Heh. I’ll just leave this here. Not for the overly serious.



Continue reading “Interlude: You. Want. To. Dance. … Not.”
Blog
InfoSe€€€

[Infra to use, to protect]
On then, with the dream of rational (i.e., ‘cost-effective’) information security control selection. Apart from the definitions, distinctions and boundaries between operations management, information management, data management, information security, IT security, business continuity management, etc. – I don’t really care, they all end up with the same sort of ‘risk analysis’ quod non (see earlier posts, the most prominent being this one) and a sort of afterburner about weighing costs versus benefits of controls to be put in place. Nothing on all the stuff I discussed in that prominent post; the time-sensitive chances, impacts and effectivenesses of threats, vulnerabilities, controls individually and in interactions, feedforward and feedback loops, the enormity of lack of reliable data and the overwhelming noise and error this introduces into any calculation.
And nothing on how one should go about estimating the costs of controls vis-à-vis their effectiveness. Because that’s even harder to do, when one has continuous but very often hardly-quantifiable costs of controls individually let alone in conjunction with others (all with costs varying in time, again, too ..!).
Awful wareness
A shortie, once again. Through
Toughest thing about security awareness is getting the employees to really care enough to want to change: https://t.co/H5gI5zaSfp
— Pete Herzog (@peteherzog) February 11, 2014
I was triggered to add some Awwww areness sauce to my previous snippets on security. Will do. Pete Herzog’s idea in
Patching systems is about meeting compliance objectives and passing pen tests and NOT security. Like fast food it succeeds bc it's easy.
— Pete Herzog (@peteherzog) February 12, 2014
will also get a place.
And an archi pic for your viewing pleasure:

[Gran Via, what else]
Bias Time (7 of 9)

[Spiritual enlightenment]
Yes, it’s bias time again. The seventh of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.
Informal fallacies
- Argument from repetition (argumentum ad nauseam): signifies that it has been discussed extensively (possibly by different people) until nobody cares to discuss it anymore
- Appeal to ridicule: a specific type of appeal to emotion where an argument is made by presenting the opponent’s argument in a way that makes it appear ridiculous
- Argument from ignorance (appeal to ignorance): The fallacy of assuming that something is true/false because it has not been proven false/true. For example: “The student has failed to prove that he didn’t cheat on the test, therefore he must have cheated on the test.”
- Begging the question (petitio principii): where the conclusion of an argument is implicitly or explicitly assumed in one of the premises
- Circular cause and consequence: where the consequence of the phenomenon is claimed to be its root cause
- Continuum fallacy (fallacy of the beard): appears to demonstrate that two states or conditions cannot be considered distinct (or do not exist at all) because between them there exists a continuum of states. According to the fallacy, differences in quality cannot result from differences in quantity.
- Correlation does not imply causation (cum hoc ergo propter hoc): a phrase used in the sciences and the statistics to emphasize that correlation between two variables does not imply that one causes the other
- Demanding negative proof: attempting to avoid the burden of proof for some claim by demanding proof of the contrary from whoever questions that claim
- Equivocation (No true Scotsman): the misleading use of a term with more than one meaning (by glossing over which meaning is intended at a particular time)
- Etymological fallacy: which reasons that the original or historical meaning of a word or phrase is necessarily similar to its actual present-day meaning.
Fallacies of distribution
- Division: where one reasons logically that something true of a thing must also be true of all or some of its parts
- Composition: where one reasons logically that something true of part of a whole must also be true of the whole
- Ecological fallacy: inferences about the nature of specific individuals are based solely upon aggregate statistics collected for the group to which those individuals belong
- Fallacy of many questions (complex question, fallacy of presupposition, loaded question, plurium interrogationum): someone asks a question that presupposes something that has not been proven or accepted by all the people involved. This fallacy is often used rhetorically, so that the question limits direct replies to those that serve the questioner’s agenda.
- Fallacy of the single cause (“joint effect”, or “causal oversimplification”): occurs when it is assumed that there is one, simple cause of an outcome when in reality it may have been caused by a number of only jointly sufficient causes.
- False attribution: occurs when an advocate appeals to an irrelevant, unqualified, unidentified, biased or fabricated source in support of an argument
- Contextomy (Fallacy of quoting out of context): refers to the selective excerpting of words from their original linguistic context in a way that distorts the source’s intended meaning
- False compromise/middle ground: asserts that a compromise between two positions is correct
- Gambler’s fallacy: the incorrect belief that the likelihood of a random event can be affected by or predicted from other, independent events
- Historian’s fallacy: occurs when one assumes that decision makers of the past viewed events from the same perspective and having the same information as those subsequently analyzing the decision. It is not to be confused with presentism, a mode of historical analysis in which present-day ideas (such as moral standards) are projected into the past.
- Incomplete comparison: where not enough information is provided to make a complete comparison
- Inconsistent comparison: where different methods of comparison are used, leaving one with a false impression of the whole comparison
- Intentional fallacy: addresses the assumption that the meaning intended by the author of a literary work is of primary importance
- Loki’s Wager: the unreasonable insistence that a concept cannot be defined, and therefore cannot be discussed.
- Moving the goalpost (raising the bar): argument in which evidence presented in response to a specific claim is dismissed and some other (often greater) evidence is demanded
- Perfect solution fallacy: where an argument assumes that a perfect solution exists and/or that a solution should be rejected because some part of the problem would still exist after it was implemented
- Post hoc ergo propter hoc: also known as false cause, coincidental correlation or correlation not causation.
- Proof by verbosity (argumentum verbosium) (proof by intimidation): submission of others to an argument too complex and verbose to reasonably deal with in all its intimate details. see also Gish Gallop and argument from authority.
- Prosecutor’s fallacy: a low probability of false matches does not mean a low probability of some false match being found
- Psychologist’s fallacy: occurs when an observer presupposes the objectivity of his own perspective when analyzing a behavioral event
- Regression fallacy: ascribes cause where none exists. The flaw is failing to account for natural fluctuations. It is frequently a special kind of the post hoc fallacy.
- Reification (hypostatization): a fallacy of ambiguity, when an abstraction (abstract belief or hypothetical construct) is treated as if it were a concrete, real event or physical entity. In other words, it is the error of treating as a “real thing” something which is not a real thing, but merely an idea.
- Retrospective determinism (it happened so it was bound to)
- Special pleading: where a proponent of a position attempts to cite something as an exemption to a generally accepted rule or principle without justifying the exemption
- Suppressed correlative: an argument which tries to redefine a correlative (two mutually exclusive options) so that one alternative encompasses the other, thus making one alternative impossible
- Well travelled road effect: estimates of elapsed time is shorter for familiar routes as compared to unfamiliar routes which are of equal or lesser duration.
- Wrong direction: where cause and effect are reversed. The cause is said to be the effect and vice versa.
Door of invention
This door does it:
http://www.businessinsider.com/klemens-torgglers-kinectic-door-2014-2
Edited to add: Seven more.
On APTs
Suddenly, an uproar over this Mask APT that appears to have been around for seven years. Oh. Not much of an uproar. Also not over this.
Some may remember my prediction, from way back i.e. two months ago [not even going to put in links; just browse the Predictions category of posts], that 2014 would be the year of APTs, among others. Now, I almost feel that it isn’t 2014 but just January. Too bad!
Or, if you would want to shed light on this, do comment.
Hardcore, (Information) Security pieces

[Meant as gateway, not closure]
Earlier, as in here, here and here, and other places apart from these, I floated the idea of redesigning the way we tackle the core of Information security. Unfortunately, I don’t have sufficient time (yet!) in lunch breaks to get it all together in one big white paper hence I’ll drop some elements here, again.
I’ll keep working on collecting loose ends, so when I find time, I can integrate it all, including your comments, of which I have received so much. Not so much. As one. Single. Comment.
Herewith, then, to start off, a picture I took from … somewhere, probably the ISACA site somewhere. I’ll work from this, structuring the story line from top to bottom, first how we do it now (kindergarten level, with the pretense, pomp and circumstance of high priests doing high art), next, how it should be done ndash; qualitatively, vaguely, massaging off the rough edges and not being able to do much more except for the hardest cores of security (Remember the pyramid I presented? Read up via the above links).

Also, I’ll drill down a bit on the design of controls, according the lines sketched earlier (yup, see links again) and using an augmented [By me; disclaimer [Huh? When it’s by me: Why …!?]: *value may not be included] anti-fraud matrix à la:

Which will have an advice that visually is something like this, of course:

which is very different from the usual “Uhhhh, dunno, do we have a Motivation or Rationalisation here, dude..? Can’t progress until we figure out.” i.e. is design and action oriented.
But then, this matrix will be overlaid (third dimension) on the SABSA matrix I guess. Though I’ll make it very clear that SABSA is all very well, but very much focused on the bottom layers of itself only, the bottom layers of the InfoSec pyramid I sketched. And, upwards, there’s much methodological confusion. In particular re its Information and Conceptual / Context / Wisdom definitions and placements.
And of course I’ll throw in a bit of ABAC referring to this.
OK. Time’s up!
Which means I welcome your comments. One may dream, right …?
A few bits of hope, a lot of redundancy

[Perfectly doable, for a machine/computer, very soon. Barça harbour.]
Along flew a tweet on this insightful piece.
Providing some leftover bits of hope that there will be a humanity that can sustain itself, in various marginal ways. Glad that we don’t need to be drones (and other links) ‘anymore’… As long as we can outpace AI, which we may lose control over soon.
Exit homo sapiens sapiens. Entrat Singularity, artefactum sapiens sapiens sapiens.
No coin

[Bank towering over daily affairs? Nopes!]
OK, a final (?) note then on Bitcoin et al.
Because we haven’t discussed the non[?]-currency equivalents yet. Austrian Freigeld, Swiss (very succesful, still very much operational) WIR and Dutch Noppes (nothingnadas), that sort of stuff. And now, there’s Qoin, working internationally. Because Noppes “… didn’t deliver the required result. By linking noppes to the guilder [now euro], there was no market efficiency. With noppes, the rich still got richer. A lawyer could hire a cleaner very cheaply, whilst people with little talent and a greater demand for care, were left out.” OK …
Why then, link up with the community currency Makkies (‘hendies’), where the unit of calculation is someone’s hour of performance regardless of any-currency going rate ..?
And why not drop all the stuff altogether, and move to the full digital currency schemes? [Suddenly realise how ominous that can read.]
But I may repeat myself from that post, and others.
Conclusion: Crisis makes creative; let so many ‘genetic’ variants spring up in ‘richer’ times (rich of need, in a surprising evolution theory plot twist), and all but a few be weeded out once the real pressure comes on. And we’ll end up in Singularity armageddon.
Contra?note ID is
This @meneer returned to an old snippet, on his blog. To which I have the following, apart from an earlier post:
- People, if they are real people, visit your site to obtain services, indeed. But you want either moneda or some other nonpecuniary return. This may be kudos only, as in the naive sharing model, or some other form of not near- but far-money, e.g., client data for you to sell better or to sell outright. [Yeah, I know @meneer, you wouldn’t. Others have mortgages.]
So it’s not that they don’t trust you for services, but you may need some form of trust (e.g., through pre-trust in their propensity to ‘pay’ through some reliable third party declaring their trustworthiness or allsorts of revenue from affiliation however looesy defined).
Interlude; here’s a picture for your viewing delight:

[Valencia, obviously, by the master, obviously]
- Unreal ‘people’ will just troll. Actual hooman trolls, or the AI that keeps getting better (also at guessing captcha’s). You may want to not ‘service’ them with bandwidth, and/or with room to screw up e.g., your site its stats, its quality image (re illegible or defamatory comments) or its usability for others. You do need some way to assess the trustability level in advance i.e., when the visitor comes to your site.
- Your dislike for trust models is correct. But how did we get along on sneakernet ..? What is the closest proxy we can find, when in bits? Paying for bandwidth ..? All sorts of bonus/malus and whitelist/blacklist systems work only if not when all involved, all ‘citizens’, would fall under the same rule of unified law. I’m not negative, but don’t see a solution.
Trust is not a one-way affair (though ‘leaders’ of the real kind, trusted, may not trust all their followers individually…, etc.), but a cumbersome concept. Cumbersome implementations, will follow.
Too bad! And even if we get the basic concepts extremely simple, they may not be implementable similarly. As in e.g. quantum physics et al.: Simple basics, but not simple or useful in its implementation throughout when you’re in the mudane world out there, e.g., at a good restaurant. [Disclaimer: I’m not a fan of molecular cooking; waaay too much chasing effects at the expense of natural cooking.]
No I don’t have a definitive answer. Just wanted to add my 2c.






