Category: Sociological, psychological notes

The IS Audit Worker of 2019


[Your prospect of Elysean fields]

2019 is only five years away… But predictions require a suitably close horizon to be able to see how today’s trends and Early Indicators might play out, and still be sufficiently distant to allow flexibility and variance off the predictions – otherwise the predictions are dull.

Hence, apart from my predictions for 2014 (and update) below, some more ‘mega’trends, in particular for the management of information risks – I still maintain that anything managed, isn’t a risk ‘anymore’! – professional or more specifically, the ‘information systems auditor’. Note the ‘’ as this post will show how the role and content will change enough to warrant a new job title.

Now then. As a starting point, I took the insightful graph of the always even more insightful Ross Dawson off rossdawson.com, noting the CC-BY-SA 2.5 license:

Which is a depiction of trends that impact the IS auditor as professional, rather than touching (too much) on the content of her/his work… Indeed, but I’ll demonstrate where the content is touched, too, by the trends depicted. Let’s just run them down one by one:

1. Connectivity will mean the necessary re-think of the traditional CIA to be able to guide, control and audit the information security stance of clients. The Information availability explosion, the globalised (i.e., de-geography-bound is de-accidental-physical-location-bound) access hence globalised use, and mobile work to even loose the ties of the Last Mile (in a way), require this. And enable the IS auditor to do the same. Already, this is being piloted, and in my view, we’ll see much more of this kind of work for the IS auditor in the very near future; this enables not only the auditor to not have to come to the clients’ offices too much – albeit that initially, some F2F contact may still be required but the need may diminish quickly when clients gain experience –, it also enables her/him to engage with clients much further afield, remotely. As far as (by today’s standards) superb connections reach, that is. See items 5, 9, 10, 13, and 15 below.

2. Machine capabilities will lead to work being taken from our hands. Through raw processing power explosions (not only due to Moore, but also due to the explosion of the sheer number of devices out there), Spatial recognition giving machines even more data to deal with, and large-scale Artificial Intelligence deployment not the petty trials of today, will enable the off-loading of much manual mental work (human- / person-bound work) to machines ‘out there’. The user will not even need to know where the ‘there’ is. Or should (s)he ..? We’ll see a redesign of philosophy, thought, methodology and tools on privacy surface. Quite some areas where IS auditors might (sic) lead the way, in thinking, acting, controlling and auditing.
And robotics … If that takes off, it’ll be piecemeal on the one hand (I too want my Roomba) but massive on the other (so many disjoint markets blooming). If only Asimov’s Three Laws can be reinstated, and reenforced or we’ll end up either in a mess or dead… It’ll start with Worker replacement anyway … (see below).

3. Demographics are something that we have somewhat less to deal with in the management of information risks. Apart from Migration leading to professionals’ markets impoverishing to markets of lemons, if unprotected (the dams will only hold back only so much inflow for only so shortly), and Country divergence maybe hitting us when our geographic region forces us to move elsewhere, as in item 1 above.

4. Social expectations Not much, either, apart from the Flexibility that will created Theory of Firm 2.0 type organisations, on which the IS auditor and others can no longer impose totalitarian bureaucracy. What then ..!? I don’t know. Your bad, if you can’t adapt… From the true ethics of your trade, you should have already adapted long ago…

5. Modularisation may impact us in ways similar to what we have already seen in the past; just labour specialisation, if any. Not too much to do about not too much. Though the general trend by which broad experience by and large caters for broad, balanced widening of one’s professional content in the stages after specialisation, may turn or have been turned already, the direction is unclear, either repeating constantly all directions, or awaiting a major redirection.

6. Globalisation I already characterised as a possible major impact through the Connectivity angle. In Products, I consider it to will come to completion in the near future. Service… To the degree that any service has no physical-presence component; (medical) care, for one, would be hard to do remotely, and also some other personal services e.g., IT tech support, may not ever work to a satisfactory degree without being able to communicate by nonverbal / sensory signals. So, not all the promises of item 1 above may not be realised all too soon.

7. Productivity will be driven by the Machine capabilities, mostly. Together with Connectivity, theese will determine Factor shifts or rather, define and refine factors of worth. Manual labour will re-flourish! And so will brain work, but only the non-standardised stuff, the work requiring creativity, true intelligence and empathy. Where many IS auditors etal. Think they are, but they aren’t. You know my rants against ‘peers’ just checking boxes. That is not what auditing is about. That is administration. Auditing, and other management of risk roles (sic), is about interpretations, judgement, close calls, gut feeling, and guts. Balls. (F/M), you must have them or be replaced by drones. Do not count on being (just) on the right side of the dividing line! Count on being on the wrong side, the down side, the cast out side. Or join progress.

8. Value polarisation again one where the machine capabilities, Connectivity, and Globalisation will work to quickly create new classes of haves and have-nots. The 1% of today, may be another 1% in other fields tomorrow or the day after. Try to be part of that, or you’re no longer suitable as part of life. Seek out your own 1%. But one thing would clearly be wrong: Remain as you are, meek, sheepish, not daring to be a Man (M/F) … So, most IS auditors et al. will have to change dramatically, if one can change one’s character…

9. Remote work I already described above. Telepresence, (remote!) Collaboration, and (local) Machine operation – 3D rinting, maybe ..? – will work as above (item 1 again). Virtual worlds may provide diversion from the destroyed natural habitat we still have to live in. The tropical island scenario still is somewhat too far away from us.

10. Work marketplaces are the mechanism through which the market for lemons may play out, or not. The barriers to Participation should be watched – some arguments for, some against –, Availability may not be an issue anymore (oh, but availability of suitable, sustainable markets may be), Pay pressure defines the lemons aspect, as does Access to expertise. Don’t sit still, as through Globalisation, access to expertise and availability, and participation will lead to pay pressure. I.e., pressure on your economic sustainability. Do not think you’re protected in your behemoth Organisation; any organisation is not too big to fail ..! So, even Big4 IS auditors should be aware. The bigger, the … no, size doesn’t delay a crash landing into a gentle glide, you’ll not be able to sit it out. The only sliver of new work would be to assess the work marketplaces against some standard but even that may be outsourced to … why assume a certified auditor should do that; why not instead (sic) by a reliable professional …

11. Crowdsourcing will impact IS auditors, too. But it may be a threat, or a blessing. No more dumb production of checked boxes…!? On the one hand, drafting those dull IS adit work programs from PDFs and too lengthy texts, may be outsourced to Labor pools – lucky if you can stay out of them, otherwise, you’re done. Will you be the one overlooking Managed crowds, or in it? By the munbers, and by today’s mentality, the vast majority of IS auditors will in fact be in the masses. Enhanced mechanisms will enable evenmore IS audit work (aspects) to be crowdsourced, changing the value proposition in the audit / advisory projects hence threatening livelihood. Open innovation’s also an In or Out aspect, for IS audit work. Though there may be a splinter of secondary audit work to be done on the deliverables of crowd sourcing and on the crowd markets… Fuzzy why that should be by certified auditors.

12. Worker replacement. Oh yes, if you’re a worker. Which is what a lot of IS auditors are. Not doingthe hard to replace physical work (taken over by Robotics, see 2, for the standard stuff but) since this requiresproximity and flexibility. Plumbers will be OK, IS auditors, not; will suffer from (enormous progress in) Automation, Robots, though Service may be slower to migrate (medical care robots may be proficient in many other areas, too, though), and Judgement may be the last to go over, to AI. So, as above, anything requiring judgement may for the foreseeable future not be taken away from us. But again, so many IS auditors et al. don’t judge, but administer. Where would you want to go, if (not when!) you would be able to (quod non)..?

13. Economy of individuals I consider to regard our profession in particular. Are you one of those few ones above that actively seeks out one’s own future? Then you’re in luck; your Independence and Entrepeneurship may lead to work being available, in Collaboration of the Theory of Firm 2.0 based on your Reputation. All these factors will be currencies of the future, so work on hoarding them! Not ‘the’ currencies, as Bitcoin and the like may kick in on a large scale within five years.

14. Polarisation of work With the Pay and Opportunity being so unevenly distributed, one may not rely on Affiliation with an organisation of old any longer. The dinosaurs are dying. New affiliations will need to be sought out. IS auditors, be aware, be active or be left out.

15. High-performance organisations or as I indicated above, Theory of Firm 2.0 organisations, may rise quite quickly. Google, Facebook and the like have risen to their 1.5 (sic) status and size in (qua order of magnitude) five years. Others may be in their inception phase today, and be the biggies, the most wanted (virtual) workplaces literally tomorrow. Again, be aware. Internal markets, Ad-hoc networks, Social technologies and Distributed value creation may all be part of the landscape of small and middle-sized temporary organisations that will flourish, already from, literally, today and tomorrow on. All these factors point at project-oriented get-togethers of professionals all with their own needs (for fair value to contribution distribution) and wants (work only where, when and for whom you like, do only what you like; if one factor starts to fail, move elsewhere) banding together just for the common interest and then all going their own ways again, maybe meeting again in the future, maybe not. Temporary Affiliation only..? Or looser ties? Double o, though many an IS auditor may have a single o as they haven’t innovated and are left behind as deadwood.

16. Education is key, to many of society’s desirable developments. Available, Open, Continuous is must be, and focused on Peer learning. All things where IS auditors could play a role, as auditors and advisors, and partaking out of necessity to keep abreast of latest developments.

Because the italics weren’t there for nothing. IS auditors, and others, just play a role and not an important one at that! Do not fool yourselves; auditors are only, and no more than, an afterthought of business and other organisations. Be happy that you have some specialised knowledge that you apply in whatever role, one accidentally being audit. When now both the unimportance of the audit role comes to the fore, in particular through Ross Dawson’s megatrends and technology developments, and your knowledge and experience that you apply in the role, are ever quicker to expire, you’ll have to keep abreast of all new knowledge ever more certainly, ever more widely and completely, and ever faster, and you’ll have to constantly seek out new roles to apply your greatness. Dropping audit as an expired old skin…

The central message is clear. IS auditors et al.: Innovate! That takes trial and error, and ‘learning experiences’ also for one’s deeper insights and even character, it takes risk taking and damage to one’s personal quest(s), but with the right virtues (Aristoteles-like), one will prevail. Innovate, along the lines of the work future and towards developments as described elsewhere and more.

[More will follow on this subject…]

The State of Crowdsourcing


[Kopenhagen. Denmark]

It has been a while since Wikinomics et al. brought the idea of Crowdsourcing to the fore.
Where are we now, with that ..? Would anyone have good pointers as to the current state of affairs with the handful

of initially successful crowdsourcing ideas, sites, etc..?

My guess is that in the end, crowdsourcing times global reach equals a market for lemons. How to fix that ..?

With market rules, but how to keep those neat and tidy, and above all principle-based, and still enforce compliance

..?
The latter part is maybe the most difficult part. The hordes will overrun any (necessarily human-monitored)

decent-behaviour rules slash subscription/abuse system.

With no rules, accepting the race to the bottom, in quality but in price, in return, too.

With club memberships. Maybe. These will go up and down the effectiveness scale. And may arrive at some Pareto

optimum that’s just no use – no use for elicitating the strengths of crowdsourcing as a problem resolution

mechanism.

Where would moderation be

..?

Anticipating nothingness


[Your guess.]

Just read a post on Anticipatory Computing. Like it, though maybe not a full Belieber:
For one thing, the picture contains the limitations of the idea: It has this block Understanding the World, and within that Understanding the Human.

But let’s not get ahead of ourselves. The idea presented, on the surface looks rather appealing. And scary at the same time. If a System around you would implement Ambient Intelligence, it certainly should include Anticipatory Computing. As noted in a post below, Data crunching or even Information or Knowledge, is a basis for Intelligence but no more than that… And notice the underpinning ‘Predictive Analysis’ idea.

But it’s scary, too, for its Privacy implications. Think Minority Report. Even the complacents may not want to live such a life.
Moreover, who will control the System ..? There is no safeguard that it won’t get abused; it will as even any democracy will succumb to totalitairan control. [Famous who was it that said this?] Or will not any human be in control anymore (no need) but will (s)he fall to the ÜberSystem as well? Singularity.

And don’t now complain that Anticipatory Computing will not go so far. Any development will go as far as it can, and further, with scope creep at a societal scale always winning out over moral counterforces.
Let’s just be happy that its fundamental flaws have already been built in. Apart from the practical aspects (some here); but we shouldn’t overstimate these, these days: A model of the World – Universe ..? As that determines 😉 the quantum collapse of probability functions that ‘determine’ us Humans since Understanding the Human requires encapsulation of all its erratic neuron firing – would have to include the model itself as well, leading to infinite recursion, silicon-based life’s idea of infinity.

Nevertheless, let’s see how things develop, shall we ..?

New InfoSec (OSSTMM)


[Eye aye, captain!]

Hey look, interesting new way(s) to do effective information security…:
An intro in Dutch
And the ‘source code’ in English

Now, let’s combine this with Rebooting CIA, and we’re getting somewhere …

[Edited 2013-12-13: a link (in Dutch) maybe relevant to the CIA remark.]

Shaping up Non-BYOD


[Honeymoon]

To investigate; an idea: Now that the BYOD phenomenon has taken the pressure off of IT departments’ provision of equipment (and software), how can we use the time and budget that has become available, to shape up the Asset / Configuration / Inventory Management regarding the iron that we still have, keep, and service ..?

Out of a desire to maybe see those systems management areas for once be complete and current… Even if only for the efficiency of subsequent maintenance, and the beauty to see insight finally bringing better understanding and razorsharp management.

But it won’t be an easy walk. Because of the backlog… Because of the amount of work, redecorating the shop while it’s still open for business, and while all sorts of other demands are placed on staff; demands that are more urgent, more important, and more interesting ntellectually.

And because so much … user interaction oh the horror, is required. To establish the total landscape of all systems, from the meanest hardware cable and plug, all the way up through the infrastructure, systems software, middleware, applications, parameters, et.etc. up to what the end user would understand to be their ‘system’. And back again, checking the rationale of every tiny part, and every chunk in between and at the top. Indeed, much may be found, that wasn’t suposed to be there, that is, without anyone knowing why, but still working, without anyone knowing why. Or how. Or where…

So far, so good. But now, the shop is still open and all end users want the latest (app!) toys to be connected to just all enterprise ‘systems’ in ways that nobody would know a rationale for but hey, we must quod non give it a try!
Yes, the old demands are still there, reenlivened, with seriously stepped up requirements in terms of timeliness and speed, versatility, and quality. High time to make it happen; high time to start with the basics ..!

Rebooting the CIA


[Nope]

The CIA of information security doesn’t cut it anymore. We have relied on Confidentiality-Integrity-Availability for so long, that even ‘managers’ in the most stale of government departments now by and large know of the concepts. Which may tell you that very probably already by that fact, the system of thought has been calcified into ineffectiveness.
At least we should reconsider where we are, and where we’d want to go.

Lets tackle Confidentiality first. And maybe foremost. Because it’s here that we see the most clear reflection of our deepened understanding of the value merits of information not being in line with the treatment(s) that the information (data!) gets. Which is a cumbersome way to formulate that the value estimation on data, and the control over that data, is a mess.
Add in the lack of suitable (!) tools. User/Group/World, for the few among you who would still know what that was about, is clearly too simple (already by being too one-dimensional), but any mesh of access as can (sic) be implemented today, makes a mess of access rights. Access blocks? Access based on (legitimate, how to verify) value (s), points in time, intended and actually enabled use, non-loss copyability, etc.?
But what is the solution ..? Continue reading “Rebooting the CIA”

Fuzzy risk language


[Antwerp. Seriously.]

In some previous post, I posited that we should move from quantitative (quod non) to qualitative or even intuitive risk management.
And how that may be difficult. ‘cause it is.
As an intermediary step, I propose to build a better language with which to communicate, discuss and calculate (sic) with qualitative risk management.

Because I see a place for a combination of fuzzy logic and wavelet theory, including neural network signal combination functions.
As my time is limited, this time of year, would anyone have pointers to what’s already out there in papers, practical applications, etc..? That could kickstart the discussion. And I’ll return with more, better, more extensive, more thought out stuff on the subject later.

Bit coin: Money bytes sovereignty


[Berlin again, tucked away, much underrated]

Bitcoin’s hopping up and down in ‘real’ currency terms and everyone is happy to declare it all a pyramid game.
It is, but so is any other currency issued on the promise of maybe some future repayment in … the same or another currency. The underlying value of any currency depends on the future income stream of the issuing entity, or intermediate trade for … other currencies, services, or goods. Exactly like Bitcoin.

Except, of course, that ‘normal’ currencies are issued by governments, geography-based entities from the past when geography mattered.
But does it, still, today, much ..? And will it in the near future? Aren’t we already in a blended world, a blended society, where for the lower layers of Maslow’s pyramid we’re still physical entities and hence geography-dependent (safety, water, food, shelter, etc.) but for the higher layers (group belonging, recognition, self-actualisation) we don’t care from where it comes ..? Once our (developed) world develops further, with so much more automated, silicon- rather than carbon-based, intelligence and sentience becoming available, will the importance of the lower layers not diminish ..?
Up to a point, I know, we can’t ‘shed’ the lower layers. Though the Singularity could, almost, and could at least do without us…

But that’s not the point. the point is that if the sovereignty of nations, understood here in the narrow sense to regard the right and possibility to create and issue money at will, backed by a grossly overestimated guarantee (would you dare to guess how often governments have declared insolvent, in the past few centuries alone ..? On the principle, they all were and are equals…), is lost because others can have the same sovereignty and other sovereignties previously reserved for nation-states, why would we still regard nation-states as the highest entities ..?
[You will now point out that some nations of nation/states spring up, e.g., USofA (sic), EU, UN; right, but their structure is just an amalgamated mesh of more of the same]

And, why would we regard what we previously had, as currency, while not understanding Bitcoin and the many others around (see this and that, possibly incomplete), as such, too ..? Or would we need a ‘real’ economy to underpin a currency; where would you draw the line, then..? What would be the link between a currency and its ‘underlying’ economy, what would be the boundaries of the economy, what definition of sovereign debt would we include or not (there’s many definitions; e.g., would we include guarantees?), how would we establish a ‘value’ in what other ‘currency’..? Gold has been dethroned, remember?

So, we need to study harder, and all of us need to understand more, about the nature of money altogether and only then take a look at digital currencies and their merits (or non-). Would anyone have pointers to good in-depth on-line courses or so ..?

The Compliabullies


[Berlin at dusk]

Just a thought: Would investigation and analysis show that the kids that were bullied in prep school and / or (separate hypotheses…) high school, in later life be the ones that end up in Compliance and Risk Management (not being management of risks…!) departments, to take eternal revenge on those that bullied them..?
Because the latter will not have noticed too much the damage they did (they were kids back then) and have merrily gone their own way as they were allowed to be prepped to do. Now, they find themselves being caught in a web by the ones that have frustration embedded deep in their brains at the lower levels that (truly) developed early on, the ones that want to get even by tossing around and beating the innocent puppets into ill-understood compliance with stupid rules.
The bullying instigators, of course, the ones that were behind the scenes, are the big stingers that happily fly straight through the web that catches only the little bugs.

If so, will there be a fix, so much needed, to the totalitarian bureaucracy explosion of the last decade or will the ossification have to go even further before the current economic structures collapse under the weight of their overhead and inproductivity ..?
Sometimes I’m optimistic that the cycle has already reached its peak (see some earlier posts). Sometimes I’m not, and would appreciate your ideas…

Maverisk / Étoiles du Nord