Information Security – Page 16 – Maverisk / Étoiles du Nord

WindTalker

Right. So we have a side channel attack where your hand movements over your mobile, when typing in your key, will interfere with WiFi signal patterns in a detectable, traceable way thus revealing your key. Like this (PDF).
Would this, on a second trend note, destroy or obviate even more the need for, Active Access Control ..?

Plus:

[Mock-up for fabrics not mockery of your security; Stedelijk Amsterdam]

For members, useful insights

I’d suggest making this available widely; beyond membership only. Because it ties in so well with, e.g., this and many other issues at this.

Yes, I may be biased; just like everyone if only for having been member of this. Which (subject) plays a much more prominent role in your lives than you think, certainly in the nearest of futures. Beware.

And be aware of:

[Your ethics reasoning: All corners, leading nowhere, abandoned; Fabrique Utrecht]

First Rule of Risk

First rule of risk: Never underestimate risk. Even when you follow this rule, and even when your estimates seem ‘proper’.
Where of course, the propriety of your estimates is in grave doubt, either on the “This has never happened to us so / Come on, get real, [we’re not a target because we’re of no interest to anyone] what are the odds!? / Ho hum, there’s the boy cried wolf again”,
or on the “I’ve been reading this thing about CYBER! Arrrgh! In the Inquirer so why aren’t all staff hiding under their desk and we didn’t yet have the Marines take over and destroy the office to defend it ..?” FUD-side.
[Side note: You did have ‘consultants’ over (office (culture, motivation) destroyed, seems like a preventative measure?), but be aware that’s the opposite of Oorah]

Because when every nanosecond brings the possibility of an ‘event’ (how’s the repeat of sampling with (! … is it?) replacement over so many draws working out in your frequency estimations..!?), one can be sure that a 99% chance of something not happening, will result not in the virtually certainly not happening every time, but in the certainty that the 1% will strike, repeatedly, and a strike will endure much, much, much longer that the inception of it. The ‘event’ isn’t measured in nanoseconds, but in days, weeks, months and sometimes even years (think the, near-certain, reputational damage). So, your estimates are too low, all too low.

But since the detractors are always downplaying your estimates due to their other-directed agendas, do follow the First Rule of Risk …

[Your in-house security gurus are quite like that, yes, being the absolute rookies at the BlahBlah Seat At The Board Table — probably available only when the Board is out — or any level they’re relegated to]

Lament / Where have ‘Expert Systems’ gone ..?

Those were the days, when knowledge elicitation specialists had their hard time extracting the rules needed as feed for systems programming (sic; where the rules were turned into data, onto which data was let loose or the other way around — quite the Turing tape…), based on known and half-known, half-understood use cases avant la lettre.
Now are the days of Watson-class [aren’t Navy ships not named after the first of the class ..?] total(itarian) big data processing and slurping up the rules into neural net abstract systems somewhere out there in clouds of sorts. Yes these won out in the end; maybe not in the neuron simulation way but more like the expert system production rules and especially axioms of old. And take account of everything, from the mundane all the way to the deeply-buried and extremely-outlying exceptions. Everything.
Which wasn’t what experts were able to produce.

But, let’s check the wiki and reassure ourselves we have all that (functionality) covered in “the ‘new’ type of systems”, then mourn over the depth of research that was done in the Golden Years gone by. How much was achieved! How far back do we have to look to see the origins, in post-WWII earliest developments of ‘computers’, to see how much was already achieved with so unimaginable little! (esp. so little computing power and science-so-far)

Yes we do need to ensure many more science museums tell the story of early Lisp and page swapping. Explain the hardships endured by the pioneers, explorers of the unknown, of the Here Be Dragons of science (hard-core), of Mind. Maybe similar to the Dormouse. But certainly, we must lament the glory of past (human) performance.

Also,

[Is it old, or (still) new ..? Whatever, it’s prime quality. Spui, Amsterdam]

When it comes to Risk, Appetite is Tolerance

Previously, with many others I believed that Risk Appetite would have to be the starting point of discussion for anything Risk within organisatons. The appetite, following from discussions on Strategy being the choices of directions and subsequent steps that would need to be taken to achieve strategic objectives, i.e., where one sees the organisation ending up in the future. Very clearly elucidated here. Backtracking, one will find the risks associated with these possibly multiple directions and steps — in qualitative terms, as NO valid data exists (logically necessarily, since these concern the future and hence are determined by all information in the universe which, logically, cannot be captured in any model since then, the model would have to be part of itself, incurring circularities ad infinitum and already, the organisational actions will impact the context and vice versa, in as yet (for the same reason) unpredictable ways.
And then … This risk appetite, automatically equated with the risk tolerance by the Board for risks incurred bottom-up by the mundane actions of all the underlings (i.e., including ‘managers’, see yesterday’s post), then suddenly would have to be in quantitative terms… [Yes, bypassing tolerance-as-organisational-resilience-capacity]
As all that goes around in organisations, through the first 99.9% of Operational / Operations Risk, and then some 10% industry-specific risks (e.g., market- and credit- for the finanical industry), not measured but guesstimated by hitherto outstandingly some that have least clue and experience [otherwise, they would have been much better employed in the first line of business themselves… The picture changes favorably (!) where we see some organisations shift to first-line do-it-yourself risk management… finally!] with what the chance and impact figures would be. As if those were the two only quantities to be estimated per ‘event’… As if any data from anywhere would be sufficiently reliable benchmarking material — If you believe that nevertheless, you should be locked up in a treatment facility… Yes sometimes it’s taken to be this moronic… No need to flame bigger here, as that was already done here.

But wait where was I. Oh, yeah, with the bypassing of tolerance defined as what the organisation could bear. The bare fact being, that no-one can establish a reliable figure for that. What the Board can and want to bear … Considering that the Board would have to be all-in, i.e., not only all of their bonuses since ever under clawback threat, but also all of their earned income incl salaries and personal wealth — if any of the Board would not want to risk all they ever had and have, bugger off this is what you signed up to. Considering also that strategic decisions are about wagering the existence of the company on choosing right or else, this wagering the well-being and wealth of all employees however unable to bear loss by mere fact of never had the ability to create some reserves, the previous consideration isn’t exaggerated. You wager others’ very existence, you wager your own ‘first’.

Summa summarum:
Risk Appetite is what the Board lets happen as Risk Tolerated Already.

Plus:

[And away goes your grand hallway down the drain; [non-related] Haarzuilens, Utrecht]

Commoditised exploits

What was first; the exploits or the use of them ..?
When now, we have this kind of reasoning, aptly, there already was this, too.

So, … What now ..?

20161025_163321
[This being the state of (the best of … ;-[ ) Duts design nowadays. Yes the rest is worse, much worse. Law of handicap of head start; Zuid-As]

Fuzzy Vocabulary (Cross-)Boundaries

When discussing Risk …
There will always at some stage turn up a discussion (or multiple, if you’re Lucky; not) about the meaning of certain key words. Which is a pity, because … no, not because it distracts. Though it does, the main issue is that the secondary, meta, discussion about vocabularies is never / rarely resolved.
At strategic levels, talk is about risk appetite and risk tolerance, and foremost about business opportunities (of which the exitement is) spoiled by “risk managers” that point out the world might not be perfect and hence one is all but certain not to achieve the objectives. Smart business leaders push forward anyway, at best keeping the risks in the back of their heads while sanding off the rough edges of progress at that goes along all quite well. When strategies turn out to fail: Well, such is life as it has been since the dawn of humanity.
At tactical levels, talk is about risk portfolios and … not much, really; mostly project and program risks. Of the Boy Cried Wolf kind.
At operational levels, quasi-(sic!) quants do their stuff and come with all sorts of fabulous fables of formulas that wouldn’t stand scrutiny at the most basic of math levels. What idi.t would translate ‘High’ to ‘5’ and then multiply it with some other ‘4.5’ to arrive at a ‘22.5’ “risk” ..!? Heat maps are the reflection of the own moronic brain functioning onto what are supposed to be Managers’ levels of understanding. Though the outcome is correct, the origin of the reflection should be kept in mind instead of forgotten.

And all talk about ‘risk’ (‘operational risk’, even worse), ‘impact’, ‘High’, as though these were somewhat the same thing for all involved, disregarding most of time- and situation-variance or rather completely -determination. Right. Wrong. Just regurgitating definitions from ISO standards demonstrates to not understand the nature of the problem…

Any theoretical science logical-AND linguistics specialists that can help? And:

[Tinguley in a picture is quite different from the message of it …; Stedelijk Amsterdam]

The legacy of TDoS

So, we have the first little probes of TDoS attacks (DoS-by-IoT). ‘Refrigereddon’.
As if that wasn’t predictable, very much predictable, and predicted.
[Edited to add: And analysed correctly, as here.]

Predicted it was. What now? Because if we don’t change course, we’ll achieve ever worse infra. Yes, security can be baked into new products — that will be somewhat even more expensive so will not swarm the market — but for backward compatibility in all the chains out there already, cannot be relied upon plus there’s tons of legacy equipment out there already (see: Healthcare, and: Utilities). Even when introducing new, fully securable stuff, we’re heading into a future where the Legacy issue will grow for a long time and much worse than it already is, before (need to be) huge pressure will bring the problem down.

So… What to do ..? Well, at least get the fundamentals right, which so far we haven’t. Like this, and this and this and here plus here (after the intermission) and there…

Would anyone have an idea how to get this right, starting today, and all-in all-out..?

Plus:

[IRL art will Always trump online stuff… (?); at home]

Bring on the Future; it belongs to ME

Some say self-driving cars / autonomous vehicles will take over driving as if they will take over all driving. But the intermediate phase [where autonomous persons and autonomous masters with slave (!) persons] will see ‘driving’ turn into a pastime, a hobby, of thrill seeker persons. Yes, even with Insurance rates getting somewhat higher. Not much higher, let alone skyrocketing, because the lone drivers that hold out, will find more and more very defensively behaving autonomous tin cans opposite them, scaring the latter (to steer) off the road…! Hence, aggressive drivers will not (provably) cause many accidents, autonomous vehicles will in all their panic. Hence, autonomous humans will not have staggering Insurance rates

and will keep on driving because of the fun of it, the feeling of independence and self-control, the thrill sought and found…

After human chess players could no longer win against ‘computers’, humans still play chess. After humans were outpaced by cars of all kinds, humans still try to win gold medals at the very event. After humans lost Jeopardy against Watson, humans still compete on ‘intelligence’ everywhere; opportunistically retreating ever further on the definition of ‘intelligence’.
Hence, humans will not drive ‘cars’ en masse, in the near+ future. But they will upgrade the purpose of driving, and will drive.

I sure will, for fun. With so many ‘lectric autonomous thingies on the road moving the sheeple, I’ll have or get myself all the road space I need… The road will belong to ME ME ME ..!

And

[One perfect artist does NOT outdo others; Gemeentemuseum Den Haag]

Hurt Spree at American University: 17 Millennials Insulted

Tragedy causes discussions about freedom to carry opinion

October 18, 2016 by Hank Grohl
crimescene

During a hurt at a university in Nebraska, 17 students have been insulted. The victims are all millennials that were attending a class on civil rights movements.

The hurter was a white, privileged man who worked as tenured professor of social history at the university. He is said to have just walked into a classroom where he started to fire off historical facts at students. Panic broke out immediately, but thirty students managed to flee the classroom. Even before the hurter could be arrested, he hurt himself.

This is not the first time that America wakes up to a hurting incident with insulting outcome. Even last month, in Colorado fifteen students were seriously hurt by a remark about gluten.

The Nebraska incident has yet again raised questions about the right to have an opinion. More and more Americans are are calling for limits to carry opinions.

[If you took the previous as a ridicule of gun violence atrocities: It is not. Maybe on the contrary, ridiculing whining over if-possible-less-than first world problems. Geddit now?]

[Original, in Dutch, on the Speld; translated with permission]