Extra, extra! A Fine!

It was bound to happen: Fines! For privacy violations! Oh how do the Frightful Five shudder at the thought of these economic penalties that will down their businesses. Not so much. Is there anyone that thinks the fines will do better under the GDPR regime ..?

Kindergarten dreams. If all people are nice to each other there will be no more war and world peace. If GDPR kicks in …

Plus:

[An air of nice, just the air; not Nice but 4711 Cologne]

Fighting the Fifth Estate

The Fourth Estate it was called, before it succumbed to sycophantry and fake news. The journalistic world, that by its moral code and behaviour cleansed the news so that the trias politica, and the populace, could do its job of monitoring and correcting each other.
Now that the fourth is no more (effective) [edited to add: some holdouts, like Bellingcat], but the Fifth is (Facebook, Google, … the Frightful Five), one might need extra resources to get the first few scratches of control back.
With this little device. An anti-bug. Not preventative yet, but detective with resilience against detection. Counter-intelligence.

Oh this was just a HT to the developers. And BTW, any half-decent TLA would support these guys [edited to add again: Bellingcat], for their adherence to lofty principles does in fact align with the ultimate, ulterior purpose of any country’s TLAs. Only the stupid will fight against noble straight-backs.

Oh and:

[Yes even HMs GCHQ would, in principle, concur. Or, they work for the Dark Side; London]

Deviate for Resilience

Well there’s an imperative. Deviate for resilience. Which goes waaay beyond mere ITCM or its linkage into BCM. What I mean here, though, is a reflection from the B side into the IT side.
Once encountered when it was still supposedly somewhat ‘cool’ (as it was called in the grandpa’s days) or so to work on … can you believe it, $AAPL infra. Where the Infosec staff had carved a corner for themselves: That they’d actually need to deviate from corp policies (the devolved kind) of using M$ stuff for alibi reasons of needing in ITsec par excellence, a fall-back that would actually work when all of the M$ infra would’ve collapsed due to some class breaking glitch exploit. Yeah. That meant that you did need a substantial budget to your own discretion without much transparency towards effectiveness of spend and no gadget and toys buying, right?
Nowadays, the coolness if ever it truly was (stupid sheeple), has worn off totally and is a tell for no comprendre qua cost/benefits analysis, sufficient tech-savviness to cut it in today’s world, and forward compatibility even to the cable mess (costing you tons). Predicting which unicorns will succeed, or fail, is easy; the former are on M$, the latter on … you guessed correctly. Nevertheless, the resilience argument still holds.

Which goes beyond the mere platform choice. It goes for global/local deviations as well. IF yes that’s a big if, if done right, not for NIH purposes (both ways ..!) but for resilience purposes. It’s not efficient to the max, but if you strive for that, you’ve done so much wrong already it might be irrecoverable. E.g., mission, organisational culture, risk management (incl analysis), control choices and implementations (case in point: multiple malware scanners), etc.

But remember: When done right, you very probably do need to deviate all over the place for resilience…

Just remember that to defend yourself, OK? And:

[If telecom fails due to clock synchro errors, it’s still a sun dial (really it is); Barça]

Your security policy be like …

The theme of your security policy and how good it is (not), is of course a recurring one. The recurring one, annual cycle (Is that still frequent enough? Yes if it’s truly a policy like here) included, with an all else follows attached. But then, it’s only Bronze when only a top-10 bulleted list extracted from … ISO2700x, mostly. It’s Silver when actually compliant in all directions, which includes serious ‘local’ adaptations…
And it’s Gold, when over and above that, it looks like this.

Not even kiddin’, really. Since your information security policy, next to the other security policies …, covers all of information of any kind and medium processed anywhere in the business. Which means that the from-IT angle will very probably not suffice.
But which also means that it helps when it rocks, in ways that interests all of your audience which is all of your colleagues including all colleagues at outsourced, cloudsourced and what have you processes and lines of business. Transparency, right ..? Runs all the way down the food/supply chain.

Indeed, the maturity of a company may be gleaned from the maturity (rocks’iness) of the information security policy. Get that right, and all else need not follow since it has gone before.

And oh, did I mention that in the implementation, resilience should be built in and not only be through formal (for-) BCM practices ..? I’ll return to that tomorrow. Plus:

[Lightning (-) rocks (pavement), too; Ottawa]

Copying it bluntly, for you

Just like that, a full page of niceness and arguments to consider. Guess which one I’m switching to. So should you. Competition, leading to improvement.

Dubbeltestje

Ubent nu onderdeel van een testje. Niet statistisch verantwoord, maar dat is sowieso vrijwel nergens te vinden; dát zijn pas unicorns …
Anyway, without further ado, let’s see how many (huh) hits this post will get when it’s half-Dutch. When you’d interpret that as half-baked, you’re correct…(?)

Terwijl er tegenwoordig héél wat luipaarden zijn, die nu dus voor de foute partijen kiezen contra het vage clubje, “ze”, die de leeuwen zijn in dezen. De welpjes, die hebben nergens benul van noch hebben ze ooit iets fout gedaan (?). Etc.; het is allemaal nog heel relevant vandaag de dag.
And, on a lighter note:

Too late for GDPR compliance ..? Click here to pay up

It seems like everyone’s finally waking up to the fact that ‘GDPR D-day’ is less than 283 days ahead.
Yes I checked. And I didn’t discount for weekends – minus 80 days, more of less –, holidays – either the normal kind, at some three weeks in this period, or the sanctified ‘bank holidays’ for those that say they don’t believe in holidays, or say they do but still are too awkward sheep to actually go on normal holidays, maybe a week in total – and the year-end curfew on all IT changes because business is doing things they have done for years, decades, and still haven’t mastered apparently.
So, we’re more in the area of 100-150 business days left.

Before what …!?

GDPR has power of law per … 20 days after its publication in the EU Official Journal, on 4 May 2016 … !!!

It’s just that officially, it’s not enforceable.
And would one be able to challenge organisations already today, e.g., with the letters from hell just not from the duds?
[To the latter: The Dutch DPA was sanctioned in court four times recently for not having acted sufficiently in spirit and to the letter of their tasks. Suggest to estimate what percentage this constitutes to the actual number of cases they didn’t act sufficiently where legally, they were and are forced to; refusal to obey instructions…]

No really: ‘Civil’ law is other than administrative law, right? Enforcement is postponed, but is the requirement to comply as well ..?

Will ask legal advice. And:
[The Classics, may stay even when at an angle; NY-NY]

Long and fruitful lives

Again, the discussions re pension age turns up; whether those in ‘physically stressful’ occupations should be pensionable – even in this day and age, without any regard to subject’s want or not..! For 10 points, compare to slavery – at earlier ages. Use 100 words or less.
Where there never is any regard either for the starting age(s) of work. Most often, those in the ‘physically stressful’ categories will have started work early, right? And/or, have paid their dues, in terms of contributions to pension schemes anyway, or indeed hard work without much in the way of tax deduction cleverness. So yeah, when it comes to a ‘right’ to be pensioned early, that should be, should have been for a long time already you lazy … policymakers, in the schemes. And, for those who started later (like Yours Truly… much later but better prepped and experienced than my cohort, definitely), having to end later should come as not much of a surprise nor special burden. Nope, I didn’t mean pre-tired half-lives, plain late-r-etirement…

Whatever. Plus:
[When this is your work/-place, you’re not used up so early, are you? Granada]

Question: Aggregate discrimination?

Iwas a bit puzzled: In all the discussions about forcing diversity into organisations by ‘positive’ discrimination even if only by preferring one candidate over the other when they are otherwise equal hence the selection criterion is discrimination by definition (sic), where is the issue settled that issues at group level, do not reflect well on individual levels ..?
That’s a long one. Triggered by this memo of Googles exexec of course, which is a rational analysis followed by a point-proving response …
I’m not going into the detail of that discussion there. However, I will go into the thing that discrimination is defined as preference based on irrelevant distinctions. Which works out in hiring like:

  • In masculine organisational cultures [to take the by far most common starting position…], shock therapy will only be counter productive to all. Very-feminine women [same, qua LGBTQ inclusion] will be laughed away at their first outbreak of tears, either openly or covertly, and be let go for not being able to stand the heat. Men will be confirmed in their convictions that high testosteron is a requirement for the job, and have the ‘proof’ (quon non).
  • If any such lady would survive, it can not be but for two scenarios: Either the men park the lady in some inconspicuous, near-only flower arranging function where nothing changes except having a token female around to show off, or the lady adapts, or chips in, or was on the masculine side of the vast statistical spread already (however off-center). Oh third scenario, the most unlikely one: All (sic) adapt – but when there are many men already, the ‘average’ will remain close to the starting position which means the lady has to adapt most, and the many men only slightly. That helps a tiny bit, and may take a long while to help (devolved-)Kaizen-style.
  • How can I help that I’m a white male …? It’s not that I had a choice, and why should I be discriminated against when someone of equal capabilities for a job (IF properly assessed so, yes) happens to never had a choice but be female/…/… and also …/…/…? Such a scheme makes me an immediate victim of discrimination, the same discrimination situation there was before the hiring started… Reminds me of that old story at a Party conference: [Speaker shouting] “What is Capitalism!?” [Crowd shouting] “One man exploiting another!!” [Speaker shouting] “And what is communism!?” [Crowd again] “Exactly the opposite!!”
    And also: I want to win the WC 100m dash too but the others are faster than me (just); that’s discrimination!
  • Of course, there’s tons to be said about the assessment of capabilities for the job, both on the candidate side (only the best of the best of the best psychologists might be able to more often than not correctly assess someone’s capabilities correctly, all others will fail dismally the more so the less they are aware of their own assessment-incapabilities…), and on the job side (have you ever seen an appropriate, consistent and complete job description let alone an equal requirements description …!? That’s a lie). Fix these two, and I’d say you’re quite on your way to solving a major part of the problem. You will also no longer ‘discriminate’ against redheads, people with polka dot socks, etc. But this will be hard, especially in the area of properly describing job requirements, not to include the often very ‘diplomatically’ formulated requirements of being a chum, having friends at the department already, not rocking the boat, belonging to the right country club (or ), etc., or even worse not describing such subtlest of subtlest subcultural clues but applying them nevertheless.
  • It seems that apart from the assessment process atrocities, the root cause of all the above is in two elements:
    • Discrimination happens at two levels; individual and, by addition/statitics, at group level;
    • The solution/correction is sought to fix the group level but is applied at the individual level.

    That’s not going to work. Though there’s no avoiding belonging to groups (even when at the spread-out multi-affiliation levels and circles, bubbles and foams of Sloterdijk’s kind!), some group affiliations are irrelevant and/or hindering, unwanted, irritating to individuals that are ‘allocated’ to these groups by others without consent, want or need.

    Oh and then, there’s a third root cause: The stupidity of statistical generalisation, a.k.a. ‘the statistician drowned in a river of one foot average depth’. Meaning again that not all men are pigs. Like the Bell curves; a great many [F/M] have more of XYZ than quite a number of [M/F], and shoving all into the extreme corners as typification, is an insult to those that have no want for such undue generalisations.

  • Where are the companies where the work force is >50% female/…/…, that beat the heck out of male-majority companies ..? Not just some unicorns, but real, like, 5000+ FTE companies. Strange. The Frightful Five all rose in the past two decades. Equality-pushes have been much longer already – allowing more than ample time to have such role model counterexamples. What’s ‘wrong’ (not) ..?

I’m not sure where I’m going with this. Apart from the conclusion that ‘positive’ discrimination is not a solution.

Now go and re-read the exexec’s memo all the way to its conclusions. The commenters there, don’t seem to be able to think straight, by the way; just hecklers to be dismissed. And, not being allowed to even discuss ‘diversity’ or actual facts pertaining to that, is the most direct and in-your-face form of censorship thinkable. There’s hardly anything even equally unconstitutional than that; if the ‘values’ at Google call for such unconstitutional behaviour, the company should be disbanded and execs jailed for it.
[Edited to add before scheduled release: How easy can all comments be summarised on the polarisation scale from nuanced and content-focused, all the way past the preconceived-conclusion reiterators that are close to, the so PC bigoted that they can’t even see their own extremism. Sad. Very sad. In ten, twenty years’ time, people will look back and not understand the blind fanatism of the wrong side…]
[Edited to add before scheduled release again: This here piece by some professor. Seriously misinformed, misinforming, apparently, or just throwing oil on e fire for fun.

For what many seem to have missed, is … the tech industry needs to change, by turning normal. Meaning that it needs to get away from the tech-only jobs and have more balance in there. See above qua job requirements … It’s not about biasing the hiring, which is unduly biasing in itself!, but it’s about changing the work into ‘normal’ jobs; then, you’ll find that all those jobs that favour the excluded, will suddenly be there, and the evironment in which they [not They The Others, just as a group designator] thrive, will be there too as the required performance will be up their alley more that it will be up the techies’. To put it bluntly [big !!! here], if you want more white people to be able to compete in the 100m dash, it’s no use giving them a head start or so. ‘White people’ may shine in other thing [Chess? Unsure what would happen if playing that, were more ingrained in other cultures…!] – only if we loose the distinction and not discuss any, do we level the world’s playing field for fulfillment before we require all to be good, healthy, happy and helpful, and well-rounded co-workers in any industry, good, healty, happy and helpful, and well-rounded caregivers at home and to everyone in our environment however near or far, ditto loving spouses, etc.etc. – again, them everyone will be equal … uhm, not; not everyone has the same abilities, remember ..? The thing is not to care in which direction your abilities are, or how far they go. Everyone being equal, all are boring like heck!
So, the real thing is to realise the tech industry may be average-women-unfriendly on average and that may (!!!) have to change, just like nursing and breastfeeding are male-unfriendly on average and have to change. ‘Positive’ discrimination is not going to work, neither is unbiasing-workshops – that’s punishing (sic) people for not doing something particulalrly wrong like putting them in brainwash/indoctrination labour camps… Now re-read the memo again and see that it says that. ]

Okay, to prevent further outdatedness by delay, I’ll post now.
Oh, and:

[Right… Digging in will help… Not. Spain]

Diving under, almost, everything

Dindn’t we feel it coming, if not in the air tonight than at least, after we signalled that BIOSes had been targeted… that there’s always a layer deeper one has to be on guard for infosec leakage and backdoors… How did this ‘surface’? Bypassing all the O/S features …

Just putting in down here. E.g., which, how many, platforms would be vulnerable to this; how much and what sorts of traffic could you send around through this …? Would one be able, when in so deep, to pick up system/sysadmin/root rights/credentials when browsing around ..?

And here we (not) are, all fleeing to the End User Is Stupid mantra, away from our own failings in tech but hey, users are the weakest link so we shove tons of hard protocol i.e., stupidity, on them. And burying them in awareness smotherlectures, instead of creating real behavioural change.

Oh well. And:
[Buried under the tons of network traffic, there’s a pay(ing)load you see? Nyagra]

Maverisk / Étoiles du Nord