Let Us Now Praise (Not So) Famous Men and Women
By blogsadmin on Jul 07, 2006
In regards to a matter of both procedure and etiquette (I hate the word "Netiquette," because good manners are timeless and are only diminished by the Internet, not enhanced by it), one of our stellar marketing kahunas emailed me a week or so ago to say that a lot of responses to my blog had not gotten posted through a technical snafu (a word of military origins, from the acronym "situation normal: all fouled up"). She apologized to me and said the issue had been fixed and would not—fingers crossed—occur again. Katheryn now also knows the Hawaiian for "bummer about that" (Auwē noho'i e!) for future reference. So, first of all, thanks to those of you who posted in response to my blog—particularly those who liked it—and my apologies that your comments did not appear sooner. I hope to get back to some of you individually over the next few weeks.
I was pleasantly surprised to read postings from several old friends, including someone who served with me at my last active duty Navy command. Still another poster (who knew me from a previous life at Oracle) wondered in conjunction with the blog entry on military history why I have not talked about my military background more extensively.
As I write this, it's the 4th of July (I joke with my UK employees that, though they do not get the day off, they can recognize this as "Thank Heavens, We Got Rid of Those Troublesome Colonials Day.") While there are many patriots who do not wear a uniform, it's also true that those who have served in the military literally have laid their lives on the line for their country. As such, it is a good day to reflect upon the nature of military service, and the way my military service influences my thoughts on security to this day.
I spent a fair bit of my late childhood and adolescence living at the United States Naval Academy, where my father was the academic dean (a civilian position, but he was in the Air Force Reserve at the time—more on that later). I grew up around a number of military people and was privileged to meet some extraordinary individuals who had real places in history; e.g., one of the die-hard fans I used to sit next to at Navy sporting events was a retired rear admiral who had been the berthing officer at Pearl Harbor the day the Japanese struck (in short, he had decided where the ships were parked that day). Another individual I met had been ADM "Bull" Halsey's chief of staff and later, was Chief of Naval Operations during the Korean War. The headmaster of my school set up the Cuban Missile Blockade. My algebra teacher was a defender of Midway (BGEN "Barbed-Wire Bob" Hommel). These individuals continue to exercise an influence on me for reasons as diverse as the opportunities that they helped make available to me in the Navy, and the content of their character, which I hope I emulate half as well as they did.
My military career was short and nowhere near as illustrious as that of so many people I met growing up. I joined the Navy directly after I graduated from the University of Virginia. I was given a direct commission in the US Navy Civil Engineer Corps (CEC); that is, I did not go through Reserve Officer Training Corps (ROTC) or Officer Candidate School (OCS) to secure a commission, because I already had my "Navy trade" (I was an engineer). For those who do not know what the CEC does, I recommend the old John Wayne movie, The Fighting Seabees, which is still used as a training film at CEC Officers' School. I served three years on active duty and multiple years in the reserves, several of them with a Reserve Naval Mobile Construction Battalion (RNMCB).
I should explain that, at the time I was in an RNCMB, women were not, technically, supposed to have those jobs. Women, in fact, were not supposed to be in anything like a "combatant unit," despite the fact that in war, bullets do not discriminate and typically, the military wants to use the very best people they have for the job, regardless of gender. My sister and I were technically assigned to the staff of a Naval Construction Regiment (in paper-pushing jobs), while in reality—and cleverly—we were "cross-assigned" to naval construction battalions by a reserve Navy Captain who believed in bending the rules in a good cause. I should also add that the men we actually served with in the RNCMBs were almost universally supportive, respectful, and treated us fair and square, which is all that we wanted: a chance to prove ourselves as leaders.
I learned an important life lesson vicariously from my sister in the course of a field exercise she participated in with her RNMCB. Field exercises typically are designed to help you prepare for war by having "attackers" and "defenders" execute a battle plan. There are—also, typically—rules of engagement about what is allowed and not allowed in these field exercises.
My sister had done a lot of the work to set up the field exercise, which included active duty members of the US Marine Corps as the attackers. I believe there may have been an element of "active duty" vs. "reservists"—aka "weekend warriors"—rivalry going on, as well as the fact that many men do not want to lose to women—in anything. All this notwithstanding, my sister managed to—I believe the correct word is "annihilate"—members of the US Marine Corps in this field exercise, in no small part because she violated the rules of engagement and smuggled in night vision scopes, which were relatively new and just beginning to be fielded. In short, she could see in the dark and the Marines could not. They targeted her unit, perhaps to "teach the female officer a lesson," and she used that against them. As she says to this day when I remind her of the story, "Rules? There are no rules. This is war!" The Romans would say: Sid sibi pacem, para bellum (If you would have peace, prepare for war). The Marines may have smarted in losing to a bunch of reserve Seabees, but they will not underestimate them again, nor did anybody underestimate my sister again. (I had learned at the ripe old age of 5 not to underestimate my sister.) I venture to say that underestimating the enemy is a cardinal sin in war. She taught a number of people a very good lesson, indeed.
I was reminded of this incident recently when a colleague at Oracle I respect immensely wanted my ethical hacking team to do a security assessment of his product. He was explaining the functionality the product is designed to support, and initially requested that my team conduct their ethical hack within the boundaries of what the product was supposed to do. I agree that testing "does the product perform within configured boundaries and configured security policies as applicable" was an important part of the ethical hack. However, "no holds barred, throw the rule book out" hacking I also wanted to be part of this assessment, since unethical hackers aren't going to care (or, as we say in security parlance, "give a rat's tuches") what our stated security policies are. Furthermore, our customer may not always configure or use the product within the bounds of our assumptions. As my sister would say, "Rules? There are no rules! This is war!" Field exercises and "ethical hacks" are good opportunities to prepare for the worst in a controlled environment, but to get the most out of them, you need to consider what happens if the rule book is not followed by a real opponent, which it almost surely will not be.
One individual who looms large among those who influenced me is a not-so-famous woman who probably did more than anybody to open up opportunities for women in the Navy, CAPT Winnie Q. Collins. When Winnie joined the Navy in WWII as an officer, she was among the first to do so. She was among the first group of women to be stationed in Pearl Harbor; she designed training programs for other Navy women (even designing women's uniforms, some of which are still worn today and still look great). There was a time when there could only be a single female CAPT in the Navy, and Winnie was it.
Winnie had better sea stories than almost anybody else I knew, like the time she inadvertently blew a kiss to ADM Nimitz (only Winnie could pull that off, I have to say), and the time she met ADM "Bull" Halsey. Winnie pushed the bounds of what women were allowed to do; she did it with style, with diplomacy, but nonetheless, with fortitude and persistence. Years later, when the so-called combat exclusion came down and more opportunities opened for women to be pilots, to be stationed on ships, and other critical jobs in national defense, nobody was more pleased than Winnie and nobody deserved a bigger round of applause for working for decades to see it happen. Winnie died several years ago and was buried at Arlington Cemetery after a military funeral with full honors, which she would have loved, and which she richly deserved. I appreciate that there were opportunities I never would have had if it were not for her and other "forward-thinkers." I miss her to this day.
One influence I alluded to earlier deserves his own paragraph: my Dad. OK, this is, in a way, a throwaway, because everybody's Dad is a big influence on them (sometimes, alas, a negative one). My father fought in two wars (WWII, where he served in the Pacific Theater with the 20th Air Force in the Marianas and finished the war as a 21-year-old Army Air Corps Captain) and Korea. (He also has great war stories I am still listening to. I only found out a few years ago that he had met both GEN Douglas MacArthur and GEN Curtis LeMay. How cool is that?) He stayed in the Air Force Reserves and retired as a Major General. As I mentioned, he was in civilian life the dean at the US Naval Academy, where he made many positive changes to the academic program. (Any former "boat schoolers" reading this, my dad was the one who instituted the reading of every graduate's name at graduation, not just the honor grads, because he felt every midshipman deserved his or her minute in the sun.) One of my happiest moments in life was the day my dad swore me into the Navy (I still have a picture of the event on my piano: my Dad in his Air Force blues, and me in Navy dress whites, looking as ecstatic as I felt at that moment).
My father is the most high-integrity person I know and his is the standard I try to emulate. As my Mom says, my father has never let her down on an issue of moral principle or integrity: he always does and always has done the right thing. Integrity and honor now seem like "quaint" or even "archaic" concepts in a world where so many operate based on what they can get away with and what everybody else is allegedly getting away with, but my belief is that at the end of the day, all you really have is your honor and integrity to recommend you. (The military, I might add, still values these attributes; consider the motto of West Point: "Duty, Honor, Country" continues to be enshrined upon every heart on the Hudson.)
Integrity I think is particularly important to the practice of security because the consequences for shading the truth can be so drastic. Your job is to provide your very best professional opinion about the state of your product, or your "operational defenses," to the very best of your ability. You can be ignored, or your advice can be overruled (sometimes for good reasons, sometimes for bad reasons), but your job as a security professional is to state the truth as you see it, as best you can. (Putting it differently, do you want your networks to be breached because you "positioned" a hole big enough to drive the QEII through as "flexible security")?
I take it for granted—and I shouldn't—that I work for a company that values those attributes in me and in the other wonderful security professionals I work with (e.g., my peers who look after operational security and physical security—you rock, Todd and Bob!). I feel fortunate that I've never been asked to compromise my integrity for Oracle (one if the biggest reasons I've been here for 17 years).
To this day, when I meet someone who has been in the armed forces, there is a common bond between us. Part of that is due to shared experiences that seem to be the same no matter when or where you served (e.g., the Navy was and is always futzing with the uniforms so you have to buy all new ones—argh!). We now live in an age—unlike, say, the 1940s and 1950s—in which most people have never served in the military and many do not know anyone who has. Frequently, we who have served are asked why we did so ("Why would a smart guy like you go to West Point?" "Why did you join the Navy when you didn't go through ROTC?" "Why did you become a Marine now?") Why, in short, did you do something like this—where your life could be put at risk—when you weren't forced to do so?"
I didn't join the military for the experience, the leadership opportunities, or the life lessons I got that cling to me still, though those are all benefits I continue to appreciate. Freedom isn't free: our history shows that. There are people today who, like the Founding Fathers, still pledge their lives, their fortunes and their sacred honor to defend this country. I joined the Navy because I wanted to serve my country, which has done so much for me, and I wanted to be part of something bigger than myself. I was proud to have served, and I would do it again in a minute. There are lots of flags flying today in the little town in which I live in Idaho, but no fluttering flag has ever meant as much as the ones I saluted when I wore a uniform. If you are a veteran, you will understand, and if you aren't, I can't explain it to you.
In a way, the reason I work in computer security reflects the reasons I joined the military. Much of what I do at Oracle involves working with others in industry, and with those in the government, to try to make security better for everybody. To be part, in short, of something bigger than myself, which involves defending my country—and others—from attackers. I tell the developers I work with that all of our customers have secrets that they are counting on us to help defend, but that some of those secrets are national secrets. And that is the standard of security we must meet: defense of national secrets.
Today is a good day to praise the many not-so-famous men and women who have served in the military, and those who serve today, who continue to believe that freedom is worth defending and worth personal sacrifice. Thank you all.
Ua mau ke ea o ka ‘āina i ka pono. (The life of the land is perpetuated in righteousness.)
Among the men who fought on Iwo Jima, uncommon valor was a common virtue.
—Fleet Admiral Chester W. Nimitz, USN, 16 March 1945.
Random good reads on US military history:
We Were Soldiers Once, and Young by Harold G. Moore
Patton: A Genius for War by Carlo D'Este
American Caesar by William Manchester
Goodbye, Darkness by William Manchester
More than a Uniform: A Navy Woman in a Navy Man's World by Winifred Quick Collins
Really excellent quotes about the US Marines (bless them!): millennium.fortunecity.com/redwood/352/usmc4.htm
For those who have never been, it's well worth a trip to Arlington National Cemetery.
A couple of my favorite places to honor those who served are the War Memorial of the Pacific (the Punchbowl) in Honolulu, Hawai'i, and the USS Arizona Memorial.