Summarily: yolosec

Yes that’s the summary title at once describing the sum total result of all your humongous efforts to ‘secure’ … whatever scope, in infosecland. HT to @thegrugq
To which we may add the find of yeauleau for francophones. Of course.

That’s it for today. With:
DSCN8135
[Fashionable Without A Cause, too; (i.e.) Milan. Look to the left (shop) and shiver…]

Pro-nun-ciation

OK.
We already had the CGEIT title certification. Which is pronounced in Dutch as ‘See goat’.
Now let’s add CSX. Pronounced by all as ‘See sex’.

Oh jolly! One is ignorant, XOR one is prepubescent.
Either way, #fail – big time. Let alone for content. This, if you’re still a believer.

You still deserve?
DSCN6161
[To be in your stroller; Nancy city park]

P( Danger(You) > 0.5 ) ⇒ Shutdown( You )

For the Fellow Travelers among you, that still believe that AI (AGI or ASI) will bring us joy and an arcadic peaceful creative work-free life forever after, please do consider this here piece. And see that we’re only at the beginning.
[Oh for AGI/ASI reference, see here.]

Luckily, hopefully, the tide will turn. But there simply is no guarantee it will.

And on this most pleasant note, I’ll leave you with:
DSCN7386
[Málaga – but when the struggle is forbidden and ‘ratio’ quod non might seem to prevail, the Dark may roar and explode out of its confines in utterly destructive ways. As in this previous post…]

FogAI picture

… Just to put it out there: What has happened to all the thrilling AI initiatives that flew around one after the other at the start of the year ..?
At that time, I even included some stuff in my Predictions, as so many new things were popping up. But now, … not so much. Because what?

Or have all the ‘leaks’ been thumbplugged and is development still going strong in skunk works towards a renaissance explosion sometime soon ..?

Whatev’; for you:
DSCN2101
[Its back being Mont serrat. Or so. ?]

Signalling healthy process

Yet some more cross-over ideas from the IoT world into the administrative bureaucratic office world: Streams of transactions as signals.
Of the health of the process, of course. To be defined, obviously, as the fit to the surroundings. The fit may be off, either intentionally (wanting to let the world adapt to the process, enforcing (?) change) or unintentionally left blank                i.e., having to cope with exceptions to what was envisaged as transactions’ content or form.

Now apply yesterday’s first picture of process control.
Now, too, consider what one could do with sampling theory (as a subset of ‘Shannon’, if properly elaborated, possibly skirting with ‘classical’ statistics ..?). Taking 2log(n) samples (where n is the number of transactions ..?? Just a wild guess) and being able to reconstruct the ‘signal’ then taking its integral (discrete transactions … just summing it up ..?) for the total. Or Fourier-transforming it all and … get your basic theory straight before dreaming of moving on so don’t start at the other end as ‘accountant’…! And/or treating exceptions (as e.g., found by the sort of analysis that these girls/guys are so good at; that not even being meant as a cynical qualifier) as noise to the signal. Never fully suppressable, but useful to pick up secondary signals, stacked in their variation of frequencies, amplitudes an wavelet transformations. That all tell you something, if you listen. Whether you want perfect, over-HiFi replay [intermission: Ugh I’m getting old, even knowing that HiFi was a thing…], or lively veracity, actual fullness of music. And take in again the ole’ industrial process control with its recipe / derivative function(s), et al., and be able to better control it all from the ‘dashboard’ in the control room. When all of the routine stuff, the routine 80%, of business is done by … ‘robots’. Humanoid or digital-machines, IDC.

And hey, while we’re at it, why not throw in attempts to include in bookkeeping not only discrete numbers (arbitrarily rounded to hunderds, of random currencies) but Real numbers or even Complex numbers as well ..? The latter, e.g., to indicate VAT surcharges, etc.; leading to tuples-as-single-‘numbers’ in bookkeeping. Maybe somewhat harder to track that all is booked correctly, but also maybe powerful in capturing singular transactions and some processing rules/logic, and controls, in one tuple (‘record’).

Where AI may then be applied to do sanity checks. Not on this author; no AGI or ASI would suffice…

OK, for now:
DSCN1436
[“What a shoe box” but yes that *is* the Bata shoe museum, Toronto]

Model code

In the race to get everyone and your grandmother (but in particular, ‘youth’) to code as that would be the new literacy, this here piece arrived quite in time.
In which Chris Granger explains that modelling the world around us (and taking it in), is the new literacy. [Read the article; it’s a full stretch more intricate than that actually.]

Right. With a number of sideline qualifications. But I don’t have the time right now to elucidate… They’re in the order of “But then, calculus and basic reading skills are required to understand the world and be able to deal with it. So it’s not that the old forms of literacy will go away (on the contrary; dismal education globally (sic) should be repaired, in particular numeracy) but they will be augmented. This will require a massive, huge! upgrade of about all teachers at all levels – which will not happen anytime soon. And programming skills are only the basics one needs to be able to analyse, model, and design the world around us, much like + and – are required to understand one’s income – assuming one has or needs money to live – or even money, or society’s functioning.
Let alone understand culture. Isn’t culture what is being transferred in Education ..?”

And so on. But as said, time limits… See this, too. Hence:
DSCN7557
[Baltimore is old. ?]

Here, First

Integrity at any level is the Yggdrasil of any CIA or other quality of the layers on top of it.

I.e., if at the platforms level the integrity of software (à la Turing, engine/programs and data) cannot be fully 100,000…% be guaranteed, no extreme of measures op top of it can restore the missing percentage, only (somewhat) limit further deterioration of the stack on top.

Okay, this being a bit abstract, a somewhat more simple and extensive explanation will follow.
Till then:
DSCN6859
[No base, no glory; Sevilla]

Stuck in the 80s (wrong end)

Some recruiting experience a friend had recently… (in no particular order, just what I recall from his analysis; yes I did take notes after a short while and seeing friend’s energy drained even in the recall):

  • When walking into the shared space / reception, an all-M team were starting on pizzas.
  • Setting: One candidate (my type, i.e., aiming to think fresh), one manager-possibly-to-be (M; styled like a civil servant), one HR (F; typical? she got the coffee).
  • Mptb repeatedly brought up a vacancy not applied for. Mptb may have wanted to fill that slot more urgently, but was not the one that triggered friend to send the open (sic) application for a first meeting just to learn more about the co.
  • Mptb couldn’t but return over and over again to the capacity for sales. Friend had already mentioned explicitely in the motivational letter that sales (of the cold call type) was the main weak point, well-known. Why keep hammering on that? Not on marketing (friend has great, very frequently demonstrated capabilities for that), hardly anything on content, not much on knowledge or fields of interest. But then, what can one expect from an Mptb that had the first half of ‘career’ in selling bananas (literally; I checked for friend)? Also, Mptb did not show any interest when friend mentioned his very, very extensive, professional thoughts-filled blog; possibly b/c Mptb didn’t know the concept of ‘blog’..?
  • Apparently, only the one-pager resume had been gleaned over. Of which friend had remarked in the motivational letter that it might read as being skewed to the (IS) audit side but that work content had hardly been that at all for the part decade+ and had been almost completely with advisory and consultancy services. Mptb could not see that, or may not understand enough of business outside the own (narrow? I’ll leave that to friend and you) scope of one’s own daily drudge. Mptb kept hammering that out. Friend has a two-pager resume in English (may be too difficult for the all too Duts Mptb?) that has job content descriptions but that didn’t even come to pass. LinkedIn? Nothing. Friend has a very extensive and diverse profile there and had checked; Mptb hadn’t had a single cursory look. SocMed seemed not to exist.
  • Mptb indicated anyway to operate at ‘tactical’ level with clients. Highly doubtful. At least, taken from some details of the conversation, friend operates a level and a half higher, and examples given and some details of the discussion indicate, Mptb hardly rises above operational control level and didn’t demonstrate to understand much about dealings at various management let alone governance levels. Which may have explained some of the misunderstandings. But Mptb would have had to be the one to have noticed, if Mptb – or would be a very mediocre, 70s-to-80s type of manager?
  • Same indication from the salary range indication. Quite something lower than current. Pay the bananas, get the monkeys.
  • But then, Mptb did keep on spelling out that selling services project-wise to clients, bore down to just proposing a handful of CVs with all track records spelled out. Actual project definition, ToR, deliverables, whatev’ (?). Ah. If friend were to spell out all projects, that would lead to a. a 25-30 page resume, as friend had a resume like that already 16 yrs ago that counted 15 pages (I still have that on back-up somewhere) through executed project summaries (sic), b. clients being dismayed their details would be presented to just about anyone else – if you see the project details of others, yours will be displayed to competitors as well in our business that deals with/in confidentiality.
  • But then, the main point is that friend doesn’t want to be bodyshopped, stuffed in client job slots just for the pay by the hour. How 80s can you get ..? Didn’t Mptb notice the world has changed, and such retro business is to be ridiculed …?
  • This, with a focus on billable hours and not sitting on the bench. Yeah, friend and I understand that. To be an operational hygiene factor. Not the focus of daily work life.
  • On the other hand, Mptb also kept on hammering on with questions how friend would deal with project hiccups, as if they’d be simple bugs or so. To be fixed with a simple fist bang..? As if that goes in today’s business, at the level one wants to be concerned. Friend’s answers to resolve them in, at the same time, businesslike and diplomatic ways, apparently was too difficult to grasp.
  • And oh yes, a handful of half-cocked STAR attempts were thrown in. The sample I heard, are far from and would have missed the point (the method’s information gathering actually intended) quite comprehensively.
  • Overall, Mptb seemed like a bad listener to me, not interested in what friend brought to bare let alone what work friend wants to do, what directions he wants to go, etc. Oh yes, there was the question about own ideas for personal development, but the answers again didn’t seem to land; friend got reaction, not response.
    And though non-verbal comms was clearly mentioned, Mptb didn’t recognise that as a signal that his own posture only conveyed confusion and resignation. Verbal comms didn’t result in replies by Mptb that might indicate understanding and exchange of ideas, just what friend told be to understand “Hm, didn’t get the fully templated answer I wanted to hear b/c that’s the only kind I understand”. But Mptb found fault with friend over the latter’s non-verbal.
  • Overall II, I’m unsure whether, or rather am sure that, friend nor I would want to work with/for such a Mptb. Probably, ‘management’ would consist of bullying over unbilled hours only; no sight of understanding today’s knowledge workers need to be freed of chores such as sales, and need coaching and all other facilitating stuff (and risk management, etc.) offloaded to … the manager as that’s his job, to be free to deploy one’s excellence without being bothered by not-understandelings. We agreed we wish Mptb luck with client relationship management as he’d need tons of it, and would advise him to stay away from actual project execution or staff management. If we’d get into a relevant position we certainly wouldn’t invite him.
  • The (quite unattentively) somewhat brushed aside HR lady slipped in some questions about friend’s private life and goals in the end. I know friend as someone who wants to very much have a seamless blend of (hardcore to softcore) business, semi-professional hobbies, and other stuff. Mptb didn’t seem to care.
  • Conclusion: A waste of my friend‘s time.
  • Friend was contacted afterwards; they sought a full-on build-a-team-through-all-sales person indeed. That was not in the function profile friend showed me… And, as said, friend wrote in his motivation that if anything, that is was/his weak point. The waste of time could have been prevented.

Had to discuss this over a couple of days, to get it out of friend’s system…

Only to realise that I haven’t had a good job conversation myself recently, either. Though most of the (not so many) times, only a couple of above’s issues were at play, I was disappointed all too often. I also didn’t really like the other sort of ‘interview’ where one is asked snarky gnarly brain teasers. Of even had to do an assessment with a day’s full of questions with quite certainly the wrong answers. Or just in the interview. Why do recruiters still think they’re the conversation boss or something? Haven’t they learned how to beg for the right talent ..!? I might not completely be in that category [worded like that not to appear presumptuous at considering myself perfect, or would that add to the adoption of the hypothesis? ;-] but still to have a grown-up conversation about it all, would be welcome. So, … your comments.

But hey, then, to not get depressed:
DSCN6875
[Pleasant life; not only the Expo at sunny Sevilla]

SwDIoT

Recently, there was yet another exepelainificationing of ‘software defined networking’, along the lines of separation of the control plane from the data/content plane (here).
Which ties into a core problem, with IoT the subject of this post: Integrity.
Yes, confidentiality may be an issue, but singular raw data points themselves often are too granular to actually steal any information from. And Availability is of course also of the essence, especially in ‘critical’ systems. But te main point of concern is with Integrity, of the system in a wider sense, but also in the smallest sense.

Take Stux … Integrity breach as the vector space, spanned along a great number of dimensions.
Objective: Degradation of the information value; increasing the variance to a level where noise overwhelms the R2 of the signal (however far from log2(n), big if you understand), through degradation of the (well, original) software integrity.
Path: Introduction of intentionally-faulty (?) software. With use of of, probably, penny-wise correct IAM, being pound-foolish at the medium level. I mean, the level where human and other actors are unwitting accomplices in planting da bomb. That’s what you get by simpleton top-down compliance with just about every thinkable rule: To do any work, underlings will devise ways to circumvent them. And, adversaries will find, see, avenues (that wide) for riding on the backs of the faithfully compliant to still achieve the objective.

But OK, back to … separating the control plane from the data plane. Bringing a shift in efforts to disrupt (no, not of the mehhhh!! destructive, economy-impoverishing kind but in the actual signal degradation kind) from just-about any attack plane down to, mostly, the control plane. That may seem like an improvement, de-messing the picture. But it also means shifting from a general, overall view of vulnerabilities to the core, and a core which is less tested or understood, and harder to monitor and correct, than previously. Or is it ..?

So, if we take this Software Defined to IoT, we’ll have to be careful, very careful. But yes, IoT is constructed that way … With signals to actuators that will result in altered sensor data feedback. Know the actuator signals, and the actuator-to-sensor formulas (!), and you’re good to go towards full control, with good or bad (take-over) intent. Know either (or how to get into the sensor data stream), and at least you can destroy integrity and hence reliability. [DoS-blowing the signal away in total blockade or grey noise wipe-out, and your cover is blown as well. Is a single-shot or semi; you may want to have full-auto with the best silencer available…]

Hm, the above from the tinkering with the grand IoTAuditing framework promised… To turn this all into a risk managed approach. Well, for now I’ll leave you with:
DSCN3214
[It has a glass floor up in there, you know. Blue Jays territory, ON – and yes, a very much sufficiently true and fair horizontal/vertical view picture, according to accountants]

Morozov’s no joke

Just a vey few:

“The fear of appearing inauthentic, of being a fake, has propelled nearly as much technological innovation as pornography.”

“But Adorno does have a point: authentic things are not necessarily morally good, and morally good things are not necessarily authentic.”

“In this, the authenticity rhetoric of Facebook is strikingly similar to the public debates in 1950s America over whether uniformity (everyone living in mass society is essentially the same) was a greater sin than conformity (some people adopt ideas, habits, and beliefs only to get along). The latter, the conformists,were seen as phonies who chose to be someone else; the former, those who were uniform by design, were seen as the real phonies – as people who thought they were making choices and being their unique selves, when in fact they were anything but.”

Worrying about usability – the chief concern of many designers today – is like counting calories on the sinking Titanic.”

The goal of privacy is not to protect some stable self from erosion but to create boundaries where this self can emerge, mutate, and stabilize.”
“Digital technology has greatly expanded the windows and doors of our own little rooms for self-experimentation – but we are now at a point where those rooms are on the verge of turning into glass houses.”

“Given the complexity of the self, trying to reduce the privacy concept to a purely utilitarian framework is like steamrolling a statue to capture its essence in the simpler space of the two-dimensional plane.”

Oh how many more such insights are there, to Learn. And weep. For that:
DSCN5410
[Yes, Gettysburg battlefield. Ominously.]

Maverisk / Étoiles du Nord