January 2021 - ASATHOR

Slowing Down: Ford Mustang '66 Convertible

I love to drive. I love driving great cars. The definition of great is being able to experience driving. That can be a car with a lot of power, but it can also be a car that requires some work. That's what today is all about. I already had good experiences with a '92 928 GTS (in times of penalty interest rates also interesting as a drivable investment) and now I was looking around for a classic that should bring me driving pleasure and contribute to the deceleration of life. After a short consideration a Ford Mustang of the 1st generation came on the shortlist. As the founder of the ponycar scene 100% cult and as a convertible in the summer certainly ingenious.

A screwdriver I am not. And I know that buying cheap always means that you have to top up the supposedly saved money later with interest and surcharge (this somehow applies to many situations in life). So I started looking for well preserved oldies and found US Cars 24 Classics in Wuppertal, a company specialized in Mustangs. The homepage is not quite modern, but that doesn't matter - it's the content that counts and it's very good. Because the company's philosophy is to the point: imported old cars are turned into real classics with top marks by a lot of diligence, knowledge and craftsmanship. I took a look at a few of the available stock cars that I liked in the pictures and made an appointment on the spot with the managing director, Mr. Thiel. Favorite was a black 66 convertible with red interior. No sooner said than done and off to Wuppertal.

Mr. Thiel and his team breathe gasoline. After a nice preliminary talk in the salon, we looked at the candidates. And - I've never seen anything like it. There's a '66 Mustang standing there looking like it's fresh off the assembly line. Mr. Thiel explained everything to me personally with a lot of attention to detail and then offered to take a look at the factory himself. There you can see how much scrap is cut out of a body and what is then rebuilt in 100s of hours. In the favoured stock car there were already 1.500 hours! And then I was offered some tweaking: better cooling, stainless steel exhaust system, Edelbrock carburetor, full underbody sealant. Sounded all sensible, handshake and deal! I don't have to think twice about something like that.

At the radiator grill clearly to recognize as 66er with GT equipment.

Then the waiting began, because the stock vehicle was still further processed, final preserved and rebuilt as ordered. The adjustment of the engine is also part of this. In total, another 300 hours went into it. Mr. Thiel has kept me in between always with pictures and video material up to date.

The registration took place in parallel, not so easy in Hesse, but thanks to close dialogue and with the registration service Kroschke (they actually have an oldie specialist) finally also successfully completed. A Classic Data report was also prepared - passed with top marks. Just reading the report is fun.

And then the time had come: we picked up the Mustang with great anticipation. By train to Wuppertal, nice dinner, and in the morning to the company premises. The taxi driver quickly asked why we were there and was open-heartedly happy with us - I think he would have loved to come along. He knew the US Cars Classic and the team and described them as "international top class" - I can confirm that 100%. I think he would have loved to come along.

And then the moment came - the first time to see the finished Mustang, the first time to hear the finished Mustang, the first time to sit in the finished Mustang. Awesome. Awesome. Awesome. That was also captured on video. We had everything explained to us and I felt like I was in the movies! It was all hard to believe, all a bit unreal. But to see it with my own eyes, to feel it with my hands and to hear it with my ears.

The stainless steel exhaust system not only looks good ...

And then came the transfer drive - unfortunately in the rain. This began directly with a fuel stop, where we learned the John Wayne position - a gush of gasoline almost always comes sloshing out of the tank if you are not careful. With a full tank we went on the highway - 300 km to the south of Hesse. That was exhausting because of the weather conditions and the unfamiliar seats without headrest - I had sore muscles in my shoulders for 2-3 days afterwards. But especially in the face, because I couldn't get out of the grin. The last 30 km we could drive open thanks to sunshine on the mountain road - a true revelation and better than I ever imagined. The Mustang was built in '66 and not designed for top speed. It's low geared and it doesn't go faster than 100. But it doesn't have to. You hear the sound of the 4.7 liter (289 cubic inch) V8 engine, you feel the wind, you feel the road over the steering wheel. A great driving experience, where you forget the time and life decelerates.

The classic 289 ci "Small "block like from the picture book. Refined with Edelbrock 4V carburetor system and optimized radiator. Right front a funny detail: in the bag is the wiper water inside.

Now the 66 "lives" together with the 928 in my barn and just the sight of it makes every day a special day. And even more so when I start the engine, warm it up and hit the track. I've quickly made connections with other US Car fans, so the odd drive with old and new V8s is behind me and ahead of me. There is gasoline talk and ... driving! 400 miles later I can only say: the '66 is worth every cent and: anytime again!

Back in Black. And red. Red is fine, too.

To learn about the history of the Ponies from 1964 to today, this book Ford Mustang - all models from 1964 onwards is a good choice - I always read it. If one has managed the first pages, it is also good to read. If you want to learn more about the technology, which goes beyond the also worth reading owner's manual, you should take a look at the Ford Mustang wrench manual.

Interview: Thomas Köhler on due diligence, being self-employed and health

I have known Thomas Köhler for many years from the early days of Virtual Forge. At that time he was still managing director and partner of his own company. We have kept in touch until today, even if the paths were different.

The interview provides insights from the perspective of an investor and from the perspective of an entrepreneur seeking growth capital:

Only the correct assessment of future viability leads to a good valuation
Say NO when it doesn't fit
Do not neglect work-life balance and health in the medium term

Tom, what happened next for you and how did our joint due diligence project come about?
In 2006 it became clear that my ideas about the future of my company (development into a specialist for managed services) and those of the main shareholder (corporate IT concepts for medium-sized businesses) did not correlate. As a result, we parted ways and I sold my shares. After 15 years in my own company, it quickly became clear that a change to the "normal" employee life should not be my first choice. Fortunately, I have a large network, and so after a few months I joined a "boutique" management consultancy as a freelancer to devote myself to interim management.
During this time I have not lost sight of the topic of security. Because I still considered it to be very promising (which I still do today), I often discussed with the owner and boss of the consultancy about founding a corresponding company. During a conversation with you, you mentioned the interest in an investor, so I then established the contact.
You then carried out the due diligence of Virtual Forge - what is your experience and what can you recommend to an entrepreneur going through such a process?
The actual investor must have understood and penetrated the business of the target company, otherwise he cannot adequately assess the future viability and will arrive at an inadequate valuation. I'm not a big fan of pure financial investors for start-ups since that time, in the light of things the said consultancy would have been one in your case. Surely there would have been interesting contacts, but basically the relation to your topic was missing.
What have you done since then in terms of start-ups, projects, etc. that particularly excited you?
After a warning shot to my health, I joined a company, a medium-sized logistics IT company with big growth plans. Due to its success, this company was then bought by a global player, so that I am now active there as an employed manager. However, I also founded companies again relatively soon: apart from supporting start-ups as a mentor, I deal very successfully with the topic of data protection together with a lawyer. This can be presented very well as a sideline and has many points of contact with security. It's just not possible to be completely self-employed.
In hindsight, we didn't take the step at the time - our reason was that we didn't believe in the future or the story. Likewise, the valuation was just way too low. How is your retrospect?
You were absolutely right. Apart from the financial aspect, it certainly wouldn't have fit in the medium term, for lack of reference to the topic. In addition: If the gut feeling is not right, one should not marry...

Interview: Prof. Sebastian Schinzel on startups, entrepreneurship and future security issues

I have known Sebastian since the early years of my former company Virtual Forge. He has been teaching and researching applied cryptography and system security for many years and is co-founder of the Institute for Society and Digital (GUD) at Münster University of Applied Sciences. He was also North German Champion, German Vice Champion and Team World Champion in Biketrial.

The interview with him turns around:

Stay creative with solutions, as no one can say how attacks will evolve
Staying authentic as a founder and entrepreneur
Strengthening the security industry in Germany and Good Ol' Europe

Sebastian, you have witnessed the transformation of Virtual Forge from a group of idealists to a company. What influenced you the most from this time?
Back then, we came to Virtual Forge from the Capture The Flag (CTF) team of the TU Darmstadt and therefore approached the first customer projects more like a hacker competition than a consulting service. Those were exciting and educational times. Then, when the CodeScanner CodeProfiler was developed, the transformation from a consulting-heavy pentesting company to a product development company began. This was indeed an upheaval, as product development requires completely different corporate structures. Penetration tests are very creative and usually relatively short projects, while product development requires years of structured development that only bears fruit after a longer period of time. I was shaped by experiencing this and being able to apply it to my current entrepreneurial activities.
You have already founded companies yourself. What goals did you pursue with them?
The goal is to promote Germany as a business location and the IT security industry in Europe. There are many good people here, good training, many good ideas, but often too little courage to try the step to self-employment. This is probably one of the main reasons why Germany lags behind the USA in terms of innovative IT companies, for example.
What makes a start-up successful for you and why can it go wrong?
You need a good idea for a solution to a concrete problem in the market, a good team and customers with a concrete need for the solution. And a lot of stamina and a bit of luck. And preferably not a pandemic!
Can you elaborate on that point a bit?
For corporations, the pandemic often seems like a good excuse. It can be used as an argument for just about anything: Restructuring, downsizing, etc. For a startup, it's detrimental because funding is difficult, customers are unlikely to jump at new ideas, and it's also hard to bring people on board who are currently more concerned with job security (vs. going into a more risky startup).
What is your opinion on the topic of "we stay as we are" vs. growth?
One does not exclude the other. You can absolutely stay "as you are" and still grow. I guess it comes down to self-image: what is one? Do I want to improve the world by making computer systems more secure? Or do I insist that I can only improve the world through this one service or product? The latter may prevent me from improving the world because the service or product will not catch on permanently.
And finally, a technical question: which topics are suitable for you, as a "security professor", for a start-up?
Cybersecurity will continue to be relevant, even if other topics such as AI are currently dominating the funding landscape. Companies are constantly learning and therefore are a "moving target". While penetration testing was very innovative 10-15 years ago with few specialized vendors, today almost every consulting firm has penetration testing in their program as well. Founders should ask themselves: what service, what product will companies be asking for in 2-5 years? If you have a good idea for this and at the same time have some innovative companies with buying interest up your sleeve, then you should consider founding a company.
Derived from this - which ones will it be in the next 5 years?
Many companies have learned that preventing cyber attacks, e.g. by looking for and closing security holes, secure software development, etc. is not enough. If employees open the wrong attachment, the attackers have a foot inside the company and can spread from there. The current extortion Trojan gangs are highly professional and have high profit margins. Pure prevention through protection is no longer sufficient. Companies need to ask themselves:

How do I detect successful attacks in a timely manner?
How do I know the extent of the attack?
How can I stop the attackers from spreading further?
How do I reliably throw the attackers out of my network?
And of course: how do I rebuild my IT infrastructure if an attacker had already penetrated deep?

These are questions for which one needs specialized personnel, possibly also with on-call duty etc.. Most companies cannot handle this. Some of this can be outsourced to Managed Service Providers (MSP), but some of this knowledge must also be available internally.

Image source: Münster University of Applied Sciences, Wilfried Gerharz

Functional training

Most people don't move enough, which inevitably leads to misalignment and pain. In times of home office, this can even get worse. Even if you do sports, such as cycling or jogging, problems can arise if you lack body stability. Strength training is therefore essential in my view. The aim should be to get the body so stable that you can move without pain in the long term. In addition, having good muscles helps you burn more calories, making it easier to control your weight. I used to train in studios(Kieser or Venice Beach), but then at some point I stumbled across functional training1.

When training with equipment, muscles are targeted and also trained in isolation. You go to the lat pulldown to train the latissimus. You go to the leg press to train the thigh muscle and the large gluteal muscle. Etc. For many people, this is enough because they value shapely and well-defined muscles. But this will not help to get the body holistically stable.

This is different with functional training. The idea here is to build up strength using your own body weight or suitable aids in movement sequences that are close to natural or sport-specific movements. The exercises involve several muscle groups and joints. I have considered here so far:

Body Weight Training
Sandbag Training
Kettlebell Workouts
Slingtrainer
Squats

I always alternate between these training approaches or mix them - on the one hand, to avoid boredom. On the other hand, to always provide different muscle stimuli (they otherwise also get bored and the training effect stagnates).

¹ Michael Boyle: Functional Training. ISBN-10 : 3742301489, 2017

... about this blog (my mission statement)

My mission statement is based on Simon Sinek's slightly expanded Why-How-What circle. It's likely that I'll continue to refine this over time, but here's the first pitch.

Why? My articles are aimed at entrepreneurs and those who want to become entrepreneurs. I assume the entrepreneur wants to make an idea big and "come out ahead". Such people who have a clear, entrepreneurial goal are my target audience. Entrepreneurial success means making few mistakes or correcting them quickly. The management of the company should be conscious and active. It is about working out what to offer to whom(marketing) and how(sales). It is also about setting a strategy and bringing it to fruition. Finally, it is important to constantly reinvent the company and adapt it to the market. The best example here is dealing with the pandemic, which by no means everyone survives if they don't adapt their company.

How. I follow two basic perspectives: 1) improve the company itself and b) improve the entrepreneur. Both need to be in harmony to ensure that an idea ultimately becomes a product in demand and this then leads to success. Both perspectives have different facets that need to be systematically captured and continuously improved. After all, standing still means taking a step backwards, as the competition never sleeps in an attractive market.

I like to start with a 360° view of the company. In doing so, I apply a multi-dimensional model that I developed and refined with my mentor. The dimensions considered include: Customers, Market Approach, Employees, Plan and Actual Numbers, Product Roadmap, etc. Once this is captured, I look with the entrepreneur to see where the bottlenecks are and what operational steps can be derived. A consistent review of the success of the measures rounds this off. I apply the same system to the entrepreneur. The dimensions here include: entrepreneurial fitness and physical fitness. It is also about internalizing the phases of entrepreneurship (growth, sale, exit, life after).

Ishe allowed to do that? As a former company founder, CEO and Managing Director, I walked a rocky road for many years, growing my company through various stages to 120 employees and a leading company. I also actively sought growth capital, negotiated and eventually sold the company. I am now happy to pass on the experience I gained along the way.

^{(1) Is it "the" or "the" blog? Ask the dictionary!}

About me ...

My name is Markus Schumacher, born in 1973, and I live in the Bergstraße district (Hesse). In this blog, I exchange ideas on topics that have literally "occupied" me for many years: Technology, Entrepreneurship and "Toys". This post outlines how I got into it.

Computers have fascinated me since I was a child. The conscious starting shot of my nerd career was in 1985, when my parents gave me a Commodore C64. Besides playing games, I quickly became fascinated with designing with a computer and still do today. By the way, I still have the C64 (see picture).

This hobby led me to study electrical engineering at the TU Darmstadt. When I couldn't find a reasonable job during the semester break in 1996, I decided to participate in a programming internship to learn the then new language Java . After Assembler and C in my studies, this was a completely new experience and set the course for the future. Equipped with this knowledge, I quickly got a job at an advertising agency in Frankfurt to design the first applets for websites of financial companies.

Java 1.0 Desktop Reference (original) — This is my original copy of the Java 1.0 Desktop Reference.

Thus infected, I decided to stay at the university and do my doctorate. I started this in 1998 at the IT Transfer Office (ITO) , an organization of the Department of Computer Science at TU Darmstadt that kept itself alive exclusively through externally funded projects, initially sponsored by the Digital Equipment Corporation. This awakened the entrepreneurial streak in me. The creative freedom, but also the entrepreneurial risk (no project, no job, no PhD) of this time had a great impact on me. It also made me aware early on that technology alone is not enough to sell products or services on the market.

Without teaching duties, however, I lacked contact with the students. Therefore, building on my childhood experiences with computers, I created the Hacker Contest . The goal was to investigate current technologies (new at the time: WLAN, Bluetooth, etc.). In teams the participants took the role of attacker and defender. This initiative was continued for many years, even after I left the university.

In May 2003 I successfully completed my doctorate "with distinction". The topic was Security Patterns, a topic I have been dealing with for many years. Patterns originally come from architecture. The idea is that no architect can learn how to build beautiful houses. You need experience to do that - and that's what is captured in a pattern. The idea was transferred to software (sgt. Design Patterns) and I then adapted and described it for security.

One of my pioneering topics: Security Patterns was a new topic that had a lot of momentum in the design pattern community.

Equipped with this know-how, I decided to go "out" after my doctorate. I had been offered a junior professorship, but that was still quite new at the time and not very attractive to me. I therefore used my ITO contacts and quickly found a job at SAP as a product manager for security. At that time, SAP was another project partner of the ITO and had taken over the Lab in Karlsruhe with which we had cooperated. During this time, the "old" SAP base in NetWeaver (Release 640+) and I was able to learn a lot about the different SAP technologies during this time, most recently during the conversion from an idea to the generally available product SAP Business ByDesign.

The topic of security was and is a matter of the heart for me for many years. However, I have not understood it in the sense of a function for protection, like logging something in with a name and password. Rather, it has always been more exciting for me to understand what gaps a system has, how to exploit them, and what you have to do to be "bulletproof". Since I also noticed that SAP customers do a lot of their own development, the next step was bound to happen. When programming and when systems are complex, gaps are almost bound to occur. So it was clear that I would leave SAP in 2006 and, together with a business partner I met at SAP, I founded the Virtual Forge GmbH together with a business partner I met at SAP. Incidentally, I recruited many of the first employees who then carried out SAP-focused penetration tests from the cohorts of participants in the Hacker Contest.

I had some ideas in my luggage about what can be done in the SAP environment that is not offered by the SAP standard. This resulted in another pioneering topic: scanning SAP ABAP code for security vulnerabilities. The resulting solution CodeProfiler for ABAP (version 1.0 presented at the SAP TechEd in Berlin in 2009) is still a market-leading solution today. During this time our book "Secure ABAP Programming" was published. It has not lost much of its topicality, because although there are some new programming constructs in the SAP environment, "old-school" ABAP is far from being at an end.

SAP ABAP - but secure! In 2.000 lines of code 1 critical security hole. Until today the benchmark.

Virtual Forge was the practical introduction to business management for me. Exclusively self-financed, we have managed to reinvent the company over the years to stay ahead in the market and survive. As CEO and Managing Director, I spent many years looking after sales (how do I sell the value of technology), marketing (which customers do I target and how do they find me) and administration. All the while, tough decisions had to be made and my own compass readjusted: this included the company strategy and its implementation. With about 120 employees, we decided in 2018 to go in search of growth capital so we could be strategic (vs. reactive). This eventually ended with the sale of the company(mid-2019) to market competitor Onapsis, where I was an employee for the first time in many years as General Manager Europe.

Since the beginning of 2021, I am now self-employed again with the idea of sharing experiences I have gained on the path to entrepreneurship outlined here. It goes as written at the beginning all facets of entrepreneurship and technical topics. I will always describe "toys" besides the job. By that I mean things that you can afford to do as an adult and that are one thing above all: fun.

You can find me on LinkedIn and XING, among others.