Category: Information Risk Management

Two shorties

Just to drop ’em.

First; the hypes come and disappear again quicker than you get to notice them as such. As in some Bird thing. Is this the new way trends will go ..? If so, we’ll all have trouble keeping up, and will see disparate clusters of innovation, some re-inventions without linkage, some unique evolutionary directions taken. Long live diversity! Until the Other comes to bite you. Yes, I did aim to frame this as a remark on, e.g., economic development (followed by military power to secure the elsewhere cheaper resources), new-business models, and products and services. Now that we come to realise the balance between exposure for scrutiny and secrecy for deep development. À la Eppel.

Next: Not even pop-art is sacred. What’s next; a 3D (sic) printer for Jackson Pollocks ..? The horror. But, this may lead to creativity being defined better. Since the Act of pop-art, at its inception, was the great Move. The copy, even IF it were an improvement or only equally valuable (in cultural terms), still needs the reference to the greatness of pop-art, throughout, and doesn’t add a critique or anything, no ump to new insights. Nice mee-too art, but not Great Art, for my part. Now where is that chasm; what criteria to establish..?
(And, some pics in the link are quite good, in particular when seen as a series. Some form of art there. Should not have referenced older art too much, would have been better.)

As expected, a picture again for your viewing pleasure:
DSCN3987
[Trier but you spotted that]

Bias Time (8 of 9)

DSCN0013
[Library of ideas?]

Yes, it’s bias time again. The eighth of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.

Faulty generalizations

  • Accident (fallacy): when an exception to the generalization is ignored.
  • No True Scotsman: when a generalization is made true only when a counterexample is ruled out on shaky grounds.
  • Cherry picking: act of pointing at individual cases or data that seem to confirm a particular position, while ignoring a significant portion of related cases or data that may contradict that position
  • Composition: where one infers that something is true of the whole from the fact that it is true of some (or even every) part of the whole
  • Dicto simpliciter
  • Converse accident (a dicto secundum quid ad dictum simpliciter): when an exception to a generalization is wrongly called for
  • False analogy: false analogy consists of an error in the substance of an argument (the content of the analogy itself), not an error in the logical structure of the argument
  • Hasty generalization (fallacy of insufficient statistics, fallacy of insufficient sample, fallacy of the lonely fact, leaping to a conclusion, hasty induction, secundum quid)
  • Loki’s Wager: insistence that because a concept cannot be clearly defined, it cannot be discussed
  • Misleading vividness: involves describing an occurrence in vivid detail, even if it is an exceptional occurrence, to convince someone that it is a problem
  • Overwhelming exception (hasty generalization): It is a generalization which is accurate, but comes with one or more qualifications which eliminate so many cases that what remains is much less impressive than the initial statement might have led one to assume
  • Pathetic fallacy: when an inanimate object is declared to have characteristics of animate objects
  • Spotlight fallacy: when a person uncritically assumes that all members or cases of a certain class or type are like those that receive the most attention or coverage in the media
  • Thought-terminating cliché: a commonly used phrase, sometimes passing as folk wisdom, used to quell cognitive dissonance.

InfoSe€€€

DSCN5667
[Infra to use, to protect]

On then, with the dream of rational (i.e., ‘cost-effective’) information security control selection. Apart from the definitions, distinctions and boundaries between operations management, information management, data management, information security, IT security, business continuity management, etc. – I don’t really care, they all end up with the same sort of ‘risk analysis’ quod non (see earlier posts, the most prominent being this one) and a sort of afterburner about weighing costs versus benefits of controls to be put in place. Nothing on all the stuff I discussed in that prominent post; the time-sensitive chances, impacts and effectivenesses of threats, vulnerabilities, controls individually and in interactions, feedforward and feedback loops, the enormity of lack of reliable data and the overwhelming noise and error this introduces into any calculation.
And nothing on how one should go about estimating the costs of controls vis-à-vis their effectiveness. Because that’s even harder to do, when one has continuous but very often hardly-quantifiable costs of controls individually let alone in conjunction with others (all with costs varying in time, again, too ..!).

Continue reading “InfoSe€€€”

Awful wareness

A shortie, once again. Through

I was triggered to add some Awwww areness sauce to my previous snippets on security. Will do. Pete Herzog’s idea in

will also get a place.
And an archi pic for your viewing pleasure:
DSCN5735
[Gran Via, what else]

Bias Time (7 of 9)

DSCN0443
[Spiritual enlightenment]

Yes, it’s bias time again. The seventh of the series of biases that you, yes you, have. Even if you are aware of these, and even if you consciously try to correct for them to be, heh, ‘objective’, as in what e.g. auditors pursue, you will fail.

Informal fallacies

  • Argument from repetition (argumentum ad nauseam): signifies that it has been discussed extensively (possibly by different people) until nobody cares to discuss it anymore
  • Appeal to ridicule: a specific type of appeal to emotion where an argument is made by presenting the opponent’s argument in a way that makes it appear ridiculous
  • Argument from ignorance (appeal to ignorance): The fallacy of assuming that something is true/false because it has not been proven false/true. For example: “The student has failed to prove that he didn’t cheat on the test, therefore he must have cheated on the test.”
  • Begging the question (petitio principii): where the conclusion of an argument is implicitly or explicitly assumed in one of the premises
  • Circular cause and consequence: where the consequence of the phenomenon is claimed to be its root cause
  • Continuum fallacy (fallacy of the beard): appears to demonstrate that two states or conditions cannot be considered distinct (or do not exist at all) because between them there exists a continuum of states. According to the fallacy, differences in quality cannot result from differences in quantity.
  • Correlation does not imply causation (cum hoc ergo propter hoc): a phrase used in the sciences and the statistics to emphasize that correlation between two variables does not imply that one causes the other
  • Demanding negative proof: attempting to avoid the burden of proof for some claim by demanding proof of the contrary from whoever questions that claim
  • Equivocation (No true Scotsman): the misleading use of a term with more than one meaning (by glossing over which meaning is intended at a particular time)
  • Etymological fallacy: which reasons that the original or historical meaning of a word or phrase is necessarily similar to its actual present-day meaning.

Fallacies of distribution

  • Division: where one reasons logically that something true of a thing must also be true of all or some of its parts
  • Composition: where one reasons logically that something true of part of a whole must also be true of the whole
  • Ecological fallacy: inferences about the nature of specific individuals are based solely upon aggregate statistics collected for the group to which those individuals belong
  • Fallacy of many questions (complex question, fallacy of presupposition, loaded question, plurium interrogationum): someone asks a question that presupposes something that has not been proven or accepted by all the people involved. This fallacy is often used rhetorically, so that the question limits direct replies to those that serve the questioner’s agenda.
  • Fallacy of the single cause (“joint effect”, or “causal oversimplification”): occurs when it is assumed that there is one, simple cause of an outcome when in reality it may have been caused by a number of only jointly sufficient causes.
  • False attribution: occurs when an advocate appeals to an irrelevant, unqualified, unidentified, biased or fabricated source in support of an argument
  • Contextomy (Fallacy of quoting out of context): refers to the selective excerpting of words from their original linguistic context in a way that distorts the source’s intended meaning
  • False compromise/middle ground: asserts that a compromise between two positions is correct
  • Gambler’s fallacy: the incorrect belief that the likelihood of a random event can be affected by or predicted from other, independent events
  • Historian’s fallacy: occurs when one assumes that decision makers of the past viewed events from the same perspective and having the same information as those subsequently analyzing the decision. It is not to be confused with presentism, a mode of historical analysis in which present-day ideas (such as moral standards) are projected into the past.
  • Incomplete comparison: where not enough information is provided to make a complete comparison
  • Inconsistent comparison: where different methods of comparison are used, leaving one with a false impression of the whole comparison
  • Intentional fallacy: addresses the assumption that the meaning intended by the author of a literary work is of primary importance
  • Loki’s Wager: the unreasonable insistence that a concept cannot be defined, and therefore cannot be discussed.
  • Moving the goalpost (raising the bar): argument in which evidence presented in response to a specific claim is dismissed and some other (often greater) evidence is demanded
  • Perfect solution fallacy: where an argument assumes that a perfect solution exists and/or that a solution should be rejected because some part of the problem would still exist after it was implemented
  • Post hoc ergo propter hoc: also known as false cause, coincidental correlation or correlation not causation.
  • Proof by verbosity (argumentum verbosium) (proof by intimidation): submission of others to an argument too complex and verbose to reasonably deal with in all its intimate details. see also Gish Gallop and argument from authority.
  • Prosecutor’s fallacy: a low probability of false matches does not mean a low probability of some false match being found
  • Psychologist’s fallacy: occurs when an observer presupposes the objectivity of his own perspective when analyzing a behavioral event
  • Regression fallacy: ascribes cause where none exists. The flaw is failing to account for natural fluctuations. It is frequently a special kind of the post hoc fallacy.
  • Reification (hypostatization): a fallacy of ambiguity, when an abstraction (abstract belief or hypothetical construct) is treated as if it were a concrete, real event or physical entity. In other words, it is the error of treating as a “real thing” something which is not a real thing, but merely an idea.
  • Retrospective determinism (it happened so it was bound to)
  • Special pleading: where a proponent of a position attempts to cite something as an exemption to a generally accepted rule or principle without justifying the exemption
  • Suppressed correlative: an argument which tries to redefine a correlative (two mutually exclusive options) so that one alternative encompasses the other, thus making one alternative impossible
  • Well travelled road effect: estimates of elapsed time is shorter for familiar routes as compared to unfamiliar routes which are of equal or lesser duration.
  • Wrong direction: where cause and effect are reversed. The cause is said to be the effect and vice versa.

On APTs

DSCN4198
[Easy to get in. Valencia]

Suddenly, an uproar over this Mask APT that appears to have been around for seven years. Oh. Not much of an uproar. Also not over this.

Some may remember my prediction, from way back i.e. two months ago [not even going to put in links; just browse the Predictions category of posts], that 2014 would be the year of APTs, among others. Now, I almost feel that it isn’t 2014 but just January. Too bad!

Or, if you would want to shed light on this, do comment.

Hardcore, (Information) Security pieces

DSCN1599
[Meant as gateway, not closure]

Earlier, as in here, here and here, and other places apart from these, I floated the idea of redesigning the way we tackle the core of Information security. Unfortunately, I don’t have sufficient time (yet!) in lunch breaks to get it all together in one big white paper hence I’ll drop some elements here, again.

I’ll keep working on collecting loose ends, so when I find time, I can integrate it all, including your comments, of which I have received so much. Not so much. As one. Single. Comment.

Herewith, then, to start off, a picture I took from … somewhere, probably the ISACA site somewhere. I’ll work from this, structuring the story line from top to bottom, first how we do it now (kindergarten level, with the pretense, pomp and circumstance of high priests doing high art), next, how it should be done ndash; qualitatively, vaguely, massaging off the rough edges and not being able to do much more except for the hardest cores of security (Remember the pyramid I presented? Read up via the above links).
COSO_2013_ISO_31000-english

Also, I’ll drill down a bit on the design of controls, according the lines sketched earlier (yup, see links again) and using an augmented [By me; disclaimer [Huh? When it’s by me: Why …!?]: *value may not be included] anti-fraud matrix à la:
Anti-F 1
Which will have an advice that visually is something like this, of course:
Anti-F 2
which is very different from the usual “Uhhhh, dunno, do we have a Motivation or Rationalisation here, dude..? Can’t progress until we figure out.” i.e. is design and action oriented.
But then, this matrix will be overlaid (third dimension) on the SABSA matrix I guess. Though I’ll make it very clear that SABSA is all very well, but very much focused on the bottom layers of itself only, the bottom layers of the InfoSec pyramid I sketched. And, upwards, there’s much methodological confusion. In particular re its Information and Conceptual / Context / Wisdom definitions and placements.

And of course I’ll throw in a bit of ABAC referring to this.

OK. Time’s up!

Which means I welcome your comments. One may dream, right …?

A few bits of hope, a lot of redundancy

DSCN1926
[Perfectly doable, for a machine/computer, very soon. Barça harbour.]

Along flew a tweet on this insightful piece.

Providing some leftover bits of hope that there will be a humanity that can sustain itself, in various marginal ways. Glad that we don’t need to be drones (and other links) ‘anymore’… As long as we can outpace AI, which we may lose control over soon.

Exit homo sapiens sapiens. Entrat Singularity, artefactum sapiens sapiens sapiens.

No coin

Bank? Nopes!
[Bank towering over daily affairs? Nopes!]

OK, a final (?) note then on Bitcoin et al.
Because we haven’t discussed the non[?]-currency equivalents yet. Austrian Freigeld, Swiss (very succesful, still very much operational) WIR and Dutch Noppes (nothingnadas), that sort of stuff. And now, there’s Qoin, working internationally. Because Noppes “… didn’t deliver the required result. By linking noppes to the guilder [now euro], there was no market efficiency. With noppes, the rich still got richer. A lawyer could hire a cleaner very cheaply, whilst people with little talent and a greater demand for care, were left out.” OK …

Why then, link up with the community currency Makkies (‘hendies’), where the unit of calculation is someone’s hour of performance regardless of any-currency going rate ..?

And why not drop all the stuff altogether, and move to the full digital currency schemes? [Suddenly realise how ominous that can read.]

But I may repeat myself from that post, and others.

Conclusion: Crisis makes creative; let so many ‘genetic’ variants spring up in ‘richer’ times (rich of need, in a surprising evolution theory plot twist), and all but a few be weeded out once the real pressure comes on. And we’ll end up in Singularity armageddon.

Contra?note ID is

This @meneer returned to an old snippet, on his blog. To which I have the following, apart from an earlier post:

  • People, if they are real people, visit your site to obtain services, indeed. But you want either moneda or some other nonpecuniary return. This may be kudos only, as in the naive sharing model, or some other form of not near- but far-money, e.g., client data for you to sell better or to sell outright. [Yeah, I know @meneer, you wouldn’t. Others have mortgages.]
    So it’s not that they don’t trust you for services, but you may need some form of trust (e.g., through pre-trust in their propensity to ‘pay’ through some reliable third party declaring their trustworthiness or allsorts of revenue from affiliation however looesy defined).

Interlude; here’s a picture for your viewing delight:
DSCN4130
[Valencia, obviously, by the master, obviously]

  • Unreal ‘people’ will just troll. Actual hooman trolls, or the AI that keeps getting better (also at guessing captcha’s). You may want to not ‘service’ them with bandwidth, and/or with room to screw up e.g., your site its stats, its quality image (re illegible or defamatory comments) or its usability for others. You do need some way to assess the trustability level in advance i.e., when the visitor comes to your site.
  • Your dislike for trust models is correct. But how did we get along on sneakernet ..? What is the closest proxy we can find, when in bits? Paying for bandwidth ..? All sorts of bonus/malus and whitelist/blacklist systems work only if not when all involved, all ‘citizens’, would fall under the same rule of unified law. I’m not negative, but don’t see a solution.

Trust is not a one-way affair (though ‘leaders’ of the real kind, trusted, may not trust all their followers individually…, etc.), but a cumbersome concept. Cumbersome implementations, will follow.
Too bad! And even if we get the basic concepts extremely simple, they may not be implementable similarly. As in e.g. quantum physics et al.: Simple basics, but not simple or useful in its implementation throughout when you’re in the mudane world out there, e.g., at a good restaurant. [Disclaimer: I’m not a fan of molecular cooking; waaay too much chasing effects at the expense of natural cooking.]

No I don’t have a definitive answer. Just wanted to add my 2c.

Maverisk / Étoiles du Nord