Predictions 2014; little update


[Paris La Defense; Metropolis-like]

Oh, a few notes to add to the Predictions 2014 blog:
Just saw that Smart, Cloud, Analytics and Mobile may abbreviate quite well… T not fitting in there…
Forrester (-‘16) rightly adds a rethink of ‘trust’ and ‘identity’
Gartner has ‘software defined everything’ and ‘3D printing’ in the mix. The former, Forrester has as well, when reading and recombining what they have (and G’s predictions may be regrouped as well, to form the F’s list, or the SCAM-T list).
Both don’t have Analytics, oddly enough. But via @duivestein, too, a good intro into Things.

Maybe we’d include Trust, Identity, Things abbreviated, before SCAM.
Back to predicting, I expect to see some hitherto unseen early signals re the dissolution of the absolute governance power of geography-bound countries / nation-states, and the nascence of (more) virtual communities with some form of barriers. Remember what I dropped as a note below on Bitcoin; I expect to see more of those in(ter)ventions. Interesting to see how the power balances (multiple) may play out: Will some developments be kidnapped / abused by states in a global (cold) cyberwar e.g., via or in the UN; how will the developments resist, and what will hold or not ..? This, too, may not be a thing for 2014 only (it may take decades!), but we’ll see some buds spring up next year.

That’s all. For now. Whether that’s Now, is another discussion entirely.

Check (out Bitcoin) please


[This was my work place, once, for a short while. Yes, actually it was.]

Just a note, on an idea that needs to be spread: When bitcoin makes it, any currency can make it. Seniorage by historic derelicts called geography-bound ‘countries’, may wane. The Community may take over, here, too. May want to speed up my reading of Empire and Multitude – critically, as I certainly don’t agree with everything, out of experience so far and out of principle…

Predictions 2014

Already somewhere below, I noted that the Analytics part of SMAC(T) may need to be rephrased. Already now, I’m unsure whether to do that or just leave it unchanged. What I didn’t yet do, was to opine on the other elements so often put together.
First, a picture.


[Casa de Música Porto, for the chaotic structure of the future]

Now then:
Social everything: Yeah, yeah, of course there will be news. The decline of Fubbuck, etc. But will we see actual breakthrough hitherto unseen inventions of anything game-changingly new? I predict 2014 will be a pause year in which we’ll only see paradigm detailing and quite an improvement (sic) of the use of Social by medium- and larger sized enterprises. In somewhat innnovative ways, but nothing earth-shattering.

Mobile everything: The same, hopefully through the much-wanted huge improvements in cross-platform and cross-screensize compatibility and standardization. Which, too, would be refinement rather than absolutely unexpected New.

Analytics, we discussed, separately.

Cloud, ‘mehhh’ for theory, ‘hey how refreshing to be able to distinguish so clearly a good implementation’ in practice. Because that’s what we’ll see in 2014; cloud stuff deliberately done right. (Being deliberate, not by accident as it was in 2013!)

Things; The Internet Of ~, maybe, but in my view it’ll be too early. More like something for under the [Warning: European + derivative culture reference coming up] Christmas tree, to be played with in the year after.

Any other business?

Yes.

One with long odds: Clarity on the demise of “ERP” software. Of course, pre-2014 already the said administrative software, hardly ever used to its full potential but very often having been relegated into the bookkeeping role only, had been pushed away from the limelight into the back of the stage. But in 2014, we’ll see an acknowledgement of this, with consequences I cannot really predict very well – probably, all sorts of other software, more geared towards front-office functionality and integrating better architecturally with the bandwidth from there to the app/widget-world, will take over center stage.
[Update 2014 02 06: This link]

One with lesser odds: An enormous push for more information security, both at its operational, technical levels and upwards in renewal of structure (away from the stale, outdated ISO2700x sphere!) and inclusion of a more holistic approach (see some of my earlier posts, and probably some to come in the near future).
This will have a second leg in renewed interest in Business Continuity Management, not only by rule-based following of standards but also by more principle-based (sic) implementation of ISO 31000 (with all its drawbacks) throughout the business. If we can get our heads around the eradication of that ‘the business’ nonsense… and really integrate (continuity) risk-based management into general management, not needing too much 2nd or 3rd lines:

A final one: The deflation of TLD. The three lines don’t actually defend against anything but regulatory discovery of all that goes wrong in the business (from top to bottom and back again, there). As the previous prediction will already defend against actual mishaps, TLD will be shown to be emperor’s new clothes where lightning strikes. And oh will it strike; frappez, frappez toujours! it will and I hope. All those busybodies doing busywork, I just can’t stand it. The utter denouncement of humanity and human dignity …!

So, there you have it again; SMAC(T) weighed, and three more. Who make some interesting stuff available when I hit (or overshoot) five or more out of eight ..?

To close, another picture…

[Serralves, Porto – rainy outlook]

Interesting life, or dissolution

Some lament the cease-and-desist against 23andMe’s personal DNA profiling kit. I don’t, too much.


[Of course, a picture. Belém, Portugal: Into the Great Unknown, quite possibly never to return (in the olden days; for seamen this tower statistically would very probably be the last thing they would ever see of their homeland)]

I can understand that some may want their personal genetic footprint, e.g., when one already has an inkling there may be some bad omens in them but these can be undone by (hopefully not too severe) lifestyle changes. Fair enough.

But already in the ‘not too severe’, there’s a catch.
From history (including ‘worthwhile’ history i.e. folk tale, worthwhile for its life lessons beyond data points on kings and queens that are boring and mostly irrelevant for us today) we learn only the omens that have panned out, not the maybe many more ones that lead to nothing.
So, once one knows one’s personal DNA profile, and if (not when) one would from that know the increases, however slight (sic), in probabilities of all the possible diseases that one could, statistically!, get, one could, theoretically, change one’s lifestyle so pervasively that the chance (!) of outbreak of some disease or ailment could be lowered. By what amount, one is (sic) unsure. For how long one can postpone the ‘inevitable’, same. What to do when life style changes conflict for one future disease as opposed to the other, unknown. That one will die in the end, fact.

And, what would you want from life ..? Even living in the most ‘preventative’ way may not help; one is quite completely unsure about that. What does one sacrifice ..? All life’s pleasures, all one’s freedom ..!
Of course the bigger stupidities that are so clearly unhealthy can be done without.
But where to draw the line? Because preventative behaviour also includes the little things one can do without with some effort; but bad stuff in moderation can be good against some other health risk or one would revert to living on artificial ingredients only (e.g., not wine but only the healthy particles in it; who knows what overdoses, who knows how much is still healthy – re-read the story of Job’s pancreas and that actor that got pancreas problems by Job’s fruitarian diet –, who knows whether artifical ingredients work the same as natural stuff maybe only in combination with other neutral or ‘bad’ stuff… and on and on…)
So one misses the pleasures of life and also is unsure about the benefits.

And would you want to live a miserable life, possibly a little or somewhat longer than a full and enjoyable one? Is that what life is for? Or is one to enjoy life, in moderation preventing the obvious no-no’s, and through that be much happier than otherwise – as if happiness hasn’t been demonstrated to be one darn good preventative medicine in the first place. One might actually live longer by giving everything a little (…) try!
Plus, at what age would one want to change one’s life? Does one bother one’s spouse with all the austerity (probably) implied? What if the life you had, bound you together? Get a divorce, be even more miserable, etc..? And would you force your children to life such a miserable life (certainly compared to the non-believers they play with)? Where does abuse start?

And, the fullness of life is to be cherished and enjoyed. Risks, the fundamental unknow of the future, makes it worthwhile. An angst-driven panicked effort to eradicate all risks, will never succeed. Be reasonable and embrace the risks you can bare. Death will not be a risk but a certainty, and with moderate joy in life, one circumnavigates the stupid mistakes while having a fun trip.

And if you would actually know all that is going to happen to you (otherwise, you could not predict which diseases you’d get ..! think that one through, it works out that way), why live at all? You’d be using up resources without any benefit, you will have lived your life already. Your life would dissolve ..!

So, I have quite some questions that may be answered one by one, but in the end ‘One shouldn’t count arguments, one should weigh them’ (Cicero). Genome testing: ethically limited demand.
[Written up while being generally healthy, enjoying in moderation some, not even ‘all’, pleasures of life.]

Invitation: Responsible disclosure for charities

Staking a claim, and asking for your input! (Again…)

First, a picture to brighten up your day:

[Sevilla, obviously]

There have been many rows in public discussion regarding the spend of charities. Either the moneys received haven’t been spent according to expectation (sic), or the charities’ governors have received (perceived (sic) to be) too high recompense for their efforts and/or costs.

Common denominator is of course lack of transparency upfront that could have set expectations better, and would have demonstrated due diligence and due care. This, beyond the formal bookkeeping disclosures of annual accounts, etc., that apparently are too opaque for the public to understand. Or even for the guardians of public interest; journalists.

So, the invitation is to contribute to a little research study projectlet I’m starting, on responsible disclosure for charities.
To find a model or pointers, by which charity governors may increase transparency towards the general public about the spend of money, without having to cough up all detailed private income data or having to distort sound (fund) spending strategies.
And with sufficient clarity to all, if possible even the dumb masses (not derogatory, but sometimes they appear to be…). This may be a challenge; to clarify strategy without having to cast it in stone and/or dumb it down itself into forseeable ineffectiveness.
First up: Benchmarking governor’s incomes from the charities. E.g., vis-à-vis others’ hours put into the charities, and/or hourly wages. Would that be possible? What would be the standard? (Since simple numbers would lead to a race to the bottom in governor quality!) Etc.

So, any contribution takers …?

Control administration(s)

Before I forget: Some work has been done indeed on translating the industrial process (control) model to the administrative world. ACS’s KAD+ model (in Dutch) is an excellent example – especially the original KAD model at operational level that seems unsupported now. Maybe they are just a bit too far ahead of the curve, too clean-cut, to have found the traction they deserve.

That’s all, folks!
For now. Here’s a picture for your viewing pleasure:

[Alhambra, Granada]
Yeah, next up, some seriously long form blog again.

Control industry

First, a picture for your viewing pleasure; you’ll need it:

[Baltimore inner harbour; rec area]

As a backlogged item, I was to give a little pointer to the design of control in (process-oriented!) industry, from which ‘we’ in the administrative world have taken some clues like sorcerer’s apprentices without due and proper translation and without taking the pitfalls of our botched translation job into account.

To start with, a little overview of the basics of how an industrial process (e.g., mixing paint, or medicine) is done, at the factory floor:

In which we see the main process as a (near- or complete) mathematical function of the input vector (i.e., multiple input categories) continuously (sic) resulting in the output vector which is supposed to come as close to a desired output as possible, continuously, on the parameters that matter. The parameters that matter, and the inputs, are measured by establishing values for parameters that we can actually measure, continuously (sic). With the inputs and outputs of course including secondary and tertiary ‘products’ like waste, heat, etc., and with all elements not being picture perfect but with varying variations off set values (the measuring devices and e.g. process hardware, also will have a fluctuating noise factor).
With the input vector being measured via the feedforward loop (control before anything might deviate) and the output vector being measured through the feedback loop (control by corrective actions, either tuning the process (recipe) or, more commonly, tuning the inputs). And the control function being the (near- or complete) mathematical derivative of the transformation function.
And all measurements being seen as signals; appropriately, as they concern continuous feeds of data.

That’s all, folks. There’s nothing more to it … Unless you consider the humongous number of inputs, outputs and fluctuations possible in all that can be measured – and not. In all elements, disturbances may occur, varying in time. So, you get the typical control room pictures from e.g., oil refineries and nuclear plants.
But there’s a bit more to it. On top of the control loop, secondary (‘tactical’, compared to the ‘operational’ level of which the simple picture speaks) control loop(s) may be stacked that e.g. may ‘decide’ which recipe to use for which desired output (think fuel grades at a refinery), and tertiary (‘strategic’ ..? Or would we reserve that for discrete whole new plants ..?). And there’s the gauges, meters and alarm lights in a dizzying array and display of the complexity of the main transformation function – the transformation function can be very complex! If pictured as a flow chart, it may easily have many tens if not hundreds of all sorts of (direct or time-delayed!) feedforward and feedback loops in itself. Now picture how the internals of that are displayed by measurement instruments…

Let’s put in another picture to freshen up your wiring a little:

[Baltimore, too; part of the business district]

Now then, we seem to have taken over the principles of these control designs into the administrative realm. Which may all be good, as it would be quite appropriate re-use of stuff that has proven to work quite soundly in the industrial process world with all its (physical, quality) risks.
But as latter-day newly trade trained practitioners, we seem to have not considered that there are some fundamental differences between the industrial process world and our bookkeeping world.

One striking difference is that the industrial process world governs continuous processes, with mostly linear (or understandable non-linear) transformation and control functions. Even in the industrial world, non-linearity but also non-continuous (i.e., discrete, in the mathematical sense) signals (sic) cause trouble, runaway processes and process deviations, etc.; these push the limits of the (continuous-, duh)control abilities.
Wouldn’t it be wise, then, if we had taken better care when making a weak shadow copy of the industrial control principles into the discrete administrative world …? Discrete, because even when masses of data points are available, they’re infinitely discrete as compared to continuous signals (that they sometimes were envisaged to represent)? Where was the cross-over from administering basic process / production data to administrating the derivative control measurements, and/or the switch from continous signals captured by sampling maybe (with reconstructability of the original signal being ensured by Shannon’s and other’s theories ..!!), to just discrete sampling without even an attempt to reconstruct(ability) of the original signals?

So we’re left with vastly un- or very sloppily controlled administrative ‘processes’, with major parts of ‘our’ processes being out of our scope of control (as is witnessed by the financial industry’s meltdown of 2007– ..!), non-linear, non-continuous, debilitatingly complex, erroneously governed/controlled (in fact, quod non) in haphazard fashion by all sorts of partial controller (groups) all with their own objectives, varying overwhelming lack of actual ‘process’ knowledge, etc.

Just sayin’. If you would have a usable (!) pointer to literature where the industrial control loop principles were carefully (sic) paradigm-transformed for use in administrative processes, I would be very grateful to hear from you.
And otherwise, I’d like to hear from you, too, for I fear it’ll be a silent time…

The Waning Age of Compliance

[Madrid; danger exites even if quite balanced, safety kills with boredom]

All raise your hands; who thinks we have reached the end of the Age of Compliance …?
Hmmm, not too many hands. Must be because you’re a totalitarian-bureaucratic lot with the illusion that your underling creeping back into the corner approach is equal to being powerful. Ah, power, the one thing you craved so much, out of uncertainty and frustration!

To be true, the Age of Compliance, in ascendance since before the turn of the Millennium and having had such a nice boost from an utter misreading of completely unnecessary (if not for common law) SOx legislation, has refined itself into all sorts of directions and common cultures in a way that Ortega y Gasset wouldn’t have dreamt of.
Which is how the 1% of power wanted it (read Seth Godin’s blog on Bullies). To subdue the 96% of drones. To corner the 3% of Defectors (read Bruce Schneier’s book Liars and Outliers). To enlist the ethically corrupt that follow orders without thinking, to suppress freedom. To standardize, to capture in process and procedure, to choose the open labor camp over the wilderness of freedom.

Now I’m ranting. But not by too much.

Luckily, like any empire so the empire of top-down control will subside, crumble, deteriorate, degenerate in its corner of bureacratic stall and standstill. The ones that escape(d), the ones that are on their own way to actual newness and developemnt, innovation, will build their next thing.

Yes, the Age of Compliance is waning. Some utopian new societal structure will appear. We still have a chance to let it build alongside the Old without the need for violence and revolution, but it’s a difficult route to navigate between Scylla and Charibdis. Will we manage? Only if we pay attention, to content and development-as-a-project of this New.

Hey, would anyone know of a research institute or research program that keeps track of this all, from a sociological perspective ..?

Interlude: Sing ularity / along

The thought just popped up: What if we’re all already beyond the singularity point, and the transient intelligence of human life has already taken over ..?
No-one is capable of changing the world’s affairs anymore, and it would take all people together to get that done, but getting all people together (including motivating them to band together, to their advantage) will result in all people just doing what they already do.
Since the first 90% of human behaviour is already determined by ultimately (!) self-interest, uncosciously deciding what’s best as fits with the world’s turning as it is today, and the last 10% would then also be captured in conscious deliberation towards rational contribution towards whatever purpose the world’s turning leaves us – which is exactly the play room that the autonomous transient intelligence would leave us.
Just look at how we behave in society; following rules that put us down, queueing up in traffic, standing in line at the shops, working in offices, etc., all tagging along stuck in a rut.
Now, we let algorithms take over the boring work stuff, leaving ever less for us to do or excel in. Even ‘creative’ work is cornered by developments of understanding creativity and shrinking it ever more.

[Ronda, Spain]

So, the current world can already be interpreted as going along its own course and direction, only leaving some wiggle room for the sully us. At least there we have a semi-happy scenario for past the Singularity – but the transient intelligence might improve itself unnoticably to a state where humans are no longer required and (as they already are: l’enfer, c’est les autres; les humains) a nuisance to be gotten rid of. Be warned. Be creative or offed.

The P (part 1, too)

Now then, for the grand Part 1 of the People of Information Security. À la the triangle I posted on earlier (see somewhere below) where the People aspect floats around the triangle like a dense cloud; obscuring your clear view and posing a foggy unclarity threat.
To jot down, there are many aspects of People that we have to deal with, but let’s start with some random unstructured angles:
[Generalife, Granada]

People are a Threat. Externally, they are the actors, not random Acts of nature. No, they, they! the people, the masses (even in Ortega y Gasset style), they exist only to attack us!
How nice if you believe such, how nice to all those that have a sense of community and either don’t care to attack you even if it could be to their (risk-weighted) profit, or even help you, tacitly or visibly, explicitly. How hard do you work to alienate all those, too? Notwithstanding that there are indeed some out there that want to attack you: Have you ever stepped into their shoes to figure out why ..? If (very big if) you really stepped into their mindset, wouldn’t you do the same because by their reasoning, you ‘deserved’ it?

People are Vulnerabilities, on the inside. They are frail, failing their duty-above-all to follow your procedures, excuse me the word F.ck the contributions to the organizational success; your procedures are sacred of course?

People are Means in information security. That’s actually what they are in the People, Process, Technology trio. Vulnerability, and Threat by the way, if they deviate from how you wanted to deploy the resource, but they can also be very powerful ‘allies’ as resource to deploy in information security, information safety [nice idea, to defuse the old phrase], information asset protection. People are the thing (sic) that might follow Process using Technology to achieve protection. People are the ones to task doing to safeguard your information assets. They may not be perfect, but they will for a long time to come be the actual actors and re-actors.

People are psychological constructs acting in sociological environments. I cannot write this often enough: Read and re-read Bruce Schneier’s Liars and Outliers, to understand how these People may operate in your artificial society called organization (oh the wishful thinking in that word…).

People then, will have to be included in security design in the prominent role they have not as an afterthough. They will have to take center stage indeed, as alpha and omega of information security organization.
We’ll have to find ways to really start with People and see how their work may be structured, and how their work may be supported (not the other way around!!) by Process and Technology. Process as a little handy tool, not as the raison d’être – an uphill struggle it will indeed be, but also sign of the times already! Totalitarian bureaucrats beware; the Age of Compliance is waning. See a future blog. Technology as a little handy tool (in big plural), not as the first to arrive and to bolt a bit of Process and very maybe even People onto here and there.
But we haven’t explored such a design direction at all, yet! We have no clue, no metholodogy, no vocabulary, to describe such a ‘design’ …

That’s where you come in; through your comments I propose to crowdsource such a methodology. Be part of it!

Maverisk / Étoiles du Nord