Information security – Page 14 – Maverisk / Étoiles du Nord

Common meltdown

Ah, indeed a meltdown is approaching; maybe not even of the common kind of just something breaking down in ‘IT’ — the inverted s… hits the fan scenario — but a larger-scale one. Being the lack of budget / approval for IT staff to do continuous education of all sorts. [As in here, in Dutch.]
Which will inevitably lead to ever larger of the small- to midsize collapses mentioned, possibly one triggering the other till past the critical point where the chain reaction feedback loop switches from negative to positive.

By which time it will be too late, much too late, to hyperventilatingly engage in counteractions. Both against the root cause problems in IT, as in the edjucayzional category within those. Because, au fond, so many of IT’s ails were and are, increasingly, driven by lack of (continued) education. Causing problems in the user’s specs (at the highest levels) and subsequently, 2nd Law of thermodynamics, spawning all of the subsequent complexity developing into unmanageability, and error stacking that breeds like viruses.

Even more poignantly in InfoSec corners. You know, the outposts of IT — yes, yes, I know that the I is of so much greater import than the T but get real, instead of 20% InfoSec is 85-95% T still, these days ..! — where the real commandos and fancy-dancy ‘Delta teams’/SEALs operate.

Can we all please get our act together ..? If we don’t turn this supertanker around quickly, we don’t even need to bother about global warming because we’ll have no industrialised world to worry about…

Après nous la deluge …

[Mosquito hunt; Edinburg]

Hard coating emaille

If you’re well-seasoned, you may have turned a bit sour by all the silver bullet news even when that was targeted at point problems/solutions. And, you may even be old enough to recall Why Johnny Can’t.
Seems there’s a new version of the latter, with a similar conclusion. Too bad for all of us.

Oh well…:
DSCN0414
[Also ‘old’, also of a ‘no photo allowed inside’ site. Guess which]

C’est arrivé près de chez vous; LoRaWAN

Yet another major building block of the Future … in place. [And, not a ref to some City of Light atrocities]
Where’s the Privacy and (OR) Security experts …? For certainly, though almost out of public view, the undercurrents develop fast, into a maelstrom — I’d like it even more in this form — of possibilities; to be abused before being controlled, as has always been the case throughout history.

Oh well, can’t stop Progress, certainly not of the Technology kind… But one can hope we (sic or huh?) the Concerned will be in sufficient numbers to be able to and to be allowed to insert the appropriate controls into the whole shazam.
Like, you know,

[Or is this an Tocqueville’ian opposite ..?]

NFChipknip

Long live innovation! Of the in some respects backward kind.
Yes we did have the chipknip, a stored-value debit card system that for small amounts (e.g., parking in Amsterdam though that hardly counts as ‘small’). And yes, of course it was abolished because nobody wanted it. For one, because the stored value had to be loaded onto the card, at ever (sic) less available separate ATM-like holes in the wall. For a second, because losing the card meant losing the stored value.

For a third, because given this functionality, people much preferred to stick to cash money that was more easy to get, much more widespread usable (think C2C payments…), quite similar if not same in risk, and anonymous obviously vis-a-vis anonymity promised by, hold it, banks, of all the crooks one could imagine. If you don’t see the latter, consider whom Jesus threw out of the temple as prime example of choice of all that was rotten in society back then already, and banks have ‘developed’ ever since.
This to the chagrin of banks that, as usual, packed their most devious of actions in the thinnest of transparent films of customer-servicing arguments and licked their, expensive is an understatement, wounds.

But now we have the triumphant return of the idea in the form of NFC payments off one’s debit card. Which comes with one improvement (not having to preload) but with all the other risks aggrevated:
The ‘preload’ is, relatively, limitless or to one’s credit (sic) limit. Compared to the user-controllable stored value of yesterday.
Skimming doesn’t even require the card to be physically put into a physical reader anymore. The still physical NFC reader devices are just as susceptible to plants of skimming devices as before. Maybe the customer can check the debitable amount but the displayed can be spoofed easily, obviously [or you are foolishly considering yourself competent when not seeing that risk]. But passers-by can skip just as easily (and ‘approve’ without any your notice).

Yes, even with small amounts payments, every now and then one will be required to enter one’s PIN as verification of holdership. But that hinders, and was a measure previously implementable easily so why not then already? And for larger amounts the PIN is required always, turning the actions into a simple debit card payment as we (in the developed world so maybe excluding North America) have grown accustomed to for decades already, but now need not enter the card into the chip reading slot anymore. Wow, the improvement! And all this while maintaining the latter debit card systems.

So, we have to trade security for convenience. While banks trade simplicity for … complexity. And savings, nowhere near. How to prevent some to consider banks to be full of i… ..?

Anyway…:

[The back side of subsequent developments may be pretty or not; Dunedin]

Privvezy Protrection

An off the cuff — where’s gentlemens’ style, these days? — remark hit a nerve. When an interesting company had some very interesting speakers and me. On IAM, data leakage and … well, what was it, data protection XOR privacy …?

Because the little collateral remarks was about Privacy being the ethical imperative, but being implementable straight away, would need translation to operational Data Protection.

Yes, where the core of legislation is about the latter, in an attempt to achieve the former… to the degree feasible, achievable, and wanted.
Demonstrating that all legalese, even of the EU kind, is just about white washing whatever you’d want to get away with.

A sore reminder that when one would want (hypothetically, for the sake of the argument that such would be theoretically possible) Privacy, one’s still on one’s own. Against all that is formally formed or not as Institutions, against the windmills that all want you to believe don’t exist or have power over you…

But hey, I’m a happy bunny so I’ll leave you with:

[When Penzance would be at Bergen On The Beach]

Define ‘Risk’…

This should be an easy one, by pointing at ISO 31000 and its definition the effect of uncertainty on objectives. But that same easy def also raises more questions than it answers, e.g.,

How to define [ hence | and ] classify effects,
How to define [ hence | and ] classify uncertainty (a biggy …!),
How to define [ hence | and ] classify objectives,
How to establish measurement of effects,
How to establish measurement of uncertainty,
How to establish measurement of objectives

that all have an impact on, and are impacted by, the definition. Hopefully, I don’t have to elucidate define hence classify, define and classify or establish measurement regarding effects, uncertainties or objectives. I’ve been at the subject before (here and many posts since) so much that it hurts, me too. But still, many won’t listen and remain stuck in their proven (sic) mistaken belief that the World we’re dealing with, can be caught in models to ‘predict’ the future and/or at the same time remain stuck in, by now approaching hilarious, classifications like Basel II-IV’s… or the slowly but steadily outdating of the classical information security mantra of CIA — those three classes of objectives don’t cut it anymore.

For the more advanced reader (approx. 90% by now — hopefully), the question remains: How to define and classify uncertainty, effect(s!) and objectives ..? Standard classifications all had their stab at it, but failed for the fuzzy nature of those phenomena. Some leaned to the Uncertainty side, trying foremost to classify threats. Some, to the effects side with their vulnerabilities-first approach — via the Impacts classification. Some even had Objectives in mind when pondering the downside potentials of loss-of-upside potential, including scour-for-opportunities to any (0-100%) degree. And then, there’s the abovementioned surefire laugh over ‘Event’ driven analysis… yes consistency, completeness and orthagonality remain essential.
But above all, none captured the time-fluctuation confluence of causes, effects, impacts, … [what have we] that all have such unanalysable structure. Due to their continuous nature; contrasted to the discrete nature often but cannot-be-more-false’ly assumed. [If you don’t get the fundamental difference between discrete and continuous phenomena, go study core math in depth, length and breath. Which is helpful against so great many ills of mind…] And due to the enormously-over-three body problem of interactions [link is about grand business not the petty risk analysis kind but the link therein is valid for the above, too].
Modeling in order to understand may work, but only to understand the exaggeratedly dumbed-down model, the conclusions of which if normative are (in this case, there is such a thing as absolute) certain not to apply or work so why bother. Oh, maybe you may bother, to get a feel of your inadequacy. [Note: I don’t feign to be above that. But I don’t allow you to assume you are as that is both a theoretical and practical logical error.]

Yesy, yes, I know; there very probably is no One Classification Fits All, then. But we may dream, and strive for it, don’t we ..? And at least be very, very clear about it — it being the approach we do take, and what it might potentially (with the probability being above zero but certainly being far off 100%) achieve. Aren’t GUTs, like the Standard Model or the hyperdimensional string theories, the dreams that stuff are made of, too ..?
As always, your suggestions, please. And:

[Just wait till Etna Says Boom. Or don’t.]

Comparatively innovative (Beetleroot)

There was this quite simple hack; in (very) pseudo-code: If 2-wheels Then { Rollerbank; diss up some fancy figures; }
Which calls to mind the Problem of BIOS hacking / backdoor/malware pre-installing, as explained here.

On the one hand, a solution is available: At a sublimated information level, encode, as here. In the physical, car, scenario this would be readily implementable as: Just test the emissions, not rely on data produced by the system itself. Prepared By Client is used pervasively in accounting (financial auditing part) as well so consider yourselves warned…
On the other hand [there always is another hand it seems, possibly because this is real life], in the VW scenario there will probably also be a call for source code reviews. Or at least, from the software development corners, there will be. But then one ends up in the same situation as spelled out in the Bury post: How to verify the verification and not be double-crossed? A source code review would be one part, but how to compare a clean (pun not intended at time of typing) compile / image to what is actually installed (continued, without change-upon-install-to-dirty-version or change-at-service) throughout in the field?

Another issue from this: How to overrule self-driving (or what was it; fully-autonomous) cars ..? The BIOS-hack and Car examples show some intricacies when (not if) one would have a need to overrule near-future “Sorry Dave, I can’t Do That” situations. Once no physical controls are left to take over manually, … Arrmagerrdon. Yes, that 2001 was a rosy, romantic, not horror scenario. And demonstrating that at a comprehensive abstraction level, Prevention still trumps Detection/Correction. But not by much, and the advantage will slip by careless negligence and deliberate deterioration efforts.

Oh well. We all knew that All Is Lost anyway, And then, this:

[(digi)10mm wasn’t wide enough to capture the immersion in this… Noto again]

PIA is KIA and KYD (?)

Since the whole Privacy thing has gained new traction with both the European Data Privacy Directive regaining (some…) steam and the European Court finally deciding what all with any bits of brain already knew i.e. that ‘Safe Harbour’ was a sour joke (to put it mildly), I realized, when working on a presentation for a forum centering on/around Identity and Access Management, that any Privacy Impact Analysis work comes down to two things; an objects-side analysis in the form of Know Your Data and a subject-side analysis by means of Know your (authorised OR actual) Identities and their Access, with some Privacy By Design thrown in at the solutions end.
Since I just like sentences of the right length, being entities that contain a discrete but complete set of logically coherent and united concepts.

And for those of you in the know; the above contains all there is to Know. Sort of. Maybe add in a bit of this (in Dutch; from the FD newspaper), for implementation. For a lot of implementation…
And, things may change in the somewhat near future with the advent of drones, IoT, robotics (humanoid or abstract), and ANI/AGI/ASI, in the IAM sphere alone. Just read up your huge backlog on this blog, and elsewhere as I cannot really summarise it all here…

I’ll give you some time space for that now. With:

[At the Ragusa Ibla end but of course you knew]

Vendors pitchin’ — reality’s b… moving elsewhere

Was reminded today that still, a great many vendors in the (Info)Security arena are pitching their worn-out warez to a laggerd crowd — or is it just me to see that, in particular where IAM is concerned, all eyes are still on some vault idea of data storage and systems, behind some mirage of a perimeter of the ‘data center’ (as it is presented ..!).
Luckily, I met this old friend of mine of Zscaler that see that today’s access and wider security concerns are over Cloud (storage, services) and Users (out there, anywhere). How nice would it be if not too much time would be wasted anymore on the classical, outdated (sic) model(s) and we’d all move to this new world ..?

This, for your viewing pleasure:

[Watching the ships go by, Amsterdam]

A quantum leap

Remember, that (not) a great many days ago I posted some bits on crypto ..? There’s a new twist to it all, after the venerable Bruce noted that some agency started a new, this time ’round bit more fundamental round, on crypto algorithms. And then, some notes on the approach of quantum computing. Well, the latter is still five to ten years off (current estimates; could be three, could be twenty, as such estimates go).
But impacting. So, the following flew by:
CryptographyChart-1-482x745
Which explains a lot, hence I just wanted to pass it on. Bye for now.