Category: ERM, GRC

Stumbling over yourself, in the retreat

DSCN5600
[Utreg]

Remember the good ol’ Boston Consulting matrix ..?

Among the puerilely [that is a word] shallow startup business, apparently not many do. They’re only chasing the next, even more questionable question marks, ‘knowing for sure’ (not) to turn those into stars without fail. Current stars exist only to set the example and to be beaten.
Dogs, of course, are what they are. And cash cows are also dogs. As they aren’t fast enough. Sure. But where startup managers believe to have found the ultimate question mark will turn into star certainty, and VCs just spending off their (or Other Peoples’ Money ..!) lifetime earnings as lottery tickets, the cash cows prod along quite happily, getting only half of the world’s attention for delivering … 95% of the world’s goods and services (mostly, from the bottom up Maslow’s pyramid).

Thus, two economies result; the one being much more dependent on the other than usually considered, with the other not being old and decrepid, to be done away with, but a core, a solid basis for long-term alignment or else one keeps on floating in the sky until one evaporates. The other way around is not quite as necessary as believed..!
Which also leads to those of the stable kind, trying to get into the action of the fluid kind, to stumble while they try to retreat into some fluid future. They lose the stability, and cannot catch up with the road runner(s) for sheer secondness and ballast of the old. Cash cows are big, required and necessary, and should be left alone to innovate not to disrupt. Disruptors, may be loosely tied to cash cows, but certainly not with the intention to later integrate the latter back into the former. That will lead to failure throughout; the horse already left the barn and you wouldn’t have wanted to close the gate but now have had a kick in the teeth; i.e., the slow just missing the grasp and ending up on the rails, grappling their teeth together, while the train ever speeding up will have left the station. This form of retreat (that’s what it is, retreat as leader, T Rex trying to regain initiative by outpacing and outsmarting the Velociraptors in their teamwork) will lead to pathetic stumbling.

Conclusion: Don’t do it. Not in the me-too way. Dare to decide what you are, be proud of that ..! Just innovate, not disrupt yourself internally only, and be strong … survival of the fattest and fittest. Don’t be a lightweight, you’ll fall like Icarus – after you have learned not to fly too low …!

Bias Time (9 of 9)

DSCN0006
[To round off brain ‘governance’]

Yes, it’s bias time again. The last of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.

Red herring fallacies

  • Ad hominem: attacking the person instead of the argument. A form of this is reductio ad Hitlerum.
  • Argumentum ad baculum (“appeal to the stick” or “appeal to force”): where an argument is made through coercion or threats of force towards an opposing party
  • Argumentum ad populum (“appeal to belief”, “appeal to the majority”, “appeal to the people”): where a proposition is claimed to be true solely because many people believe it to be true
  • Association fallacy (guilt by association)
  • Appeal to authority: where an assertion is deemed true because of the position or authority of the person asserting it
  • Appeal to consequences: a specific type of appeal to emotion where an argument concludes that a premise is either true or false based on whether the premise leads to desirable or undesirable consequences for a particular party
  • Appeal to emotion: where an argument is made due to the manipulation of emotions, rather than the use of valid reasoning Continue reading “Bias Time (9 of 9)”

TL;DR on TLD (or 5LD)

Ah, yes, let’s not forget to add the biggest Quod Non of the decade to our list of subjects for the redevelopment of information security / information risk management / risk management / management of risks / management ‘book’ forthcoming.
Indeed, three lines of ‘defense’ will be in. As well as the extension to five lines of defense. Which will all not work, and will all just add to the culpability of those proposing them, as they must know better or declare their incompetence at an even broader scale and abstraction layer.

Because, and here I repeat myself, and many others, how can something help defend when it’s not between a threat and a vulnerability ..!?

000026 (3)
[Dee An Bee]

Because I already discussed this in the past (way back, couple of months ago (final one)), and will discuss in all detail in the overall Book (white paper) on the above subjects, I’ll leave it here. For the believers in the idea: Full speed ahead into the blind alley …!

Silent SOx Shutdown

As Fortune Magazine reported last week, suddenly everyone realises that the dreaded (dreadful?) Sarbanes-Oxley act has hardly any sway anymore over business affairs. And some senators are calling for its repeal.

First, a pic for your viewing pleasure:
DSCN2158
[Barça, near the Olympic (remember?) village]

Can we assume this a sign of the waning of Compliance ..? Hopefully. What we’re left with, is a decade of misery for all but the compliabullies. How can we force them to pony up the compensation for financial and immaterial damages they caused ..?
They’re probably too blind (numb) to see that they did, massively, without any improvement in overall management, or viability, of the organisations involved. On the contrary, all the efforts were so misdirected that initiatives that might actually have helped, were thwarted. Innovation initiatives were demolished, economies destroyed. The only escape vent was in the financial industry, where wizardry escaped the numb compliabullies. What a bubble blew out…
And think of all the (actual, positive) creativity and careers that didnt take flight, or were culled. How to restore all the joy of years of productive careers, not as a second wind because that always sourly reminds of the lost years, the irrevokably lost life ..? If all that can be done is destroy the compliabullies’ lives and memories, then maybe that’s all that can and should be done. Not preferable, but if, then.

Two shorties

Just to drop ’em.

First; the hypes come and disappear again quicker than you get to notice them as such. As in some Bird thing. Is this the new way trends will go ..? If so, we’ll all have trouble keeping up, and will see disparate clusters of innovation, some re-inventions without linkage, some unique evolutionary directions taken. Long live diversity! Until the Other comes to bite you. Yes, I did aim to frame this as a remark on, e.g., economic development (followed by military power to secure the elsewhere cheaper resources), new-business models, and products and services. Now that we come to realise the balance between exposure for scrutiny and secrecy for deep development. À la Eppel.

Next: Not even pop-art is sacred. What’s next; a 3D (sic) printer for Jackson Pollocks ..? The horror. But, this may lead to creativity being defined better. Since the Act of pop-art, at its inception, was the great Move. The copy, even IF it were an improvement or only equally valuable (in cultural terms), still needs the reference to the greatness of pop-art, throughout, and doesn’t add a critique or anything, no ump to new insights. Nice mee-too art, but not Great Art, for my part. Now where is that chasm; what criteria to establish..?
(And, some pics in the link are quite good, in particular when seen as a series. Some form of art there. Should not have referenced older art too much, would have been better.)

As expected, a picture again for your viewing pleasure:
DSCN3987
[Trier but you spotted that]

Bias Time (8 of 9)

DSCN0013
[Library of ideas?]

Yes, it’s bias time again. The eighth of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.

Faulty generalizations

  • Accident (fallacy): when an exception to the generalization is ignored.
  • No True Scotsman: when a generalization is made true only when a counterexample is ruled out on shaky grounds.
  • Cherry picking: act of pointing at individual cases or data that seem to confirm a particular position, while ignoring a significant portion of related cases or data that may contradict that position
  • Composition: where one infers that something is true of the whole from the fact that it is true of some (or even every) part of the whole
  • Dicto simpliciter
  • Converse accident (a dicto secundum quid ad dictum simpliciter): when an exception to a generalization is wrongly called for
  • False analogy: false analogy consists of an error in the substance of an argument (the content of the analogy itself), not an error in the logical structure of the argument
  • Hasty generalization (fallacy of insufficient statistics, fallacy of insufficient sample, fallacy of the lonely fact, leaping to a conclusion, hasty induction, secundum quid)
  • Loki’s Wager: insistence that because a concept cannot be clearly defined, it cannot be discussed
  • Misleading vividness: involves describing an occurrence in vivid detail, even if it is an exceptional occurrence, to convince someone that it is a problem
  • Overwhelming exception (hasty generalization): It is a generalization which is accurate, but comes with one or more qualifications which eliminate so many cases that what remains is much less impressive than the initial statement might have led one to assume
  • Pathetic fallacy: when an inanimate object is declared to have characteristics of animate objects
  • Spotlight fallacy: when a person uncritically assumes that all members or cases of a certain class or type are like those that receive the most attention or coverage in the media
  • Thought-terminating cliché: a commonly used phrase, sometimes passing as folk wisdom, used to quell cognitive dissonance.

InfoSe€€€

DSCN5667
[Infra to use, to protect]

On then, with the dream of rational (i.e., ‘cost-effective’) information security control selection. Apart from the definitions, distinctions and boundaries between operations management, information management, data management, information security, IT security, business continuity management, etc. – I don’t really care, they all end up with the same sort of ‘risk analysis’ quod non (see earlier posts, the most prominent being this one) and a sort of afterburner about weighing costs versus benefits of controls to be put in place. Nothing on all the stuff I discussed in that prominent post; the time-sensitive chances, impacts and effectivenesses of threats, vulnerabilities, controls individually and in interactions, feedforward and feedback loops, the enormity of lack of reliable data and the overwhelming noise and error this introduces into any calculation.
And nothing on how one should go about estimating the costs of controls vis-à-vis their effectiveness. Because that’s even harder to do, when one has continuous but very often hardly-quantifiable costs of controls individually let alone in conjunction with others (all with costs varying in time, again, too ..!).

Continue reading “InfoSe€€€”

Awful wareness

A shortie, once again. Through

I was triggered to add some Awwww areness sauce to my previous snippets on security. Will do. Pete Herzog’s idea in

will also get a place.
And an archi pic for your viewing pleasure:
DSCN5735
[Gran Via, what else]

Bias Time (7 of 9)

DSCN0443
[Spiritual enlightenment]

Yes, it’s bias time again. The seventh of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.

Informal fallacies

  • Argument from repetition (argumentum ad nauseam): signifies that it has been discussed extensively (possibly by different people) until nobody cares to discuss it anymore
  • Appeal to ridicule: a specific type of appeal to emotion where an argument is made by presenting the opponent’s argument in a way that makes it appear ridiculous
  • Argument from ignorance (appeal to ignorance): The fallacy of assuming that something is true/false because it has not been proven false/true. For example: “The student has failed to prove that he didn’t cheat on the test, therefore he must have cheated on the test.”
  • Begging the question (petitio principii): where the conclusion of an argument is implicitly or explicitly assumed in one of the premises
  • Circular cause and consequence: where the consequence of the phenomenon is claimed to be its root cause
  • Continuum fallacy (fallacy of the beard): appears to demonstrate that two states or conditions cannot be considered distinct (or do not exist at all) because between them there exists a continuum of states. According to the fallacy, differences in quality cannot result from differences in quantity.
  • Correlation does not imply causation (cum hoc ergo propter hoc): a phrase used in the sciences and the statistics to emphasize that correlation between two variables does not imply that one causes the other
  • Demanding negative proof: attempting to avoid the burden of proof for some claim by demanding proof of the contrary from whoever questions that claim
  • Equivocation (No true Scotsman): the misleading use of a term with more than one meaning (by glossing over which meaning is intended at a particular time)
  • Etymological fallacy: which reasons that the original or historical meaning of a word or phrase is necessarily similar to its actual present-day meaning.

Fallacies of distribution

  • Division: where one reasons logically that something true of a thing must also be true of all or some of its parts
  • Composition: where one reasons logically that something true of part of a whole must also be true of the whole
  • Ecological fallacy: inferences about the nature of specific individuals are based solely upon aggregate statistics collected for the group to which those individuals belong
  • Fallacy of many questions (complex question, fallacy of presupposition, loaded question, plurium interrogationum): someone asks a question that presupposes something that has not been proven or accepted by all the people involved. This fallacy is often used rhetorically, so that the question limits direct replies to those that serve the questioner’s agenda.
  • Fallacy of the single cause (“joint effect”, or “causal oversimplification”): occurs when it is assumed that there is one, simple cause of an outcome when in reality it may have been caused by a number of only jointly sufficient causes.
  • False attribution: occurs when an advocate appeals to an irrelevant, unqualified, unidentified, biased or fabricated source in support of an argument
  • Contextomy (Fallacy of quoting out of context): refers to the selective excerpting of words from their original linguistic context in a way that distorts the source’s intended meaning
  • False compromise/middle ground: asserts that a compromise between two positions is correct
  • Gambler’s fallacy: the incorrect belief that the likelihood of a random event can be affected by or predicted from other, independent events
  • Historian’s fallacy: occurs when one assumes that decision makers of the past viewed events from the same perspective and having the same information as those subsequently analyzing the decision. It is not to be confused with presentism, a mode of historical analysis in which present-day ideas (such as moral standards) are projected into the past.
  • Incomplete comparison: where not enough information is provided to make a complete comparison
  • Inconsistent comparison: where different methods of comparison are used, leaving one with a false impression of the whole comparison
  • Intentional fallacy: addresses the assumption that the meaning intended by the author of a literary work is of primary importance
  • Loki’s Wager: the unreasonable insistence that a concept cannot be defined, and therefore cannot be discussed.
  • Moving the goalpost (raising the bar): argument in which evidence presented in response to a specific claim is dismissed and some other (often greater) evidence is demanded
  • Perfect solution fallacy: where an argument assumes that a perfect solution exists and/or that a solution should be rejected because some part of the problem would still exist after it was implemented
  • Post hoc ergo propter hoc: also known as false cause, coincidental correlation or correlation not causation.
  • Proof by verbosity (argumentum verbosium) (proof by intimidation): submission of others to an argument too complex and verbose to reasonably deal with in all its intimate details. see also Gish Gallop and argument from authority.
  • Prosecutor’s fallacy: a low probability of false matches does not mean a low probability of some false match being found
  • Psychologist’s fallacy: occurs when an observer presupposes the objectivity of his own perspective when analyzing a behavioral event
  • Regression fallacy: ascribes cause where none exists. The flaw is failing to account for natural fluctuations. It is frequently a special kind of the post hoc fallacy.
  • Reification (hypostatization): a fallacy of ambiguity, when an abstraction (abstract belief or hypothetical construct) is treated as if it were a concrete, real event or physical entity. In other words, it is the error of treating as a “real thing” something which is not a real thing, but merely an idea.
  • Retrospective determinism (it happened so it was bound to)
  • Special pleading: where a proponent of a position attempts to cite something as an exemption to a generally accepted rule or principle without justifying the exemption
  • Suppressed correlative: an argument which tries to redefine a correlative (two mutually exclusive options) so that one alternative encompasses the other, thus making one alternative impossible
  • Well travelled road effect: estimates of elapsed time is shorter for familiar routes as compared to unfamiliar routes which are of equal or lesser duration.
  • Wrong direction: where cause and effect are reversed. The cause is said to be the effect and vice versa.
Maverisk / Étoiles du Nord