program is supposed to do some Internet limiting too, so that's worth looking into. That's another reason why I thought about writing my own program, but that takes loads of time. Basically though, I'm thinking that a internet limiting program is basically just a firewall with some type of web interface. I also found a site with lots of different programs to choose from, but I don't have time to do through all of them.

The modesty question

Okay, I've looked into the modesty question, and for the most part, I confirmed my suspicions. I knew all along that the bible doesn't give you standards like, any skirt above the knee is immodest, but I was sure hoping...! Anyway, using my handy-dandy copy of eSword, I looked at 1 Timothy 2:9 and read the original greek for the words modest, shamefacedness, and sobriety. I also looked up the words modest and modesty at m-w.com, and learned that it means propriety, which basically means what is fitting and appropriate. But appropriate for whom? For society. So...we all know that is a continually shifting sand, so I wasn't too happy at that point.

So I decided to go to the web. I found an article on MInthegap.com which was really excellent. I think I'd seen MInthegap once before, and since its currently got some kinda database error as I'm typing this, I can't say more about it. One of the things that had been lingering in my mind about modesty was that it had to do with wanting to be noticed, to show off, which is the connection between modern day modesty and the scripture in 1 Timothy, and that was confirmed. The article made a connection between modesty, chastity and humility. There was more, but like I said, the site is down. The big thing, was the survey. There was a link to the Modesty Survey, a survey of over 1,600 Christian guys about what they consider to be modesty. Good stuff. I only went through a fraction of it before I decided to capture it here before my daughter's piano lesson was finished and the window of opportunity was closed.

A thought of a previous moment

A thought that's been on the brain for several days now that I haven't followed up on is what it means to be modest, and how modesty relates to the scriptures. There's this passage of scripture that talks about women not being adorned with braided hair and such. That doesn't really seem to relate to today where women are scantily clad, but then again, maybe it does.

Bace: Ch 4--Analysis Schemes

Eh, I read it all, and I got a basic understanding of what the schemes are, but there was a lot that went over my head. And I'm wondering if it even matters. Another problem of mine is that when I'm reading this stuff I'm always asking myself, how do you code something like this. I gotta stop asking that.

Basically everything is broken down into the categories of misuse detection and anomaly detection. Honestly, I may have to read this chapter again, but the only thing that's really sticking out now is the conclusion of the chapter, namely that "analysis involves isolating patterns of behavior known to represent problems (misuse analysis) and using mathematical approaches to characterize user behaviors that are abnormal (anomaly detection)." (pg. 117)

There was some talk about agent based systems that did get my attention, though. For some reason, I hadn't considered that others may have done research very similar to COL Carver's, and that I could base my thesis off that research. Definitely worth looking into.

This past weekend

So what all happened? We left Friday night to go to my mother's house. We got there and then went to Taqueria Arandas for dinner. After we finished eating, my mother went to Kroger's and we went back to the house. I don't know exactly when she got in, as I went to bed sometime after 10pm. I woke up around 6am and left for Port Arthur to have breakfast with my father. We went to Conn's and looked at a very nice priced digital SLR camera. He also took me by Lois's so that I could meet her granddaughter, who was celebrating her third birthday that day. We went back to his house and I made the mistake of getting on the computer. We had been talking about Linux distributions, so I downloaded virtualBox so he could play around with some distros in there. In the process I also ended up downloading utorrent and 7zip. That kept me there later than I should have been, as I'd told Carolina I'd be back before the morning was over.

When I got ready to leave my dad's, he noticed that the rear driver's side tire was almost flat. He guided me to a shop where I got a cheap replacement, and then I headed back to Houston. By the time I got there, it was after 3pm. We hung out there for awhile, and then went to Maria's. My brother-in-law was on the porch relaxing with one of his friends, Ivan. Ivan explained to me that I was rude to him the last time I was there--I walked past him many times and never spoke. I remembered that the last time I had a terrible headache, plus I wasn't sure he spoke english. He demonstrated his understanding of several languages, including German and Arabic. He picked these up as a merchant marine. After leaving there, we went to see my other sister-in-law Rosalba. We stayed there for awhile and then came home.

Sunday we went to church as usual, but I started the day off much better than usual. I'd gotten to bed around 10 or 11 the night before, so I got up around 7 and decided to put on an old CD and sing along in praise to God. The CD was Jesus is Alive. That really got me going spiritually. I then went out and ran two miles. I showered and then we got off to church. Carolina was helping with the preschoolers, so she left early by herself. Since I'd already gotten off to a good start in the morning, I was really moved in the service. I had already been moved to tears once that morning by myself, and it happened twice during the praise and worship at church. It felt good. I can remember when this happened before, and I've always taken it to mean that God is moving and doing that work in my heart that I've asked him to do, to take away the heart of stone and replace it with a heart of flesh, a heart that is tender and receptive to His voice. One of the deacons spoke about justice and retribution. The examples he gave from his own life were very powerful.

When I got home, I found that the network connection wasn't working. I'd tried it the night before and thought I just needed to reboot my laptop, but I found that I just wasn't receiving a signal from the modem gateway. I went to the computer with the wired connection and was able to connect without a problem. I rebooted the modem with no results. I checked the user's manual and went through the troubleshooting steps, also with no results. Finally, I called Motorola. I was pleasantly relieved to find that the customer service was knowledgable, not reading from some canned script or something. Apparently, while we were in Houston, the channel I was using became overrun, possibly by the nearby ISP. The customer service rep also mentioned my WEP 128-bit settings as a possible culprit, but I'd never had a problem with them before. Anyway, we got it fixed. I also took this opportunity to switch from WEP to WPA.

I also got a pleasant surprise that afternoon as I got a call from SGM Quarles. I'd sent him a letter a week ago with my contact information. We talked for awhile, and I told him I'd be trying to contact Julio and get with Silvia so we could get something together.

Thought of the moment

Bace: Ch 3--Information Sources

Bace is taking it one chunk at a time, which is good for somebody like me. Intrusion detection systems determine whether an intrusion has been made based on information. This chapter discusses where the information on which the decision is made comes from. She also talks about the different levels of abstraction of information, and how they can affect the intrusion determination.

She talks about operating system audit trails and system logs. The audit trails are lower level and more secure. She gave real world examples, with Solaris Basic Security Module and Windows NT event logger. Now the thing is, I guess I thought of BSM as being an audit trail and event logger as system logs. Actually, I'd never heard of BSM before, and I'm wondering if anything similar is present in Linux. Maybe that's what the commercial versions provide.

The need for audit reduction is described. The gears shift from host-based information sources to application based. On page 60, she says the intrusion detection community thinks that all the important ID information will be at the application level. I wasn't understanding why until I read her examples about database systems. Some computer systems exist only to run extremely large scale applications like databases or web servers, so yeah, that's where all the information would be. Network based sources were discussed, but most of it was either stuff I knew or had at least heard of.

And she said that there are other sources--including human sources. Of course we set configurations and such, but we can also feed the machine outside information that it doesn't have access to but is relevant. She also pointed out that data within the sphere of computer security but outside of intrusion detection can be useful. Her example was physical security logs to corroborate whether a masquerader is at large.

Bace: Ch 2--Concepts and Definitions

No surprises here. Pretty short chapter. Starts off with an introduction to intrusion detection where the components and goals are stated. A lot of the chapter actually deals with security in general rather than intrusion detection. Formal definition of computer is given with the security triad of confidentiality, integrity and availability. Threat, vulnerability and the relationship between the two are mentioned. Security policy is covered. Other parts of security infrastructure are touched upon: access control, identification and authentication, encryption and firewalls. Intrusion detection systems are classified and the components are listed. Page 41 deals with response, and I learned a few things. I guess I should have known, but response is a lot broader than what were hear about the most, which is going on the attack. Using Bace's definition of response, all intrusion detection systems are response systems, which I guess I've kinda though all along was correct.

Bace: Ch 1 continued

These were thoughts that came to me as I was reading, not actually material from the book itself...

Can an IDS backtrack password guessers? If you have an IP, can the system check tos ee who is behind the IP? Can the IDS investigate, play detective? If its an internal threat, it should be easy, but if its an external threat, it could be hard. But could a person somehow monitor that remote IP to see what else that person is doing? Maybe they logon to some system that shows their name or username. Maybe you can get a general idea of who they are by the websites they look at. If they look at tamu.edu there is a strong chance that they are a prospective or current student (with a smaller chance off being a former student). But I guess before I go too far down that rabbit trail, ethical considerations need to come into play. Is that legal? Invasion of privacy? I'm thinking not, especially if the person was clearly trying to guess passwords on your system. Don't you have a right to try to figure out who that person is?

Better yet, can I get a person's MAC address if I know their IP? That would be more useful than an IP in this day of DHCP. But I'm guessing the IP address would be more helpful in trying to track the person. Should this program be named after a tracking dog (Malamute??) or a detective (Ollie, Bacon?)

...

I'm so ignorant. Bace tells me on page 22 that my tracking system idea was done 18 yeras ago, in a system called DIDS.

...

So overall, chapter 1 pretty much lived up to its name. I got a short history of intrusion detection. What's nice is it not only tells the systems, but it also tells the players, including the principal architect of each system. What's disturbing is that this book's history stops at 1990. The book was published in 1999, and I was content to have a book that is almost a decade old if it was pretty definitive. But if the information is actually decades old...I don't know. Well, I guess I'm not reading this book for the systems, but to gain an understanding of the concepts, so this book still should be okay, I hope...

Bace: Ch 1--History of Intrusion Detection

I understand that just as the basis of intrusion response is intrusion detection, the basis of intrusion detection is audit. She defines audit as the process of generating, recording, and reviewing a chronoligical record of system events (page 7). The Tan Book states that one of the goals of an audit mechanism is to provide assurance that attempts to bypass the system will be recorded and discovered. This made me think again of my idea to have duplicate logs on multiple systems, as many systems as the security administrator can get his hands on. I'm thinking that it wouldn't be too much trouble to send logs to about half a dozen systems, and an intruder would be hard pressed to delete logs from all of them. At the very least it would take a lot of time. But could the mechanism that facilitates sending the logs itself make the recipients vulnerable to attack?

Bace: Introduction

I decided a long time ago that I would use Rebecca Gurley Bace's book Intrusion Detection to get me up to speed on intrusion detection. Now I'm finally actually reading the book. I like how in her introduction she describes the cycle of how new technology is adopted and eventually abused, bringing about the need for regulation (page 1).

On page 2 she defines intrusion detection as the process of monitoring the events occurring in a computer system or network, analyzing them for signs of security problems. I actually told someone a few minutes that my thesis was on intrusion detection. I guess I'd forgotten that my thesis is actually on intrusion response. Intrusion detection is part of intrusion response, so I figured I'd get that base. Plus I haven't found any definitive books on intrusion reponse. Perhaps I can write one someday.

Yesterday

Yesterday I basically wasted an entire day. I don't mean that I did not do one productive thing the entire day--if nothing else I sent our defective wireless keyboard back to be replaced. What I mean is that I didn't do what I was supposed to do. After I came back from the Post Office, I came to the library, and I was supposed to work on my thesis. Right now that means that I need to be learning about intrusion detection, gaining knowledge about the subject matter. I did not do that. I spent the entire day surfing the web, looking at computers, televisions, digital pianos, but not one time did I crack a book. Its pretty sad. I am going to do better today.

Craziness

I finally got this blog thing where I feel like its worth posting to, and now I'm not able to publish--the server is not accepting FTP. That's strange, because I seem to be able to access it by the web, but then, there appears to be more than one server somehow.

So...I had one blog which I guess should have been remotely related to academics, but I seemed to mostly post my spiritual state. Then I created a work blog to keep track of my thesis work from day to day and the work I did on CCDC. But it was getting too difficult to maintain more than one blog, and I had said at one time if I did do another blog everything would be put all in one blog. The bad thing about that is that people who may be interested in the academic stuff may be put off by the personal stuff, and vice versa. But in all likelihood, nobody is going to look at the blog but me. And if I use categories correctly, people can still separate the blog into whatever they want to look at. Similarly, I am using Thingamablog as opposed to just Notepad as I had been doing before, but Thingamablog does not allow for comments. More than likely, nobody will be looking at the blog to comment anyway.

Last Week

I didn't accomplish much last week. I'd been on 'vacation' since my dad came to town, which was around June 14th. The previous week we went to Florida. I don't even think I made it to the library until at least Tuesday, maybe Wednesday. I pulled the Intrusion Detection book off the shelf several times, but I didn't do any actual work. I remember now, that first day I spent time trying to create a sample C++ program to create a Windows (Vista) Contacts object. The goal was to familiarize myself with Windows Contacts to create a Thunderbird plugin. I failed miserably. A Windows Contact is a COM+ object, and creating one isn't as cut and dried as I thought.

I honestly don't remember doing anything of value on Thursday. No, wait, I emailed Willis Marti telling what little I actually had done and asking him if Patrick had actually gone to CCDC. He said he'd been as a participant and as a coach. On Friday, I started working on getting Thingamablog to the place where I could use it for all my blogging needs. I finished that today. My goal is to merge entries from both previous blogs into Thingamablog. It would be a cut and paste job if it weren't for the fact that the dates have to be entered using the form field. That's going to take time for each entry.