Bluebottle

 

Image from Pixabay

“Big bluebottle optimistic about 160th attempt to pound through the window,” the Dutch satirical website De Speld reported this week. At times I feel a great connection with that insect.

Do you that feeling that something is crystal clear to you yet not at all understood by someone else? I also sometimes sit on the other side, for example when the children have fun saying "Hey Marco, great!" and I ask them what the hell they're talking about (it’s a viral TikTok thing; you don’t need to know more about it).

However, if I myself am surprised because someone really doesn’t get it, then it is a different story. You need to respond professionally, whether in your private life or at work. An example of the former I experienced twice when the children entered high school and were taught mathematics. I used to help them with math, and when I was dealing with simple equations, I found that they had no idea what a variable actually is. Their glazed looks when I said: “Just fill in 2 for x…” spoke volumes. Then you have to reset yourself, go back to basics and find words to explain something that is completely self-evident to you. In the meantime, I do wonder how a teacher could possibly not notice something like this. By the way, it helps if you've been through a situation like this before – with the second child I quickly recognized what was going on and wasn't even surprised anymore.

But especially in my work I sometimes feel like the bluebottle, trying to smash through double glazing. Taking an extra run-up and hitting that window again at full speed definitely wouldn’t do much good. That fly doesn't understand. I do. And so I'm going to look for another window that might be open. Although that takes extra time and effort, it does offer perspective on achieving my goal.

You have to be open to this phenomenon on both sides. Yesterday I was in a meeting about how we should deal with the BIO (the Dutch government’s baseline for information security, fully bases on ISO27002) in a certain project. After a while I realized that one of the participants might not know what that BIO is all about. That's why I asked him. In this case, he was well informed, but it’s also possible that someone completely drops out because they don't know what you're talking about. On the other hand, if someone talks about something you don't know, or uses an abbreviation that doesn't mean anything to you, ask about it. After all, there is only one stupid question: the question that was never asked.

I've been struggling with passwords for a while now. Every now and then I run into colleagues who – no doubt with the best intentions – handle passwords insecurely. Typically, these are system to system passwords used in testing. These tests are often performed automatically, sometimes in the middle of the night. Now there are techniques to ensure that those passwords are in a digital vault, from which they can be retrieved by the relevant process. Without human interference. And no one knows those passwords, because they are automatically generated and immediately encrypted and stored in that vault. Sounds solid, doesn't it?

Unfortunately, there are teams that cannot or do not want to apply this. They request the password in plaintext and want to store it in their team password manager access it if necessary. When I hear about that, I'm just that bluebottle thinking: how come they don't understand that passwords for system to system access should not be known to people? But of course it is never that simple. There are always good reasons not to do it the right way. And if something works, there is usually little incentive to change it. But, I say: open your window to let the bluebottle through. This results in a win/win situation: fly happy, you happy. And your operation becomes a bit safer. Even if it is 'only' in the test environment. Which by the way should be production-like…

 

No Security (b)log next week.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

 

• online platforms, such as Google and Amazon, will no longer be allowed to manipulate their European users.
• Google will soon offer us a smoother cookie wall. [IN DUTCH]
• maybe that iOS app is still tracking you.
• Preferably arrange your privacy before critical questions arise. [IN DUTCH]
• As early as 1971, people were already concerned about the privacy aspects of computer use.
• can you not report data leaks for a while. [IN DUTCH]
• finds weaknesses in the security of systems quite a bit of pocket money.
• ill-considered implementation of zero trust can lead to security systems going blind.
• Patient records, which were stored in the cloud, were inaccessible for hours due to a DDoS attack. [IN DUTCH]