Full Chapter Managing Risk and Information Security Protect To Enable 2Nd Edition Malcolm W Harkins Auth PDF
Full Chapter Managing Risk and Information Security Protect To Enable 2Nd Edition Malcolm W Harkins Auth PDF
https://textbookfull.com/product/information-security-in-
healthcare-managing-risk-terrell-w-herzig/
https://textbookfull.com/product/the-plot-to-hack-america-
malcolm-w-nance/
https://textbookfull.com/product/it-auditing-using-controls-to-
protect-information-assets-third-edition-chris-davis/
https://textbookfull.com/product/microsoft-365-compliance-a-
practical-guide-to-managing-risk-toelle/
Quantitative Finance and Risk Management A Physicist s
Approach 2nd Edition Jan W Dash
https://textbookfull.com/product/quantitative-finance-and-risk-
management-a-physicist-s-approach-2nd-edition-jan-w-dash/
https://textbookfull.com/product/information-security-planning-a-
practical-approach-2nd-edition-lincke/
https://textbookfull.com/product/gender-roles-in-peace-and-
security-prevent-protect-participate-manuela-scheuermann/
https://textbookfull.com/product/managing-and-using-information-
systems-galletta/
Managing Risk
and Information
Security
Protect to Enable
—
Second Edition
—
Malcolm W Harkins
Managing Risk and
Information Security
Protect to Enable
Second Edition
Malcolm W. Harkins
Managing Risk and Information Security: Protect to Enable
Malcolm W. Harkins
Folsom, California, USA
ISBN-13 (pbk): 978-1-4842-1456-5 ISBN-13 (electronic): 978-1-4842-1455-8
DOI 10.1007/978-1-4842-1455-8
Library of Congress Control Number: 2016949414
Copyright © 2016 by Malcolm W. Harkins
ApressOpen Rights: You have the right to copy, use and distribute this Work in its entirety, electronically without
modification, for non-commercial purposes only. However, you have the additional right to use or alter any source
code in this Work for any commercial or non-commercial purpose which must be accompanied by the licenses in
(2) and (3) below to distribute the source code for instances of greater than 5 lines of code. Licenses (1), (2) and (3)
below and the intervening text must be provided in any use of the text of the Work and fully describes the license
granted herein to the Work.
(1) License for Distribution of the Work: This Work is copyrighted by Malcolm Harkins, all rights reserved. Use
of this Work other than as provided for in this license is prohibited. By exercising any of the rights herein, you
are accepting the terms of this license. You have the non-exclusive right to copy, use and distribute this English
language Work in its entirety, electronically without modification except for those modifications necessary for
formatting on specific devices, for all non-commercial purposes, in all media and formats known now or hereafter.
While the advice and information in this Work are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions
that may be made. The publisher makes no warranty, express or implied, with respect to the material contained
herein.
If your distribution is solely Apress source code or uses Apress source code intact, the following licenses (2) and (3)
must accompany the source code. If your use is an adaptation of the source code provided by Apress in this Work,
then you must use only license (3).
(2) License for Direct Reproduction of Apress Source Code: This source code, from Intel® Trusted Execution
Technology for Server Platforms, ISBN 978-1-4302-6148-3 is copyrighted by Apress Media, LLC, all rights reserved.
Any direct reproduction of this Apress source code is permitted but must contain this license. The following license
must be provided for any use of the source code from this product of greater than 5 lines wherein the code is
adapted or altered from its original Apress form. This Apress code is presented AS IS and Apress makes no claims
to, representations or warrantees as to the function, usability, accuracy or usefulness of this code.
(3) License for Distribution of Adaptation of Apress Source Code: Portions of the source code provided are used
or adapted from Intel® Trusted Execution Technology for Server Platforms, ISBN 978-1-4302-6148-3 copyright
Apress Media LLC. Any use or reuse of this Apress source code must contain this License. This Apress code is made
available at Apress.com/9781484214565 as is and Apress makes no claims to, representations or warrantees as to
the function, usability, accuracy or usefulness of this code.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every
occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion
and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this
publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is
not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions
that may be made. The publisher makes no warranty, express or implied, with respect to the material contained
herein.
Cover image designed by Freepik.
Managing Director: Welmoed Spahr
Lead Editor: Robert Hutchinson
Development Editor: James Markham
Editorial Board: Steve Anglin, Pramila Balen, Aaron Black, Louise Corrigan, Jonathan Gennick, Robert
Hutchinson, Celestin Suresh John, Nikhil Karkal, James Markham, Susan McDermott, Matthew Moodie,
Natalie Pao, Gwenan Spearing
Coordinating Editor: Melissa Maldonado
Copy Editor: Mary Behr
Compositor: SPi Global
Indexer: SPi Global
Artist: SPi Global
Distributed to the book trade worldwide by Springer Science+Business Media New York,
233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail
[email protected], or visit www.springer.com. Apress Media, LLC is a California LLC
and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc).
SSBM Finance Inc is a Delaware corporation.
For information on translations, please e-mail [email protected], or visit www.apress.com.
Apress and friends of ED books may be purchased in bulk for academic, corporate, or promotional use. eBook
versions and licenses are also available for most titles. For more information, reference our Special Bulk Sales–eBook
Licensing web page at www.apress.com/bulk-sales.
Any source code or other supplementary materials referenced by the author in this text is available
to readers at www.apress.com. For detailed information about how to locate your book’s source code, go to www.
apress.com/source-code/.
Printed on acid-free paper
About ApressOpen
What Is ApressOpen?
• ApressOpen is an open access book program that publishes
high-quality technical and business information.
• ApressOpen eBooks are available for global, free,
noncommercial use.
• ApressOpen eBooks are available in PDF, ePub, and Mobi formats.
• The user friendly ApressOpen free eBook license is presented on
the copyright page of this book.
iii
This book is dedicated to my family.
Contents at a Glance
Foreword ......................................................................................... xv
Praise for the second edition of Managing Risk and
Information Security...................................................................... xvii
About the Author ............................................................................ xxi
Acknowledgments ........................................................................ xxiii
Preface ...........................................................................................xxv
vii
■ CONTENTS AT A GLANCE
viii
Contents
Foreword ......................................................................................... xv
Praise for the second edition of Managing Risk and
Information Security...................................................................... xvii
About the Author ............................................................................ xxi
Acknowledgments ........................................................................ xxiii
Preface ...........................................................................................xxv
ix
■ CONTENTS
Conclusion ............................................................................................. 47
■ Chapter 4: External Partnerships: The Power of Sharing
Information ................................................................................... 49
The Value of External Partnerships ....................................................... 51
External Partnerships: Types and Tiers.................................................. 52
1:1 Partnerships ..................................................................................................... 55
Communities........................................................................................................... 57
Community Characteristics .................................................................................... 57
Community Goals.................................................................................................... 59
Sharing Information about Threats and Vulnerabilities........................................... 59
Sharing Best Practices and Benchmarking ............................................................ 60
x
■ CONTENTS
Conclusion ............................................................................................. 63
■Chapter 5: People Are the Perimeter ............................................ 65
The Shifting Perimeter .......................................................................... 65
Compliance or Commitment? ................................................................ 66
Examining the Risks .............................................................................. 68
Adjusting Behavior ................................................................................ 69
A Model for Improving Security Awareness .......................................... 71
Broadening the Awareness Model ......................................................... 74
The Security Benefits of Personal Use .................................................. 74
Roundabouts and Stop Signs ................................................................ 75
The Technology Professional ................................................................. 77
Insider Threats....................................................................................... 78
Deter ....................................................................................................................... 79
Detect ..................................................................................................................... 79
Discipline ................................................................................................................ 80
xi
■ CONTENTS
Conclusion ............................................................................................. 97
■ Chapter 7: A New Security Architecture to Improve
Business Agility ............................................................................ 99
The 9 Box of Controls, Business Trends, and
Architecture Requirements ................................................................. 101
9 Box of Controls .................................................................................................. 101
IT Consumerization ............................................................................................... 102
New Business Needs ............................................................................................ 103
Cloud Computing .................................................................................................. 104
Changing Threat Landscape ................................................................................. 104
Privacy and Regulatory Requirements.................................................................. 105
xii
■ CONTENTS
xiii
■ CONTENTS
xiv
Foreword
Security and first-person shooter video games have one obvious thing in common: if
you’re not continuously moving, you’re dead. In this second edition of Managing Risk
and Information Security, Malcolm Harkins helps us move our thinking into areas of risk
that have become more prominent over the last several years.
Because there is so much new content in this edition, I will focus on a topic that has
risen to greater prominence since the first edition: people are the perimeter. When we
reflect on what has changed in recent years, with an eye to the vulnerabilities that result
in real-world compromises, a pattern emerges: virtually all the major breaches that we
have seen involve manipulation of people. When nearly everyone has heard of phishing,
we have to ask ourselves: why is it still such an effective tool?
The obvious theory is that we haven’t managed people risk as well as we should.
Perhaps we have been standing still and need to learn how to dodge and experiment
with the way we drive better people-security outcomes. Unfortunately, the path is not
100% clear. Unlike technology, the field of influencing human behavior in security is
remarkably complicated and supported by limited research.
Malcolm provides us with a great foundation and framework to build our
“security engagement” functions. I like to use the word “engagement” because it
speaks to how the security organization relates to the workforce in a manner that isn’t
simply bounded by the more traditional term “training and awareness.” Engagement
encompasses anything that shifts the desired behavior outcome in the direction we want
it to go. I have seen remarkable shifts in measured behavior from the use of
non-traditional tools such as security gamification and simulation.
The way Malcolm differentiates between “compliance” and “commitment” is key.
Managing Risk and Information Security is an ever-evolving classic in the field of security
management.
—Patrick Heim
Head of Trust & Security, Dropbox
xv
Praise for the second edition
of Managing Risk and
Information Security
xvii
■ PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY
The CISO is more than just a technology expert; she must be savvy
about leadership, influence, and change across complex organizations;
someone who sees her mission not to just drive implementation of a
large system, but to foster sustainable culture change at every level. As
an organizational psychologist, I recognize Harkins’ keen eye for group
dynamics and leadership tactics that enable CISOs to enhance enterprise
security. He puts his finger on the habits, assumptions, and decision
processes typical of many employees and teams, as they unknowingly
increase security risk, and for that alone this book is a gem. It should be
required reading for aspiring CISOs and for anyone who has a role in the
recruitment and hiring of CISOs.
—Marc Sokol, PhD
Executive Editor, People + Strategy
xviii
■ PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY
xix
■ PRAISE FOR THE SECOND EDITION OF MANAGING RISK AND INFORMATION SECURITY
While other security officers are looking to the traditional or the latest
“cool” product, Harkins goes against the tide and asks the questions that
need addressing. His forward-thinking mindset and Protect to Enable
approach inspire others to innovate and go beyond the mainstream.
If you cannot bring Harkins to your company for mentoring, this book
will at least spark thought and will change how your engineers view
security within the business.
—Charles Lebo
Vice President and CISO, Kindred Healthcare
Malcolm’s vast experience makes him one of the most credible security
leaders on the international stage and serves as the perfect platform for
this book. Rational, compelling, and authoritative writing is far too rare
in the world of risk and information security, but Malcolm completely
nails it in Managing Risk and Information Security with invaluable
advice and recommendations for anyone planning a future in the
security world. His extensive experience in business before becoming
a CISO is one of the missing ingredients in many security executives’
professional toolbox, which is which is why this is such an important
book. Make sure to keep a highlighter and notepad handy because there
are a lot of nuggets in here you’ll want to remember on your journey to
becoming a better security professional.
—Mark Weatherford
Chief Cybersecurity Strategist at vArmour and
former Deputy Under Secretary for Cybersecurity
at the US Department of Homeland Security
I’ve had the privilege of working with many talented CISOs over the
years and Malcolm is one of the best. His logical, methodical approach
to solving the most complex cybersecurity problems is reflected in his
lucid style. An enlightened approach to understanding risk that unites
all stakeholders and a systemic intelligence-based approach to security
infrastructure are the only ways to reduce the threat to manageable
levels. This is our best path forward if we are ever to realize the vast
potential of the innovative digital world we are creating. In Managing
Risk and Information Security, Malcolm shines a light on that path in a
comprehensive yet very readable way.
—Art Coviello
Former CEO and Executive Chairman, RSA
xx
About the Author
xxi
■ ABOUT THE AUTHOR
papers and in December 2012 published his first book, Managing Risk and Information
Security. He also was a contributing author to Introduction to IT Privacy, published in
2014 by the International Association of Privacy Professionals.
Malcolm received his bachelor’s degree in economics from the University of California
at Irvine and an MBA in finance and accounting from the University of California at Davis.
xxii
Acknowledgments
I received valuable feedback from many readers of the first edition of this book. That
feedback helped me to expand the book with additional insights, clarifications, and
updated examples. It also encouraged me to add two more chapters to the second
edition: one on corporate social responsibility, and the other on performance coaching.
Special thanks to Mike Faden: without his help this book would not have happened.
As I noted in the first edition, many people during my journey at Intel helped me
learn and grow. A number of them published material that is still referenced in this
second edition.
Other experts who have helped me come from a variety of different peer groups.
They include members of the Bay Area CSO Council, the Executive Security Action
Forum, the members and staff of CEB and its Information Risk Leadership Council,
participants in the Evanta CISO Executive Summits and the CISO coalition, as well as the
Security Advisor Alliance.
Finally, I wish to thank Stuart McClure for giving me the opportunity to join Cylance.
xxiii
Preface
If you don’t believe in the messenger, you won’t believe the message.
You can’t believe in the messenger if you don’t know what the messenger
believes.
You can’t be the messenger until you’re clear about what you believe.
—James Kouzes and Barry Posner,
in The Leadership Challenge
A great deal has transpired since the first edition of this book was published in January
2013, both in the world of information risk and in my personal life and career. To briefly
cover the latter, in January 2013, I was named Intel’s Chief Security and Privacy Officer.
My broad role was one of the first of its kind in corporate America: I was charged with
managing and mitigating risk for Intel’s products and services worldwide, in addition to
Intel’s internal IT environment. In June 2015, I left Intel to become CISO at Cylance Inc.,
and in May 2016, I was named Cylance’s Chief Security and Trust Officer.
These career changes occurred during an extraordinary period of escalating
information risk, as evidenced by an almost continuous stream of major hacks and
breaches, and a corresponding rise in society’s awareness of risk. Some key examples:
• May 2013: Edward Snowden flies to Hong Kong after leaving
his job at an NSA facility in Hawaii. The following month, he
reveals thousands of classified NSA documents. The disclosures,
including previously unknown government surveillance
programs, continue to cause worldwide repercussions today.
• December 2013: The blog Krebs On Security reports a massive
data breach at Target. The company confirms the breach the next
day. Within months, Target’s CIO and CEO both resign amid the
fallout.
• May 2014: A U.S. grand jury indicts five Chinese military officers
on charges of hacking American companies and stealing trade
secrets.
• November 2014: Employees at Sony Pictures arrive at work to
discover their network has been hacked. Attackers steal and then
erase data on thousands of systems, forcing studio employees to
revert to using fax machines and pen and paper. The attackers
then dump huge batches of confidential business and personal
information online.
xxv
■ PREFACE
xxvi
■ PREFACE
business. For computing to continue to improve the world we live in rather than endanger
it, it needs to be trustworthy. And for that trust to be deliverable, we need to ensure the
data we enter into our computers is both secure and private. As an organization, we
demonstrate and build trust through our approach to solving these cyber-risk challenges.
In the preface of the first edition, I said “Managing Risk and Information Security is
a journey, but there is no finish line. Our approach to managing information risk must
continue to evolve as rapidly as the pace of business and technology change. My hope is
that people will read this book and begin their own journey.”
I still firmly believe what I said then. But I also believe that, as General George
Marshall once said, “The only way human beings can win a war is to prevent it.” We
are at war against adversaries who wish to harm the users of technology. But there is
also a battle among those responsible for protecting security and privacy. On one side
are organizations that would like to continue on the current path because they profit
from the insecurity of computing, or that approach the duty of care with a bias towards
limiting liability rather than protecting their customers. On the other side are those who
believe that our role is to generate trust. We do that by protecting to enable people and
businesses. It’s a hard road; I know, because I experience it every day. But we shouldn’t
back away from something just because it is hard. We need to plant our feet and stand
firm. The only question is where we plant our feet.
xxvii
CHAPTER 1
Introduction
There are two primary choices in life: to accept conditions as they exist,
or accept the responsibility for changing them.
—Denis Waitley
In January 2002, I was hired to run a new Intel internal program called Security and
Business Continuity. The program had been created following the major security events
of the previous year (9/11 and the Code Red/Nimda viruses) and it focused primarily
on the availability risks at that time. I had no background in technical security, but I
had been at Intel for nearly 10 years in a variety of business-related positions, mostly
in finance. As I learned about information risk during the first few months, it became
apparent to me that the world was starting to change rapidly and that a “perfect storm”
of risk was beginning to brew. In June 2002, I put together a diagram (Figure 1-1) to
explain the risks to my manager, Intel’s CIO, and anyone who would listen to me.
The diagram has been updated slightly since then to more explicitly highlight the
geo-political forces that are a key part of the threat, vulnerability, and regulatory
risk landscape.
FOOTNOTES
[901] This appears to have taken place on the Xocotlan road, followed by the
Spaniards on first entering the country, for in the temple of this town, says Bernal
Diaz, were found the saddles and other trophies. He estimates the treasure lost at
40,000 pesos. Hist. Verdad., 108, 116-117; Lejalde, Probanza, in Icazbalceta, Col.
Doc., i. 425.
[902] Herrera writes, under Iuste and Morla. If correct there were two Morlas.
[903] Herrera copies this account, but gives also another in an earlier chapter,
which leads one to suppose that Yuste and a few companions escaped to the
mountains. They either perished of hunger or were captured at some settlement
while offering the remnant of their treasures for food. An inscription by Yuste on a
piece of bark recorded their sufferings. ‘Por aqui passò el desdichado Iuan Iuste,
con sus desdichados compañeros, con tãta hambre, que por pocas tortillas de
mayz, diò vno vna barra de oro, que pesaua ochocientos ducados.’ dec. ii. lib. x.
cap. xiii.; dec. iii. lib. i. cap. v. Torquemada repeats both versions, i. 530-1. Peter
Martyr and Gomara are also confused, allowing the Yuste party in one page to fall
at the pass, and on another to turn back to Villa Rica from Tlascala. Hist. Mex.,
165, 181-2. A misinterpretation of a vague passage by Cortés is the cause of the
mistake, into which nearly every writer has fallen. The party carried, according to
the Cartas, 141, 183-4, a number of agreements with the natives, and other
valuable documents, beside Cortés’ personal effects and valuables, worth over
30,000 pesos de oro. Bernal Diaz says three loads of gold. The inhabitants said
that people from Tezcuco and Mexico had done the deed to avenge Cacama. But
none except the natives of the district could have had time to gather for the attack.
[904] Herrera places the number of the party at 50 or 60. dec. ii. lib. x. cap. xv.
Bernal Diaz speaks of the slaughter in Tochtepec of 72 men and 5 women, and he
leaves the impression that they were a part of the Narvaez force which had
followed the army at their leisure. Hist. Verdad., 108. This is no doubt the party
described in the text. Yet Herrera, in cap. xvii., refers to the destruction at
Tochtepec of a force of 80 men under Captain Salcedo, who was sent to reduce
this province a few months later. This incident, mentioned by no other original
authority, may be identical with the preceding. Had the party in question belonged
to the original force of Narvaez it would have accompanied Yuste and Alcántara.
Such not being the case, it must have arrived after their departure. This receives
confirmation from Gomara’s statement that several small parties, who had been
attracted to New Spain by Cortés’ conquests, were killed in Tepeaca and
Xalacinco. Hist. Mex., 173. The narratives of Bernal Diaz and Cortés specify some
of these, numbering from ten to eighteen men, who fell at Quecholac, Tepeaca,
and other places. It is not likely that so many small parties could have arrived on
the coast during the short interval of Cortés’ departure from Cempoala and his
retreat to Tlascala; nor that they would have ventured in small numbers into a
strange country, during so unquiet a period; nor would a mere dozen have been
allowed to penetrate so far as Tepeaca ere they met their fate. Hence they must
have belonged to the large party spoken of in the text, whose members, dead or
captive, were distributed among the different towns which had aided in their
defeat. This appears to be the only way to reconcile the differing statements,
which have so confused every writer as to lead them into apparent blunders or into
the omission of facts. See Robertson’s Hist. Am., ii. 99; Prescott’s Mex., ii. 409-10;
Brasseur de Bourbourg, Hist. Nat. Civ., iv. 353-5.
[905] Bernal Diaz intimates that only two vessels remained of Narvaez’ fleet, and
one of these was now destroyed so that the crew might be sent to Tlascala. The
reinforcements numbered four soldiers and three sailors, two of whom suffered
from swollen stomachs, and the rest from venereal diseases. Hist. Verdad., 109.
[906] Bernal Diaz, Hist. Verdad., 109, mentions only four deaths.
[907] ‘Se le pasmo la cabeça, o porque no le curaron bien, sacãdole cascos: o por
el demasiado trabajo.’ Gomara, Hist. Mex., 162. Solis describes the progress of
the cure with a minuteness that would do credit to a medical journal. Hist. Mex., ii.
212-14.
[909] Cortés assumes only two rivals, the natural sons of Montezuma, ‘el uno diz
que es loco y el otro perlático.’ Cartas, 153.
[910] Twenty days after Montezuma’s death. Ixtlilxochitl, Relaciones, 413, 304.
[911] Of which Sahagun gives some account. Hist. Conq. (ed. 1840), 137. See
also Torquemada, i. 511.
[912] ‘Él les hace gracia por un año de todos los tributos y servicios que son
obligados á le hacer.’ Cortés, Cartas, 155; Gomara, Hist. Mex., 173.
[913] Beaumont, Crón. Mich., MS., 68 etc.; Native Races, ii. 107-8; v. 508 et seq.
[914] ‘Entrarian en parte de todas las rentas de las provincias sugetas por el
imperio.’ Ixtlilxochitl, Hist. Chich., 304.
[915] ‘Tanto supieron decir á la señoría estos embajadores, que casi toda ella, ...
la redugeron á su voluntad y deseo.’ Old Xicotencatl being one of the most
devoted. Id. Herrera also assumes that this chief favors the Mexicans, but the
supposition is due to confounding the two men of this name. dec. ii. lib. x. cap. xiv.
[917] Bernal Diaz assumes that the young chief had been brought before the
council a prisoner, to be arraigned for his machinations. His father was so deeply
incensed against him as to decree his death, but the other chiefs were lenient out
of respect for the father; the conspirators were arrested. Hist. Verdad., 109-10. A
later writer states, on doubtful authority, that the chieftain was also removed from
the command of the army; and Solis assumes that the act of jostling him down the
steps in the council-hall was the form of degradation, which took place during a
special session, after the deliberation. He appealed to Cortés, who caused him to
be reinstated. Hist. Mex., ii. 220-3. According to Camargo, the elder Xicotencatl
had ceded his place as ruler to the son, owing to his advanced age. Hist. Tlax.,
173-4. In such a case no imprisonment or degradation could have been admitted;
perhaps in no case, since he merely advocated what he considered to be the best
for the country. Duran states that he was surrendered to Cortés, who ‘le puso en
prisiones, y creo que al cabo le mandó matar,’ Hist. Ind., MS., ii. 485, a statement
which may have aided to confuse Gomara, who allows Cortés to execute him
already during his first stay at Tlascala. On the present occasion he lets
Maxixcatzin strike the leader of the opposite faction. Hist. Mex., 90, 164. His
blunder and vagueness helped Herrera to confound the two Xicotencatls, and
Brasseur de Bourbourg to attribute to father and son the same opinion. Hist. Nat.
Civ., iv. 365-7. This is also the view of Ixtlilxochitl. The discussion was held in the
hall or oratory of Xicotencatl, where Cortés had planted the cross. While
Maxixcatzin was advocating the Spanish cause a cloud settled on the cross and
darkened the room. This miracle encouraged the orator, who threw down the
younger Xicotencatl and won all to his side. The Mexican envoys were now
dismissed with a refusal, whereupon the cloud dissipated, leaving the room bright
and the cross resplendent, and attracting many believers. Hist. Chich., 304-5.
Sahagun allows Xicotencatl, chief among the lords, to attack the second lord for
urging the murder of the Spaniards. Hist. Conq. (ed. 1840), 138.
[919] Tlascala sealed her enslavement, as some view it, ignoring national interests
for the sake of shameful revenge. Behold now the punishment in her decay, and in
the odium cast on her descendants by other peoples. So says Bustamante, in
Sahagun, Hist. Conq. (ed. 1840), 140. They have certainly dwindled away ever
since Cortés began to scatter them as colonists in different directions; but this was
the natural and inevitable consequence of the presence of the stronger element.
During Spanish dominion they enjoyed some slight privileges, and since then no
odium has attached to them except in casual references to the conquest by
prejudiced writers.
[920] ‘En nombre de todos.’ Gomara, Hist. Mex., 166. Whereat Bernal Diaz is
exceedingly wroth. ‘We, the old soldiers, stood by Cortés,’ he asserts, ‘and
Gomara’s omission to say so is intended to exalt him at our expense.’ Hist.
Verdad., 110. Cortés himself intimates that the request was general. Cartas, 142.
But Herrera more justly attributes it to ‘la mayor parte.’ dec. ii. lib. x. cap. xiv.
[921] ‘Si mal nos sucediere la ida [of the next campaign] hare lo que pedis: y si
bien, hareis lo que os ruego.’ Thus Cortés, by his skill and firmness, saved not
only the conquest but the lives of his men, which must have been sacrificed in a
retreat. Had they reached Villa Rica they would not have remained there, but
would have passed on to the islands, thus abandoning the country. Gomara, Hist.
Mex., 167. Most of the points in the above speech are to be found in the lengthy
harangue prepared by this author. Oviedo’s is weaker, and loses itself in
repetitions and crude elaborations, adorned with learned references ill suiting a
soldier addressing rude men, although not altogether inconsistent with Cortés’
love of display. Toward the conclusion is said: ‘If any one there is who still insists
on leaving, let him go; for rather will I remain with a small and brave number than
with many, if composed in part of cowards and of those who respect not their
honor. Even if all fail in their duty I shall not. We shall now know who, being of us,
will drink water from the hand, and who will kneel to drink with the face to the
ground, so that they may be bidden to depart, as God said to Gideon.’ Oviedo, iii.
332-3. The test, if ever intended, was not made, since all acquiesced. Solis, the
inveterate speech-maker, has unaccountably subsided for this period; perhaps he
is piqued at finding himself so fully anticipated. Cortés gives a brief synopsis of
what he indicates to have been a long speech. On no account would he commit so
shameful, dangerous, and treasonable an act as to abandon the country. Cartas,
142-3; Clavigero, Storia Mess., iii. 151; Herrera, dec. ii. lib. x. cap. xiv.
[922] ‘Habiendo estado en esta provincia veinte dias, aunque ni yo estaba muy
sano de mis heridas, y los de mi compañia todavía bien flacos, salí della.’ Cortés,
143. Gomara follows, while Bernal Diaz, Hist. Verdad., 110, writes that after a stay
at Tlascala of 22 days Cortés announced the determination to march on Tepeaca,
which provoked murmurs from the men of Narvaez. Preparations for the campaign
appear to have intervened before the march began, and negotiations with the
province to be assailed. Herrera intimates that fully 50 days had passed before
negotiations were opened. dec. ii. lib. x. cap. xv.
[923] ‘Significa Tepeyacac, remate, o punta de zerro,’ owing to the position of the
city at the end of a mountain range. Id., cap. xxi.
[924] Their father, Chichtuc, had been sole ruler, but after his death the sons
divided the province. Id. This author assumes that it was merely an ally of Mexico,
but there is little doubt about its being tributary. ‘Ixcozauhqui, le principal de ses
trois chefs.’ Brasseur de Bourbourg, Hist. Nat. Civ., iv. 368.
[925] The suggestion of thus opening the campaign is claimed by native historians
for the Tlascaltec lords, Ixtlilxochitl naming Xicotencatl as the originator. Hist.
Chich., 303; Camargo, Hist. Tlax., 177.
[926] And out of gratitude for Cortés’ intercession in his behalf, as Solis claims.
[927] Half of the booty obtained in all conquered countries, with incorporation of
Cholula, Huexotzinco, and Tepeyacac. Camargo, Hist. Tlax., 176. This extent of
jurisdiction is doubtful. ‘Les haria en nõbre de su Magestad escriptura de
conservarlos en sus tierras, y govierno,’ is the moderate arrangement given in
Vetancvrt, Teatro Mex., pt. iii. 146. When in 1655 an attempt was made to
encroach on their rights they produced the document and obtained justice.
[928] Bernal Diaz, who alone enters into details, enumerates 420 soldiers, 4000
Tlascaltecs, 17 horses, and 6 cross-bows, without artillery or ammunition. Hist.
Verdad., 111. But this is hardly reliable, for a few lines before he refers to 440
men, and there is no doubt that some ammunition, field-pieces, and other war
material must have been obtained from Villa Rica. Herrera speaks of musketeers
and 6000 allies, 50,000 more to follow. dec. ii. lib. x. cap. xv. Gomara allows
40,000 allies to set out at once, with provisions and carriers. Hist. Mex., 168.
Ixtlilxochitl mentions only 4000, and names some of the leaders. Hist. Chich., 305.
Herrera states that a question arose as to the prudence of trusting so small a body
of soldiers with so large a force of allies—which soon swelled to over 100,000—
who might in case of disagreement overwhelm them. A council was held, which
decided that the loyalty of the Tlascaltecs had been sufficiently tried, and that a
small number of allies would be of no service. ubi sup., cap. xiv.
[929] Cortés’ first messengers returned with two Mexicans, who brought the
contemptuous reply. They were given presents, and told to summon the native
chiefs to a parley. On their return with a threatening answer ‘fue acordado, ... por
ante Escriuano ... que se diessen por esclauos à todos los aliados de Mexico, que
huviessen muerto Españoles.’ Bernal Diaz, Hist. Verdad., 112. ‘Respondieron que
si mataron Españoles fue con justa razon, pues en tiempo de guerra quisieron
passar por su tierra por fuerça, y sin demandar licencia.’ Gomara, Hist. Mex., 168.
[930] ‘Tuuierõ los Indios amigos buena cena aquella noche de piernas, y braços,
porque sin los assadores de palo, que eran infinitos, huuo cincuenta mil ollas de
carne humana.’ The Spaniards suffered from want of water and food. Herrera,
dec. ii. lib. x. cap. xv. Rather a strong story. The Spaniards could not well suffer
from hunger in the midst of maize fields, in harvest time. Oviedo takes occasion to
dwell on the common practice of devouring the slain on the battle-field, thus
saving the trouble of burial. iii. 334. ‘Mi pare una favola,’ is Clavigero’s comment.
Storia Mess., iii. 152. See Native Races.
[931] ‘Padeciendo siempre de agua, y comida.’ Herrera, ubi sup. But this could
hardly be the case in so rich a province, at this time.
[932] ‘En obra de veinte dias hobe pacíficas muchas villas y poblaciones á ella
sujetas ... sin que en toda la dicha guerra me matasen ni hiriesen ni un español.’
Cortés, Cartas, 143. ‘En obra de quarenta dias tuvimos aquellos pueblos
pacificos,’ but with great hardship, ‘porque de sangre, y polvo que estaua quajado
en las entrañas, no echauamos otra cosa del cuerpo, y por la boca,’ etc. Bernal
Diaz, Hist. Verdad., 112-13.
[933] The name of a beautiful bird, now San Martin de Huaquechula. This town
was known to the Spaniards under the name of Guacachula.
[937] Bernal Diaz names Olid alone for the command, and Gomara adds Ordaz
and Andrés de Tapia, while Herrera substitutes Ordaz and Ávila. The latter is
probably wrong in giving them 300 soldiers, and Peter Martyr errs, through his
printer, perhaps, in allowing only 3000 allies.
[938] Cortés writes that this occurred in a town of Huexotzinco province, and that
here the Spaniards were alarmed by the report of collusion between the
Huexotzincas, the Quauhquechollans, and the Aztecs. The leaders described the
expedition as difficult. Cartas, 146. Gomara follows, naming the captain who
brought the chiefs captive to Cortés. Hist. Mex., 169. Bernal Diaz points out very
plausibly that Huexotzinco lay wholly out of the way; and, ignoring the accession
of volunteers, he assumes that the report of a vast gathering of Mexican troops
round Quauhquechollan was the cause for alarm, among the Narvaez party only.
Olid appealed to their honor, and did all he could to encourage them, but failed.
Hist. Verdad., 112-13. Clavigero believes, on the other hand, that Olid caught the
alarm as readily as the rest. Storia Mess., iii. 154. The joining of Huexotzincas
may have led to the belief that the march lay through their territory.
[939] Bernal Diaz states that Cortés did not go, but sent Olid a sharp letter, which
roused him to proceed with the expedition. But our chronicler was sick with fever
all this time, and has evidently not been well informed. Cortés’ description of the
route and of different occurrences indicates that he must have been present.
[940] ‘Cayeron muchos dellos [enemy] muertos y ahogados de la calor, sin herida
ninguna, y dos caballos se estancaron, y el uno murió.’ Cortés, Cartas, 149.
[943] ‘Dos tiros de ballesta el uno del otro.’ Cortés, Cartas, 150.
[944] ‘Tres estados en alto, y 14. pies en ancho,’ says Herrera, dec. ii. lib. x. cap.
xvi. ‘Alto como cuatro estados por de fuera de la ciudad, é por de dentro está casi
igual con el suelo.’ Cortés, Cartas, 150. Meaning, in places.
[947] Bernal Diaz assumes that Olid is the sole leader; that he was here wounded,
and lost two horses. Returning to Tepeaca he was received with great honor, and
joined in laughing at the alarm which had caused the army to turn back at Cholula.
He would never after have anything to do with the opulent and timid soldiers of
Narvaez, he said. Hist. Verdad., 114. Gomara supposes that the bridge had been
destroyed before the flight, so that few of the garrison escaped from the sword and
the stream. Hist. Mex., 171.
[948] Ixtlilxochitl extends the stay at Ytzocan alone to twenty days. Hist. Chich.,
305. Others make it less.
[949] Cortés calls it Ocupatuyo, which Lorenzana corrects into Ocuituco, and
Torquemada into Acapetlahuaca, i. 315, while Clavigero insists that it should be
Ocopetlajoccan. Storia Mess., iii. 157.
[951] This name is badly misspelled. Chimalpain identifies it with Huaxtéca, which
is decidedly out of the way, Hist. Conq., ii. 12, while Orozco y Berra stamps ‘en
verdad errónea’ the suggestion of Lorenzana that it is Oajaca; but modern maps
do place it in Oajaca, very slightly modified in spelling.
[952] They had always been loyal, they said, although deterred by fear of Mexico
from sooner proclaiming it; the four remaining pueblos of the province would soon
send in their allegiance. Cortés, Cartas, 152-3.
[953] The construction of sentences in Cortés, Cartas, 152, and the complex
relationship, have misled nearly every one who notices this incident—as, Gomara,
Hist. Mex., 171; Vetancvrt, Teatro Mex., pt. iii. 147; Bernal Diaz, Hist. Verdad., .
[954] Alonso Coltzin. Chimalpain, Hist. Conq., ii. 12. Ixtlilxochitl calls him
Ahuecatzin. Hist. Chich., 305. Alvarado stood sponsor. Terrified by some idle
gossip, or by the preparations for his baptism, the boy asked the friar when he was
to be sacrificed; but received comfort in a pious exhortation. Torquemada, i. 520.
[955] Herrera gives the command to Olid and Juan Rodriguez de Villafuerte, the
owner of the much disputed first madonna image, accompanied by Juan Nuñez,
Sedeño, Lagos, and Mata. dec. ii. lib. x. cap. xvii. Olid may have been detached
from Quauhquechollan after the first success had made troops less necessary; yet
Herrera indicates that he set out before this expedition.
[956] ‘En lo de Cachula fue adonde auian muerto en los aposentos quinze
Españoles.’ Bernal Diaz, Hist. Verdad., 112.
[957] B. V. de Tapia, in his testimony against Cortés, states that about 6000
prisoners were sent to him from these districts by Olid, all of whom had
surrendered without resistance, and that he ordered the men, 2000 in number, to
be executed, the women and children being sold or distributed. Cortés,
Residencia, i. 59-60.
[958] ‘Boluierõ a Tepeaca, y auiendo estado treynta dias en esta jornada hallaron
a Hernando Cortes, que era buelto de Guacachula.’ Herrera, dec. ii. lib. x. cap.
xvii. These successes are said to have been dimmed by a severe defeat at
Tochtepec, on Rio Papaloapan, whither Salcedo had been sent with 80 men. It
was the entrepôt for trade in this region, and was held by a strong Aztec garrison,
aided by native warriors with Chinantec pikes. Owing partly to the efficient use of
this weapon, and partly to the carelessness of Salcedo, the troops were surprised
and slaughtered to a man, after selling their lives as dearly as possible. The
disaster being a blow also to Spanish prestige which it would never do to overlook,
Ordaz and Ávila were sent not long after with a larger force, some horses, and
20,000 allies, to exact retaliation in death, captivity, and rich spoil. The victors
came back with ample plunder. Herrera, ubi sup. See note 4 this chapter for
doubts on the massacre.
CHAPTER XXIX.
KING-MAKING AND CONVERTING.
October-December, 1520.
Thus all was going gayly with the Estremaduran once more. It
was easy work overcoming the divided Aztec forces, which
combined had proved so formidable. And there was little trouble now
from factions. None advocated a station by the sea-side, with ships
ready for flight; none thought of abandoning New Spain for Cuba.
The simple presence of the general was as the shield of Abas, which
performed so many marvels, and the mere sight of which could on
the instant stay a revolt or reduce a province to submission.
The successes of the Spaniards were rapidly enlarging the fame
and influence of their leader, bringing among other fruits, as we have
seen, alliances and reinforcements, not alone from native sources,
but from Spanish. The first accession of the latter was thirteen
soldiers and two horses, brought in a small vessel under the hidalgo,
Pedro Barba, formerly commandant at Habana. Commandant
Rangel at Villa Rica had received instructions to secure any vessel
that might arrive, both with a view to obtain recruits, and to prevent
news from travelling to Cuba of the defeat of Narvaez, or other
incidents. As the vessel entered the roadstead he accordingly
approached it in a well manned boat, with hidden arms. “How fares
Narvaez?” was Barba’s first inquiry. “Exceedingly well,” replied
Rangel. “He is prosperous and rich, while Cortés is a fugitive, with a
score of miserable followers at the most; or he even may be dead.”
“All the better,” rejoined Barba; “for I bear letters from the most
magnificent Velazquez, with instructions to secure the traitor, if he be
alive, and send him at once to Cuba, whence he shall go to Spain,
as commanded by our most illustrious Bishop Fonseca.” As a matter
of course, Señor Barba will accept the proffered hospitality; he will
go ashore and deliver his message to Narvaez in person. And he will
catch this slippery fox from Estremadura, and carry him hence to be
hanged; he will carry him to his worshipful master Velazquez to be
hanged. So entering the boat he is conveyed away, but only, alas! to
be declared a prisoner; only, alas! to learn that though damned,
Cortés is not dead, and is by no means likely at once to meet
strangulation at the hand either of Barba, Narvaez, or Velazquez.
Meanwhile other visitors in other boats proceed to secure the crew.
The vessel is dismantled; and since Cortés is the king, and not
Narvaez, the so lately fierce and loyal Barba, nothing loath, declares
for Cortés. Indeed, Barba was by no means unfriendly to the
general, as proven by his attitude at Habana two years before. Any
such reinforcement was gladly welcomed at Tepeaca, and Cortés
sought to insure Barba’s loyalty by making him captain of archers.
[959] A week later arrived another small vessel, under the hidalgo
Rodrigo Morejon de Lobera, with eight soldiers, a mare, a quantity of
crossbow material, and a cargo of provisions. It was secured in the
same manner, and the soldiers and sailors proceeded to join the
army. Thus Cortés draws them in, friend and foe alike being his fish,
if once they enter his net.
More substantial reinforcements were in store, however.
Governor Garay, of Jamaica, had in no manner been discouraged by
the failure of his last expedition to Pánuco, and the rumors of his
rival’s success in New Spain fired him to renewed efforts, the more
so since he possessed the royal grant, the vessels, and the men,
with ample means to sustain them. In the spring of 1520 he had
despatched three vessels, with about one hundred and fifty soldiers
and sailors, a few horses, and some artillery, under the former
commander, Pineda.[960] Ascending the Pánuco the expedition
came to a town,[961] and met with good reception, but the natives
soon tired of giving their substance to strangers, who may beside
have been guilty of excesses, and they made hostile
demonstrations. Pineda showed a bold front, and proceeded to
attack the town, but was surprised and killed, together with a number
of soldiers and the horses.[962] The rest escaped as best they could
in two of the vessels, pursued by a fleet of canoes. One of the
caravels was wrecked not far above Villa Rica, whereupon a portion
of the men resolved to proceed by land rather than suffer starvation
on board, for in the hurry of the flight the lockers had received no
attention. Both the sea and land parties arrived at the Spanish port,
where every care was given them.[963] Thence they were forwarded
to Tepeaca, where their cadaverous complexion and swollen bodies
procured for them the nickname of ‘panzaverdetes,’ or green
paunches. Hardship and bad food had carried a number past relief,
and even in Tepeaca several died, including Camargo, as Bernal
Diaz believes.
A month later, after the Quauhquechollan expedition, another
vessel arrived with about fifty soldiers,[964] under Miguel Diaz de
Auz, an Aragonian cavalier. He had been sent to reinforce Pineda,
but after remaining at Rio Pánuco for a month, without seeing even a
native, he had come down to search for the fleet. The fame of Cortés