Tag: IRM

Accountansdiscussie: Start en eind

Als 28 mei @nbacc met @tuacc in de slag gaat, is deze post misschien een hulp, en onderstaande alsnog het resultaat…
Imago accountants
[Parool, zaterdag 24 mei 2014]

Want laten we wel wezen: Een lab voor diepe vaktechniek loopt consequent (if) aan tegen: “Volgens de theorie kan niks hier werken en weten we exact waarom. In de praktijk werkt alles, maar niemand weet hoe. Wij mixen theorie en praktijk.” en ook: ” Laat niet degenen die zeggen dat iets onmogelijk is, in de weg staan van degenen die dat iets al doen.” Succes …

[En dan krijg ik weer te horen dat ik ‘te’ cynisch ben. Cynisme is een laatste poging vooruitgang te bereiken – waar de meeste betrokkenen (?) in apathie afwezig blijven, geestelijk of fysiek. Apathie; de houding van degenen die alle hoop zijn verloren. Nee, dáár ben je blij mee…]

Cryptostego

Just as last week I’ve been discussing stego with colleagues, I missed this Bruce’s post…
Be sure to read the comments, though. A couple on stacking steganography over cryptography, which is what I would presume would work.

And, again the question: what would you know of actual use ‘out there’; is it common, rare, what are the characteristics of its users ..? Is it the next big thing after (?) APTs …?

Oh, here it is; the pic you expected:
DSCN2526
[Would ‘Riga’ be a hint that there’s more to the picture …!?]

Column on Open Source code Bystanders

Well, the column is out there now… Will be published in the July 2014 ISSA Journal but here’s a preview, in Dutch

And, of course:
DSCN6225
[S’bourg, or Brussels – always mix them up and end up in the wrong place for a meeting]

The InfoSec stack (Part 1b; implement or not to be)

Some have questioned why I put the Compensate part upward on the right side, instead of downward, as is usually considered.
Well, this may be obvious to those in the know, but: Compensating control weakness at a higher level simply does not work..!

This, because of some very basic principles:
1. Any ‘control’ at some level, will have to be implemented at at least one lower level or not exist at all except for some ink on paper (OK, ‘ink’ on ‘paper’).
2. ‘Implementation’ of some deficient control at any level by ‘compensating’ it at a higher level, will lead to an implemenation at the level of the deficiency or lower, or will not be implemented.
3. The lower the implementation level, the stronger. The higher, the weaker. ‘Compensating’ at a higher level requires more controls there to be about as strong, and hence more at the same/lower levels as implementations otherwise the same strength may not be achieved.
4. ‘Compensating’ at a higher level doesn’t fit in the design at that level or would be there already, the deficiency would not be ‘compensated’ by pointing at its rationale. Adding to the design, obviates that the design was deficient or is overcomplete now – the resulting implementation will be flawed by design.
5. Occam-like efficiency thus requires implementation of compensating controls at the same or lower levels.


[Paris, La Défense, for pictoral reasons]

QED

Maverisk / Étoiles du Nord