Tag: IRM

Managing Fortuna’s Risks

On how Risk Management is self-defeating… or just something one has to do while Life has other plans with you(r organization).

First, the übliche picture:
20140813_154840
[Shadow (play) of Dudok, Hilversum again of course]

First, the Defeating part. This, we hardly discuss at length, full enough, but when we do, it’s so obvious you understand why: Because RM is about cost avoidance, even if opportunity cost avoidance. Which makes you the Cassandra, the Boy Cried Wolf of the courtiers (sic). It’s just not interesting, not entrepreneurial enough. [Even if that would be pearls before swines…]

Second, this is why it’s so hard to sell (no quotes, just outright sell for consultancy or budget bucks) the idea of RM to executives – they only see the cost you are. They don’t see themselves as delivering something if, if, if only, they had integrated RM into their daily ‘governance’ (liar! that’s just management!) / management. They don’t want to do anything. They just don’t understand to do something that doesn’t show to be effective even if others for once see no harm (though the others will not even care to flag the kindergarten-level window dressing that’s going on with the RM subject; too silly that, to call out).

Third, this happens not only with ‘boardroom’ RM (~consultancy/advisory), it has been well-established at lower ranks; all the way from the mundane IT security, Information Security, Information Risk Management, Operational Risk Management (where the vast majority of organisations don’t make anything tangible anymore), including the wing positions of, e.g., Credit and Market Risk (which are in fact, with the visors to mention, the same as the previous!), to Enterprise Risk Management altogether.

Fourth, we tie in Queuillism. The Do nothing part almost as in Keynesianism where in the latter, future-mishap prevention should be arranged during the years where government intervention wasn’t required as such. As in Joseph’s seven fat years contra the seven years of famine (Genesis 41). How does this reflect on RM? Would it not be just BCM in its widest, enterprise-wide sense? Isn’t that what ‘management’ is about, again..? Just sanding off the rough edges and for the rest, give room to the actual stars, the employees at all levels, to let them bring out their best – so exponentially much more than you can achieve by mere, petty, command & control. You raise KPIs, I rest my case of your incompetence. And this goes for governments even more. Just enormously expensive busywork.

Fifth, finally, the fourth trope points into the direction of Machiavelli’s Fortuna. Which was also covered by Montaigne, of course. It doesn’t matter what you do, in the end, Life has other plans with you. Sobering, eh? Oh but again, you can shave off the rough edges for yourself, too. Just don’t think in the end, that will matter much beyond some comfort to you. Katharsis, and move on.

OK, since you held out so long:
20140813_154800
[The same, from another angle]

Mind posting/reading

This new Mindmeister feature looks interesting:

Except for two things:

  • It will create a bucketload of ‘Tourettists’ at all sorts of public venues (coffee shops, terraces, the beach, side walks, etc.) when all sorts of, mostly, self-inflated hipsterlaggerds start recording their every doodle out loud instead of just clicketing it to Kik / Tele- / Instagram / WeChat / Line / Viber / Wicker / Threema / surespot et al. Yapping out somewhat loud will be even more annoying…
  • Who reads your doodles at the back side ..? Yes this is already an issue with like programs, in particular if (not when) one would use them to sketch outlines and content ideas for concepts / posts / columns / articles / books that might be construed to reflect a societal(ly -) or political(ly less wanted) opinion of sorts.
    Already now, of course, who reads what you’re working on, even when stored off-line ..? But this will become an even greater issue when even the slightest of your mind’s burps might get captured immediately by your own doing.
    How far till this turns into actual mind reading?
    Would someone (AI (yes, being someone), or human if you’re still in old school thinking mode) be able to immediately present you with position-changing tweets etc.?

Well, we’ll see… Singularity, here we come! We want you! After that, we’re done.

Gotta TruSST’MM

Had been planning for a long (?) time already to write something up on the issue of Trust in OSSTMM3© – in particular, how it doesn’t conform with received (abstract) notions of trust and how that’s a bit confusing until one thinks it through wide and deep enough.

First, a picture:
DSCN4198
[Controlled to I/O, Vale]

Then, some explanation:
As I get it (now!), the OSSTMM model defines Trust as being an entry into or out of a system/component (objects, processes). The thing you may do when you are trusted. Literally, not the protection wall but the hole in that wall. Which isn’t some opinion thing the holder has of the visiting tourist. Interesting, but troublesome in its unsettling powers.

Dang. Running out of time again to delve into this deep enough – in particular where I wanted to link this to a previous post about identity and authentication … (this post in Dutch). OK. will move on for now, and return later. Already, if you have pointers to resolution of the differences (the whole scale (?) of them), don’t hesitate.

Quick note: Privacy is about Info, not Data

Just a quick note to drop it, here, already before my holiday. May elaborate on the subject later, in a much extended form. The idea being:

Privacy is about Information, not about Data. Privacy sits on the divide, or jump, from data to information, as in this previous post.

Data doesn’t mean a thing. And yes there’s use in protecting data, but that’s only part of the picture. To discuss ‘directly or indirectly identifying data’ one needs to understand the value, and information, in data combinations. So you’ll have to keep the information value in mind always.

Which also means that if you discuss topics with various categorically-not-understanding-anything-other-than-bonuses stakeholders under the common header of personal data protection, you have lost connection to them. By giving up before you started; they will not ‘get it’. They know ‘data’ only in the abstract, as something to stay away from. If you don’t keep the (distinction AND connection) in mind and exepelainify it extensively ‘externally’, you lose.

Same, if you don’t bridge the gap ‘internally’ in your in-group. Only when an exhaustive search for all meaning of any combination of data has been completed, would one know what data elements could possibly be necessary for identification and hence are privacy-sensitive.
This would probably set the threshold very low indeed. But hey, that’s your problem right there. Offer perfect protection of get sued into oblivion.

I’ll return on this. Thank you:
20140306_151133[1]
[Kei-good design.]

Postdictions 2014-II

A progress report on the Predictions 2014 I made in several posts here, at the end of Q2.

First, of course, a picture:
DSCN1023
[New then, outdated now, La Défense]

So, there they are, with the items collected from several posts and already updated once before in this:

Trust Bitcoin may be in this corner, covering a lot of this subject [edited to add: it’s now legal in California ..!]. Also, Heartbleed pointed out our dependency on ‘anyone but us’ in actually checking/testing open source software like OpenSSL, and the trust placed in the great many low-level bits and pieces that make up ‘the’ Internet (connections).
[After publishing, I’ll cross-post my ISSA Journal column on this, as a post] —> [Here it is]
Identity Facebook allowing anonymous (fake) identities. Users deleting posts from socmed, and switching to ephemeral messaging (Snapchat et al.). The European Court ordering Google to delete histories at request. (The semantics of) identity proceeds to being manageable…
Things Moving into a focus, vanguard of Sensors. And the Glass successors are surfacing. Earables here …
Social Movement all around; with a focus on privacy as in my May 30th post.
Mobile See Things.
Analytics Wow, this one’s moving into the Through of Disillusionment quickly! Now get it to jump out at the other hand, as quickly.
Cloud Mehhh, indeed. Still. The focus shifts towards actual security implementations, and control over that. On the Slope of Enlightenment, I’d say.
Demise of ERP, the Dude, these platforms aren’t even audited otherwise than by the most boring of boring routines – anyone interested in things other than pure dry deadwood, are working on other things.
InfoSec on the steep rise Even if we haven’t seen enough on this!

On APTs: We’ve seen Heartbleed come. And not go. This being just a mere incident, incidental symptom…
On certification vulnerabilities: See the previous. Check.
On crypto-failures, in the implementations: Some minor Bitcoin stuff, not too much else.
On quantum computing: – still not too much –
On methodological renewal; as it was: I blogged about this (re Rebooting CIA and OSTMM). Some progress here and there, but no ✓ yet.
Deflation of TLD Really out of sight even in the most dull accountant’s circles.
   
Subtotal Already clearly over 80% as we speak, when discounting for some fall-back here and there.

The faint of heart wouldn’t necessarily want to speak the bold characters out loud.
See you at the end of Q3 ..!

[In repeat, to add:]
Missed in the predictions ahead of time, but still worthwhile to watch: Google’s move towards banking via Gmail … as per this story, as commented ‘ere.

Iconic clarity failure (privacy edition)

Got a pointer to the icons that are in the EU Privacy directive.
Wow. I can’t even … (did I just write that ..!?)

See whether you’re able to guess the meaning of the following:
Icons

A big Nope, huh …? The answers, after the break… Continue reading “Iconic clarity failure (privacy edition)”

OSSTMMPerimeter ..?

Just a note; was struck by the OSSTMM approach towards the structure of infrastructure. [Disclaimer] though I am quite a fan of the OSSTMM approach (and do want to write up tons of whitepapers linking it with my ideas for moving forward in the InfoSec field without having to revert to #ditchcyber bla), I feel there’s a snag in it:
The analysis part seems to still take a perimetered, though onion, approach. The Defense in Breath is there, for sure, but still the main (sic) focus is on the primary axis of the access path(s). Does this still work with the clouds out there and all, focused as they are on principalled agnostics on where your data and ‘systems’ might hang out?

OK yes now I will go study the OSSTMM materials in depth to see whether this is just my impression and I’m proven horribly wrong, or …

So i’ll leave you with:
DSCN3689
[Hardly a street, next to Yonge]

Note: M$ is just a vendor

Microsoft declared the era of XP finally over, amongst others by not providing fixes in Updates per May 13 (not a Friday, but close).
Markets (use base out there) declared Microsoft to be just one vendor among many, not to dictate anything but to deliver at want, at need. No more. They did so through continued use of XP in oh so many machines, of the general-purpose computer type, and in embedded systems et al. Microsoft weighs, the user base decides.

And, of course:
DSCN7921
[A sunny pic of Ståckhølm]

WIoTables

Am I too late with this post, or are people still mixing up the Internet of Things and Wearables ..?

First, a picture:
DSCN0468a
[Rarely seen Cala, at ON]

Because we’re talking quite distinct things. Yes, there’s a crossover area where e.g., the sensors or ‘reflectors’ we wear, operate in the IoT realm of ambient intelligence.

But for starters, there’s wearables. Mostly, human-to-Matrix sensors / Matrix-to-human feedback interfaces. Hooking you up in a blue pill world. Oh yes so helpful; often providing morsels of value like Likes through displaying to all out there, mostly to trolls, your (under)achievements. Or calling attention to your slacking; business can’t wait! (You’re not essential though, by the way, easily dumped by the wayside if some human or not algorithm plays it that way).

And there’s the IoT, sensors, networks, actuators, and Central Scrutinisers (1979 mind you!!) that form the Matrix itself. Out of control, soon to be out of control of any human or (alternatively) TLA. Soon to be run by its transient Singularity.

Now, don’t make that error again!

Maverisk / Étoiles du Nord