How I Reacted to Heartbleed

Recently a bug was revealed in OpenSSL, called Heartbleed. One of the very unfortunate aspects of this bug was the potential for all passwords and cryptographic keys on a server could have been dumped to any hacker who knew about the flaw. As users, we can't control the cryptographic keys; however, we can control our passwords.

I was able to quickly identify my key accounts at risk in order to reset each password. How? With a password management database, KeePass. I also had help from the well-documented Mashable article.

I have all of my passwords stored in a KeePass database. Each account is categorized into groups like Banking, Email, Investments, etc. (see screenshot above). Using the Mashable article, I edited the each description by adding "OpenSSL" for each account that used OpenSSL. I also ran a few online searches to determine the status of other accounts I wasn't sure about.

Once I finished that, I search through the entire database (over 240 passwords!!) for "OpenSSL" to list all the entries together. Starting with my financial accounts in Banking, Investments, and other categories, I changed each password, one-by-one.

It took about an hour, but who out there without a password management database can say they reset all their key accounts so quickly?

Now I'm not going to stop there. I'll be reseting some passwords once a week until I hear this issue is cleared up. (Thus entering "OpenSSL" permanently in each account description.) It's going to take time to re-issue those cryptographic keys and for all the certificate authorities to synchronize. For these important accounts, I don't want to risk losing control.

In the end, if you are a user of web services like me, start using a password management database right now. (I would not use LastPass since it is online. However, according to their documentation, they use forward secrecy, which is currently the best way to do these things and would prevent any true information leak.)

Start by entering your most important accounts and change the passwords to random passwords. Gradually add those you don't use as frequently or are not as important. Then set a schedule for each important password to expire on a regular basis: every 2 months, 6 months, or whatever you think is best for the account. My financial accounts are reset every 3-6 months.

Hopefully webmasters, server admins, cryptographers, and anyone else involved in this ecosystem starts to realize that we have a broken internet. Encryption technologies are failing and need a serious upgrade. In some places, we don't even have encryption, and it's harming trust. It's up to the gatekeepers to keep us safe and to promote trust - we users can only do so much.

What is a Data Scientist?

Today on Quora, someone asked, "What are some software and skills that every Data Scientist should know?". I wrote the following as a response, reflecting on my current position and the role I play.

---

I started adding post-it notes with sub-titles to my name/title tag on my cube, as sort of a joke regarding the question, "What is a Data Scientist?".

Here's the current list:

• [Client] Analyst
• [Product A] Analyst
• Financial Analyst
• Sales Analyst
• Contract Analyst
• Quality Assurance Analyst
• Call Center Analyst
• Data Surgeon (aka, data mining with the intent to figure out what's wrong)
• Data Diagnostician (alternative of above, maybe with no details to examine)
• [Product B] Analyst
• Database Developer
• Bug Finder (as in software bugs)

So it would appear from this list that there isn't a lot of data science going on. And that's partially true.

Each of our clients has its own relational database, so we do "meta-queries" to access them one by one in order to answer a question. That's sort of data science like. Eventually, though, we're going to have one master database with all clients that will cascade into individual databases. So our "meta-queries" will be obsolete.

We deal with a lot of "big data" too, but it's usually not that big of a deal. Even with relational databases, it's okay. Some queries may take a little longer (30-60 minutes), but that's rare. We have some machine learning tasks that pull in massive training data sets, so at that point you have to be more careful about "big data" problems like running out of RAM or disk space. But it can be handled, and rather simply.

What I really wish I could do more of is machine learning, and while I've accumulated several ideas that would enhance products or help us make better decisions in the year I've been a Data Scientist, these other tasks take up most of my day.

In the end, I write a lot of SQL, use the Linux command line moderately, and report on data in Excel spreadsheets. I use Python occasionally to write scripts. And I'm always learning something new (new SQL techniques, Python libraries, Linux command line tools, etc.).

My Professional Network, Graphically

A few months ago, I was thinking about my professional network and wondered what it would look like if it were mapped out. It turns out, LinkedIn has a lab project to do just that. I loaded up my profile and a few minutes later, this came out (click for larger version):

Each dot in the above chart represents a person, and each line represents a connection between people. The larger the dot, the closer the relationship. I am at the center, and unique clusters of people become apparent by their interrelationships, and they are grouped together in space.

The lab does not label the clusters, but it does identify the clusters by color, and it allows the user to identify those clusters and name them, as I have done above. Further, you can explore your network by hovering over the individual dots that represent people.

Essentially, five groups arise from my network: Family, Friends, and Educators on the left; Dean Health Plan at the top; CPM Healthgrades at the upper right; the UW Health System, which is composed of the University of Wisconsin Medical Foundation (UWMF), the University of Wisconsin Hospitals and Clinics (UWHC), and the University of Wisconsin School of Medicine and Public Health (UWSMPH); and finally the SAS Institute at the bottom.

The lab isn't perfectly accurate, but it is pretty good. I checked out a number of individuals and some don't make sense, but most do. As an example, my wife is one of the larger dots on the left, which makes sense, since she also has networked with our friends and family on LinkedIn (although I usually avoid doing so for a number of reasons).

The UW Health cluster is visually split, but there is apparent movement and interrelationship between the organizations. There are some people who traveled between the UW and Dean, one way or another. The same is true between Dean and CPM, with most, I believe coming from Dean to CPM. There are some hubs in each organization, likely managers, project managers, or other people who attended a lot of meetings (I think one of the big dots at Dean was an IT manager who sat in on a lot of projects).

Aside from family and friends, SAS is probably the oddest group. I have some connections, and they seem to be somewhat strong. Before I attended the SAS Global Forum, this chart may have looked quite different, since I made many more connections after the conference. The chart also shows how well-developed my connections were at Dean and the UW, and how I'm still fairly new at CPM. (I bet if I ran this today it would look a bit better developed.)

Of course, charts like these leave out people who aren't on such sites as LinkedIn, but I would think that all the other people would compensate for them when graphed like this. Additionally, I don't have much of a network for old jobs like the ones I had in college, nor have I really networked much with fellow college classmates.

It would be interesting to see what other people's networks look like, especially people who are essentially professional networkers, like HR professionals or recruiters. How do networks in different industries look (mine is mostly health care)? What if you have someone who only networks with family or friends? What does that show? Perhaps different geographic locations you've lived in? How about someone who is a world traveler?

This type of graph is very powerful in that makes you think about the data behind it and ask such questions as I have done. It opens up doors we haven't thought of and inspires curiosity.

A New SAS Tool for Checking the Log

SAS just released a new tool for checking the SAS log:

SAS Log Error Checking Tool

It only works on Windows, requiring the .NET framework, and it appears to be a separate executable from the usual SAS program. Further, it seems to only check for ERROR and WARNING messages.

As I've written before, I have a macro, CheckLog, that checks the log, too, and it runs on any operating system, can be used within a current interactive SAS session, and it appears to check for more messages. (See the CheckLog About page for more documentation.)

If anyone tries out SAS's tool, I'd love to hear a comparison of the capabilities!

Electronic Task Management

I have a lot of things to do, and sometimes I have trouble remembering it all. At home, I use my computer to do remember and remind me of many tasks. At work, I use a combination of paper and the computer. Since documents from my PC or the network are not always available, it is still useful to retain a copy of certain tasks on paper. Nonetheless, I still use a few computer tools, at home and work, to help remember all of these tasks and make task management easier.

My wife and I planned our wedding using a number of Google's online office applications, including Docs, Calendar, and Notebook. We also used RememberTheMilk (RTM), an online task management application. Managing our tasks online provided the opportunity to travel and retain access to our tasks, as well as keep an eye on tasks while at work. Gmail and Microsoft Outlook also provide some useful tools for managing tasks.

For our wedding, my wife and I kept a few documents for the wedding in Google Docs, including the guest list and a service provider comparison spreadsheet. In Google Notebook, we had song lists, service providers and costs, a long to do list, and all sorts of ideas in a shared notebook. (Unfortunately, Notebook is not longer supported, so I transferred our notes to Google Docs and have been using that application since.) For specific projects at work (for example, HEDIS), I keep a task list in an electronic document, and I usually archive the tasks as I go forward, keeping newer items at the top.

My wife and I also used RememberTheMilk for managing tasks. I used this quite a bit and shared to-do items with my wife. We went back and forth between our to-do list in Notebook, which was a long-term list, and RTM, which was a short-term list. I still use RememberTheMilk for short- and moderate-term tasks, and Google Docs for long-term tasks. RTM, Google Calendar, and Outlook's task feature are useful for scheduling a task with a reminder and a specific due date. Calendar was also useful for sharing events with my wife as well as managing our to-do list and making appointments.

I associate many tasks with emails. Using Gmail at home and Microsoft Outlook at work, I flag specific emails with varying levels of priority. Gmail has a "lab" feature that enables various flags or "stars" that users can associate with anything. I have flags for immediate tasks, "important" tasks (due soon), "assigned" tasks (due later), items to read or review, and items to monitor. Gmail also has a Task list feature. I have not used this feature extensively, since I have been using RememberTheMilk for some time, and it appears that RTM has more features (e.g., scheduling tasks, associating a task with a URL).

I hope these tips and strategies are useful to someone out there. If you have any novel and efficient ways of managing tasks, feel free to share them in a comment!

IBM Buys SPSS & SPSS vs SAS

Announced earlier today, IBM is to buy SPSS, the statistical and predictive modeling software and competitor with SAS. (More news articles.)

I used SPSS at my last job, and I liked it quite a bit. There were certain tasks that were much easier using the windowing interface, and SAS's code-only method just doesn't quite match that. For example, transposing a dataset in SAS is not very intuitive. In SPSS, however, the wizard explains which variables to choose for identification of variables, constants, and variables to transpose.

Then on the other hand, SAS is quite powerful and is capable of a lot more than SPSS. Perhaps SPSS's code module can be used in a similar way, but when I used it, it was rather annoying. If you need to use a dataset, it required it to be open. In SAS, you don't ever have to open a dataset, unless you need to figure out what the variables are like. Then again, you can just look at the column information in the context menu. SAS flows from one dataset to another, and there's no need for the dataset to pop-up when using it.

SPSS was much better at handling variables (columns). Variables could be easily changed from one type to another, and "labels" for particular variables could be applied. For example, 1 = Low, 2 = Medium, and 3 = High. This can be accomplished in SAS with formats, but it's not quite the same, as it requires the user to apply the format. SPSS was also quite useful for turning a variable into a category or a variable with ranges; for example, converting salaries into salary ranges. A window wizard helped with that too.

At any rate, it will be interesting to see what happens in this market now that IBM is going to own SPSS. I always thought SPSS and SAS joined together would be a really great product, and perhaps IBM will bring to SPSS more SAS-like capabilities. Who knows?

More comparisons of SPSS and SAS:

• A Guide to Statistical Software
• Comparison of Data Analysis Packages
• Comparison of Statistical Packages

AHIP Insurance Course

Last week, I completed an introduction to insurance course, Fundamentals of Health Insurance - Part A (Basics of Health Insurance), offered by AHIP, America's Health Insurance Plans, a coalition of health insurance companies. I had decided to take the course online to save paper and money. To prepare for the exam, I studied for a couple of hours every night last week. I had already read all of the material, but it was quite a bit of information to remember, so I was reviewing it and going through the study guide. I took the test Friday and passed. However, I wasn't offered the opportunity to offer any feedback on the course, so I would like to here.

First, I had a number of problems accessing the presentation online. When I would try to load the presentation in Firefox, I received an error message from Java. I tried it on Internet Explorer and received the same message. I checked my version of Java, and it appeared to be up-to-date. I also check my security settings in both Firefox and Internet Explorer. Nothing seemed to be blocking it. I also checked my firewall, but since I was in a hurry, I didn't check it thoroughly. So then I tried my wife's laptop, which is less secure than my desktop PC in terms of browser security and firewall settings, and it worked. I studied using her computer for a few weeks until I had some time to investigate issues on my PC. Finally, I manually updated Java and changed my firewall settings to asked about network connections. It turned out that the Java applet AHIP was using was out-of-date, and I had to allow an exception. I'm not sure if the update or the firewall change resolved the issue, but it worked on my PC.

The presentation itself was also problematic. The data presented was out-of-date by at least 10 years, as the presentation only included data up to the 90s. It appeared that many of the terms, definitions, and trends were also quite out-of-date. The presentation also included a number of "Knowledge Checks" to see if you were understanding the material. About 90% of the time, these questions were completely irrelevant to the material. At first I thought they were from a different chapter, but now that I've finished reading the material, I don't think they were even from the right course. The answers to the questions were not provided in ANY of the material. Fortunately, these questions were only intended to help the student study and did not count toward the final grade. I'm not even sure AHIP even kept track of the answers.

I had contacted AHIP about both problems - with access and the questions - however, they were not much help. The guidance on updating my PC did not help, nor did the tip that "these intermediary quizzes are not graded" - basically saying "skip them". Open the following link to view the email conversation with the AHIP representative:

http://docs.google.com/Doc?id=dff94k46_67gdnxhwhn

At any rate, I was able to overcome these issues, study the material, and pass the test. There were issues with the test, too. The location for accessing the test was oddly placed at the end of the presenation content. If you clicked on it before you were ready or before your test time, that took up 1 of 2 test opportunities, since it would load the official test. I heard a number of people saying they accidentally clicked on it or expected it to be a practice test. This seems to be a bit of poor design.

The test format was a bit odd. It consisted of a number of frames with the browser, with a convenient clock counting down the time left for the test. The questions were multiple choice, but included poorly-written answers like 1) A and B; 2) B and C; 3) A, B, and C; 4) Only A; 5) Only C. These types of questions do not really increase the ability of the test to distinguish between those test-takers who know the material and those who do not. Simpler questions with 3 or 4 clear choices for responses would be adequate.

Some features were actually very convenient, helping the test-taker. One was the "Review" button, which once pressed would flag the question and put it on a list for you to answer later. The other was the button that showed the list of questions to review. The next button, as I heard from a colleague, changed from "Next" to "Submit" on the last question, which is not good if you're not paying attention to the number of questions you've answered. She clicked Submit by accident, without reviewing the questions she had flagged, and as a result, failed the test. Once I completed the test, a list of the questions I answered correctly appeared. Apparently there was a link at the bottom that showed the total percent correct, but I did not see it. I clicked the "Home" button to check to see if I passed the test. When I went back, it did not load the test results. I suppose it was a safety mechanism so that the user does not overwrite a test that was just taken, which would not be good, especially if the taker passes it the first time and fails it the second.

Although all of these problems were present, I did learn quite a bit. The course had a lot of good information about how the insurance industry works and huge number of common terms and definitions. There was some information I did not find as relevant, for example, commissions for agents/brokers, but it would certainly be useful for someone in those fields or working with those fields. I heard feedback from my co-workers that sounded similar to my experiences, but I found that a lot of people order the books. I feel that's a bit wasteful; however, it would have avoided the problems with the online presentation and questions. In the end, the information I learned was very useful, but the presentation could have been better. I hope AHIP reviews the presentation and content and updates the content to include new data and up-to-date definitions.

Internet Explorer 6 at Work

At my last and current job, my computers have been set up with Internet Explorer 6 as the default browser, even though Microsoft has developed Internet Explorer 7 and version 8, not to mention the flourish of alternative browsers, like Firefox, Safari, and Google Chrome, to mention only a few.

I've noticed that the possible reason for this may be legacy software, software that may exploit some security hole in Internet Explorer 6 in order to operate. At my last job, I downloaded Internet Explorer 7 because I thought it would be more secure while I was performing research. (At my new job, the IT department is much more serious about security, since the company deals with health care data. I am unable to modify much of anything. My screen resolution isn't even permanent!)

When I tried to access one of the company's intranet pages for storing customer information, I received numerous errors while trying to use some of the features. I tried lowering the security settings, updating all sorts of related software, and modifying the connection settings, all to no avail. It just wasn't going to work on Internet Explorer 7.

The software has some serious flaws - it's number 8 on the worst tech products of all time rated by PCWorld and the Computer Emergency Response Team has recommended that internet users not use it at all. So I'm wondering, with all of the security flaws and out-of-date features, why do companies still use it? Do newer versions lack compatibility with legacy software? Is it too difficult and time-consuming to convert to the newest version? Is it easier just to wait until Vista is the defacto operating system for business PCs? What is the reason?

Update: One of my co-workers had IE 8 installed. It was an attempt to help a web interface work better, and it seemed to do the trick! Lesson: Upgrade!