ERM, GRC – Page 23 – Maverisk / Étoiles du Nord

Temporary Awareness

A call for poignant pointers.

You may be aware that research is on-going (among other, by Yours Truly) in the area of sustained ‘security awareness’ — a misnomer for security habit change. Which is driven by psychological stuff like everyone’s individuality, everyone’s individual circumstances (not only at work, not only formal short/medium term) and everyone’s learning and operations style and preferences. And hence, habit change would also have to cater for all these differences. One-time ‘awareness training’ (sic), yeah, right on.

Still, such would be a somewhat valid approach … for perm staff.
Not for infrequent visitors, like your garden variety (IS) auditor, that would drop in every now and then and till have access to sensitive data; on purpose or not, benign or malign leakage or not.
Not for temps, interns et al., that are around too short for true awareness to sink to the back of the head, for instinct reflexes (oh ideal). Or the induction program would be a grilling drill; conter-productive.
Not, and this is where my problem is mostly, with third party staff, that primarily work for the vendor and have other KPIs than client security — at least, higher on their agendas. They come in (physically or remotely), do their thing that hooks quite deep into your operational processes (physically like cleaners and installers, logically through e.g., software and parameter updates) almost always at arms’ length control with still their other KPIs first, and then leave you possibly vulnerable or robbed, and ith full accountability without grip on actual operations taken place.

Apart from the platitudes of requiring transparent compliance with all your security policies (purely hypothetically, IF you’d be able to find and collect them, they’d be sorely outdated, and 50% or more wouldn’t be applicable but which 50% you have no clue), what about the above-mentioned change to the ~~good~~ sufficient habits ..?
Your input would be much appreciated…

Also:

[Temp attention, eternal bliss; Syracuse]

Nocial Media

… How did yesterday’s post know about what I type here now ..?

Too easy. Now for something real:
Nocial Media.
Which is about the distribution of socmed interactions.

Because, the best we have so far is stratified data, by country, age group / gender. Which totally misses that, my guess [hence: fact], a great many relations, either current/frequent or distant/loose, are distributed over a different set of classes. Like, a chunk will be global among peers of any sort (or several of such groups), but also the other chunk will be local, traditional, geo- or socially close like (well, F2F peers but they’re an in-between group) family, IRL colleagues, and association co-members.

Now, would any of you have data on such, probably exponential-in-many-directions, distributions ..? I’d love to hear, TIA.

Oh and on a side note; maybe worthwhile to have some sociology expert elucidate on this: What-how is our future when ‘kids these days’ use /Insta…/Snapch… etc. that leave so little trail; how will your future self be able to browse through old youth pics …? [Advertisers will … Be very sure of that…]

Plus:

[What bin you’re in — Zuid-As Amsterdam]

SecPoll

Finally, a competition where you can win, too, seriously.

Yes you can, I’m serious. And you win something serious…
The deal:
Your top-3 predictions, in comments, about what new ‘cyber’security stuff (#ditchcyber) will happen in 2017.
In return, if you’re the top predictor (NO.), to celebrate you’ve best found ’17’s bubbles of the year you’ll receive a perfect bottle of ’17 bubbles.
The things you describe can be of any sort, related to information security in the widest sense. Something-cloud, something-privacy, something-Docker, something- Layer 7 or 8 firewalls, something-systemic-breachlike, whatever, it’s up to you. However:

Some terms and conditions [subject to updating when needed..! My call and prerogative]:

No editing your predictions after entering them;
Three apiece;
None should not be around per second half of December 2016;
All should be measurable, and measurably the largest over 2017, suggestions for measurement/metrics should be attached.

I’ll be awaiting your wisdom / totally random stuff with:

[Who would’ve predicted the success, and beauty, of this/these, eh? DC]

Dense, but study

All about this here article. Yes I too, started out as picture browser through this. But more careful study unearthed a lot of gold, qua understanding of the issues. Even to the point of pointing out some gaps, here and there — well, the understanding did, not as much the overview — in ‘moral continuums’, that can and should be filled.
And, much work can be done on opeationalising the Obvious breaches of fundamental human rights (as per Universal Declaration) so don’t go babbling about commerce needs a chance.

[And now for a switch of goal but you’ll find the relation …!]

Where the latter is one big part often missing with ‘disruptions’ quod non:
Doing something simply illegal is just that and is not ‘allowed’ because innovation should be allowed to be tested.
Innovation should not be attempted when the new has been determined already to be illegal
How hard can it be? Laws had been put in place to protect the weak against the powerful, specifically at points where the need was obviated. IF some law has no purpose anymore, one should first do away with it, first through political ways and if that wouldn’t work out to be possible, only then, through e.g., courts for obvious unfairness (sic; if your law system is of the common type you’re hosed anyway). When you don’t succeeed in this the only legal ways, too bad that’s how democracy works, if.
If some law still has purpose but there’s negative side effects you’d want to do away with, do away with the side effects not the law; in the two ways as before doofus!

Oh well. Mock disruptors beware; the world does not need nor welcome you.
And:

[Sometimes, Classics are perfect enough; Prague]

Mumbling, much ..?

How come that almost (?) everyone (for sure) recognises the tune of this, but none know the lyrics — well, by heart, and able to sing somewhat proficiently…?

Just asking.

And:

[Beautiful, but linked to tragedy; Prague — only need to straight the horizon…]

Some quick notes on Audit / service development

An invitation for co-development or I go it alone…
[This also being a copyright / idea claim]

Undecided what name will stick; either
Ethics Test Services, or
Autonomous Judgement/Decision Analysis Services;
Because it is about checking the morality baked into, or emerging from, algorithmic decisions and/or decisions and conclusions from autonomous and self-learning systems;
Contra “Computer says No”, obviously.
If you’d want to learn what that refers to; see here;
[Intermission] Whereas some in European politics (sic) discuss to impose a limit where autonomous systems without one human in the loop anywhere would have to have an ‘explanatory’ function that can display in layman’s terms how it arrived at some decision, and that being contestable. But the questions are: What if the ‘system’ were hosted outside the EU (and just like inflation, Gresham will obviously apply), and what if (maybe ‘when’; we’re talking politicians here) such a very first step towards transparency may still not make it, and what if as a cheap escape trick the human would and could only click ‘OK’ — could (s)he be culpable?
Elements would be:
- Process correctness,
- Data correctness,
- Exceptions handling; essential and necessary.
This, in Standard Form and with an overall human (me; run to the hills) judgement both over process/systems quality and over moral/ethical admissability;
Will have to extend the notions of ethics, morality et al. here; e.g., how humans make decisions in the first place with all their errors of all kinds, what to do when systems/humans don’t follow morality and/or the decisions from the systems.

So, everyone (dabbling in this space from now on,) will pay me serious license fees for using the above ideas in commercial services… [note: I’m serious]
And/or all help is welcomed.

To add:

[Would deliver above services to this address for expense reimbursement only …]

Log not Log

About the resurgence of ‘logging’ as a thing.
In compliance, for whatever reason because everyone lost the Original purpose.
In ‘audit’ (like, checking bookkeeping — no you drop the pretense and lies that’s all there is to it!), since we (??) can now do den totalen Prozesskontrolle.
In systems management, to …:

Monitor the health of systems — note that a lot of logging will be superfluous for this purpose (lest the next bullet comes into play), and a lot of the other records will be processed near-completely-automated into nice dashboards; note also that in this environment, that seems to work whereas in enviroments where ‘dashboards’ have been promoted for ages (decades, mind you) without any success, with the cause already known just as long;
Detect/find, and process, intrusions. Being proxies for ‘fraud’ (quod non, and note that legally, there’s no such thing!) to be committed.

Most efforts of late go into the latter thing (apart from the good work (sic) done by, e.g., the Coney‘s of this world). Where we see a jump to the worst, most atrocious, of Big Brother privacy obliteration by processing each and every little in-systems program step that can be logged, traced. Even by, what could have been, proper all-out systems management integrating the traditional style of it, with IoT device management, as e.g., Splunk now is focusing on whilst leaving their core competence behind.
Missing the point that ‘systems management’ over all transactions having started with the human ones, was the Original purpose. To monitor (at the speed of annual bookkeeping ..!) the health of ‘systems’, the business as performed and understand that not all transactions could be perfectly in line with the, unthinkingly overstandardised ideal transaction patterns.

Can we now, now that we do have the mechanics (log writing speed, all-connectivity, and storage (!) and processing tools available) regain that latter part..?
Hopefully.

And:

[Modern (purpose), still also a sun dial; Barça]

Quitting a club

Where some trade association of … drum roll … chartered (sic) IS auditors declared Cybersecurity is becoming an ever bigger problem. An IS auditor should need to keep informed of the latest developments as an argument to join in some CYBER ARRGHHH! lecture,
one better leaves. I did.

Sure, I’m member of some other, global, of the same trade and tricks one might say. But to list the other arguments to quit the local (i.e., Dutch; could have characterised them as ‘provincial’ but why) one, would take ten pages (yes I have them, spelled out including various legal trespassing of the vilest kind, far from complete after some this-years developments within the club…) and I don’t want to bother you with the water under the bridge.
And sure, I re-joined yet another trade association. And try to contribute in another way, as yet not yet disclosed. And #ditchcyber.

But I’m unsure about my discretion in leaving (behind the hopeless) and would be curious about your best advice when and how (that’s two) to quit a club. Thoughts?

Oh:

[Not only T towers might need (sic) to be renamed…]

Plusquote: LogiC PA

Be ware, dear people. Recently, an accountant, of the CPA type, came with the following quote:

The partner model isn’t part of the problem with our industry sector, because look at banks; they left the partner model ages ago and still got into trouble recently.”

To think that such ‘logic’ considers themselves competent to even come within miles’ range of anything to do with money, let alone approving designed-for-hypercomplexity (with the hubris element in hyper) bookkeeping — as unfathomable complex as the finance sector had concocted by the quants, theoretical physicists that were experts in completely-outside-of-human-reality math … but hey, they hadn’t a partner model to shield them from reality …

Typical of the thing that brought POTUS-elect into Office. And the proper response here of course is to laugh in their face for their stupidity; so many (all?) religions and not-religions have the eternity of afterlife where the above will be punished to no end. Lost their soul, can’t be helped.

Oh well:

[Re-using an old one, and recalling a Clan song; from Porto’s Casa de Musica of course]

Sticky Wicked

I’ve been seeing ‘wicked problem’ turn up again lately. Again, hardly in its original sense let alone to the criteria. But rather, as problems where the counterforces to solutions are just too dug in against change, to be overcome. As human, societal problems rather than something systemically hard. To bulldozer over, with a MBT, maybe ..? What a fine demonstration of irritation to let loose.

And, of course: