Intelligence-Driven Incident Response, 2nd

Edition Rebekah Brown & Scott J. Roberts

download

https://ebookmeta.com/product/intelligence-driven-incident-
response-2nd-edition-rebekah-brown-scott-j-roberts-2/

Download more ebook from https://ebookmeta.com

Intelligence-Driven Incident
Response
SECOND EDITION

Outwitting the Adversary

With Early Release ebooks, you get books in their earliest form—
the authors’ raw and unedited content as they write—so you can
take advantage of these technologies long before the official
release of these titles.

Rebekah Brown and Scott J. Roberts

Intelligence-Driven Incident Response
by Scott J. Roberts and Rebekah Brown
Copyright © 2023 Rebekah Brown and Scott Roberts. All rights
reserved.
Printed in the United States of America.
Published by O’Reilly Media, Inc., 1005 Gravenstein Highway North,
Sebastopol, CA 95472.
O’Reilly books may be purchased for educational, business, or sales
promotional use. Online editions are also available for most titles
(http://oreilly.com/safari). For more information, contact our
corporate/institutional sales department: 800-998-9938 or
[email protected].

Acquisitions Editor: Jennifer Pollock

Development Editor: Angela Rufino

Production Editor: Elizabeth Faerm

Copyeditor: TO COME

Proofreader: TO COME

Indexer: TO COME

Interior Designer: David Futato

Cover Designer: Karen Montgomery

Illustrator: Kate Dullea

October 2023: Second Edition

Revision History for the Early Release
2022-02-25: First Release
2022-08-18: Second Release
2022-11-18: Third Release
2023-02-07: Fourth Release

See http://oreilly.com/catalog/errata.csp?isbn=9781098120689 for

release details.
The O’Reilly logo is a registered trademark of O’Reilly Media, Inc.
Intelligence-Driven Incident Response, the cover image, and related
trade dress are trademarks of O’Reilly Media, Inc.
The views expressed in this work are those of the authors, and do
not represent the publisher’s views. While the publisher and the
authors have used good faith efforts to ensure that the information
and instructions contained in this work are accurate, the publisher
and the authors disclaim all responsibility for errors or omissions,
including without limitation responsibility for damages resulting from
the use of or reliance on this work. Use of the information and
instructions contained in this work is at your own risk. If any code
samples or other technology this work contains or describes is
subject to open source licenses or the intellectual property rights of
others, it is your responsibility to ensure that your use thereof
complies with such licenses and/or rights.
978-1-098-12062-7
[LSI]
Chapter 1. Introduction

A NOTE FOR EARLY RELEASE READERS

With Early Release ebooks, you get books in their earliest form—
the authors’ raw and unedited content as they write—so you can
take advantage of these technologies long before the official
release of these titles.
This will be the 1st chapter of the final book. Please note that
the GitHub repo will be made active later on.
If you have comments about how we might improve the content
and/or examples in this book, or if you notice missing material
within this chapter, please reach out to the editor at
[email protected].

But I think the real tension lies in the relationship between what
you might call the pursuer and his quarry, whether it’s the writer
or the spy.
—John le Carre
Once relegated to the secretive realms of national security and
military operations, intelligence has become something that is
fundamental to the daily functioning of many organizations around
the world. At its core, intelligence seeks to give decision makers the
information that they need to make the right choice in any given
situation.
Previously, decision makers experienced significant uncertainty
because they did not have enough information to make the right
decisions. Today they are just as likely to feel like there is too much
information, but just as much ambiguity and uncertainty. This is
especially the case with network security, where there are fewer
traditional indications that a significant action is actually about to
take place. In order to make decisions about how to prepare for and
respond to a network security incident, decision makers need
analysts who understand intelligence fundamentals, the nuance of
network intrusions, and how to combine the two into an accurate
assessment of a situation and what it means for their entire
organization. In short, they need analysts who can conduct
intelligence-driven incident response.
Before diving into the application of intelligence-driven incident
response, it is important to understand the evolution of cyber
security incidents and their responses, and why it is so relevant in
this field. This chapter covers the basics of cyber threat intelligence,
including its history, recent activity, and the way forward, and sets
the stage for the concepts discussed in the rest of this book.
Intelligence as Part of Incident Response
As long as there has been conflict, there have been those who
watched, analyzed, and reported observations about the enemy.
Wars have been won and lost based on an ability to understand the
way the enemy thinks and operates, to comprehend their
motivations and identify their tactics, and to make decisions—large
and small—based on this understanding. Regardless of the type of
conflict, whether a war between nations or a stealthy intrusion
against a sensitive network, intelligence guides both sides. The side
that masters the art and science of intelligence, analyzing
information about the intent, capability, and opportunities of
adversaries, and is able to act on that information, will almost
always be the side that wins.

History of Cyber Threat Intelligence

One of the best ways to understand the role of intelligence in
incident response is by studying the history of the field. Each of the
events listed below could (and often do!) fill entire books. From the
iconic book The Cuckoo’s Egg to recent revelations in decades old
intrusions such as Moonlight Maze, the history of cyber threat
intelligence is intriguing and engaging, and offers many lessons for
those working in the field today.

The First Intrusion

In 1986, Cliff Stoll was a PhD student managing the computer lab at
Lawrence Berkeley National Laboratory in California when he noticed
a billing discrepancy in the amount of 75 cents, indicating that
someone was using the laboratory’s computer systems without
paying for it. Our modern-day network security-focused brains see
this and scream, “Unauthorized access!” but in 1986 few
administrators would have jumped to that conclusion. Network
intrusions were not something that made the news daily, with claims
of millions or even billions of dollars stolen; most computers
connected to the “internet” belonged to government and research
institutes, not casual users, and it was easy to assume everyone
using the system was friendly. The network defense staple tool
tcpdump was a year from being started. Common network discovery
tools such as Nmap would not be created for another decade, and
exploitation frameworks such as Metasploit would not appear for
another 15 years. The discrepancy was more easily expected to be a
software bug or bookkeeping error as it was that someone had
simply not paid for their time.
Except that it wasn’t. As Stoll would discover, he was not dealing
with a computer glitch or a cheap mooch of a user. He was stalking
a “wily hacker” who was using Berkeley’s network as a jumping-off
point to gain access to sensitive government computers, such as the
White Sands Missile Range and the National Security Agency (NSA).
Stoll monitored incoming network traffic with printers writing reams
of packets onto paper to keep a record and began to profile the
intruder responsible for the first documented case of cyber
espionage. He learned the typical hours the attacker was active,
monitored the commands he ran to move through the
interconnected networks, and observed other patterns of activity. He
discovered how the attacker was able to gain access to Berkeley’s
network in the first place by exploiting a vulnerability in the
movemail function in GNU Emacs, a tactic that Stoll likened to a
cuckoo bird leaving its egg in another bird’s nest to hatch and
inspiring the name of his book on the intrusion, The Cuckoo’s Egg.
Understanding the attacker meant that it was possible to protect the
network from further exploitation, identify where he may target
next, and allowed a response, both on the micro level (identifying
the individual carrying out the attacks) and on the macro level
(realizing that nations were employing new tactics in their traditional
intelligence-gathering arsenal and changing policies to respond to
this change). Sharing this understanding ended up being key not
just to protecting Lawrence Berkeley National Lab, but many other
government organizations.

Destructive Attacks
In 1988 Cornell student Robert T. Morris hacked into a computer lab
at the Massachusetts Institute of Technology (MIT) and released a
computer program that was designed to replicate itself to as many
computers as possible without being detected. It did this by
exploiting a backdoor in the Internet’s email delivery system as well
as a flaw in the finger program that identified network users. It may
have just been a harmless experiment - or a prank, as some have
described it - that few people ever knew about, however it did not
work exactly as Morris intended and became part of cyber history
(which is just like regular history, but cooler). The worm ended up
crashing 6000 computers, which was about 10% of the internet of
the time, with computers at Harvard, Princeton, Stanford, Johns
Hopkins, NASA, and the Lawrence Livermore National Laboratory
among the many victims. Investigators from the FBI were struggling
to inspect the activity, unsure if it was an outage or an attack, when
Morris called two friends and admitted that he was the one behind
the worm. One of the friends called The New York Times, which led
to the eventual identification and conviction of Morris for violations
of the new Computer Fraud and Abuse Act of 1986 (CFAA).
While there was no nefarious intent behind this worm- it was really
just another example of how programs don’t always behave exactly
the way that their creator intended them to - there were far reaching
implications that can still be seen today. As the internet became
more and more critical to operations, it became even more
important to be able to quickly identify and remediate other
intrusions or destructive attacks. The Computer Emergency
Response Team (CERT) was established at Carnegie Mellon
University as a professional, trained response team responsible for
providing assessments and solutions for cyber attacks. It also
highlights why it is sometimes important to be able to attribute an
attack - in 1988 there had been significant “warming” of the Cold
War, with Reagan and Gorbachev meeting in Moscow and Soviet
Troops beginning to withdraw from Afghanistan. If this worm had
inaccurately been blamed on Soviet activity - which was actually the
case for the activity from the Cuckoo’s Egg - it could have
significantly changed the course of history.

Moonlight Maze
In the decade following 1986’s Cuckoo’s Egg and 1988’s Morris
Worm, the field of Incident Response improved, not just with the
creation of CERT, but because of the professionalization of the field
itself across the government, military, and private sector. In addition,
the emergence of proper network monitoring tools meant that
defenders weren’t reliant on printers scattered around a basement to
identify malicious network activity. This increase in capabilities was
fortuitous, as intrusions not only continued but grew in scope and
sophistication. In 1998, the US government identified what is
believed to still be the largest and longest running intrusion into
government networks - codenamed Moonlight Maze.
In March of 1998, the US government noticed anomalous activity
within several sensitive and restricted networks, including the
Pentagon, NASA (yes, NASA has apparently always been pretty high
on the priority list for intrusions), and the Department of Energy
(DOE). Further analysis identified the same malicious activity at
several universities and identified that the activity had been ongoing
for at least two years. The sustained nature of this activity was
unlike any of the previous intrusions (as far as was known at the
time) which had seemed more targeted and short-lived. Unlike those
instances, the adversaries had left strategic backdoors in different
parts of the network so that they could return at will. Information
was being gathered from numerous locations that often seemed
unrelated.
We have been fortunate enough to work closely with people who
directly supported the investigation and response to Moonlight Maze,
both in the 1990s and today, as there are still many unknowns and
many insights to be found from this intrusion. Talking with these
individuals and reading through the numerous reports on the
intrusion hammers home the point that intelligence work is critical to
incident response, and that cyber threat intelligence in particular
bridges the gap between what is happening on the strategic level
with national interests and foreign adversaries, and how those
adversarial goals and actions show up on a computer network. The
US has had a full scope intelligence community actively looking and
listening for signs of foreign interference, but the largest network
attack went unnoticed until it was detected “by accident” because
intelligence work had not yet been fully modified to account for
actions taken against a network.
Moonlight Maze kicked cyber threat intelligence capabilities into the
modern era. Computer networks were not something that might be
impacted from time to time, these networks were now being
targeted directly for the information and access they held. Computer
networks were part of intelligence collection, and intelligence needed
to play a role in their defense.

Modern Cyber-Threat Intelligence

Over the decades, the threats have grown and morphed. Adversaries
are not just foreign governments or curious students. Organized
criminals, identity thieves, scammers, ideologically motivated
activists, and others with various motivations all realized the impact
that their activities could have when directed at digital targets
instead of physical ones. These adversaries use an ever-expanding
set of tools and tactics to attack their victims and actively attempt to
evade detection. At the same time our reliance on our networks has
increased, making incidents even more impactful. Understanding the
attacker has gotten much more complicated, but no less important.
Understanding how to identify the attacker activity and how to use
that information to protect networks is the fundamental concept
behind a more recent addition to the incident responder’s toolkit:
cyber-threat intelligence. Threat intelligence is the analysis of
adversaries—their capabilities, motivations, and goals, and cyber-
threat intelligence (CTI) is the analysis of how adversaries use the
cyber domain to accomplish their goals. See #fig0101 on how these
levels of attacks play into one another.

Figure 1-1. From intelligence to cyber-threat intelligence

Initially, intelligence analysts came into the picture after an intrusion

like Moonlight Maze to understand what the overall intrusion told us
about the adversary. What were their goals, their motivations, their
capabilities, their organizational structure - all things that were
important for a strategic understanding and long-term planning, but
not things that would immediately provide value to those trying to
defend their networks from the attacks of today, tomorrow, or
sometimes even last week. Cyber-threat intelligence began to focus
more on tactical and technical details that were more immediately
actionable, learning along the way what types of information were
most valuable in different situations. Cyber-threat intelligence
analysts didn’t just bring data, they also brought insights.
In information security, we traditionally focus on observable
concepts; we like things that are testable and reproducible. Cyber
threat intelligence, meanwhile, lives in the area between
observations and interpretation. We may not know for sure that an
adversary will attempt to access employee financial records, but we
can conduct analysis on data about past intrusions and successful
attackers outside of our network and make recommendations on the
systems and types of data that may need additional protection. Not
only do we need to be able to interpret information, but we also
need to be able to convey it in a way that is meaningful to the
intended audience to help them make decisions. Looking back on his
historic analysis of the intrusions in the Cuckoo’s Egg, Cliff Stoll
identified the need for a story as one of his key takeaways from the
entire experience. “I thought I could just show people the data and
they would understand,” he said “but I was wrong. You need to tell a
story.” (SANS CTI Summit 2017)

The Way Forward

New technologies give us more information about the actions that
attackers take as well as additional ways to act on that information.
However, we have found that with each new technology or concept
implemented, the adversary adapted; worms and viruses with an
alphabet soup of names changed faster than our appliances could
identify them, and sophisticated, well-funded attackers were often
more organized and motivated than many network defenders. Ad-
hoc and intuitive intelligence work would no longer suffice to keep
defenders ahead of the threat. Analysis would need to evolve as well
and become formal and structured. The scope would have to
expand, and the goals would have to become more ambitious.
In, addition to detecting threats against an organization’s often
nebulous and ephemeral perimeter, analysts would need to look
deeper within their networks for the attacks that got through the
lines, down to individual user systems and servers themselves, as
well as look outward into third-party services and to better
understand the attackers who may be targeting them. The
information would need to be analyzed and its implications
understood, and then action would have to be taken to better
prevent, detect, and eradicate threats. The actions taken to better
understand adversaries would need to become a formal process and
a critical part of information security operations: threat intelligence.
Incident Response as a Part of Intelligence
Intelligence is often defined as data that has been refined and
analyzed to enable stakeholders to make better decisions.
Intelligence, therefore, requires data. In intelligence-driven incident
response, there are multiple ways to gather information that can be
analyzed and used to support incident response. However, it is
important to note that incident response will also generate cyber-
threat intelligence. The traditional intelligence cycle—which we cover
in depth in #basics_of_intelligence—involves direction, collection,
processing, analysis, dissemination, and feedback. Intelligence-
driven incident response involves all of these components and helps
inform direction, collection, and analysis in other applications of
threat intelligence as well, such as network defense, secure software
development, and user awareness training. Intelligence-driven
incident response doesn’t end when the intrusion is understood and
remediated; it generates information that will continue to feed the
intelligence cycle.
Analysis of an intrusion, no matter if it was successful or failed, can
provide a variety of information that can be used to better
understand the overall threat to an environment. The root cause of
the intrusion and the initial access vector can be analyzed to inform
an organization of weaknesses in network defenses or of policies
that attackers may be abusing. The malware that is identified on a
system can help identify the tactics that attackers are using to evade
traditional security measures such as antivirus or host-based
intrusion-detection tools and the capabilities they have available to
them. The way an attacker moves laterally through a network can be
analyzed and used to create new ways to monitor for attacker
activity in the network. The final actions that an attacker performed
(such as stealing information or changing how systems function),
whether they were successful or not, can help analysts understand
Another Random Scribd Document
with Unrelated Content
Is there no way my life can save thine from a pain?
Is the love of a mother no possible gain?
No labor of Hercules—search for the Grail—
No way for this wonderful love to avail?
God in Heaven—O teach me!

My prayer has been answered. The pain thou must bear

Is the pain of the world’s life which thy life must share.
Thou art one with the world—though I love thee the best;
And to save thee from pain I must save all the rest—
Well—with God’s help I’ll do it.

Thou art one with the rest. I must love thee in them.
Thou wilt sin with the rest; and thy mother must stem
The world’s sin. Thou wilt weep, and thy mother must dry
The tears of the world lest her darling should cry.
I will do it—God helping!

And I stand not alone. I will gather a band

Of all loving mothers from land unto land.
Our children are part of the world! Do ye hear?
They are one with the world—we must hold them all dear!
Love all for the child’s sake!

For the sake of my child I must hasten to save

All the children on earth from the jail and the grave.
For so, and so only, I lighten the share
Of the pain of the world that my darling must bear—
Even so, and so only!
 A QUESTION f

Why is it, God, that mother’s hearts are made

So very deep and wide?
How does it help the world that we should hold
Such welling floods of pain till we are old,
Because when we were young one grave was laid—
One baby died?
 THE HOUSEWIFE f

Here is the House to hold me—cradle of all the race;

Here is my lord and my love, here are my children dear—
Here is the House enclosing, the dear-loved dwelling place;
Why should I ever weary for aught that I find not here?

Here for the hours of the day and the hours of the night;
Bound with the bands of Duty, rivetted tight;
Duty older than Adam—Duty that saw
Acceptance utter and hopeless in the eyes of the serving squaw.

Food and the serving of food—that is my daylong care;

What and when we shall eat, what and how we shall wear;
Soiling and cleaning of things—that is my task in the main—
Soil them and clean them and soil them—soil them and clean them
again.

To work at my trade by the dozen and never a trade to know;

To plan like a Chinese puzzle—fitting and changing so;
To think of a thousand details, each in a thousand ways;
For my own immediate people and a possible love and praise.

My mind is trodden in circles, tiresome, narrow and hard,

Useful, commonplace, private—simply a small backyard;
And I the Mother of Nations!—Blind their struggle and vain!—
I cover the earth with my children—each with a housewife’s brain.
WEDDED BLISS *
“O come and be my mate!” said the Eagle to the Hen;
“I love to soar, but then
I want my mate to rest
Forever in the nest!”
Said the Hen, “I cannot fly,
I have no wish to try,
But I joy to see my mate careening through the sky!”
They wed, and cried, “Ah, this is Love, my own!”
And the Hen sat, the Eagle soared, alone.

“O come and be my mate!” said the Lion to the Sheep;

“My love for you is deep!
I slay, a Lion should,
But you are mild and good!”
Said the sheep, “I do no ill—
Could not, had I the will—.
But I joy to see my mate pursue, devour and kill.”
They wed, and cried, “Ah, this is Love, my own!”
And the Sheep browsed, the Lion prowled, alone.

“O come and be my mate!” said the Salmon to the Clam;

“You are not wise, but I am.
I know sea and stream as well,
You know nothing but your shell.”
Said the Clam, “I’m slow of motion,
But my love is all devotion,
And I joy to have my mate traverse lake and stream and ocean!”
They wed, and cried, “Ah, this is Love, my own!”
And the Clam sucked, the Salmon swam, alone.
FEMALES *
The female fox she is a fox;
The female whale a whale;
The female eagle holds her place
As representative of race
As truly as the male.

The mother hen doth scratch for her chicks,

And scratch for herself beside;
The mother cow doth nurse her calf,
Yet fares as well as her other half
In the pasture free and wide.

The female bird doth soar in air;

The female fish doth swim;
The fleet-foot mare upon the course
Doth hold her own with the flying horse—
Yea and she beateth him!

One female in the world we find

Telling a different tale.
It is the female of our race,
Who holds a parasitic place
Dependent on the male.

Not so, saith she, ye slander me!

No parasite am I.
I earn my living as a wife;
My children take my very life;
Why should I share in human strife,
To plant and build and buy?

The human race holds highest place

In all the world so wide,
Yet these inferior females wive,
And raise their little ones alive,
And feed themselves beside.
The race is higher than the sex,
Though sex be fair and good;
A Human Creature is your state,
And to be human is more great
Than even womanhood!

The female fox she is a fox;

The female whale a whale;
The female eagle holds her place
As representative of race
As truly as the male.
“WE AS WOMEN” *
There’s a cry in the air about us—
We hear it before, behind—
Of the way in which “We, as women,”
Are going to lift mankind!

With our white frocks starched and ruffled,

And our soft hair brushed and curled—
Hats off! for “We, as women,”
Are coming to save the world.

Fair sisters, listen one moment—

And perhaps you’ll pause for ten:
The business of women as women
Is only with men as men!

What we do, “We, as women,”

We have done all through our life;
The work that is ours as women
Is the work of mother and wife.

But to elevate public opinion,

And to lift up erring man,
Is the work of the Human Being;
Let us do it—if we can.

But wait, warm-hearted sisters—

Not quite so fast, so far.
Tell me how we are going to lift a thing
Any higher than we are!

We are going to “purify politics,”

And to “elevate the press.”
We enter the foul paths of the world
To sweeten and cleanse and bless.

To hear the high things we are going to do,

A d th h f t ll
And the horrors of man we tell,
One would think, “We, as women,” were angels,
And our brothers were fiends of hell.

We, that were born of one mother,

And reared in the self-same place,
In the school and the church together,
We of one blood, one race!

Now then, all forward together!

But remember, every one,
That ’tis not by feminine innocence
The work of the world is done.

The world needs strength and courage,

And wisdom to help and feed—
When, “We, as women” bring these to man,
We shall lift the world indeed.
GIRLS OF TO-DAY *
Girls of today! Give ear!
Never since time began
Has come to the race of man
A year, a day, an hour,
So full of promise and power
As the time that now is here!

Never in all the lands

Was there a power so great,
To move the wheels of state,
To lift up body and mind,
To waken the deaf and blind,
As the power that is in your hands!

Here at the gates of gold

You stand in the pride of youth,
Strong in courage and truth,
Stirred by a force kept back
Through centuries long and black,
Armed with a power threefold!

First: You are makers of men!

Then Be the things you preach!
Let your own greatness teach!
When Mothers like this you see
Men will be strong and free—
Then, and not till then!

Second: Since Adam fell,

Have you not heard it said
That men by women are led?
True is the saying—true!
See to it what you do!
See that you lead them well.

Third: You have work of your own!

Maid and mother and wife,
Look in the face of life!
There are duties you owe the race!
Outside your dwelling-place
There is work for you alone!

Maid and mother and wife,

See your own work be done!
Be worthy a noble son!
Help man in the upward way!
Truly, a girl today
Is the strongest thing in life!
WOMEN TO MEN †
Dear father, from my cradle I acknowledge
All your wise kindness, tender care, and love,
Through days of kindergarten, school and college.
Now there is one gift lacking—one above
All other gifts of God, this highest trust is,
The one great gift, beyond all power and pelf—
Give me my freedom, father; give me justice,
That I may guard my children and myself.

My brother, you and I were reared together;

We played together, even-handed quite;
We went to school in every kind of weather,
Studied and ranked together as was right.
We work together now and earn our living,
You know how equal is the work we do;
Come, brother, with the love you’re always giving,
Give justice! It’s for me as well as you.

And you, my lover, kneeling here before me

With tender eyes that burn, warm lips that plead,
Protesting that you worship, aye, adore me;
Begging my love as life’s supremest meed,
Vowing to make me happy. Ah, how dare you!
Freedom and happiness have both one key!
Lover and husband, by the love I bear you,
Give justice! I can love you better, free!

Son my own son! Man-child that once was lying

All rosy, tender, helpless on my breast,
Your strength all dimples, your stern voice but crying,
Looking to me for comfort, food and rest,
Asking your life of me, and not another—
And asking not in vain till life be done—
Oh, my boy-baby! Is it I, your mother,
Who comes to ask of justice from her son?
Now to the voter—tax-payer (or shirker),
Please lay your private feelings on the shelf;
O Man-at-large! Friend! Comrade! Fellow-worker;
I am a human being like yourself.
I’m not your wife and mother. Can’t be, whether
I would or not: each to his own apart;
But in the world we’re people altogether—
Suffrage is not a question of the heart.

Son—Father—Brother—Lover unsupplanted—
We’ll talk at home. This thing concerns the nation;
A point of justice which is to be granted
By men to women who are no relation.
Perceive this fact, as salient as a steeple,
Please try to argue from it if you can;
Women have standing-room on earth as people
Outside of their relation to some man.

As wife and sweetheart, daughter, sister, mother,

Each woman privately her views explains;
As people of America—no other—
We claim the right our government maintains.
You who deny it stand in history’s pages
Withholding justice! Pitiless and plain
Your record stands down all the brightening ages—
You fought with progress, but you fought in vain.
REASSURANCE *
Can you imagine nothing better, brother,
Than that which you have always had before?
Have you been so content with “wife and mother,”
You dare hope nothing more?

Have you forever prized her, praised her, sung her,

The happy queen of a most happy reign?
Never dishonored her, despised her, flung her
Derision and disdain?

Go ask the literature of all the ages!

Books that were written before women read!
Pagan and Christian, satirists and sages—
Read what the world has said.

There was no power on earth to bid you slacken

The generous hand that painted her disgrace!
There was no shame on earth too black to blacken
That much-praised woman-face.

Eve and Pandora!—always you begin it—

The ancients called her Sin and Shame and Death.
“There is no evil without woman in it,”
The modern proverb saith.

She has been yours in uttermost possession—

Your slave, your mother, your well-chosen bride—
And you have owned in million-fold confession,
You were not satisfied.

Peace then! Fear not the coming woman, brother.

Owning herself, she giveth all the more.
She shall be better woman, wife and mother
Than man hath known before.
THE SOCIALIST AND THE
SUFFRAGIST f
Said the Socialist to the Suffragist:
“My cause is greater than yours!
You only work for a Special Class,
We for the gain of the General Mass,
Which every good ensures!”

Said the Suffragist to the Socialist:

“You underrate my Cause!
While women remain a Subject Class,
You never can move the General Mass,
With your Economic Laws!”

Said the Socialist to the Suffragist:

“You misinterpret facts!
There is no room for doubt or schism
In Economic Determinism—
It governs all our acts!”

Said the Suffragist to the Socialist:

“You men will always find
That this old world will never move
More swiftly in its ancient groove
While women stay behind!”

“A lifted world lifts women up,”

The Socialist explained.
“You cannot lift the world at all
While half of it is kept so small,”
The Suffragist maintained.

The world awoke, and tartly spoke:

“Your work is all the same:
Work together or work apart,
Work, each of you, with all your heart—
Just get into the game!”
THE MALINGERER f
Exempt! She “does not have to work!”
So might one talk
Defending long, bedridden ease,
Weak yielding ankles, flaccid knees,
With, “I don’t have to walk!”

Not have to work. Why not? Who gave

Free pass to you?
You’re housed and fed and taught and dressed
By age-long labor of the rest—
Work other people do!

What do you give in honest pay

For clothes and food?—
Then as a shield, defence, excuse,
She offers her exclusive use—
Her function—Motherhood!

Is motherhood a trade you make

A living by?
And does the wealth you so may use,
Squander, accumulate, abuse,
Show motherhood as high?

Or does the motherhood of those

Whose toil endures,
The farmers’ and mechanics’ wives,
Hard working servants all their lives—
Deserve less price than yours?

We’re not exempt! Man’s world runs on,

Motherless, wild;
Our servitude and long duress,
Our shameless, harem idleness,
Both fail to serve the child.
THE ANTI-SUFFRAGISTS *
Fashionable women in luxurious homes,
With men to feed them, clothe them, pay their bills,
Bow, doff the hat, and fetch the handkerchief;
Hostess or guest; and always so supplied
With graceful deference and courtesy;
Surrounded by their horses, servants, dogs—
These tell us they have all the rights they want.

Successful women who have won their way

Alone, with strength of their unaided arm,
Or helped by friends, or softly climbing up
By the sweet aid of “woman’s influence”;
Successful any way, and caring naught
For any other woman’s unsuccess—
These tell us they have all the rights they want.

Religious women of the feebler sort—

Not the religion of a righteous world,
A free, enlightened, upward-reaching world,
But the religion that considers life
As something to back out of!—whose ideal
Is to renounce, submit, and sacrifice,
Counting on being patted on the head
And given a high chair when they get to heaven—
These tell us they have all the rights they want.

Ignorant women—college bred sometimes,

But ignorant of life’s realities
And principles of righteous government,
And how the privileges they enjoy
Were won with blood and tears by those before—
Those they condemn, whose ways they now oppose;
Saying, “Why not let well enough alone?
Our world is very pleasant as it is”—
These tell us they have all the rights they want.
And selfish women—pigs in petticoats—
Rich, poor, wise, unwise, top or bottom round,
But all sublimely innocent of thought,
And guiltless of ambition, save the one
Deep, voiceless aspiration—to be fed!
These have no use for rights or duties more.
Duties today are more than they can meet,
And law insures their right to clothes and food—
These tell us they have all the rights they want.

And, more’s the pity, some good women, too;

Good, conscientious women with ideas;
Who think—or think they think—that woman’s cause
Is best advanced by letting it alone;
That she somehow is not a human thing,
And not to be helped on by human means,
Just added to humanity—an “L”—
A wing, a branch, an extra, not mankind—
These tell us they have all the rights they want.

And out of these has come a monstrous thing,

A strange, down-sucking whirlpool of disgrace,
Women uniting against womanhood,
And using that great name to hide their sin!
Vain are their words as that old king’s command
Who set his will against the rising tide.
But who shall measure the historic shame
Of these poor traitors—traitors are they all—
To great Democracy and Womanhood!
THE “ANTI” AND THE FLY f

The fly upon the Cartwheel

Thought he made all the Sound;
He thought he made the Cart go on—
And made the wheels go round.

The Fly upon the Cartwheel

Has won undying fame
For Conceit that was colossal,
And Ignorance the same.

But today he has a Rival

As we roll down History’s Track—
For the “Anti” on the Cartwheel
Thinks she makes the Wheels go back!
TO THE INDIFFERENT WOMEN *
A SESTINA
You who are happy in a thousand homes,
Or overworked therein, to a dumb peace;
Whose souls are wholly centered in the life
Of that small group you personally love—
Who told you that you need not know or care
About the sin and sorrow of the world?

Do you believe the sorrow of the world

Does not concern you in your little homes?
That you are licensed to avoid the care
And toil for human progress, human peace,
And the enlargement of our power of love
Until it covers every field of life?

The one first duty of all human life

Is to promote the progress of the world
In righteousness, in wisdom, truth and love;
And you ignore it, hidden in your homes,
Content to keep them in uncertain peace,
Content to leave all else without your care.

Yet you are mothers! And a mother’s care

Is the first step towards friendly human life,
Life where all nations in untroubled peace
Unite to raise the standard of the world
And make the happiness we seek in homes
Spread everywhere in strong and fruitful love.

You are content to keep that mighty love

In its first steps forever; the crude care
Of animals for mate and young and homes,
Instead of pouring it abroad in life,
Its mighty current feeding all the world
Till every human child shall grow in peace.

You cannot keep your small domestic peace,