psilva's blog

Evolving (or not) with Our Devices

f5dotcom — Thu, 26 Jan 2012 20:34:01 +0000

When I talk on the phone, I’ve always used my left ear to listen. Listening in the right ear just doesn’t sound right. This might be due to being right handed, doing the shoulder hold to take notes when needed. As corded turned to cordless and mobile along with the hands-free ear-plugs, that plug went into the left ear whenever I was on the phone. Recently, I’ve been listening to some music while walking the dog and have run into an issue. The stereo ear plugs do not fit, sit or stay in my right ear. I have no problem with the nub in my left ear but need to keep re-inserting, adjusting and holding the plug in my right ear. I’m sure I was born with the same size opening for both ears years ago and my only explanation is that my left ear has evolved over the years to accommodate an ear plug. Even measuring each indicates that the left is opened more ever so slightly. I seem to be fine, or at least better, with the isolation earphone style but it’s the ear-bud type that won’t fit in my right ear. I realize there are tons of earplug types for various needs and I could just get one that works for me but it got me thinking. If my ears or specifically my left ear has morphed due to technology, what other human physical characteristics might evolve over time.

As computers became commonplace and more people started using keyboards, we started to see a huge increase of carpal tunnel syndrome. Sure, other repetitive tasks of the hand and wrist can cause carpal tunnel but typing on a computer keyboard is probably the most common cause. Posture related injuries like back, neck, shoulder and arm pain along with headaches are common computer related injuries. Focusing your eyes at the same distance over extended periods of time can cause fatigue and eye strain. It might not do permanent damage to your eyesight but you could experience blurred vision, headaches and a temporary inability to focus on faraway objects. Things like proper design of your workstation and taking breaks that encourage blood flow can help reduce computer related injuries. Of course, every profession has their specific repetitive tasks which can lead to some sort of injury and, depending on your work, the body adjusts and has it’s own physical memory to accomplish the task. Riding a bike. Often smokers who are trying to quit can tolerate the nicotine deduction but it’s the repetitive physical act of bringing the dart up that causes grief. That’s why many turn to straws or toothpicks or some other item to break the habit.

We’ve gotten use to seeing people walking around with little blue-tooth ear apparatus attached to their heads and think nothing of it. They’ll leave it in all day even if they are not talking on the phone. Many probably feel ‘naked’ if they forgot it one day, almost like a watch or ring that we wear daily. I mentioned a couple years ago in IPv6 and the End of the World that with IPv6, each one of us, worldwide, would be able to have our own personal IP address that would follow us anywhere. Hold on, I’m getting a call through my earring but first must authenticate with the chip in my earlobe. That same chip, after checking my print and pulse, would open the garage, unlock the doors, disable the home alarm, turn on the heat and start the microwave for a nice hot meal as soon as I enter. Who would have thought that Carol Burnett’s ear tug would come back.

Now that many of us have mobile devices with touch-screens, we’re tapping away with index fingers and thumbs. I know my thumb joints can get sore when tapping too much. Will our thumbs grow larger or stronger over time to accommodate the new repetitive movement or go smaller and pointy to make sure we’re able to click the the correct virtual keypad on the device. We got video eyewear so it’s only a matter of time that our email and mobile screens could simply appear while wearing shades or as heads up on the car windshield. With special gloves or an implant under our hand, we can control the device through movement or tapping the steering wheel.

Ahhh, anyway, I’m sure things will change again in the next decade and we’ll have some other things happening within our evolutionary process but it’ll be interesting to see if we can maintain control over technology or will technology change us. In the meantime, I’ll be ordering some new earphones.

Technorati Tags: F5, humans, people, Pete Silva, security, behavior, education, technology, mobile, earphone, ipv6, computer injury, iPhone, web,

Connect with Peter:	Connect with F5:

ICSA Certified Network Firewall for Data Centers

f5dotcom — Tue, 24 Jan 2012 14:01:18 +0000

The BIG-IP platform is now ICSA Certified as a Network Firewall.

Internet threats are widely varied and multi-layered. Although applications and their data are attackers’ primary targets, many attackers gain entry at the network layer. Internet data centers and public-facing web properties are constant targets for large-scale attacks by hacker/hactivist communities and others looking to grab intellectual property or cause a service outage. Organizations must prepare for the normal influx of users, but they also must defend their infrastructure from the daily barrage of malicious users.

Security administrators who manage large web properties are struggling with security because traditional firewalls are not meeting their fundamental performance needs. Dynamic and layered attacks that necessitate multiple-box solutions, add to IT distress. Traditional firewalls can be overwhelmed by their limited ability to scale under a DDoS attack while keeping peak connection performance for valid users, which renders not only the firewalls themselves unresponsive, but the web sites they are supposed to protect. Additionally, traditional firewalls’ limited capacity to interpret context means they may be unable to make an intelligent decision about how to deliver the application while also keeping services available for valid requests during a DDoS attack.

Traditional firewalls also lack specialized capabilities like SSL offload, which not only helps reduce the load on the web servers, but enables inspection, re-encryption, and certificate storage. Most traditional firewalls lack the agility to react quickly to changes and emerging threats, and many have only limited ability to provide new services such as IP geolocation, traffic redirection, traffic manipulation, content scrubbing, and connection limiting. An organization’s inability to respond to these threats dynamically, and to minimize the exposure window, means the risk to the overall business is massive. There are several point solutions in the market that concentrate on specific problem areas; but this creates security silos that only make management and maintenance more costly, more cumbersome, and less effective.

The BIG-IP platform provides a unified view of layer 3 through 7 for both general and ICSA required reporting and alerts, as well as integration with SIEM vendors. BIG-IP Local Traffic Manager offers native, high-performance firewall services to protect the entire infrastructure. BIG-IP LTM is a purpose-built, high-performance Application Delivery Controller designed to protect Internet data centers. In many instances, BIG-IP LTM can replace an existing firewall while also offering scale, performance, and persistence.

Performance: BIG-IP LTM manages up to 48 million concurrent connections and 72 Gbps of throughput with various timeout behaviors, buffer sizes, and more when under attack.
Protocol security: The BIG-IP system natively decodes IPv4, IPv6, TCP, HTTP, SIP, DNS, SMTP, FTP, Diameter, and RADIUS. Organizations can control almost every element of the protocols they’re deploying.
DDoS prevention capabilities: An integrated architecture enables organizations to combine traditional firewall layers 3 and 4 with application layers 5 through 7.
DDoS mitigations: The BIG-IP system protects UDP, TCP, SIP, DNS, HTTP, SSL, and other network attack targets while delivering uninterrupted service for legitimate connections.
SSL termination: Offload computationally intensive SSL to the BIG-IP system and gain visibility into potentially harmful encrypted payloads.
Dynamic threat mitigation: iRules provide a flexible way to enforce protocol functions on both standard and emerging or custom protocols. With iRules, organizations can create a zero day dynamic security context to react to vulnerabilities for which an associated patch has not yet been released.
Resource cloaking and content security: Prevent leaks of error codes and sensitive content.

F5 BIG-IP LTM has numerous security features so Internet data centers can deliver applications while protecting the infrastructure that supports their clients and, BIG-IP is now ICSA Certified as a Network Firewall.

Resources:

Technorati Tags: F5, big-ip, virtualization, cloud computing, Pete Silva, security, icsa, iApp, compliance, network firewall, internet, TMOS, big-ip, vCMP

Connect with Peter:	Connect with F5:

Security’s Rough Ride

f5dotcom — Tue, 17 Jan 2012 22:10:19 +0000

1 if by land, 2 of by sea, 0 if by IP

I know I’ve said this before but it sure seems like almost daily there is a security breach somewhere. Over the years, the thought process has changed from prevent all attacks to, it is inevitable that we will be breached. The massive number of attacks occurring daily makes it a statistical reality. Now organizations are looking for the right solution (both technology and practice) to quickly detect a breach, stop it, identify what occurred and what data may have been compromised. Over the last couple of days various entities have had their security breached.

As you are probably already aware either due to the headlines or a direct note in your email inbox, Zappos, a popular online shoe site, was compromised exposing information on 24 million customers. While a good bit of info was taken, like usernames, passwords, addresses, email and other identifiable information, Zappos claims that the stored credit card information was apparently spared due to being encrypted. There are still many details that are unknown like how it occurred and how long it had been exposed but all users are being required to change their passwords immediately. Users might also want to change similar passwords on other websites since I’m sure the criminals are already trying those stolen passwords around the web. These days it’s entirely too easy to use information from one hack in many others. It doesn’t even matter if passwords were compromised. Your can change your password, but the make and model of your first car, and your mother’s maiden name can’t be changed. Yet, online service providers continue to rely on these relatively weak forms of secondary authentication. The interesting thing is Zappos is/was apparently PCI-DSS compliant, proving once again, PCI compliance is a first step, not the goal. Being PCI compliance does not mean that one is secure and this also underscores importance of using WAF like BIG-IP ASM. And if it was not a web app that was owned on the server in Kentucky, then Section 6.6 is irrelevant. But again, all the details are still to be uncovered and as far as I know, no-one has claimed responsibility.

Overseas, there is an ongoing cyber-war between a Saudi (reported) hacker and Israel. 0xOmar, as news articles have identified him, claims to have posted details of 400,000 Israeli-owned credit cards and Israel’s main credit card companies have admitted that 20,000 cards have been exposed. Along the way, he has also attacked the Tel Aviv Stock Exchange and Bank Massad. In an interesting and potentially scary turn of events, a group of Israeli hackers, IDF-Team, took down the Saudi Stock Exchange (Tadawul) and the Abu Dhabi Securities Exchange (ADX) as a counter-attack. Another Israeli hacker going by Hannibal claims to have 30 million Arab e-mail addresses, complete with passwords (including Facebook passwords), and says he’s received e-mails not only from potential victims but from officials in France and other countries asking him to stop. This cyber-conflict is escalating.

In a very different type of breach, you’ve probably also seen the cruise ship laying on it’s side a mere 200 yards from the Italian shore. While not necessarily a data security story, it is still a human security story that, so far, has been attributed to human error – like many data security breaches. Like many data breach victims, people put their trust in another entity. Their internal risk-analysis tells them that it is relatively safe and the probability of disaster is low. But when people make bad decisions which seems the case in this situation, many others are put at greater risk.

Put on your virtual life vests, 2012 is gonna be a ride.

References:

Technorati Tags: F5, cyber-crime, trojan, Pete Silva, security, business, education, technology, application delivery, cruise, cyber war, ddos, hackers, iPhone, web, internet, security, breach, privacy, PCI-DSS,

Connect with Peter:	Connect with F5:

Cloud Security With FedRAMP

f5dotcom — Tue, 10 Jan 2012 19:16:17 +0000

Want to provide Cloud services to the federal government? Then you’ll have to adhere to almost 170 security controls under the recently announced Federal Risk and Authorization Management Program. The program, set to go live in June, is designed to analyze/audit cloud computing providers for federal government agencies, expedite security clearances for cloud providers and foster the adoption of cloud computing by the Federal government. FedRAMP is meant to provide a baseline for low to moderate risk systems and is based on the NIST cyber-security Special Publication 800-53 Revision 3. FedRAMP provides an overall checklist for handling risks associated with Web services that would have a limited, or serious impact on government operations if disrupted. Cloud providers must implement these security controls to be authorized to provide cloud services to federal agencies. The government will forbid federal agencies from using a cloud service provider unless the vendor can prove that a FedRAMP-accredited third-party organization has verified and validated the security controls. Once approved, the cloud vendor would not need to be ‘re-evaluated’ by every government entity that might be interested in their solution. There may be instances where additional controls are added by agencies to address specific needs.

Independent, third-party auditors are tasked with testing each product/solution for compliance which is intended to save agencies from doing their own risk management assessment. Details of the auditing process are expected early next month but includes a System Security Plan that clarifies how the requirements of each security control will be met within a cloud computing environment. Within the plan, each control must detail the solutions being deployed such as devices, documents and processes; the responsibilities of providers and government customer to implement the plan; the timing of implementation; and how solution satisfies controls. A Security Assessment Plan details how each control implementation will be assessed and tested to ensure it meets the requirements and the Security Assessment Report explains the issues, findings, and recommendations from the security control assessments detailed in the security assessment plan. Ultimately, each provider must establish means of preventing unauthorized users from hacking the cloud service.

The regulations allow the contractor to determine which elements of the cloud must be backed up and how frequently. Three backups are required, one available online. All government information stored on a provider’s servers must be encrypted. When the data is in transit, providers must use a "hardened or alarmed carrier protective distribution system," which detects intrusions, if not using encryption. Since cloud services may span many geographic areas with various people in the mix, providers must develop measures to guard their operations against supply chain threats. Also, vendors must disclose all the services they outsource and obtain the board’s approval to contract out services in the future.

More details of the FedRAMP program will be available from the General Services Administration by February 8th, but they have already started accepting applications for third party assessment vendors.

Resources:

Technorati Tags: F5, federal government, integration, cloud computing, Pete Silva, security, business, fedramp, technology, nist, cloud, compliance, regulations, web, internet

Connect with Peter:	Connect with F5:

355 Shopping Days Left

f5dotcom — Wed, 04 Jan 2012 15:17:38 +0000

After just being bombarded with the endless options of gifts for your loved ones, a simple reminder that the next blitz is just around the corner. And you are a target. 2011 started relatively tame for breaches but when hacktivism and a few other entities decided to take hold, it became a massive year for lost data. From retail to healthcare to government to schools to financial institutions – no one was immune. Household names like Sony, RSA, Lockheed and Sega were all hit. Privacy Rights Clearinghouse reports that 535 security breaches in 2011 exposed 30 million sensitive records to identity thieves and other rip-off artists. Since 2005, 543 million records have been breached – almost double the US population and about 7% of the entire world’s population. Looking at the entire Privacy Rights Clearinghouse list is staggering both in numbers and names.

It might not get better any time soon. Since mobile devices have become fixed appendages and continue to dominate many areas of our lives (phone, entertainment, email, GPS, banking, work, etc), the crooks will look for more ways to infiltrate that love affair. I suspect that mobile financial (payment/banking) apps will get a lot of attention this year as will malware laced apps. Our health information is also at risk. Medical records are being digitized. A 2009 stimulus bill included incentives for doctors and hospitals who embrace electronic health records. The CDC saw a 12% increase from last year – now 57% of office-based physicians use electronic health records. The inadvertent result is that the number of reported breaches is up 32% this year according to Ponemon Institute. That cost the health care industry somewhere in the neighborhood of $6.5 Billion. Now you might think that you have less control over a health provider’s systems than your own mobile device. While mostly true, close to half of those case involved a lost or stolen phone or personal computer. Some sort of human element involved.

It is really up to each of us to practice safe computing and, if you’re knowledgeable, share insight with those who are not tech savvy. Yes, you can be the most cautious internet citizen and still be a victim due to someone else’s mistake, oversight or vulnerability. Even so, it is still important to be aware and do what you can. For centuries we’ve been physically protecting our property, neighbors, towns, identity and anything else important to us. At times, the thieves, enemies and otherwise unwanted still got in and created havoc. Advances and admissions, plus the value of whatever needed protection kept the battle going. It continues today in the digital universe.

References

Technorati Tags: F5, banking, trojan, Pete Silva, security, business, education, technology, application delivery, ipad, cloud, context-aware, mobile, iPhone, web, internet, security, android, privacy, smartphone,

Connect with Peter:	Connect with F5:

Blog Roll 2011

f5dotcom — Tue, 20 Dec 2011 13:08:40 +0000

It’s that time of year when we gift and re-gift. And the perfect opportunity to re-post, re-purpose and re-use my 2011 blog entries. If you missed any of the approximately 50 blogs, 11 audio whitepapers or 47 videos, here they are wrapped in one simple entry. I read somewhere that lists in blogs are good.

Have a Safe and Happy New Year.

And a couple special holiday themed entries from years past.

Technorati Tags: blog, social media, 2011, f5, statistics, big-ip, web traffic, digital media, mobile device, analytics, video

Connect with Peter:	Connect with F5:

F5 Security Vignette Series

f5dotcom — Thu, 15 Dec 2011 18:27:43 +0000

Over the last couple weeks, we’ve been rolling out a series of short Security Vignette videos about various IT security challenges. We’ve posted them to the F5News blog account but also wanted to share in case you missed them. If we were going to sum up the role of security in corporate IT today we’d have to say it’s to "be prepared." This series looks at many of those security concerns which can be addressed proactively, before they are exploited or become a fire drill.

F5 Security Vignette: Proactive Security – The F5 Security Vignette series looks at various security concerns, vulnerabilities and attacks which can cause headaches for Corporate IT and the business integrity overall. This video covers SSL Certificates.
F5 Security Vignette: DNSSEC Wrapping – The dirty little secret of the Internet is how insecure DNS really is. The good news is, there’s a solution — DNSSEC. It secures the DNS query and response process.
F5 Security Vignette: Hacktivism Attack – DDoS and other targeted attacks.
F5 Security Vignette: SSL Renegotiation – The premise of the SSL Renegotiation DOS attack is simple: "An SSL/TLS handshake requires at least 10 times more processing power on the server than on the client". If a client machine and server machine were equal in RSA processing power, the client could overwhelm the server by sending ten times as many SSL handshake requests as the server could service. The counter measure against the attacks was to write an iRule to limit renegotiation requests to 5 per minute per session.
F5 Security Vignette: Credit Card iRule – The consequences of exposing hundreds of thousands of customer credit card numbers is unthinkable. Fines, lawsuits, damaged brand — the effects can be catastrophic. Even if it was accidental, the effect would be the same.
F5 Security Vignette: Apache HTTP RANGE Vulnerability – When we hear about an Apache vulnerability, it gets our attention. In this case the issue was the way Apache handles HTTP RANGE headers, which are used to request individual sub-ranges of a given response, instead of the entire response. The problem is that responding to an HTTP RANGE request is computationally expensive. A simple iRule fixes this.
F5 Security Vignette: iHealth – Security is a never ending battle. The bad guys advance, we counter, they cross over … you’re just never done. To give our side an edge we do a lot of research.
Security is our Job
F5 YouTube Feed

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, vulnerabilities, crime, social media, hacks, internet, identity theft, F5 News, security, web application security, apache, HTTP, threat mitigation, video

Connect with Peter:	Connect with F5:

2012 IT Staffing Crisis?

f5dotcom — Mon, 12 Dec 2011 20:50:09 +0000

After just proclaiming, a mere four days ago in The Top 10, Top Predictions for 2012, that I wouldn’t predict anything for 2012 and simply would repurpose other’s predictions, I offer this prognosis.

An area I have been thinking about recently is the availability of IT personnel, or lack thereof in 2012. It began with a conversation with a F5 colleague and a simple premise: Information Technology personnel seem to be in demand. We have read stories to this effect, and even anecdotally realized that times are not that bad for IT careers, despite the financial crisis. Sure, many were laid off from failing startups or collapsing banks a couple years ago, but many seemed to get new jobs rather quickly, and many of us get a few job solicitations every month.

In researching the real statistics on IT unemployment (from Help Desk to System Admins to Developers to Business Analysts), we realized how much of an understatement the premise was:

Dice.com, May, 2011: 3.8% IT unemployment – 65% of hiring managers anticipated hiring more technology professions in 2H 2011, and 49% said they were paying more in salary this year than last year.

Bureau of Labor Statistics, June 2011: 3.3% IT unemployment – Expects IT employment to grow ‘much faster than the average of all occupations’ through 2018.

Bureau of Labor Statistics, July 9th, 2011: 3.3% IT unemployment – Information Security Analyst unemployment: ZERO. Network Architect unemployment: 0.2%

Consider that the economy has not really recovered from the crash, and that many companies downsized or went out of business altogether. 5% unemployment is generally considered to be "full employment"; 3.3% is typically unhealthy for business growth. When our economy gets through this difficult period, where are companies going to find IT workers? But more specific, what does this mean?

I think that operating expenses is going to be an increasingly difficult problem for everyone, in every industry. Besides paying serious money to lure IT people away from other companies, employers are going to start paying serious money to protect the IT resources they already have. When you are an IT manager, every system you consider for implementation has two costs – the upfront cost, and how much of a resource it will take to manage it, the classic CapEx and OpEx. If you produce a solution that does not require additional headcount to manage, or actually reduces headcount, you can save OpEx for a lot of companies. Even if ProductX costs $100k, that’s only the price of one IT guy for one year. And that price is going up day by day.

iApps in BIG-IP v11 is a great step toward reducing OpEx, and evening the bar of who and what knowledge is needed to deploy our solution. Evening the bar of what skill set is needed is vitally important, because most companies can at least find some System Admins (2.8% unemployment) but may not find a Network Architect or InfoSec guy to implement the apps on the BIG-IP. The WhiteHat integration with BIG-IP ASM is similarly great, especially to those who implement the solution. Many organizations are unable to devote enough resources to managing a WAF, plus they can’t find the InfoSec personnel anyway since their unemployment rate is ZERO and has been for a few years. The integration allows those with minimal security experience the ability to build a solid web application security policy. Often, simply feeling comfortable with an appliance is all that’s needed for IT staff to give it attention.

The coming or currently unfolding (?) IT HR crisis will matter to many organizations over the next few years. Interestingly, while I was writing this, a tweet arrived asking, ‘@wimremes: random thought : do you (still) rely on recruiters or do you use your own network to find the right people for a job?’ I’m really not sure exactly how it will play out but simply something to think about.

References:

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, labor, jobs, social media, staffing, employment, internet, identity theft

Connect with Peter:	Connect with F5:

The Top 10, Top Predictions for 2012

f5dotcom — Thu, 08 Dec 2011 21:40:05 +0000

Around this time of year, almost everyone and their brother put out their annual predictions for the coming year. So instead of coming up with my own, I figured I’d simply regurgitate what many others are expecting to happen.

Security Predictions 2012 & 2013 – The Emerging Security Threat – SANS talks Custom Malware, IPv6, ARM hacking and Social Media.
Top 7 Cybersecurity Predictions for 2012 – From Stuxnet to Sony, a number of cyberattacks emerged in 2011 that experts have predicted for quite some time. Webroot’s top seven forecasts for the year ahead. Zero-day targets and smartphones are on this list.
Top 8 Security Predictions for 2012 – Fortinet’s Security Predictions for 2012. Sponsored attacks and SCADA Under the Scope.
Security Predictions for 2012 – With all of the crazy 2011 security breaches, exploits and notorious hacks, what can we expect for 2012? Websense looks at blended attacks, social media identity and SSL.
Top 5 Security Predictions For 2012 – The escalating change in the threat landscape is something that drives the need for comprehensive security ever-forward. Firewalls and regulations in this one.
Gartner Predicts 2012 – Special report addressing the continuing trend toward the reduction of control IT has over the forces that affect it. Cloud, mobile, data management and context-aware computing.
2012 Cyber Security Predictions – Predicts cybercriminals will use cyber-antics during the U.S. presidential election and will turn cell phones into ATMs.
Top Nine Cyber Security Trends for 2012 – Imperva’s predictions for the top cyber security trends for 2012. DDoS, HTML 5 and social media.
Internet Predictions for 2012 – QR codes and Flash
TOP 15 Internet Marketing Predictions for 2012 – Mobile SEO, Social Media ROI and location based marketing.

Certainly not an exhaustive list of all the various 2012 predictions including the doomsday and non-doomsday claims but a good swath of what the experts believe is coming. Wonder if anyone predicted that Targeted attacks increased four-fold in 2011.

Technorati Tags: F5, cyber security, predictions, 2012, Pete Silva, security, mobile, vulnerabilities, crime, social media, hacks, the tube, internet, identity theft

Connect with Peter:	Connect with F5:

Pearl Harbor, Punchbowl and my Grandparents

f5dotcom — Wed, 07 Dec 2011 16:19:35 +0000

(Originally posted December 07, 2009)

In honor of Pearl Harbor day, I want to share a bit of history you might not know about. This has nothing to do with technology, security or our awesome BIG-IP solutions but felt compelled to honor both my grandparents and service men/women everywhere today. I am Hawaiian (1/8th, direct from Kekaulike line), was born there and most of my ancestors lived there while it was still a Monarchy. My great(s) and present grandparents all were born and raised and some witnessed the destruction that day. A shell even landed in my grandmother’s backyard while they were at church that Sunday! Both my grandfathers played a significant role in the days and weeks following the bombing. One of my grandfathers was a carpenter and lived in Pauoa Valley (O’ahu) which is situated right next to Punchbowl, National Cemetery of the Pacific. While many equate Honolulu with Diamond Head (or Leahi – Brow of the Tuna – to Hawaiians), Punchbowl is also an old volcano crater that helped create the island. When my grandfather was a kid they used to play there and he spoke of many fun times running around inside Punchbowl as a youngster.

When Pearl Harbor was hit, many locals were called (and wanted) to help, as you can imagine. As my grandfather tells it, they needed a place to temporarily put those who had died and Punchbowl was both the closest (about 15 miles), had the space and was known as the ‘Hill of Sacrifice’ to the ancient Hawaiians so it had historical significance. Being a carpenter and living less than a mile from Punchbowl, he was part of the team that built the wooden caskets for the fallen. As the days went on and suitable re-locations were not available, they decided to start properly laying to rest those who had perished – right there at Punchbowl, including an uncle of mine. The Pearl Harbor victims were among the first to be buried there, 776 of them. About 8 years later, they officially dedicated it as the National Memorial Cemetery of the Pacific – it’s the Arlington for the Pacific Fleet. Those who have served in the Pacific Fleet actually have their choice of Virginia or Hawaii as their final resting place, as I understand.

My other grandfather, who happened to be a Honolulu Detective at the time, was born in Yokohama (although not Japanese) and had learned Japanese while attending school there. He moved to the Hawaiian Islands with his parents when he was still a teenager and grew up on the Big Island. Since he understood Japanese, the US Government had him guard the Japanese consulate when the US declared war. He really didn’t like the assignment since he had become friends with staff due to being a local police officer and had fond memories of being Japan. After the attack, there were curfews and blackouts, and my grandfather had to make sure there was still a little illumination but nothing too bright at the consulate. One evening as he was coving an exposed light bulb with a mimeograph carbon copy he pulled from the garbage, he noticed the backwards Japanese characters of a letter. As he looked closer, it contained information of about the locations of ships and other munitions stationed at Pearl Harbor, which became a key piece of evidence as they started to piece together what happened.

As the years roll on and those who witnessed the Pearl Harbor attack become memories themselves, I offer these few short stories to the great Internet to file, store and recall whenever someone wonders about all the little back stories of this significant event in our history.

Connect with Peter:	Connect with F5: