dearestleader – Page 8 – Dearest Leader

Don’t Invest Through Life Insurance

In China there is a trend of taking out a universal life (UL) insurance policy on newborn children as an investment vehicle. UL policies are a combination of life insurance and savings. Essentially the policy holder pays for life insurance and then some. The money that does not go toward the insurance premium becomes savings with interest. While it makes sense to have some level of life insurance on children to pay for funeral expenses should something bad happen, UL type insurance is not the best method to save for their college or first house. In China most policies will produce up to 4% interest on the excess cash. Inflation is expected to be 5% which amounts to a –1% savings rate on the money invested in a UL policy.

When attempting to do a job it is always best to use the best tool to do the job. If you want to have life insurance for funeral expenses and to help the family along if a working member of the family should pass away there are better vehicles to place your money into than UL. Term life is a much cheaper option and better suited to most people’s situations. Term life provides coverage at a fixed monthly rate through the term of the insurance. The insurance cost never goes up during the term, but there is no cash out at the end of the term. Recently there has been a price war among term life companies and coverage is extremely cheap. A 20-year term policy for a mid 30’s male in great health will go for around $60/mo for $1,500,000 of coverage. If you need to only cover your salary for a couple of years and pay for your funeral you will need much less. A basic term policy for most people is as affordable as renters insurance. If you want to make a sizable charitable donation upon your death then of course you will want one of the giant policies described above.

In the US there are many other options than UL for investing for your children’s future such as a 529 Plan. Life insurance is best used for providing for your funeral expenses, leaving some for your family, and donating to charity. The savings from going with a term life policy vs. a UL policy can be invested in some other vehicle that will hopefully outpace the inflation rate.

Websense misses EPS

Websense managed to stink up earnings. EPS posted was $0.35 actual vs. $0.38 estimated. Websense lost about 15% after earnings were announced.

The earnings call discussed “the new normal” of attacks being persistent and the “bad guys” wanting our corporate crown jewels. Fundamentally, we can assume that their sales and marketing force will be able to capitalize on the activities of groups such as Anonymous and LulzSec. They noted that they have increased sales of Triton products. Growth of 47% Year over Year $44.4M. 1st quarter Triton exceeded non-Triton billing. On the call Websense said they are clearly a Triton company as they look to the future. This still does not mean that we should be bullish on DLP technology, even though it is part of Triton. More than likely the bundle of Web, Email, and DLP will see Web and Email use, while the DLP sits on the shelf.

Since Websense is still above the 200MA and it held the 200MA back in March now may be a good time to get bullish, regardless of how well their technology works. There’s enough marketing hype to continue to propel them along.

The August 22.5/20 Bull Put Spread is currently pricing at $0.57. If it stays above 22.5 by August options expiration that would be a gain of 29.53%. Max loss per contract would be $193 vs. a max gain of $57. Volatility is high so selling options is a good idea here.

A bearish play would be to use the August/September 22.5 Put Calendar. This would be a debit of approximately $0.50 and would be a reasonable bearish bet since August Implied Volatility is higher than September. The Put Calendar may be a good play if we are feeling bearish about the overall market and US Debt Ceiling issues dragging everything down.

Why We Don’t Need An AntiSec Hunt

Opinion Piece: A business perspective on the #AntiSec movement from a libertarian and economic viewpoint touched by Asian “Tiger Culture”.

PayPal Chief Security Officer, Michael Barrett, has called on industry and government to track down and punish the individuals involved.

"They can be found, and for the continued safety of the internet, we must identify them and have legitimate law enforcement processes appropriately punish them.”

Is the internet in danger to warrant the inquisition and witch hunt that will follow? No. If we reference the The Ethics of Liberty by Murray N. Rothbard we come to an very important passage

The first point is that the emphasis in punishment must be not on paying one’s debt to "society," whatever that may mean, but in paying one’s "debt" to the victim. Certainly, the initial part of that debt is restitution. This works clearly in cases of theft. If A has stolen $15,000 from B, then the first, or initial, part of A’s punishment must be to restore that $15,000 to the hands of B (plus damages, judicial and police costs, and interest foregone).

If we approach the Internet as a society it is not under any threat. The users and companies that have presence on the Internet and they may be victims of the AntiSec movement, but in Rothbard’s view each entity would be handled on a case by case involvement, preferably with no involvement from The State or society.

Proportionality in Punishment

Or where is my private utility?

The current system provides little public utility at the large expense of private utility. Mr. Rothbard describes the issue well.

We must note that the emphasis of restitution-punishment is diametrically opposite to the current practice of punishment. What happens nowadays is the following absurdity: A steals $15,000 from B. The government tracks down, tries, and convicts A, all at the expense of B, as one of the numerous taxpayers victimized in this process. Then, the government, instead of forcing A to repay B or to work at forced labor until that debt is paid, forces B, the victim, to pay taxes to support the criminal in prison for ten or twenty years’ time. Where in the world is the justice here? The victim not only loses his money, but pays more money besides for the dubious thrill of catching, convicting, and then supporting the criminal; and the criminal is still enslaved, but not to the good purpose of recompensing his victim.

Suppose that, as in most cases, the thief has already spent the money. In that case, the first step of proper libertarian punishment is to force the thief to work, and to allocate the ensuing income to the victim until the victim has been repaid. The ideal situation, then, puts the criminal frankly into a state of enslavement to his victim, the criminal continuing in that condition of just slavery until he has redressed the grievance of the man he has wronged.

The criminal justice system and prison are public goods that are non-excludable, by virtue of the fact that anyone can go to prison it the US. Prison is rivalrous though. This is due to the fact that prison is first come, first served which explains why prisons are overflowing with non-violent offenders and violent offenders are automatically let out with an ankle bracelet GPS unit. This can be traced back to the fact that it is easier for law enforcement to apprehend non-violent drug users and petty criminals, rather than don their SWAT gear and take on violent criminals. The People are not getting their money’s worth under the current system and we should not be encouraging the justice system to allow violent criminals on the streets while non-violent criminals, petty thieves, and white collar criminals are incarcerated at the inefficient use of taxpayer funds.

This is important in arguing against hunting the AntiSec movement. The cost of the witch hunt does not bring economic utility to anyone except the government who can make the case for additional law enforcement and prosecution resources. This decreases private utility and gives us a bloated bureaucracy that doesn’t help us as individuals. But doesn’t ignoring AntiSec affect other stakeholders? To call someone a stakeholder would mean that there is a mutual interest, which there is not one. We can refer to the other people involved as externalities, not stakeholders. Remember if someone commits a crime against your neighbor, you should not be paying for it.

In a libertarian community everybody takes care of themselves and resists being dragged into someone else’s business. This keeps costs low for those that have no incidents, and when properly applying moral hazard places third parties at risk which continues to keep an individual’s cost basis low. When we extend the philosophical concepts of libertarianism to hunting down AntiSec there is little reason to fund such an effort. We as individuals have no private utility or incentive to provide support for someone that we are disinterested in, be it a corporation or a neighbor. Public utility is also inefficiently increased by taking private tax money and funding an unnecessary and undesirable growth of government to track down the offenders.

A Tax On Everyone

Some would say that the shift to restitution, away from incarceration is not the direction we want to take our society. The prison system in Georgia costs approximately $3 million per day to run. That is $3 million too much. Our new Governor has asked the legislature to find a legal mechanism to retroactively lower the sentences of the people in prison because there is not enough tax revenue to support the system. Counties and cities are shrinking their police and fire departments because there is not enough tax revenue coming in due to the housing crisis. Among all these problems Mr. Barrett wants to increase the size of the police state, which we can’t afford and increase the size of the prison system, which we are trying to actively shrink.

Who Pays For That?

Are we not our brother’s keeper? Are we responsible for creating a cohesive society and upholding justice? While there is some economic benefit to pooling resources and funding police, military, and social services it is improper to conclude that we should be our brother’s keeper or that conventional views of society should continue to be encouraged. All expenditures should be first approached from the private benefit perspective, and all contributions to public good or public benefit must net all people benefit at the same time. If you are not a Citigroup stock holder or customer you have no private utility from funding law enforcement, the judicial system, or the prison system in dealing with cybercriminals or physical bank robbers. Enabling the attitude that we as a society should chip in to maintain order and protect corporations from criminals has lead to the corporate welf
are state we live in and the proliferation of Too Big To Fail for any reason.

Who should pay for hunting down cybercriminals or any criminal for that matter? The direct stakeholders should be paying for it. In the case of private corporations this will come from the cash flow that they derive from normally conducting business and from the equity that the stockholders (public or private) provide. Applying risk transference to an insurance company along with moral hazard can also provide funds. Corporations have their own private security forces, both physical and infosec. Rather than involving the law enforcement and taxpayers who are not direct stakeholders, corporations should use their internal security resources to serve as detectives.

In the case of crimes that take place across state lines or international boundaries there is a solution that is available as well. These are not called FBI Agents. They are called Private Investigators (PI’s). A PI has the same ability as the FBI to go to another company’s datacenter where an attack originated and ask for logs. That company is free to refuse access PI, and they are free to bill the PI for their time involved who will then pass the cost back to his client. This provides private benefit for both the company assisting the investigation and if the PI adds a premium to his cost it provides him with benefit as well. The FBI with a warrant can not be refused. This takes away from the value of the recipient of a warrant and we should not be encouraging a system where an investigator gets a free ride. This serves to devalue the time of the professionals being served a warrant to assist in an investigation that they are not stakeholders in.

The most law enforcement should be involved is to compel an offender, once found by the PI or corporate security, to appear in civil court to sit before a judge or arbiter who will rule on appropriate damages to the victim which can include indentured servitude until the debt is repaid. The state’s expenses would be paid by the victim corporation and would be subject to reimbursement once the defendant is found to be at fault for the damages. Would this approach make winning a case easy? Of course not, but again unless you are a direct stakeholder there is no reason to care one way or another because your private utility is still zero. Supporting the current “throw everyone in prison on the planet” philosophy does not add to private utility.

What About The Other Victims?

In an infosec breach there may be other victims such as individuals whose personal data has been stolen. In a pure libertarian society bystanders have no incentive to get involved and we can see that once again for the bystander there is zero private utility to be gained by helping someone that they do not have a personal stake in. If there is no law enforcement witch hunt to help these victims then what do they do? Based on their contract with the corporation handling their data, they can sue both the corporation and the Jon Doe thief. This approach allows the secondary victims to obtain compensation for their loss and inconvenience. It also preserves private benefit to those who are not involved without depriving the victims of their right to restitution.

We Can’t Turn A Blind Eye To This, Can We?

“No one would suggest encouraging improved physical security in the real world by decriminalising breaking and entering and classifying it as a sport; why should the online world be any different?” he [Barrett] said.

Mr. Barrett is very late to the party with this statement. The libertarian movement is for decriminalizing many things and doing away with the failed notion of every crime in society being a crime against the state. The legalization movement is a prime example of where Mr. Barrett gets it wrong. Marijuana use and prostitution are victimless crimes, but are categorized as crimes against the state. The libertarian movement seeks to legalize these so called crimes. Once they are no longer crimes anyone involved in that activity so no longer a criminal, thus we lower the crime rate. In the case of a crime with a victim we can apply the same libertarian concepts to the relevant legislation. This would require reengineering the criminal code to state that there are no crimes against the state except Treason. Crimes against individuals or property can be handled in civil court with reparations paid to the victim. Damage of state property would be treated just like individual property damage. This can work and is working. Many states are rolling back their criminal statutes because prison and a large police state is unaffordable.

Failure to Understand The Free Market

Or my employer has a monopoly and you can’t leave us.

Barrett is employed by a payments company that attempts to assert a monopoly on the market. It can be clearly seen by his disagreement with people who believe AntiSec can force organizations to improve poor security practice.

The AntiSec movement had existed for around a decade and was loosely guided by a mission statement to reveal poor security practice and put an end to security exploit disclosure which it said gave ammunition to criminal ‘black hat’ hackers and put consumers in danger.

But that was a false philosophy, according to Barrett.

“While many of them claim to be defending the internet they love, in practice it would seem that they are only hastening its demise. A cynical interpretation would suggest that what most of them desire is actually their ‘fifteen minutes of fame’.”

He disagreed with some commentators who argued the AntiSec movement may be effective in its mission to force organisations to improve poor information security practice.

Failure can be a great educational tool, as well as the one espoused by Comrade Deng Xioping of China. It is very practical to force an organization to improve poor security practice and from a free market and economic perspective it should be encouraged, even at the cost of the demise of an organization, the unemployment of all its employees, and the inconvenience of its customers.

In the Tao we represent opposites through the symbolism of Yin and Yang. Good/Evil, Success/Failure, Light/Dark, etc. are all examples of of opposites depicted by Yin and Yang. This represents balance in the universe. These opposites are absolutes in relation to each other. In terms of success and failure these absolutes manifest themselves in our daily lives. For example, in commodities trading success or failure is absolute and is also a zero-sum game on a per transaction basis. In order for you t
o buy a commodity, there must be someone else willing to sell it to you and take the opposite bet that the value of that asset will go down. This is especially true if the seller is a short seller. When you sell the stake in the commodity you are betting that it will not continue to rise, but if it does you lose out on the opportunity while the person you sold it to benefits. To bluntly put it, the person opposite to your trade is experiencing absolute failure while you are experiencing absolute benefit. In order for one party to succeed another party must be subject to failure. Centuries of Asian wisdom can not be wrong.

As business leaders we can apply the same principles to companies in the same absolute terms. For example, If Bank of A has an infosec breach, its customers are free to do business with Bank of B or Bank of C instead. Customers and stock holders of Bank of C have incentive to see Bank of A collapse due to the exodus of customers. All other banks have incentive to see Bank of A fail because they can buy assets such as buildings or accounts receivable for cents on the dollar in bankruptcy court, in addition to their customers being up for grabs. Stock traders who are short Bank of A shares or who hold Put options also want to see it completely collapse to maximize the value of their position.

There is nothing wrong with wanting to see an institution fail. It is good business and if we follow the Tao we know that in order for a small community bank to grow into a regional or national bank it must come at the expense of that larger bank. In terms of biological organisms, the fit will survive while the unfit will perish. The same holds true in business and commerce. Our unwillingness to let go of Too Big To Fail continues to prop up weak institutions that keep making the same mistakes, while preventing smaller competitors that do it right from rising up to take their place. The use of public funds to enable law enforcement and the current justice system does nothing but set private benefit on fire and does nothing to place poorly run institutions in harms way to see if they can survive. What about the interim harm that may come to Bank of A’s customers while they’re failing? We can classify that as an economic externality and therefore rate its overall impact at zero. After all if it is not taking away from your private benefit, why get involved by devoting resources to the so called problem?

How Do We Turn Talk Into Action

To borrow more components from the Tao, we can implement Wu Wei. The concept means “action without action”. We can apply Wu Wei to the legislative and judicial process by promoting action by inhibiting the action of others.

Individuals can also take control of the run away police state and tax on the citizenry through the use of Jury Nullification. Georgia’s Constitution allows jurors to decide fact AND law. Jurors can put an end to the incarceration state by simply voting not guilty if it is a criminal case, which then leaves civil court as the only recourse. A juror can say that no crime was committed if a company had less than adequate security practices as viewed by the juror. That is legal to do and it should be encouraged.

We should also spend time to review relevant upcoming legislation. Any bill that introduces a new crime or increases the criminal penalty for an existing crime should be flagged. The State House or State Senator, along with the Governor is notified that the bill, if becoming law would create more taxpayer harm than benefit. Prison is a tax on law abiding citizens and as law abiding citizens we should be doing everything we can to keep people out of prison though decriminalization and promotion of restitution and rehabilitation, rather than incarceration. This also means defunding law enforcement and the district attorney’s office as a means to that end. With state and local budgets strained by the economy, nothing is off the chopping block. Now is the time to make our voices heard and take back our government through being involved politically, voting out politicians who steal from our private utility by growing the police state, and by stopping every District Attorney in his tracks through jury nullification.

Vote! Be politically active and support libertarian leaning candidates at all levels of government. Candidates who are willing to take the bold step of defunding the War on <insert noun here> and shrink the size of government in the name of freedom are the ones we should be supporting.

Mr. Garrett is wrong in his calling for an AntiSec hunt. Such activities strengthen the power of government, destroy private utility, contribute to our Prison Planet, keep small business under the thumb of mega-corporations, and weaken our sense of nationalism on the world stage by making us a nation of weaklings. He is wrong, not for the same reasons that pro-hacktavist supporters believe in, but the economic, libertarian, and Asian ethic points against his reasoning makes him more wrong than right on the issue.

Resources

Business and Society Ethics and Stakeholder Management 7E Carroll Buchholtz

Foundations of Microeconomics 4E Bade Parkin

Wikipedia

The Ethics of Liberty Ch 13 Punishment & Proportionality Rothbard

Disclaimer: This is an opinion piece. Nothing should be construed as fact unless independently verified. At time of writing your Dearest Leader does not hold long or short positions in his personal or business brokerage accounts with regard to any company mentioned in this article. Long or short positions may be initiated in the future without notice.

Using Family Limited Partnerships To Strengthen Your Clan

Family Limited Partnerships (FLIP) are a fast growing trend for protecting wealth. A limited partnership is a partnership that includes at least one general partner and a limited partner. Both partners contribute financially and share the profits. General partners actively manage the company, accepting unlimited liability for debts while limited partners do not actively manage in exchange for limited liability¹. In a FLIP the parents transfer ownership of the family’s assets to children as limited partners in the company. Since the children can’t manage the assets, such as buy or sell them, it is relatively safe to transfer assets to minor or adult children. FLIPs are less complex than setting up a Corporation, but the daily operation of one is similar. The objective is to avoid the death tax by having a large estate to transfer to one’s heirs. When done with the guidance of a CPA assets can be transferred to children annually below the threshold of gift and other taxes. This can be done over a period of time, preferably while the children are still young.

Is it worth it to go to the trouble of establishing a legal entity for simply operating a household? Absolutely! Aside from the tax benefits it places you in the right state of mind. What state of mind is that? A Family is no different than a business. It has human resources and it his profit goals to fund its ongoing activities. There is a hierarchical structure and and an order of succession in the event something happens to one of the clan elders.

Turning the household into a business venture sets up the foundation for more successful living. Introducing budgets, cash flow analysis, and investment analysis creates discipline that can lead to better future outcomes. Saving or investing for college? That is no different than a company that has a continuing education program. Want to have a sail boat and enjoy your retirement on it? The boat is an asset and your retirement is the company pension plan.

There is a noticeable difference in the success of stock traders who treat their portfolio as a business rather than a personal investment vehicle or a hobby. Life is all about learning and building ones self. Using a structured organization such as a FLIP can be the basis for thinking outside the box when it comes to leading your family into a new prosperous era.

In the future we will discuss the useful actions your immediate and extended family can take with using a FLIP to reduce your costs and also help with your estate planning.

1. Kelly/McGowen BUSN 2009 Edition

Booz Allen Hamilton Short

Booz Allen Hamilton (BAH) delivered some bad news to the public Tuesday, confirming that they were the victim of an intrusion event. Once again we are presented with opportunity to make money from watching the bad news unfold. There appears to be resistance around 20. If BAH doesn’t move above this line in the next few days, it could be a good short opportunity. This is not a liquid stock, but additional liquidity may move in on the news Wednesday. Today’s candle does not look encouraging for a short though since the stock went up the entire day. We’re keeping this on a watch list for a small but entertaining move to the downside.

Security and Privacy are Dead and Nobody Cares

A casual observation of investor confidence after an infosec breach.

One of the issues that security and privacy professionals discuss with our clients is the potential loss of customer confidence if confidential information is compromised. The responses this concern vary across industry and business size. The controls implemented would vary based on the information collected, the tolerance for risk, and the client’s ability implement cost effective controls. Since the downturn in the economy many companies have been scaling back expenditures on security controls and accepting more risk. This involves taking a more compliance centric view and making expenditures only on technology and personnel to comply with the law or self-regulating industry standards, rather than a risk centric view. When accepting more risk it is reasonable to assume that the probability of a security incident will increase and/or the impact/remediation will be more costly to clean up. Does this present any concern for the public?

Several technology executives have implied privacy is dead get over it. With the proliferation of social tools such as Facebook, Twitter, Foursquare, Gowalla, and Google Latitude, the general public has no problem with letting the their “friends” or the whole internet know where they are and what they are doing. Many people, especially the younger generations don’t see it as a big deal to broadcast that they aren’t home or their most intimate and politically incorrect thoughts. Granted GenY is focusing more buying experiences rather than material possessions, so the impact burglary may be less for GenY, but that is another topic we may discuss in detail under a personal finance tag in the future. The silent death of privacy across generations may also be foretelling the the death of security from the viewpoint of the public.

As company executives accept more security risk, the consumer public has also been accepting more risk or relying on risk transference to protect themselves. Combine apathy with risk transference and you have a big stiff cocktail of SNMP (Someone’s -Not Mine- Problem). ATM skimmers are all over the news, and among the GenX and younger crowd there is relatively little concern when compared to older individuals. That is derived from a very small sample so take it as you will. Why no concern? Most credit cards have zero liability for the consumer and fraudulent charges can be corrected immediately along with a new credit card sent overnight. To the consumer this is a minor irritation and the only people suffering are those dirty Wall Street bankers everyone loves to hate. Even debit card fraud is only slightly more irritating when dealing with small community banks and credit unions who are likely to have the consumer protections as credit cards.

Is the public suffering from apathy when companies experience a security breach? Is security dead and the inconvenience of having information compromised something that we will just have to put up with going forward? If we are not there yet we may be getting there soon. When examining investor confidence of companies that have security incidents there appears to be very little concern, even for large security breaches. When compared to the overall S&P 500 Index several of these companies rise and fall along with the Index. This would indicate that any declines in share price are related to the Index itself falling.

In recent days EMC and SPX are up and down together.

Lockheed Martin experienced a large percent move relative to SPX, but the ups and downs do have some correlation.

L-3 Communications has moved with SPX very closely since news of the intrusion broke.

Sony has underperformed when compared to SPX and their stock price has been affected the by multiple intrusions and related news stories.

EMC declined in mid March after the breach. The decline of about 10% was relatively small compared to what it could have been. Three months later EMC is performing as if the breach and any long term issues are a distant memory. EMC is currently trading in a range between 27 and 28.75.

Near the end of May Lockheed Martin announced that they had been the victims of a security breach. Nothing unusual happened to the stock price and the declines can be correlated to losses in the general market.

L-3 Communications has also been pulling back, but seeing a shooting star candle and confirmation the next day that could be expected. We can assume that any loss in value is simply related to overall market corrections.

Sony may be the exception since they have lost a lot of value since March. Sony is different than Lockheed or L-3. They have been punished multiple times by various hacking groups and the news stories simply won’t go away. The decline is about 30%.

Compare and contrast the charts above with this chart of BP after the Deepwater Horizon explosion.The stock declined almost 50% before beginning to recover and reached –30% after a week.

There are differences between all of the companies which does not allow an apples-to-apples comparison. Customers of Lockheed Martin can’t obtain a substitute from someone else as easily as Sony customers. BP is in the business of tangible goods and an oil spill has different impact in the minds of investors and the public than a data breach.

Conclusion:

Based on non-scientific, casual observations, a one-time news event has little effect on the stock price when compared to multiple news stories over a period of time. This is important to the overall business ecosystem from several viewpoints

Short sellers in the market may be able to take advantage of short term moves in price, but if the story fades from the news it would be best to cover and wait for more news.
Hacktivists wanting to teach a long term lesson to a company will need to hit them multiple times or release breadcrumbs of information over a period of time to keep the story in the news so it can wear on investor sentiment.
Consumers will need to accept that the impact to a company will be relatively minor if they mishandle private data one time. Wall Street will not severely punish the companies for poor data handling practices.
Security and Privacy professionals will need to give up on selling the idea that a one-time security breach will harm their client’s business. Based on these stock charts there is little incentive to spend money on prevention.
Consumers are at the mercy of the companies they deal with and simply put up with the inconvenience. There is little evidence of a crippling or destroying exodus of customers or a change in consumer behavior.

Disclosure: We currently have no long or short positions mentioned in this post. We may have held positions in the past.

Improve Security & Privacy, and Protect Your Patrons by Reducing Security

The Seattle Times has an interesting story about the King County Library System removing their security cameras. This is an excellent case study to illustrate that more security equipment does not always lead to better security. The case stems from an incident where a patron was mugged in the parking lot. The Des Moines Police asked to see the security footage from the cameras, but the library refused, presumably citing the need to protect their customers’ privacy. The police obtained a court order to review the footage and eventually caught the suspect. The police were not happy with the library’s cooperation.

The decision to remove the security cameras "hinders our ability to do police work," Collins (Des Moines PD Spokesperson) said.

The library made the decision to remove the security cameras to prevent similar incidents in the future. Does removing the security cameras actually present a problem from a security professionals point of view? We can perform an assessment of the situation to determine if the library is making a prudent decision. Top management at the library has decided that the confidentiality of the library patrons outweighs any benefit that the security cameras provide. Under a security management framework such as ISO 27001, top management determines the goals for an organization’s security program. In this case library management is correct in making the decision to remove the security cameras since the security framework leaves all decisions to top management.

Under the ISO 27001 framework risk assessments must be conducted on a periodic basis. To visually express top management’s decision we can use CIA in a risk matrix to illustrate their concerns. The following examples are illustrative only.

Risk	Confidentiality	Integrity	Availability
Customer Reading Choice Compromise	High	Low	Low
Vandals	Low	Low	Low
Muggers	Low	Low	Low

In this case management has decided that the risk all of a patron’s reading choices being recorded by surveillance cameras is of greater concern than other things that may be seen by the cameras. Based on the risks it would be logical to remove the cameras. What about hindering the police in their line of work? That should not be a concern of a security professional consulting on behalf of or employed by the library. There are numerous reasons why this is true. Management at the library has decided there are certain things that the police should not have access to. This is no different than protecting the physical premises of a business or using logical access controls to prohibit viewing of specific files. Who the outside threat is should not be a concern to the security professional under the ISO 27001 framework.

There also financial reasons that weigh into the decision to remove the cameras. In most businesses a compliance professional or paralegal will be fielding court orders for data. A fulltime resource would cost a minimum of $30,000 a year. Does spending that $30,000 a year bring $30,000 worth of value to the customer? It does not bring benefit to the customer, but it does benefit the police. Since the police are not part of the same organization it makes very little sense to help them from a security professional or management accountant’s point of view. If the video footage is that important to the police they should provide the equipment and manpower to monitor it or the library should invoice the police for their costs of maintaining the equipment.

If we take off our security hats for a moment and put on our management accounting hats we can see that helping law enforcement does not provide economic benefit to the organization. Therefore in order to save $30,000 by not hiring a fulltime resource we would need to remove the reason for hiring a resource. We now have a business reason to remove the cameras.

Critics may argue that the cameras are already paid for and removing them wastes taxpayer money. Once again we will need to do a financial analysis to determine whether or not the cameras should stay. Most camera systems today are linked into a DVR which is usually supported by an organization’s IT department. For purposes of this illustration we will assume that the camera systems are basically computers. Computers have a five year depreciation before they are scrapped and removed from an organization’s financial books. How many companies keep computers more than five years? From a practical and a financial standpoint we can assume that the camera system would be replaced every five years much like a computer would.

The library system has also stated that the cost of maintaining the camera system is $30,000 per year. Presumably this is the cost of a maintenance contract. By removing the cameras the library immediately starts saving $30,000 a year. One way to express loss of value is to take the current depreciation value of the cameras, subtract the value the library receives from selling the equipment, and subtract the $30,000 a year in maintenance savings. If the cameras are very old and have a little financial value that it is possible that we will have a negative number, which means that the removal of the cameras provide immediate payoff. Without knowing the details of the original purchase it is reasonable to assume that if the cameras are one or two years old we would obtain immediate ROI by removing the cameras, selling them, then begin booking the savings from canceling the maintenance contract. If factoring in the cost of a compliance professional or paralegal is done, it is possible the camera system could be scrapped in its first year of operation based on the savings that would occur in years two and beyond. There is also the capital budget savings from not purchasing a new camera system every five years.

Security and privacy professionals should not assume that more is always better. Introducing additional equipment and processes can compromise the security and privacy of a client’s customers. Top management at the organization determines what risks face that organization. While it may be unconventional to assume that law enforcement is a security risk, there is certainly nothing wrong with that approach if the organization chooses to classify them as a risk. Security and privacy professionals must also wear many different hats. By taking unconventional approaches to security and privacy, and by involving other disciplines such as accounting and finance, security and privacy professionals can better serve their clients by protecting what their clients determine to be valuable.

Nabors Industries Ltd Trade NBR

NBR has returned to its Mean and may be a good long candidate. After testing the mean and bouncing back NBR may be worth entering here.

We tried for an entry on 5/24 after seeing NBR lift off. Since it was above the R2 line using the PivotPoints study we decided to wait for a pull back to at least R1. R1 is at 26.86 so a limit order at 26.90-26.92 wouldn’t be a bad place to get in. Around 10:55 our order to enter the position was filled. We’ve let this one run for a few days now and it is up over .72 The exit target would be in the 32.00-33.00 range Taking half off the table at the first regression channel at around 29.50 might not be a bad strategy as well.

Sony Continues To Get Punished

Sony shut down several of their Internet services in Canada, Thailand, and Indonesia today. Sony stated that their Thai site was accessed to gain customer information to conduct phishing attacks. Sony Music Entertainment was also infiltrated leading to source code theft. Organizations face many security challenges but some level of organization and planning can alleviate some of the headaches caused by a breach.

One popular framework that can be used to help develop your security is ISO 27001. ISO 27001 provides a management framework to guide organizations in making sure they have all the bases covered when it comes to security. ISO 27001 is not just about technology security, but also includes sections on physical security, and legal compliance. It is considered by most organizations a complete approach to managing an organization’s security program.

These sections are of importance in improving the security standing of an organization before and after a data breach.

A.10.6 Network security management – Objective: To ensure the protection of information in networks and the protection of the supporting infrastructure

A.13.2 Management of information security incidents and improvements – Objective: To ensure a consistent and effective approach is applied to the management of information security incidents.

There are specific topics in each section such as defining network controls and incident handling procedures. A little planning before an incident can go a long way to making the cleanup and prevention of future intrusions much easier to deal with .

EURUSD Entry and Exit

Some friends have asked some trading techniques we use. Here we are trading the Euro vs the US Dollar (EURUSD). The technique can be found in the book FX Bootcamp’s Guide to Strategic and Tactical FOREX Trading. I recommend the book if you plan on trading FX and the technique can also work with Futures and Equities. Basically we setup a chart with four moving averages. They are:

5 EMA
8 SMA
21 EMA
55 EMA

To over simplify When the 21 line is above the 55 line things are very bullish. The opposite holds true when the 21 line is below the 55 line. The 5 and the 8 are used for short term confirmation. There may be pullbacks on the 5/8 period if the 21 line is above the 55 line, but they may reverse quickly.

We also added the ParabolicSAR study to help set initial stop loss orders. The ParabolicSAR dots are above the bars on the chart when things are in a bearish trend and below the bars when the trend turns bullish. For this trade we are using four different moving averages and ParabolicSAR as a confirming indicator.

When observing the chart we observed a short uptrend. The fourth candle did not cross the ParabolicSAR marker, indicating that the currency pair had not experienced a strong reversal. The next candle is an Evening Star and still did not cross the ParabolicSAR. The following candle turned bearish giving us a good indication that the trend would continue. Near the bottom of the trend there were two Hammer candles in a row followed by a green candle. The 5 EMA crossed above the 8 SMA around the same time. That was an indication to exit the short position. We were able to ride this trade from 1.4064 down to 1.4053. That is 11 pips between the two. On 10 contracts that would be roughly $110 in gains over a roughly 11 minute timeframe. We did this on a 1 minute chart which can be very bumpy and result in a lot of false signals that have bumped us out of the trade. By adding ParabolicSAR we and learning the various candle shapes and patterns we were able to pick an entry using the rollercoaster 1 minute chart. Most traders tend to do fine using the 5, 15, or 30 minute chart for short to medium ranges.

This provides a high level overview. Nothing can substitute for education and practice. There are many techniques that work in different situations. Combining what works for the individual trader is always the best approach. This should also serve as a warning to anyone who tries to trade without putting in the time to learn winning techniques before trading with real money.