Cyber security Story teller

I am an interloper.

This isn’t an imposter syndrome thing.

I’m an engineer in business school. Specifically, an MBA program.

I weighed my options before I applied. I’ve already had a lot of formal schooling, last graduating a full decade ago with a technical master’s degree. Future promotions at my organization require a graduate degree, so I didn’t need an MBA. However, most folks choose an MBA to fulfill that requirement.

Like most security folks, I’ve also done my share of arguing with Management over more budget, more people, more resources. I’ve lost more than I’ve won, again, like most.

It’s hard to translate security needs into business words that win those discussions. I also pay attention to industry news: The SEC is wading into the security business. It certainly seems like the business is coming for security.

Plus, what do we always say? Know thy business.

So, business school.

I knew I was out of place when I asked for a LaTeX template for papers and was told “APA Style”.

I didn’t take many business classes as an undergrad, so my program has begun with six months of Foundations classes designed to bring me up to speed. The experience was a firehose of information.

Accounting was stressful. Collage has changed, y’all. I’m not sure I’ve memorized much since … forever, and tests were not open book. The terms were also easy to confuse; most measures are compared against each other to derive meaning from all the data. For example, a measurement of short-term liquidity is called the current ratio, or assets over liabilities. The opposite (liabilities over assets) is the debt ratio and a measure of long-term investment risk. Mix them up, and the analysis is shot. The effect is reminiscent of staring into a crystal ball.

It also spent quite a large amount of time describing how financial fraud can occur. It’s shockingly easy, which goes part of the way to explain why Ponzi and Enron are household names.

I also discovered I keep the household finances like a bookkeeper. Thanks, Mom.

Next up was Operations Management; I wasn’t sure what to expect. Turns out it’s “just” logistics designed to keep the Just-In-Time systems running smoothly. In good news, the exams returned to open book. It basically had to be since, if you want to measure a process for efficiencies statistically, Excel is basically required.

Forecasting tomorrow’s sales to make today’s budget is witchcraft divination with math. Six Sigma and Toyota’s famous production system are highlighted in the text. My notes feature a lot of screenshots of equations.

There’s some history to the field, too, dating back to the Industrial Revolution. Eli Whitney — the cotton gin man — figured out interchangeable parts, then Ford added assembly lines, and it was all downhill from there.

It reminded me of Andrew “bunnie” Huang’s book The Hardware Hacker, only at massive scales.

Business Law was next. I know enough about the law to be dangerous; I’ve adapted to parsing the legalese in regulations and standards to translate them into plain language. The idea was not to turn us into lawyers; rather, it was to learn enough to know when to call the lawyers. (Ideally, never.)

The instructors were eccentric and made it fun, which was nice. There were a lot of discussions about the definition of “reasonable”. In any situation, what do we, as a society, expect a “reasonable” person to perform? Looking both ways before crossing the street — pretty reasonable. Failing to secure data properly — more of a gray area on what that means. Most of the law seems to be all the bright ideas to make judgement calls when two sides disagree.

What seems weird is that this is the only law class in the course plan; I checked. It feels like we should have more.

As a bonus, I took this right as the US Supreme Court dropped a bunch of rulings (Notably: Chevron Defense) and left for summer. One lecture was just a discussion on those rulings. My key takeaway is that no one is coming to save us; hoping for regulation and legislation to force capitalism to design safe and secure products isn’t a brilliant plan. The heat death of the universe will happen faster.

Awesome.

I took Finance next. Admittedly, I was confused as to the difference between finance and accounting. It seems to be a question of scope. We talked about the same financial documents introduced in accounting, but went deeper into market forces. It also looked at how businesses go about acquiring funding, how interest rates work, and the basics of financial analysis. Parts of it walked right up to calculus-based series, but specifically backed off from the calculus. Incidentally, it was the most frustrating math class SINCE I had series and sequences in calculus. That’s mostly a compliment.

Speaking of market forces, 2008 got its very own section in the textbook. We didn’t imagine it; looking at the market drop between late 2007 and early 2009; the analysis mirrored The Great Depression. The markets pulled back up roughly a year faster than The Great Depression.

Last on my docket was Marketing. Turns out, there’s more to it than running ads. There was a lot of sociology and psychology involved. One instructor actually started his career in psychology before transitioning to marketing; he liked the more practical applications of the subject. It was also interesting to see the application of what the data brokers collect and sell. Some of it gets turned into marketing databases to divide consumers up into market segments. The key criteria is that segments have to be big enough to be profitable yet small enough to meet the needs of the consumers.

One story stood out: some company dumped a bunch of research into a better mousetrap, based on a bunch of mouse-related research. It would do well, right? Nope, it flopped: consumers hated disposing of a full trap.

The root cause wasn’t the lack of a better mousetrap, it was in how people interacted with it. We have a lot of great security products, but the way people interact with security has changed little.

Maybe that’s why we can’t get resources.

I skipped Economics (based on a freshman undergrad class, like I remember that) and Statistics (I already took it the *first* time I did grad school, and that was enough, thank you).

Now, the actual courses start.