Category: ERM, GRC

Save a few

Just a reminder; Dutch lower gov’t agencies struggling with storage formats … (Here, in Dutch, but Alphabet Translate (heh that still doesn’t ring well!) may help)

There may be hope for (!) privacy. And:
DSCN1053
[Nice, functional (as / where it is), and certainly will look Old before you know it; La Défense]

Human / Not

Of course Cerf is right. But also … is the opposite side; human error would be harmless (save the Almost part) when vulnerabilities wouldn’t be attacked. As long as they exist, they will. And human error will exist; that’s just the way our genes, and memes, and all of Nature, play it out. The instability of Nature (here and here!) means evolution happens, works. On the Changing-environment- and on the trial-through-error sides.

Hence, you’re still where you started. Still pursuing max fault-freedom but sure to not achieve it. I.e., in danger — the Condition Humaine since the dawn of Time (on that in a PhD thesis, some other time) and dismissing Hegelian progress fantasies, forever.

Well then, to leave in a positive tone:
DSCN0487
[No time ?? for R&R; outside Siena]

Overwhelmed by ‘friendly’ engineers

The rage seems to be with chat bots, lately. Haven’t met any, but that may only be me — not being interesting enough to be overwhelmed by their calls.
Which will happen, in particular to those in society that have less than perfect resistance against the various modes of telesales and other forms of social engineering (for phishing and other nefarious purposes) already. Including all sorts of otherwise-possibly-bright-and-genius-intelligent-but (??)-having-washed-up-in-InfoSec-for-lack-of-genuine-societal-intelligence types like us. But these being the ones of all stripes that ‘we’ need to protect, rather than the ones apparently already so heavily loaded that they can spare the dime for development of such hyper-scaling ultra-travelling foot-in-the-door salesmen. Is this the end stage, where none have a clue as to which precious little interaction is still actually human-to-human, and the rest may be discarded ..?

As for the latter … It raises the question of Why, in communications as a human endeavor… Quite a thought.

But for the time being, you’re hosed, anti-phishing-through-social-engineeringwise.

Just sayin’. Plus:
DSCN0408
[Retreat, a.k.a. Run to the hills / Run for your life; but meant positively! Monte Olivieto Maggiore near Siena]

Wats’on your bug-hunting program ..?

Tinkering with some unrelated ideas …:
How would one go about setting Watson (Clone, III) to work on bug hunting ..?
Where the Beast would be fed all sorts of past code / code patterns (source~ or executable~, or whatever style you’d prefer) with known bugs / errors / exploits and the way in which they failed, and then have the Big W scan, e.g., Win10 source code and come up with a list (in this case, assuming sufficient storage ;-| ) of bug red flags. Probably, to be classified in a range of Sure Thing, via Commonly, to Maybe. As we’re discussing patterns, certainty can’t be had for all found points of interest per se.

That being the simple part, what about automated immunization ..? If some patterns are near-certainly bugs/errors/exploit-points always, can they be plastered ex ante ..? It might be easy(er), too, to throw in an extra development test in the first place (“Sorry Dave, I can’t compile that”). But this sort of scope creep could easily lead to creepy behavior, e.g., if (??) the (??) system would get hijacked.

Oh well. Would still be glad to have your thoughts. And:
DSC_0062
[“Tin”foil hat for actual protection (well, No.), at Haut K-bourg again]

All your Happen

Just a quick note, that the infamous What Happen — All Your Base Are Belong To Us now for some time already (as undercurrent for the non-attentives…) has a successor in

Dat Boi.

As detailed in this here piece. Go read and weep.
o shit waddup.

CfYleuDXEAA9HP2

Plusquote: Critique of the Pure Reasonlessness

This episode, by reference to the excellent Future Crimes (Marc Goodman, as here), one originally by G.K. Chersterton (The Blue Cross):

The criminal is the creative artist; the detective only the critic

To which we would want to add: And the auditor, only the disgruntled desk-bound traffic cop.
Since, the checker (and penaliser) of the trivial petty little rules, should remain in the third line, right ..?

Where by the way, the creativity of the artist is required to make the art work that sells — and hence all make their living off straightforward crime or would perish. The more you bureaucratise into totalitarianism, the more you see life wither, till death. Even if the crime keeps on being perpetrated — by laxity of the second and particularly third lines, in cahoots with the profiteers. … Maybe that’s a bit deep-but-overly-lapidary …
Hence, just:
DSC_0247
[Panopticon Central, Strassbourg]

Miss(ed), almost ..?

One might have easily missed one of the most valuable annual reports … but if you trust it (you can) or would want to dismiss it (you can, for various reasons like the management babble leading to a great many missed threats and ~levels as here, always of course, but still), it is an important item when you’re in InfoSec despite #ditchcyber! so you’d better study it.
Oh, yeah, this being the thing.

OK now. Plus:
DSC_0113
[In “cyber”space (#ditchcyber once more), easily scaled. Haut Koenigsbourg again.]

Short Cross posting

… Not from anyone, not from anywhere. But crossing some book tips, and asking for comments.
Was reading the Good Book, when realizing that it, in conjunction with Bruce, could lead to some form of progress beyond the latter when absolutist totalitarian panopticon control frameworks might seem the only way out. In particular, when including this on the Pikettyan / Elyseym escape or not that serves only some but not the serfs. And then add some Mark Goodman (nomen est omen, qua author, and content?) and you can see where Bruce may have missed exponential crumbling of structures, and said escape might be by others than the current(ly known) 1% … Not all Boy Cried Wolfs will be wrong; on the contrary — Not Yet is very, very different from Never, but rather Soon Baby, Soon.

Not rejoicing, and:
DSC_0097
[Nope, not safe here (Haut Koenigsbourg) either.]

Still, 3LD is the 4th leg

This, not as much a monster under the bed as it is a monster elsewhere; Three Lines of Defense (quod non).

I’ve discussed the utterly nonsensical, totalitarian bureaucratic, lie of its utility already over and over again, but the thought — through encounter in daily practice so often still — returns every now and then. And then, one realizes: Three Lines of ‘Defense’ (quod non) are not the third, but the fourth leg of a flipover stand. Yes, indeed, you hardly see that ever — for a reason: Where the third leg is flimsy already and certainly so compared to the stability provided by the first, essential, two legs, any fourth might impress but destroys stability of the whole!
Yes, as three ground point define a surface hence stable stance on any irregular surface (and, hence again, are completely sufficient), four such touch points are very hard to get stable, onto a plane surface. Therefore, the fourth leg destabilizes the whole shazam, undoes the effectiveness of the third. Now, two are bungling.

And no, not because a flipover has three legs does that reflect TLD; the first two legs are equally required and face us, thus giving the thing its purpose which is completely, fundamentally, different from TLD where there’s three lines behind each other that only ‘protect’ (quod non) against regulatory oversight by massaging all embarrassment away through ever more dubious language. When you don’t see the fundamental of that difference, you may or may not be hopeless. Stop dragging the IQ average of whatever group you consider yourself part of, down so low.

I now rest my case.

20160428_170217[1]
[‘Transparency’ and building material? We see right through that both, Chanel!
 (PC Hooftstraat)]

Maverisk / Étoiles du Nord