Applicable to business – Page 12 – Maverisk / Étoiles du Nord

Is the EU repivoting ..?

Just a question; is the EU repivoting its society / economy ..?

Like, it stays away from the troubles of off-shoring / de-industrialisation versus global oil struggles versus growth hacking for the purpose of masses’ employment. It’s just not into anything, it seems. Also not qua the way society is organised.
So, is it quiet(ly) (sic) re-pivoting to something altogether totally new, or is it just dumb and silent (as the world rages towards improvement for All) …?

One wonders; sage or stupid… and:
DSCN8357
[Times almost immemorial, when the EU was into the New things…; you-(should by all menas!)-know-where, Rotterdam]

More of less

Digital cameras: The more pixels and quality-enhancing features (filters, autocorrect et al), the bigger the mass of lousy to so-so-at-best pictures taken. Selfies as case in point. The less, percentage-wise, the real art photography — squared with more picture exposure leads to more seeking out the ultimate quality / qualities by the discerning few.

The same, with management. The more of it we had, since WWII (sic), the more awful to mediocre-at-best management we had. Micro-management as case in point; intellectually at the same depth (‘level’ wouldn’t suggest the lowness of it) as selfies.
And, the less actual Leaders we see, perceive, acknowledge and laude. Unicorns notwithstanding — they may be the very build-up of a bubble that will in the end demonstrate the principle outlined here.

On this cheerful note:[Now there’s quality; near Racine, WI]

From bike design to security design

You recall my posts from a couple of days ago (various), and here, and have studied the underlying Dutch Granny Bike Theory (as here), while not being put off by the lack (?) of design when taking a concrete view here.
You may also recall discussions, forever returning as long as security (control) design existed even when not (yet) as a separate subject, that users’ Desire Paths (exepelainifyed here) would inevitably be catered for or one would find continual resistance until failure — with opposition from the Yes But Users Should Be Made Aware Of Sensitivity Of Their Dealing With Commensurate (Linearly Appropriate) Security Hindrance side; things are hard for a reason and one should make things as simple as possible but not simpler. [Yeah, I know that’s a reformulation of Ockam’s Razor for simpletons outside of science and having dropped the scientific precision of O and of application to science where it’s valid and the second part is often lost by and on the most simpletons of all short of politicians which are in a league of their own.]

I feel there may be a world a.k.a. whole field of science, to be developed (sic) regarding this. Or at least, let’s drop the pretension of simpleness of cost/benefit calculations that are a long way on the very, very wrong side of but not simpler.
Anyone have pointers to some applicable science in this field?

Oh, and:
[Applicable to security design: “You understand it when you get it” © Johan Cruyff; Toronto]

4Q for quality assurance

To go beyond the usual, downtrodden ‘quality in assurance’ epitome of dullness, herewith something worth considering.
Which is about the assessment of controls, to establish their quality (‘qualifications’) on four, subsequent, characteristics [taking some liberties, and applying interpretation and stretching]:

Design. The usual suspect here. About how the control, or rather set of them, should be able to function as a self-righting ship. Point being, that you should+ (must?) evaluate the proposed / implemented set of controls to see whether self-righting mechanisms have been built in, with hopefully graceful degradation when not (maintained) implemented correctly and fully — which should be visible in the design or else. Or, you’re relying on a pipe dream.
Installation. Similar to implementation-the-old-way, having the CD in hand and loading / mounting it onto or into a ‘system’.
Operational. Specifies the conditions within which the control(s) is expected to operate, the procedural stuff ‘around’ the control.
Performance. Both in terms of defining the measuring sticks, and the actual metrics on performance attached to the control(s). Here, the elements of (to be established) sufficiency of monitoring and maintenance also come ’round the corner.

Note; where there’s ‘control(s)’ I consider it obvious, going without saying (hence me here now writing instead of that), that all of the discussed applies to singleton controls as well as sets of controls grouped towards achieving some (level of) control objective. All too often, the very hierarchy of controls is overlooked or at best misconstrued to refer to organisational / procedural / technical sorts of divisions whereas my view here is towards the completely ad hoc qua hierarchy or so.
Note; I have taken some liberty in all of this. The Original piece centered around hardware / software, hence the Installation part so explicitly. But, on the whole, things shouldn’t be different for any type of control or would they in which case you miss the point.

And, the above shouldn’t just be done at risk assessment time, in this case seen as the risk assessment time when one establishes the efficacy, effectiveness of current controls, to establish gross to net, inherent to residual risks, on all one can identify in the audit universe, risk universe, at various levels of detail. On the contrary, auditors in particular should at the head of any audit, do the above evaluation within the scope of the audit, and establish the four qualities. Indeed focusing on Maturity, Competence, and Testing to establish that — though maybe Competence (not only the competence of the administrator carrying out the control, but far more importantly, the competence of the control to keep the risk in check) is something just that bit more crucial in the Design phase, with Maturity slightly outweighting the others in Installation and Operational, and Testing of course focusing on the Operational and Performance sides of things.

Intermission: The Dutch have the SIVA method for criteria design — which may have some bearing on the structure of controls along the above.

Now, after possibly having gotten into a jumble of elements above, a closing remark would be: Wouldn’t it be possible to build better, more focused and stakeholder-aligned, assurance standards of the ISAE3402 kind ..? Where Type I and II mix up the above but clients may need only … well, hopefully, only the full picture.
But the Dutch (them again) can at once improve their hazy, inconsistent interpretation of Design, Existence, and Effectiveness of control(s).
With Design often, mistaken very much yes but still, meaning whether there’s some design / overall structure of the control set, some top-down detailing structure and a bit of consistency but with the self-righting part being left to the overall blunder-application of PDCA throughout…;
Existence being the actual control having been written out or more rarely whether the control is found in place when the auditor come ’round;
Effectiveness… — hard to believe but still almost always clenched-teeth confirmed — being ‘repeatedly established to Exist’ e.g., at surprise revisits. Complaints that Effectiveness is utterly determined by Design, fall on stone deaf ears and overshouting of the mortal impostor syndrome fears.

Back to the subject: Can four separate opinions be generated to the above four qualities ..? Would some stakeholder benefit, and in what way? Should an audit be halted when at some stage of the four, the audit opinion is less than very Satisfactory — i.e., when thing go downhill when moving from ideals and plans to nitty practice — or should the scope of the audit be adapted, narrowed down on the fly so the end opinion of In Control applies only to the subset of scope where such an opinion is justified?
But a lot needs to be figured out still. E.g., suppose (really? the following is hard fact at oh so many occasions) change management is so-so or leaky at best; would it be useful to still look at systems integrity?

Help, much? Plus:
[An optimal mix of complexity with clarity; Valencia]

One extra for Two AI tipping point(er)s

To add, to the post below of a month ago.
This here piece, on how AI software is now writing (better) AI software. Still in its infancy, but if you recall the Singularity praise (terroristic future), you see how fast this can get out of hand. Do you?

The old bits:

You may have misread that title.

It’s about tips, being pointers, two to papers that give such a nice overview of the year ahead in AI-and-ethics (mostly) research. Like, this and this. With, of course, subsequent linkage to many other useful stuff that you’d almost miss even if you’d pay attention.

Be ware of quite a number of follow-up posts, that will delve into all sorts of issue listed in the papers, and will quiz or puzzle you depending on whether you did pay attention or not. OK, you’ll be puzzled, right?

And:
[Self-learned AI question could be: “Why?” but to be honest and demonstrating some issues, that’s completely besides the point; Toronto]

You Don’t Call The Shots

I.E., You Are Not In Control !

This, as a consequence of the ‘In Control’ definition. Where the controlling and ‘steering’ (what Steering Committees are about, if properly functioning … ) are the same.
But as explained previously, such steering doesn’t happen (is impossible) already in a Mediocristan world its complexity, let alone the mix-in (to say the least) with Extremistan that you’ll find everywhere and certainly in your business.

NO you can risk-manage your business to the hilt, or even make it extremely brittle, anti–resilient by totalitarian bureaucracy that leaves no human breathing space but switches to full 100% bot-run enterprise, DAO-style ops (hence will fail with complete certainty when interacting with humans like, e.g., your clients),
because complete risk-managed stuff still weighs costs so is imperfect or isn’t…
And of the imperfection of fully-reactive quod non-‘security’, see the above and many of my previous posts…

So either way, things will happen that you didn’t order. Estimates run from 50-50 (where you have zero clue about which 50 you do control) to 90%, 95%, 99% not-your-call shots. The latter category since your brain is not wired [link: huh] to deal with more than 10% ‘free will’ and the rest is, as scientifically determined, reactive to the environment however clever and deep-minded you think yourself to be (the more the latter, the less you are … If you have to say you are wise, you aren’t). Which make the majority of what happens to you and your organisation, accidental and from the outside. Which is by the very definition not you being ‘in control’.

Despite all the ‘GRC’ liars that should be called out for that quality.

[Edited after scheduling, to add: In this here piece, there are very, very useful pointers to break away from the dismal Type I and II In Control (quod non) Statements of all shades. Should be studied, and seen to refer back to the foundations of auditing ..!]

Oh, and:
[Designed to belittle humans — failing since they’re still there…; DC]

Non Dad Bots

With all the attention having gone to the not-so-Russian-or-are-they hacks, and some ransomware and CES17 news, over the past couple of months, one could have forgotten that not too long before, there was the wavelet (not like this) of hype over the, then, sudden exponential roll-out of bots in all sorts of customer-interactive sittuwaysjons.
Have these non dad bots, contrary to the MAMILs, disappeared from the streets ..? Or where are they; not like “out there in the cloud” which means a. they’re on someone’s machines, still, geo-bound as physically these are and hence under someone’s (non!)privacy control, b. nobody cares. But in a sense of ‘market share’ by any measure (which?), and who are the big players, what are the typical products/services and what metrics are there to compare these?
[Edited to add after scheduling the first version: this]

Just wanted to know. Surreptitious developments are ominous in their invisibility already. And working worse than ever… — some help may be thinkable, not yet on its way I’m sure, but that’s a long way off what we’d need…
Oh and I didn’t mean the idea of botnets for attack purposes; that’s done deal and yesterday’s weapons technology, right?
And also not robots, as they have a physical presence which enables some form of physical override options, at least in theory, when required and not hindered…
Not even the personal at-home quasi-sentient devices limiting your world view ever more whilst plucking you bare for unwanted purchases behind your back.
But did mean the kinda chat bot-ish software working in the background…

Until then, we’re stuck with bad not dad bots not bods … With:

[Physical protection, if of the obese/obsolete kind; Nancy (sic)]

Fake-fake-fakes

[Edited to add: this, I wrote a month+ ago, and has of course since been ‘repeated’ over and over, e.g., through the poor Swedes not knowing what hit them…]

Not quite like this, but troublesome: The information explosion brought to us by the Internet, has finally come to the brink of its feared state of drowning-till-death the Truth, under Fake. Where nothing, literally nothing, can be believed anymore, nor can anything be refuted as fake once the humans’ limited context view cannot discard everything that seems legit or on the border of it, for lack of irrefutable, foundational truths that would raise the plausibility to sufficient levels.
On the contrary, the logical-positivists’ traps / blind spots would kick in. We get unprovable ‘double secrets’ and ditto ‘double falsehoods’ (“We didn’t hack the elections”) — so finally, we reach Socrates’ ideal ..!!

The Elysion at last, like:

[Now that’s E Pluribus Unum; Noto oh no it’s reluctantly-unified DunEdin…]

Four Cyber

Where a Big 4 consultancy (or rather, a hang-on-by-the-teeth-fourth intensive-people(?)-farming accountancy-wannabe-advisory) now has a (unit) label “Cyber”. Where #ditchcyber (here) hardly helps… ‘Cyber’ is like being a lady; when you say it of yourself, you aren’t. This qualifier as head of a Linked List — you didn’t need the link to get the wink or did you? — a very long list it is. How desperate can one be to maintain extortionist fee levels and labour practices, to have to label yourself so empty-barreled ..?

I’ll halt now, and:[Or, like a dolphin not leggard]

Switching to the Offence Defence wait what?

Lately, the Preventative Doesn’t Work Quick / Well Enough So All Heads Turn To Reactive Security has had its effect. But not the intended effect of doing both, just the latter it seems [yes, I know].

And, where the FLOT hadn’t been up to it before, often by lack of proper budget, the hardly sufficient funds have been shifted. Recipe for …

Indeed, the Reactive part had been neglected much too long, but a shift was not asked or, but a doubling of efforts on both sides (?). Hence, the now ‘new’ SIEM et al., may have had all the attention but that doesn’t mean success (yet!), objectively.

And subjectively, maybe less — ’so what did you do with the money ..?’ — also caused by the shift-not-double of allocations (budget, in Count da Money, time and supremely capable staff).

Not so strange, when you go, at a strategic level, from one point (/) solution to another…

So, the way out ..?

This is 2017. Do it in the mix. As presented here and here. But certainly here.

I.e., find the balance and play chess at Grand Master level on all boards (including B~ see last Thursday’s post below). Starting at the front, your attack surface, by means of Activity-Based Access Control and Integrity of Systems. And all other stuff you did in the past but have to bring back up to snuff and clean out like Augeas’ stables (thinking of your ‘user administration’ here).

And then realise that all this is still asymmetrical to the hilt, so absolutely not enough. Do not throw away what you built over the last year / and a half but extend it… With smart fill into the matrix of this. Which should be much cheaper than (thinking, faintly trying) to tighten your FLOT shut; the thin red line that it is. And with this blended approach also much less hindering the Good ones.

[Oh, edited to add after schedule-time: this. For the balance… But will, I think per Feb 27, return with a high(er)-level view why ‘preventative’ and ‘in control’ are definitely two distinct things…]

Plus:

[No you st.p.d that’s a blue’ish-and-white’ish line of sorts; Noordwijk]