Tag: Information Risk Management

Gelernter on Management

Turns out that the seminal Mintzberg’s Managing (as here), has an updated version in the almost off-hand remark by David Gelernter (in this) that we should have been dealing with an “‘organization engineer’ (otherwise known as a ‘manager’)” (p.75) all along, with a focus on the ‘uncoupling’ of the manifold different (sic) tasks to be completed to be doled out to the (relative) specialists in the department. Freeing the latter of switching (time) costs and effectiveness losses, along with freeing them of concurrency resolution.

Which indeed deserves a HT for putting it so clearly: The manager uncouples, doles out, and then awaits the results to be consolidated whilst catering to the external-defense and facilitation needs of the department staff.

Which is also key to understanding that yes managers need to have the best of insights into what the total-tasks and subtasks entail. Hence no more generic-managers over specialist knowledge workers, but task-dedicated super-insight managers. Remunerated for their superior results, not for their babble and chair-stickiness.

Let’s keep it cheerful, for once, for the coming two days and beyond. And:
DSCN8391
[Once, a world trade center: Edam]

Prediction16

Yawn. Or not. The following will get real serious in 2016. Like,

Well, for the list with everything and their dog:

  • Some Exits: Green Egg, ‘Cyber’everything, disruption/uberization, privacy, and, certainly and very much hopefully, “Like us on Facebook” … and very, very certainly hipsters let alone their ‘beards’ (quod non).
  • Entrat to replace the latter, hopefully, some actual non- or anti-bureaucratic frameworks of mind.
  • Also out, to be replaced by … [as yet unknown]: Vlogging or what have we, in socmed space, with 100k-1M+/++ followers as being he thing to aim for. As it becomes clearer and clearer in 2016 that only the 10M+/++ leaders (??) can make a dime from it, or barely a living. Who are the big winners, in all of this? User data / experience farmers?
  • Risk Management 3.0 will grow to be the Next Thing in managementspeak. If you’d need any proof, go read back the ton of posts on your perennial Truth site.
  • Also, we might get a last blip from SMAC(T) as a trend summary.
  • All of the points made by The (some) Man. Obviously. And some of this as well though this may all show to be overblown.
  • Still a wave of interest in Rise of the Robots. Combined with AI through and through, like in this. With support at an angle, from this.
  • A further blend of cloudsourcing and deperimetrisation putting your infra and all of your data naked and out there in the cold.
  • Oh almost forgot: A lot more on APTs, 3D printing (when will we finally get 4D printing …!?), MehhDrone stuff, blockchain, IoT, et al.
  • But we may hope, the latter two get much more innovative applications; one the one hand with simpler explications, on the other, truly innovating e.g., into the DAO realm.
  • Ah, DAOs; let’s first see more of this in 2016.
  • Offering a simple list copy from HBR:
    • Algorithmic personality detection: Yes
    • Bots: Yes
    • Glitches: Mwah; we indeed will see scores of them, ever bigger and more impactful (also b/c complexity explosions of the mixed e and physical worlds), but they’re somewhat of the mehhh category for the purpose of Here.
    • Backdoors: See APTs et al; much more of them yes but again, mehhh
    • Blockchain: As mentioned
    • Drone lanes: Hmmm, interesting…
    • Quantum Computing: Probably hung in there from previous (many) years’ lists; mine, too. May, might, but for the same token may not
    • Augmented knowledge: Definitely. Hopefully, in a good way. But maybe even hopefully, steered towards safe use, after a hopefully indicative but small-enough dystopian-style mishap ..?
  • CloudIAMming. IAM, renewed, for federated use in ‘the’ cloud. Yes, this will have a whole new lease of life, as a management field, and a consultancy field as well.
  • This just in: Forgot to mention VR as a thing in 2016. Definitely.
  • I may want to do an update halfway through the year…
  • Oh, and of course our motto for 2016: A CEO with you, is still a CEO.
    #gosubstitute[ _X, _Y | fool, a tool ]

After which there’s only:
DSCN7943
[Purposefully unsharp. Berlin, some years ago.]

Common meltdown

Ah, indeed a meltdown is approaching; maybe not even of the common kind of just something breaking down in ‘IT’ — the inverted s… hits the fan scenario — but a larger-scale one. Being the lack of budget / approval for IT staff to do continuous education of all sorts. [As in here, in Dutch.]
Which will inevitably lead to ever larger of the small- to midsize collapses mentioned, possibly one triggering the other till past the critical point where the chain reaction feedback loop switches from negative to positive.

By which time it will be too late, much too late, to hyperventilatingly engage in counteractions. Both against the root cause problems in IT, as in the edjucayzional category within those. Because, au fond, so many of IT’s ails were and are, increasingly, driven by lack of (continued) education. Causing problems in the user’s specs (at the highest levels) and subsequently, 2nd Law of thermodynamics, spawning all of the subsequent complexity developing into unmanageability, and error stacking that breeds like viruses.

Even more poignantly in InfoSec corners. You know, the outposts of IT — yes, yes, I know that the I is of so much greater import than the T but get real, instead of 20% InfoSec is 85-95% T still, these days ..! — where the real commandos and fancy-dancy ‘Delta teams’/SEALs operate.

Can we all please get our act together ..? If we don’t turn this supertanker around quickly, we don’t even need to bother about global warming because we’ll have no industrialised world to worry about…

Après nous la deluge …
DSC_0196
[Mosquito hunt; Edinburg]

Hard coating emaille

If you’re well-seasoned, you may have turned a bit sour by all the silver bullet news even when that was targeted at point problems/solutions. And, you may even be old enough to recall Why Johnny Can’t.
Seems there’s a new version of the latter, with a similar conclusion. Too bad for all of us.

Oh well…:
DSCN0414
[Also ‘old’, also of a ‘no photo allowed inside’ site. Guess which]

C’est arrivé près de chez vous; LoRaWAN

Yet another major building block of the Future … in place. [And, not a ref to some City of Light atrocities]
Where’s the Privacy and (OR) Security experts …? For certainly, though almost out of public view, the undercurrents develop fast, into a maelstrom — I’d like it even more in this form — of possibilities; to be abused before being controlled, as has always been the case throughout history.

Oh well, can’t stop Progress, certainly not of the Technology kind… But one can hope we (sic or huh?) the Concerned will be in sufficient numbers to be able to and to be allowed to insert the appropriate controls into the whole shazam.
Like, you know,
DSC_0752
[Or is this an Tocqueville’ian opposite ..?]

Privvezy Protrection

An off the cuff — where’s gentlemens’ style, these days? — remark hit a nerve. When an interesting company had some very interesting speakers and me. On IAM, data leakage and … well, what was it, data protection XOR privacy …?

Because the little collateral remarks was about Privacy being the ethical imperative, but being implementable straight away, would need translation to operational Data Protection.

Yes, where the core of legislation is about the latter, in an attempt to achieve the former… to the degree feasible, achievable, and wanted.
Demonstrating that all legalese, even of the EU kind, is just about white washing whatever you’d want to get away with.

A sore reminder that when one would want (hypothetically, for the sake of the argument that such would be theoretically possible) Privacy, one’s still on one’s own. Against all that is formally formed or not as Institutions, against the windmills that all want you to believe don’t exist or have power over you…

But hey, I’m a happy bunny so I’ll leave you with:
DSCN0770
[When Penzance would be at Bergen On The Beach]

Define ‘Risk’…

This should be an easy one, by pointing at ISO 31000 and its definition the effect of uncertainty on objectives. But that same easy def also raises more questions than it answers, e.g.,

  • How to define [ hence | and ] classify effects,
  • How to define [ hence | and ] classify uncertainty (a biggy …!),
  • How to define [ hence | and ] classify objectives,
  • How to establish measurement of effects,
  • How to establish measurement of uncertainty,
  • How to establish measurement of objectives

that all have an impact on, and are impacted by, the definition. Hopefully, I don’t have to elucidate define hence classify, define and classify or establish measurement regarding effects, uncertainties or objectives. I’ve been at the subject before (here and many posts since) so much that it hurts, me too. But still, many won’t listen and remain stuck in their proven (sic) mistaken belief that the World we’re dealing with, can be caught in models to ‘predict’ the future and/or at the same time remain stuck in, by now approaching hilarious, classifications like Basel II-IV’s… or the slowly but steadily outdating of the classical information security mantra of CIA — those three classes of objectives don’t cut it anymore.

For the more advanced reader (approx. 90% by now — hopefully), the question remains: How to define and classify uncertainty, effect(s!) and objectives ..? Standard classifications all had their stab at it, but failed for the fuzzy nature of those phenomena. Some leaned to the Uncertainty side, trying foremost to classify threats. Some, to the effects side with their vulnerabilities-first approach — via the Impacts classification. Some even had Objectives in mind when pondering the downside potentials of loss-of-upside potential, including scour-for-opportunities to any (0-100%) degree. And then, there’s the abovementioned surefire laugh over ‘Event’ driven analysis… yes consistency, completeness and orthagonality remain essential.
But above all, none captured the time-fluctuation confluence of causes, effects, impacts, … [what have we] that all have such unanalysable structure. Due to their continuous nature; contrasted to the discrete nature often but cannot-be-more-false’ly assumed. [If you don’t get the fundamental difference between discrete and continuous phenomena, go study core math in depth, length and breath. Which is helpful against so great many ills of mind…] And due to the enormously-over-three body problem of interactions [link is about grand business not the petty risk analysis kind but the link therein is valid for the above, too].
Modeling in order to understand may work, but only to understand the exaggeratedly dumbed-down model, the conclusions of which if normative are (in this case, there is such a thing as absolute) certain not to apply or work so why bother. Oh, maybe you may bother, to get a feel of your inadequacy. [Note: I don’t feign to be above that. But I don’t allow you to assume you are as that is both a theoretical and practical logical error.]

Yesy, yes, I know; there very probably is no One Classification Fits All, then. But we may dream, and strive for it, don’t we ..? And at least be very, very clear about it — it being the approach we do take, and what it might potentially (with the probability being above zero but certainly being far off 100%) achieve. Aren’t GUTs, like the Standard Model or the hyperdimensional string theories, the dreams that stuff are made of, too ..?
As always, your suggestions, please. And:
DSC_0643
[Just wait till Etna Says Boom. Or don’t.]

The Bureau of Chaos, by Theory

As a side note to, e.g. this here masterpiece…:
The tendency of bureaucracies to ever further detail its rulesets, that quickly become so burdensome [apart from other ills, ethically much graver], that is evident wherever (top-down) principles are translated in quasi- (not even semi-) mathematical ways, algorithmically almost, to the level of pervasive implementation, stems from the ultimate control approach to life clashing with the ultimate finest-grain detailed descriptions of the universe. Intentional, and definitely normative, description (in order to control! Man over Nature!) banging heads with extensional description.
Which will petrify, then fail because it creates its own Chaos structure, as described here. Where ‘repairs’ to the System are attempted over and over again since the initial values were not infinitely exactly known, can never be. So, one builds rulesets than behave like fractals (zoomed into), in particular when studied to understand and maybe subsequently fight.

Still, the Why of latter-day Bureaucracies (for once, I tried to avoid the overly negative, accurate and pejorative ethical (and esthetical) qualifications I commonly give to these totalitarian, inhumane structures — the latter qualification because of the Will to un-humanize it all) remains in doubt, as the Man over Nature thing (setting rules, hence achieving predictability) is somewhat less valid than otherwise; a bleak reflection of what we feel is a better description of motive.
[Intermission: Be aware as you were, that the b rulesets might be the spelled-out kind but the unwritten rules- social group kinds are also included.]
Ah, back to Maslow, maybe? Yes,yes, was dissed over the past couple of years; attempted to — and failed, probably due to unawareness of its deep values and not only superficial Meaning. Exceptions, the uncontrolled (by definition, and as the Outside is by definition, too), are threats to the achieved in that pyramid. ..? Though the higher up one is, the better one can handle ambiguity, uncertainty, the unexpected, black swans and Extremistan.

Just wanted to put it down for you. And at at last a somewhat positive turn, I’ll leave you with:
DSC_0023
[Royal waiting (room) for Godot (i.e., National Railways everywhere), Amsterdam — notice the almost perfect horizon .. little less perfect but hanging in there … whoops! of the horizontal orientation]

Comparatively innovative (Beetleroot)

There was this quite simple hack; in (very) pseudo-code: If 2-wheels Then { Rollerbank; diss up some fancy figures; }
Which calls to mind the Problem of BIOS hacking / backdoor/malware pre-installing, as explained here.

On the one hand, a solution is available: At a sublimated information level, encode, as here. In the physical, car, scenario this would be readily implementable as: Just test the emissions, not rely on data produced by the system itself. Prepared By Client is used pervasively in accounting (financial auditing part) as well so consider yourselves warned…
On the other hand [there always is another hand it seems, possibly because this is real life], in the VW scenario there will probably also be a call for source code reviews. Or at least, from the software development corners, there will be. But then one ends up in the same situation as spelled out in the Bury post: How to verify the verification and not be double-crossed? A source code review would be one part, but how to compare a clean (pun not intended at time of typing) compile / image to what is actually installed (continued, without change-upon-install-to-dirty-version or change-at-service) throughout in the field?

Another issue from this: How to overrule self-driving (or what was it; fully-autonomous) cars ..? The BIOS-hack and Car examples show some intricacies when (not if) one would have a need to overrule near-future “Sorry Dave, I can’t Do That” situations. Once no physical controls are left to take over manually, … Arrmagerrdon. Yes, that 2001 was a rosy, romantic, not horror scenario. And demonstrating that at a comprehensive abstraction level, Prevention still trumps Detection/Correction. But not by much, and the advantage will slip by careless negligence and deliberate deterioration efforts.

Oh well. We all knew that All Is Lost anyway, And then, this:
DSC_0142
[(digi)10mm wasn’t wide enough to capture the immersion in this… Noto again]

Roboccountant

Talking about robotisation of the accountancy industry…

  • Automation is letting a computer do the same, or about the same, as was previously done by hand and/or mind.
  • This ‘doing’ is a walk-through of an algorithm. In its simplest form, and for major parts the core of accountancy / bookkeeping processing, this was even parameter-free so no switches needed to be made, no decisions at switchpoints. But sometimes, the switchboard was external e.g., in accountancy rulebooks that were but for (idiot) savants (a.k.a. ‘only some accountants’) near- or completely impossible to stuff in one’s head as part of the programming.
  • The Turing machines have it. But this line is only a display of wannabe Wisdom re core automation / programming knowledge.
  • Computers were freely programmable. And still are, mostly. Robots? Maybe not so much. But then, they’re of the industrial kind welding together your Tesla, or of the ridiculously purposeless humanoid kind. So, why talk about robotisation when it’s more about automation (of the classical label), nowadays called ANI, in the cloud or not..?
  • But then, there’s a lot of interpretation and shot calling and estimations up for discussion, in accountancyland. But that was what AI was supposed to solve! So far, we have only explored the either Expert System pure logic, or the ill understood neural networks deployment, but we haven’t integrated well enough the in-between (or supra) field of Fuzzy Logic. This could bring about a far more absolute truth of e.g., 60% admissibility of some estimation and at the same time a 60% inadmissibility of the same number. Then what — is determined by …? But that’s just how it is today, in the accounting industry, disguised as tough talk on admissibility but in reality styled more like cowardly firing squad pleading.
  • I already blogged about continuous instant report generation based on approved XBRL templates, that could draw on All data available in some organization, to deliver reports with the latest data to just whomever has access to the template/generation engine.
  • With assurance on the templates, and on the soundness of the base data pool generated/filled e.g. by automated verification against external sources, and on the integrity of the XBRL templates and the generation engine — nothing more needed. Initially, difficult enough, but learning effects will diminish the burden.
  • A second intermezzo: Of course all assurance will be delivered to your smart watch (sideline: as if such a thing would ever exist). Just strap a tablet to your wrist and you’d still be out by quite some margin, on screen size required to quickly glance over all relevant data (in one view! as is almost always required to understand the displayed, to have information from the data).
  • What if we find that all fuzzy logic including zero-to-somewhat fuzzyfied expert system’s translations of the hand- and rulebooks, would be implementable on rather simple neural networks, in the order of magnitude of a snail’s brain. No, not hinting at you, but the slime trail left by that Partner you know, is tell-tale.
  • When not if, weaving errors turn up in the rulebook algorithmic… When not if, the translation of True And Fair View into materiality criteria (NOT the other way around..!!! as it would be today but also as is complete and utter stupidity of the sackable offense and life without parole magnitude) will turn out to be faulty.
  • The idea that blockchain based trust will replace the value (if any(more)) of the wet signature — has that concept become sufficiently laughable ..? — of any particular person for reliance, is moot but may have to include indemnity / insurance coverage in one way or another, or is all accountancy (?) fee placed in escrow until a pool fund for expected claims is (over)filled?
  • But, will blockchain trust not go the same way as reliance on open source software ..? Will it not fail in light of the Bystander Effect ..? Then, exploited by the worst, first. As usual.

Well, just some touch points. The main one being: The rules are algorithmic, almost by definition. Until now, there was no good automated engine to draw on, but the inroads Watson is making in the medical field (oh how comparable!), show how close we (well…) are to being outflanked by … Hey lets have a contest about the name this first Roboccountant will have …!
As long as we don’t fall for the trappings to believe in any kind of child’s hand is easily filled expectation of a humanoid robot but rather one that has no physical existence other than its bits spread out over the global infra.

Oh hey before letting you in the dust, to clear up, herewith:
DSC_0294
[Not evil but Ibla]

Maverisk / Étoiles du Nord