avatarCarlos E. Perez

Free AI web copilot to create summaries, insights and extended knowledge, download it at here

6371

Abstract

ete the work, which I multiply by an hourly rate to come up with a price for the project.</p><p id="f43f"><b>Deliverables</b></p><ul><li>The deliverable for training is a class.</li><li>The deliverable for any other project is a report.</li></ul><p id="799b"><b>Project Billing</b></p><p id="eba1">2nd Sight Lab always bills for a project the same way to keep it simple. We require 50% upfront and 50% on the delivery of a report or class. With training, we need to request the upfront payment at least 2–4 weeks prior to the class to cover the cost of work performed before scheduled class dates. The minimum project fee is 8,000 at this time but is often 15,000 and up. Private 40-hour classes with labs start at 25,000 for 10 students.</p><p id="0f1c"><b>Why No Hourly Rates</b></p><p id="cae8">We do not use an hourly-rate billing model and here’s why. First of all, if you don’t know how many hours you’re going to spend you could end up paying a lawyer 1000 to negotiate a contract and the project lasts two hours. You lost money. Secondly, I used to bill hourly through my software company. Tracking and billing time on invoices created a lot of overhead. I’d rather spend that time helping clients. Finally, it takes time to chase down payments. I had a client who consistently argued with me about every. single. bill. I finally just told her to scratch off what she had a problem with on each bill and just pay the rest. She would mark off something like 300 on a 15,000 invoice. It was very stressful and time-consuming. It’s not worth the hassle.</p><p id="369e"><b>About Cash Flow</b></p><p id="51bb">In addition to the problems I already mentioned with hourly rates, there is too much lag when trying to maintain consistent cash flow. One customer pays in advance. Another pays with a term of 60 days. Now you have a window with no cash flow. Gaps in cash flow impact small business owners more than large companies. Last year I took time off to get my house in Seattle ready to sell. The drop in income over that time period caused by my time off and the contractor’s failure to complete work on time affected my ability to get a loan for my new home. I ended up finding a way to pay cash, but it was not ideal. Even though with the sale of my home in Seattle, I had a higher income than ever in my life, banks will only look at business cash flow with their rigid underwriting formulas. All they see is a gap with no income. There’s your mini business lesson on cash flow for the day. It’s one of the number one reasons startups go out of business.</p><p id="7a86"><b>Focused Deliverables</b></p><p id="6d19">Another reason I focus on fixed-rate projects is that I don’t want to waste customers’ time. I did one hourly rate project, and I would spend hours on-site working for someone revising spreadsheets. I don’t think that was a good use of my time. It also tied me up for a long time doing busy work instead of actively solving security problems. That was an interesting project, and I was grateful to participate, but in the end, I felt like I could deliver what I gave to that client in six weeks instead of three months. I like to work on focused deliverables and get them done as quickly as possible. I’m not one for milking clocks.</p><p id="0d8b"><b>A company, not an employee</b></p><p id="6be1">When you hire me, you <b><i>hire my company,</i></b> not me personally. If you’re working on an hourly rate, you’re basically a short-term employee paid an hourly rate. 2nd Sight Lab offers a product — our classes. We also offer analysis services that include a deliverable — a report. Those products are delivered using the processes, tools, and documentation we have developed.</p><p id="762c"><b>Why I don’t want to be an employee</b></p><p id="b861">One of the reasons I choose not to be an employee of a large company is that it comes with too many restrictions and roadblocks to delivering effective security assistance. I was not allowed to say certain things for political reasons or simply ignored. I couldn’t fix things I wanted to fix. When 2nd Sight Lab assists a company, we provide the analysis and deliver a report or training. When the company receives the deliverable, it is up to them to fix the issues. If they don’t, I won’t be caught up as an employee of the company involved in the next big breach over something out of my control to fix. By coming in as an external advisor we can speak truth to power for employees who hire us to improve security. I often work with CISOs prior to pentests and security assessments to deliver the desired message in our report and provide the data to back it up.</p><p id="b969"><b>Who does the work?</b></p><p id="c41a">I’ve never wanted a large company. I had five employees in my previous company, Radical Software, and that was OK. I managed a team of 30 as director of SAAS engineering for a company. I don’t want to do that again. I spent a lot of time dealing with “people issues” (not to mention politics) instead of getting a project delivered. At this moment, I’m doing the majority of the work. Someone I used to work with helped me create some class labs for the first class I delivered when I was in a time crunch. In the past, I hired interns to help with basic penetration testing, class material review, editing, and accounting.</p><p id="50af"><b>Who are the interns and assistants?</b></p><p id="b7bc">In the past, the people helping me most of the time were my nieces and nephews, but they went off to college to be teachers and doctors and got too busy for me. Cybersecurity was not their passion. Now I’m looking into working with local colleges. I reached out to <a href="https://www.savannahstate.edu/">Savannah State University</a> last year to hire an intern. I never heard back from the department where I sent the job description. I may pursue that again later through some different schools. Other than that, I’ve only received help from people I know personally. If a client doesn’t want anyone else to do the work or see their report, we can work that out.</p><p id="fc88"><b>Security for Interns and Employees</b></p><p id="545e">I am working with a human resources company that performs background and reference checks. When I have someone work on a penetration test for 2nd Sight Lab, they get a separate cloud account and must follow our security sta

Options

ndards and instructions. After they finish, we terminate their access to any customer information on that project. Currently, I’m only using interns who are friends or friends’ kids. They are helping me test new cybersecurity training, proofreading documents, and will review books. Employees receive access through our cloud accounts, and that is one of the reasons we can only do projects from the cloud. It limits the exposure of customer data to other systems and networks.</p><p id="28e6"><b>Ownership</b></p><p id="d3be">2nd Sight Lab owns all training materials we produce or use for client training. We often will revise or rearrange our training material for a client to focus on their specific needs. That material contractually remains the property of 2nd Sight Lab and according to our agreement should remain confidential. In addition, any tools, processes, or materials we use on penetration tests or assessments remain the property of 2nd Sight Lab. However, our clients own the report we deliver. We are obligated to keep reports and any client information confidential unless explicitly allowed in our contract. For example, a customer requesting a product assessment of the efficacy of their product may want 2nd Sight Lab to publish our findings, if we find that it solves a particular problem very well.</p><p id="0ccd"><b>How to contact me about a cybersecurity project — LinkedIn</b></p><p id="c4c5">At this time, the best way to reach me for a project is through LinkedIn. I’ve explained this before but using <a href="https://linkedin.com/in/teriradichel">LinkedIn</a> I can see some information about the person with whom I am doing business. I had some very sketchy people contact me while running my past company, <a href="http://radicalsoftware.com/">Radical Software, Inc.</a> I always wondered if they were legitimate or they were having me perform work for a nefarious organization. That is one of the ways I attempt to verify clients, other than those I meet in person or who are referred by someone else. Unfortunately, I cannot provide training to organizations in certain countries at this time.</p><p id="a890"><b>Starting a cybersecurity project</b></p><p id="2089">Once you contact me on LinkedIn, I’ll send you information to set up a call to discuss your project. I only do phone calls, not Zoom or video calls, until after I have a signed contract. Even then, I require a week’s advance notice for video calls as my network is not set up to handled those at this time. After I understand a bit about the scope, you’ll receive a proposal and a contract for review. We may work to revise it to meet your specific needs. We’ll define a schedule and deliverables and payment terms in the contract. If I need to explain how to get set up for a penetration test or class those instructions come after receipt of the upfront payment.</p><p id="a1d9"><b>Completing a cybersecurity project</b></p><p id="2f1a">Prior to signing a contract we’ll discuss arrangements for communication over the course of the project. Often that will be via email for an on-going penetration test. For a security assessment, I will typically include phone interviews to ask questions up front and further discuss findings after reviewing the assessed environment, but this can vary as needed based on customer needs. Once we’ve completed our work, you’ll receive a report. I try to wait a few days before sending the final invoice to make sure the customer received and could open the report.</p><p id="f3be"><b>Additional support after report delivery</b></p><p id="dd74">Once a class is complete 2nd Sight Lab doesn’t generally provide any additional assistance, though in some cases we had a lab fail and provided a working version after class to the client. I have taken many cybersecurity classes in my time and never had another company do that for me. I usually don’t charge extra for a few questions after the report gets delivered. However, extensive questions or support would require an additional fee. Often, customers will ask us to verify their fixes for findings after completion of a penetration test report. We include that on our penetration report contracts at an hourly rate and can cap the time we spend reviewing the findings as needed.</p><p id="8b7a">If you are thinking of hiring a company to perform a cybersecurity assessment, penetration test, research project, or due diligence related to a cybersecurity investment hopefully this information helps you understand how <a href="https://2ndsightlab.com/">2nd Sight Lab</a> operates. You can reach out to me on <a href="https://www.linkedin.com/in/teriradichel">LinkedIn</a> if you have any additional questions about assessments, penetration test, or training.</p><p id="2373">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2022</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="5a42"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="faf5"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg"><figcaption></figcaption></figure></article></body>

The 3 Traits of AI where Math Hits its Limits

Credit: Inception (2010) http://www.imdb.com/title/tt1375666/

There are 3 essential ingredients that are needed to understand intelligence and unfortunately present day mathematics has trouble tackling. Mathematics are tools that enhance our reasoning processes. Mathematics is a human language that we employ to derive understanding of reality. However, this language are not all powerful and does have limitations. We explore some of these limitations here with respect to areas important to AI.

Although mathematics tends to get developed way ahead of its time, there are many times that the application of a different kind of mathematics to a new domain leads to breakthroughs. Richard Feynman, for example, employed century-old path integrals mathematics to gain new insight on developing Quantum Electrodynamics. There are however plenty of limitations in mathematics and this article addresses those limitations with respect to our ability to comprehend essential ingredients of cognition.

The “Quasi-empiricism” of math is not a new idea. Mathematics is a human language that we employ to describe our reality. Quoted from the Wikipedia article [WIKI-1]:

Eugene Wigner (1960) noted that this culture need not be restricted to mathematics, physics, or even humans. He stated further that “The miracle of the appropriateness of the language of mathematics for the formulation of the laws of physics is a wonderful gift which we neither understand nor deserve. We should be grateful for it and hope that it will remain valid in future research and that it will extend, for better or for worse, to our pleasure.

The first ingredient is the notion of time.

Time is a difficult concept to grasp. I guess the easiest way to handle it is just do what Einstein did. Just treat it as another dimension.

Most physics is invariant in time. Meaning, you can move forward or backward in time and the physics are identical. However, at the macro-world we don’t see it that way, time exists because entropy exists. The arrow of time follows that of increasing entropy.

In fact, there’s really no notion of memory without having to consider the existence of time.

Most mathematics don’t have a concept of memory. Memory is the equivalent of having state and almost all mathematics involves functional constructs that are stateless. Functional programming follows a single assignment rule where once any variable is set, it remains set to that state, never changing. It is this constraint that makes the use of functional programming something that is easily parallelizable. It is a convenient constraint that allows our mathematics to be analyzable.

We cannot, however, avoid time, because that’s where the dynamics come from. The only context that mathematics is helpful in dynamics is in the context where there is no memory exits. Introduce memory or introduce state, then all bets are off! The best that mathematics can do is to quantify the boundaries of computation and not predict its final behavior (see: https://en.wikipedia.org/wiki/Halting_problem) [WIKI-2].

The only dynamics that is analyzable by math are equilibrium states. We can only make statements about states that are in equilibrium. What happens in between, that is computation, can only be, at best, be simulated. Equilibrium is the state when we assume that time is at infinity. An unrealistic assumption, but an assumption that is brought about by convenience.

There is also the notion of asynchrony that is such a beast in complexity. That is, when different parallel processes are not in lockstep synchrony. All our digital circuitry require lockstep synchrony in the form of a common clock that drives behavior. The biological brain does not have a common clock, it works in a regime of asynchrony.

The second ingredient is the notion of collective emergent behavior.

Robert Robert Sapolsky has a short lecture on Youtube [SAP] (“Thinking about emergence and chaos”) that brings about the point about bottom-up behavior (Special thanks to Felix Hovsepian for pointing put this video). He says that “most of the stuff that he and his peers do is reductive stuff that is very limited.”

Intelligence comes from the emergent behavior that arises from the collective behavior of millions or billions of interacting components. This is the very essence of the concept of Connectionist AI. The components themselves do not have to be constructed in a complex manner and can be very simple and in fact be all uniform. Artificial Neural Networks and Deep Learning spring from this very idea of deriving intelligence from simple components called ‘neurons’. It is important to remind oneself that the neurons in ANN are a cartoonish version of a biological neuron. However, it is not the precise construction of the neuron that is important, but rather it is the collective behavior that is important.

That is why the reasoning that ANN and DL should be rejected because they are not biologically plausible is a very bad argument. It is entirely conceivable that intelligence can be arrived with very different kinds of ‘neurons’. That’s because, there’s some fundamental capability that a neuron performs (i.e. information dynamics, meaning computation, memory, and signaling) that is all that is needed, however, the connectivity is where intelligence emerges.

The third ingredient is the notion of meta-level reasoning.

This is the most difficult to grasp idea and it may, in fact, be the reason why ‘consciousness’ exists. We can understand the idea of building up ideas by the composition of more primitive ideas. We can understand this because that is how language is constructed. That is, from letters to syllables to words to sentences to paragraphs etc.

We also know of meta-level reasoning. It’s one of those ideas that’s hard to explain to novice programmers, but it exists in many programming languages. That is, you have programs that operate on the building blocks of the language itself. It leads to very expressive and short source code. Experienced programmers have no difficulty working at the meta-level. However, these kinds of system are extremely difficult to debug.

However, it doesn’t stop with just one level of meta-reasoning. You could have meta-meta level constructs ad infinitum. I’ve encountered this idea in the wild in the modeling language UML. There’s a concept of meta-metamodels, here’s the definition:

A metamodel or surrogate model is a model of a model, and metamodeling is the process of generating such metamodels.

Which, it just occurs to me, is the most universal definition of “Generalization”.

This lecture by James Crutchfield on “The Complexity of Simplicity” gives a very good sense of the enormous gap that we have between our math its ability to analyze complex systems:

Post Commentary

I’ve received the wrong impression with this article that I’m implying that mathematics is not needed. On the contrary, it is absolutely necessary. However, I am also banging the table for those who can’t see that present day mathematics has its limitations. There are many who continue to stick to 18th-century Bayesian logic and corresponding mathematics and have an unsubstantiated belief that it is actually even going to work in this new domain.

There are plenty of times where I see researchers attempt to cast DL systems in terms of ‘equivalent’ Bayesian networks in the hope that placing a round peg into a square hole will actually work. Well, it’ll work if the round peg’s diameter is smaller than the whole width of the square. But it is obvious that it wouldn’t be a great fit. There is absolutely no evidence that the reductionist logic is going to work in a domain of collective emergent behavior. If you approached a room of statistical physicists about using Bayesian inference, then you likely will be thrown out of the room in ridicule. Let’s all get real folks!

The Deep Learning AI Playbook: Strategy for Disruptive Artificial Intelligence

Further Reading

http://www.americanscientist.org/issues/pub/the-nature-of-scientific-proof-in-the-age-of-simulations/99999

References

[WIKI-1]https://en.wikipedia.org/wiki/Quasi-empiricism_in_mathematic

[WIKI-2] https://en.wikipedia.org/wiki/Halting_problem

[SAP]https://youtu.be/lQVTWHOqvWU

Artificial Intelligence
Machine Learning
Design Patterns
Deep Learning
Mathematics
Recommended from ReadMedium