Category: Sociological, psychological notes

Appetite for destruction ..?

Not even referring to the Masterpiece. On the contrary, we have here: … Well, what?
Interested as we all are in the subject, since it is defined still so sloppily, we all look for progress, I started. But stopped, when it turned out … risk appetite is defined in hindsight, with a survived disaster being the appetite threshold. Nice. So you’ll know what your appetite is when it hit you and were lucky enough to survive. If you didn’t survive, you now know you passed the threshold. Same [?] with projects: Only if it fails, do you have to write off the investment. The idea of sunk costs may be an enlightenment..?

Etc.

I believe the CRISC curriculum has other, actually somewhat useful, information on this, and on risk tolerance ..?
Your comments, please.

Plus:
[For 20 points, evaluate the risks, e.g., qua privacy, bird strikes, value development; Barça]

Cyber-Allfinanz

Strange, that we see ‘cyber’ (#ditchcyber) Insurance behaving as if it’s not Insurance but banking:
A banker is someone who lends you an umbrella, but wants it back when it starts to rain

Which already has a lot to add; ‘lends against a princely interest sum’, ‘the umbrella will be small, not enough to protect your family that’s the Deluxe edition for a premium’, not ‘starts to rain’ but ‘is predicted to be only slightly possible to have rain in some undisclosed upcoming time period’, ‘wants it back’ means ‘has it reposessed, violently’. Etc.
But that’s not the issue. The issue is that the underwriter of the insurance will not want to pay out. Duh.
Because it’s not if but when you’ll get wet. Despite all reasonable, or more, efforts on your side to protect yourselves from it by not being in the streets when the first drops fall. But then, you can’t stay inside all the time; you’re in business which means going out to play. No matter what sou’wester you don, you’re done.

In other words, no matter how perfect your compliance with, e.g., ISO2700x, you are not safe. Which means you’ve overlooked something, didn’t do e-ve-ry-thing perfectly 100,0% – certainly not when ‘compliance’ means ‘60% or above, of the reasonable efforts’. If the latter is 80% of max, you still end up with having done only less than 50% of what was possible. In the more than 50%, there certainly is something that with hindsight and progressive insight now you’ve been hit you may have done differently.
And the insurers only act on hindsight, qua culpability and cover…

’nuff said; and:
[Differently since positive: Within an unknown Cala hides an unknown Cala; Toronto]

Generate some positivity, please

Something I believe(d) in for a long time already. Being, that I don’t belong. Nor do you, or anyone, to some dreamt-up category of whatever dimension. Didn’t I refer to this (at 0:30) over and over and over again ..?
To change the tack of the posts of late, let’s take a more positive attitude. E.g., by reading Brian Solis’ story here, and elsewhere: There exists no typical generation of any characterisation. Which leaves you free to pursue your own Happiness, in whatever way you’d want — with the caveat of not inroading of the freedom of others, and respecting the Commons in various directions.

Also, contra profiling, filter bubbles, echo chambers, social isolation, shallows, etc. Contra the dark side, who wouldn’t want that ..?
Pro the eternal fact that any average is, except for rare and particular cases, unequal to about all elements over which you took the avg. Even more so when talking multidimensional elements, and hoomans are possibly infinite in that.

So, be Free(d). And:
[Spread that word! Riga]

Predictable consequences

Dutch police start with ‘predicting’ crime.

For graduation, at kindergarten level:

Can you prevent bias?

What happens to accidental bypassers?

What will be the effect on Free society?

How many years in prison will the police chiefs get for this outright attempt to overthrow (the core principles of freedom of movement, innocent until proven guilty, etc.etc., of) the constitution and the UDHR whilst failing to fulfill the duties, to protect and serve [whatever variation] those?

Remember, this is at kindergarten level. Have fun, kids! Plus:
[Is this still a thing? Yoga at Briant Park, NY]

Notnews

Remember it’s a two weeks flashback already
Monday morning’s watercooler discussion: Did you hear about this WannaCry attacks all around the world? The sky is falling! And what a hypecycle the ‘solutions’ vendors piled onto it immediately and oh hey look cat pics how cute oh now it’s Friday again how time flies CU on Monday for more cat pics.

So true it’s sobering; appropriately. And:
[Will never learn. NY]

GDPR is just a legal attempt at Y2k

Suddenly I realised, as one who profited handsomely (not in money but in perks’ way), that the whole GDPR compliance thingy is becoming quite similar, all too similar, to the hype that was called The Millennium Problem … too bad we now know how that ended, otherwise an illustrative movie could be made of the latter – now only (?) a documentary review is worthwhile, as history writing. Too bad it isn’t out in the open that despite all efforts then made, actually quite a lot of companies ended up having to hire temps to do all sorts of manual corrections in their administrations due to e.g., spreadsheets [the very things the toughest, most important business decisions hinged, and still hinge on!] going heywire over date fields.

To come back to the Issue … Are you not hit by that, almost sudden, avalanche of GDPR compliance warnings lately, like, the past couple of weeks ..? Is it not a warning that you need to do loads of things now, starting with hiring consultants (call to action; they’re Sales messages of course) this time not of the tech kind – engineers that see a problem, craft a solution and we’re done –, but of the legal kind – profiting only from prolongation of your insecurity.

And ah, there’s the snag! Multifaceted it is;

  • One: With some deadline suitably near to instill fear of lurking deadlines but suitably far to be able to still write you up with many, many ticks (per 6 or 3 minutes ..!?) at ridiculous rates, will be written;
  • Two: Unlike the patching that was the core solution (after Inventory – you did keep that in appropriate order in your wide-scope CMDB ever after 31/12/00, right ..? Even with some global outpost in the corner writing that down as 12/31/00. What stupid value loss if you didn’t! We’re only 17 years on! Did you really think legacy problems would have gone away by now …!?), we now see there is no solution but just getting compliant with all sorts of stupidly unprofitable, inefficient (and might we add, ineffective! yes if you are realistic, that’s what it is) good-for-nothing overhead;
  • Three: The good-for-nothing part — maybe not fully nothing, but oh so limitedly good for anything that you should’ve done already long ago not only for any ‘privacy’ compliance but for effective and efficient IT, -security included.

Following on this Lotus list, indeed there’s a lot of work to be done to become compliant … on the Legal side. On the IT side maybe also, but what needs to be done there, is (re)implementation of sound practices that should have been common daily practice anyway, and when implemented as such, ready; done.

The legal side on the other hand, sees all sorts of enduring challenges, like many cultural changes; no leaning back and await questions for advice to be answered out of hand with “It depends…” / “Come with a proposed solution and I’ll tell you whether it may or may not be permissible”, but for once being actively engaged and delivering definitive answers, and designing, implementing, and carrying out your (Legal) selves reams of procedural stuff. Acting on assessments, acting in communications, acting in control(s), etc.

You get it — the GDPR brings many problems for many organisations, the biggest of the problems being how to manage back the (Legal) consultancy fees… Remember, when data leakage isn’t preventable (as some dunces might still believe, many on the Legal side of GDPR compliance among them – hey they even think pseudonymisation amounts to anything), bad things are bound to happen. When (not if) not already via the avalanche of information requests …

I rest my case now, for you to have time to process the above, get it, and leave you with:

Your GDPR compliance looks much, much worse (this is actually quite good!); Toronto]

One 000

Yes, celebrations … The one-thousandestest post on this blog… [Excluding the two cross-posts by others…]

Do I regret any of them ..? Nope. [Rounded down]
Do I regret having been early with signalling many developments ..? Nope. At worst, sometimes I may have been too early, with the post(s) having slid from memory (ah, shallows you are) when finally the world came ’round to see the point as pointed out by some random stranger top-notch journalist or guru.
Non, je ne regrette rien.

OK, yes, I’ll keep on truckin’ for a while.
On everything from metaphilosophical discussions down to bitwise details on phenomena of Information, Society, IoT, Privacy, Information Security (#ditchcyber) Oxford, and gadgetry. Plus:
[The allusion to ‘reflection’ (of the old in the new etc.) is purely accidental, of course; London a decade ago]

GoTo Statement Considered Political

Bear with me; this is a mindstretcher.

Desperately few (still alive) have ever really fully read The Original (no, not that one).
And now I realise It (not it) was, and is, very valid today, as the opposite – at a meta(?)physical, quasi(?)(in)formal-logic level of abstraction – of what latter-day politicking looks like, in so many places around the world. Dangerous, that is, the latter.

Where the danger of GoTo is in its contextless jumping, ripping away the checks and balances that govern it, keep the oversight. In BASIC and others (JMP anyone?), at least there’s a form of kernel ‘hyperviser’/BIOS sort-a function, as underpinning foundation or supervisor to fall back to in last resort. [Yeah, I know one could program to wreck that but that’s not the point, and often disallowed by technical cast-in-concrete barriers.]
Where the danger of presidentiality-, morality- and common decency-less lies and alternative fact mumbo jumbo, is in its destruction of the checks and balances that govern that, keep the oversight. In reality, there’s no over/underpinning control mechanisms. They get destroyed.

’nuff said. And:
[Looks so real it’s ridiculous! But Fake!; Barça]

Golden Oldie Pic of the Day

Yet again …:

[Yes I, this refers to your infosec arrangements – wouldn’t deride the terms ‘management system’ or ‘practices’ by attaching them to what you do…]
[Yes II I did not include a dropcap style in his post on purpose. Thanks you noticed.]

Maverisk / Étoiles du Nord