Stagehand: S1 Episode 6
They called him The Boston Strong Boy—arguably the first real boxing star and one of the highest paid athletes of his time.
He’d always been good at school. He attended Boston College where his parents thought he might pursue a life in the priesthood. But he had other plans. He was a fighter. A pugilist at his core. He toured the country challenging anyone who’d step into the ring with him. Two- hundred-fifty dollars to the last man standing. He knocked out eleven men on that tour and made a pretty penny. But this fight was different. The last of its kind. It was the final bare- knuckle boxing championship to be held on US soil. He was in town training for a highly anticipated showdown that’d be held in a secret location sometime in the summer.
The only thing he was better at than boxing was drinking. But even when he was being dragged from the bar, he was a fighter. He was John L. Sullivan, The Boston Strong Boy, and my great-grandfather.
– – –
My client hired me to track down the people responsible for the Carl Timmons kidnapping. Guess he didn’t think we were that good at our jobs because it lead us directly to him.
When I first told Lincoln Palmer about Andre Savin he didn’t flinch. He betrayed nothing. I looked for any type of recoil but he didn’t cower. But he was silent for a moment. The fast thinker and even faster talker took a beat and in that silence I saw his jaw clench, his eyes blink quickly…the wheels churning. Then he looked at me as if he was trying to read me right back.
He didn’t know that John had found the cyber currency accounts of the two young men that originally kidnapped Carl Timmons in San Jose. He didn’t know we’d found the massive influx of Bitcoin that hit these accounts before the kidnapping and after. He didn’t know we’d tracked these transfers to a holding company in China that had direct links to his global real estate ventures. My client hired me to track down the people responsible for the Carl Timmons kidnapping. Guess he didn’t think we were that good at our jobs because it lead us directly to him. Then he spoke…
“How the hell did Andre get involved with this?” “That’s not clear yet, sir.”
“Has Carl given him anything? Do we know what he wants with him?”
“Carl’s alive. We’ve got eyes on the property and haven’t seen Savin yet.” I gave him as little as possible.
And finally, Palmer starts to flinch. “He’s coming after me. He’s going to try and take down the company…he’ll tell the press. Does Laureen know about this?” His paranoia was showing but I kept my cool.
“She’s taken all the security precautions necessary.”
“Carl can override those. He created those fucking precautions. Andre Savin’s had men killed for making fun of his hat… Carl’s gonna fold like a napkin. When’s Savin arriving?”
“We don’t know?”
“Well what the fuck do you know, Sully?!!”
I know your fucking type—entitled bullies masquerading as heroes.
I know you’ve been gradually losing favor among your Board of Directors and that you’ve been at odds with them ever since they backed Laureen Hansen as CEO. I know that she found out you’ve been misappropriating funds and was planning on exposing you when the time was right. I know you orchestrated a plan to have Carl Timmons kidnapped so you could save the day and set her up to be ousted when she didn’t go to the cops in order to protect the company. I know you wanted a friend as the CEO so that when you made your presidential bid, you’d have all the resources you needed.
I know your fucking type—entitled bullies masquerading as heroes.
But I didn’t say any of this. I let him lose his cool. I took the punch and let him betray himself because I could tell that Lincoln Palmer was scared.
– – –
Richburg, Mississippi – 1889
On the sweltering summer morning of July 8, visitors from across the country descended on the small town and made their way to a make-shift boxing ring in the Mississippi woods. Among the throngs of nearly three-thousand spectators who came to watch the fight of the century was the
poet Oscar Wilde, the outlaw Jesse James, and the preacher Henry Ward Beecher. They’d all come to see the epic showdown between The Boston Strong Boy and his challenger, Jake Kilrain.
It was one-hundred and three degrees.
– – –
Lincoln Palmer collected his temper. “Well this is why I hired you. You cannot let Andre Savin get what he wants from Carl Timmons. I don’t care what you need to do. That cannot happen.”
He meant this. Palmer didn’t see this coming. I hadn’t told him that the hackers he’d had his people pay to kidnap Carl had big mouths. John was able to trace the many chatrooms in which they’d bragged about their plan to an international audience of black hat hackers, including a young man that worked for Andre Savin.
– – –
Prizefighting was illegal in 1889, but this didn’t stop the hordes of journalists fighting for their place at the foot of the ring.
The fight started off strong for Kilrain, but in the fifteenth round The Boston Strong Boy lands a brutal left to Kilrain’s injured ribs. From there it was seventy-five rounds of consistent, methodical jabs that lead to the final blow. A moderate strike to the gut and Kilrain fell to the ground.
The title bout lasted a little over two hours. John L. Sullivan became the last heavyweight champion of bare knuckle boxing. He wasn’t a perfect man. Might’ve not been a particularly good one either, but he knew how to land a punch so everyone felt it… the poets, the outlaws, and the preachers.
Both men were tried for prizefighting. My great-grandfather got off on a technicality.
– – –
We were hired to find Carl Timmons and bring him back. We’re going to do just that.
Lincoln Palmer might’ve hired me, but my loyalty’s always with my country and it has no price.
“Palmer’s all yours.” “And Carl?”
“We were hired to find Carl Timmons and bring him back. We’re going to do just that.”
I hung up. Keith looked at me from the back of the van…
“Just seven armed guards, thirty seven security cams, four hundred acres of real estate, and three fucking pit-bulls standing in our way.”
Stagehand: S1 Episode 8
Carl Timmons was given 24 hours to decide what he wanted to do. This was a tactic. Twenty four hours to sit alone and think about all the money he could want and the price he’d pay for it. And 24 hours to also contemplate what Andre Savin might do to him before...
Stagehand: S1 Episode 7
Andre Savin and Lincoln Palmer had met on several occasions and had the type of relationship you’d expect between two men of their standings on the billionaire scale. Contemptuous but also understanding. They were both driven by the same desire—access to...
What Is Zero Trust Anyway?
About three minutes into planning this post, I had one of those “god, I am old” moments. Here is why I had the moment. I have worked in cybersecurity since 1994. My first job was at a big 3 working for the U.S. government through one of the world’s...
Why Bots Are the Next Big Thing in Account Takeover Fraud
Account takeover fraud may sound like a familiar term in cybersecurity, yet its prevention methods in the e-commerce domain are still nuanced. Retailers are historically concerned with payment fraud systems related to chargebacks. This happens when a customer makes a...
Stagehand: S1 Episode 5
Kuwait, 1990 I’m launched out of a submarine a few miles off the coast of Kuwait City. When I swim to shore, I quickly change into my dry land clothes—a full burka. I was a six-foot-one Marine posing as a good Muslim woman. The catch, beneath the modest...
Ransomware: When Policy Matters Most
Most CISOs divide their approach to cyber defense into three pillars: people, technology, and processes. These pillars define a cybersecurity program’s defensive architecture and arsenal, available assets, and policies and procedures that together inform...
Selling to a CISO? Practice Empathy, Not Salesmanship
The cyber security marketplace is hot. Ask any candidate for a cybersecurity role. Better yet, ask any supplier to CISOs. The supplier audience is especially vast, and it’s continuing to grow. Just three years ago, there were estimated to be less than 2,000...
The Risk of Measuring Risk
Automated measuring of control effectiveness is a very good idea conceptually. When you can combine control gaps with relevant threat information, you get a very good picture about the actual technical cyber risks your business faces. If done correctly, it provides...
Stagehand: S1 Episode 4
Keith and I left the scene like we found it: the two kidnappers dead on the floor, their shotgun up against the wall, and the rope used to tie up Carl Timmons sprawled out on the floor. We tipped off local law enforcement and were gone before they arrived, leaving no...
SecOps Needs More Democratization, Not Less SOC
An increasing complexity of technologies, as well as an increasing number of failures and attacks followed by an increasing dependency on business goals is changing the way we run Security Operations Centers. I previously discussed the concept of a Fusion Center as an...
Measuring a Cyber Awareness Culture
Until recently, cyber awareness metrics have been treated by many as a tick-box exercise driven by regulations. The regulator requires x number of hours of cyber awareness training per employee per year, and once that is done, the organisation ticks a box and waits...
Good Enough Isn’t Good Enough Anymore
The cyber risks we face today are more than we faced previously but also fundamentally different in several respects. Our adversaries are more adept and their tools and tactics more protean in capability. In light of these increasing challenges, our cyber defenses...
Data Classification: Building, and Pitching, a Rock Solid Program
In our final installment, we are going to discuss how you roll all the concepts previously covered into a plan of action. The difference between the success and failure of a data classification program is a lack of action. I have reviewed over 10 programs in my...
Stagehand: S1 Episode 3
Cyprus ~ 2006 Ali Hassan was a low-level operative in Hezbollah, but we had it on solid authority that he knew where three high-level leaders of the terrorist organization were hiding. Keith arrived fifty-seven hours into Hassan’s interrogation and by the looks of it,...
Data Classification – How to Categorize It, Where to Store It
Previously, we discussed the requirements of a mature data classification program. In this post, we are going to review the administrative mechanics of such a program. Data classification, you’ll recall, usually includes a three- or four-layer system akin to the...