Creative solutions

 

Image from Pixabay

Professor Barnabas was kind enough to lend me his time machine. I take you back to the 1990s and we land at the Walterbos campus in Apeldoorn, the Netherlands, at the time the only location in this city where we had an office. The two highrise buildings were not yet there, nor were the underground passages – if you wanted to get from one building to the other, you had to go outside.

The company restaurant, which at the time we simply call the canteen, was located where tower H now stands, next to building G. The canteen had a tiled floor and a wooden ceiling; the laths were half an inch apart and above them was black cloth. At a certain point, that ceiling was replaced by a smooth, closed ceiling. It looked fresh, but had an unpleasant side effect: the acoustics of the canteen had deteriorated enormously. In the old situation, the sound was partly absorbed by the open ceiling, now everything was reflected. The canteen had become very noisy and that was certainly not pleasant.

A while later the floor was fitted with carpet tiles. I don't actually know whether that was an acoustic measure or whether this adjustment was planned anyway, but I always suspected that this was intended to compensate for the damage caused. The problem, which was caused by the adjustment of the ceiling, was solved on the floor. And it worked. But how well thought-out are carpet tiles in a canteen? Spilled tomato soup on a tiled floor is no problem. It becomes an ugly stain on carpet.

Back to the recent past. Last summer it was very hot, on occasion. So hot that the equipment in a technical room on our floor had a hard time. Such areas are equipped with additional access security – only authorized personnel can enter. But because melting equipment was not such a good idea, they had a mobile air conditioner brought in and placed in the doorway. The warm air from the technical room was blown into the office space. Problem solved. Or was it?

Followers of outside-the-box thinking may love those carpet tiles and the air conditioner. I personally tend more to solve problems where they arise. Poor acoustics due to a closed ceiling? Do something about the ceiling. Overheated technical room? Provide cooling inside that room. Especially if an outside-the-box solution has unpleasant side effects, such as a stained floor in the canteen. Or how about compromising the security of a technical room, in combination with heating up an office space which already was quite hot?

If the ideal solution is not quickly available, I understand why an alternative is chosen. But if you introduce new risks, you must take compensatory measures. Once upon a time, at that old Walterbos campus, summer also got just too hot. Then the doors of the computer center were opened, and a security guard was stationed at each door. No one was sitting at the open door on our floor. The irony of this happening where the security team is located...

Sometimes you cannot avoid solving problems somewhere other than at the source. Suppose your organization wants to put data in the cloud. But because that is someone else's computer, you see unauthorized access to your data as a risk, partly due to the fine American legislation and the fact that you almost by definition do business with the US when you go to the cloud (remember, this blog post comes to you from Europe). Then you can only do one thing: protect your data in such a way that it is of no use to anyone who gets their hands on it. Encrypt your data, and do so in such a way that no one except your organization has the key. If the cloud supplier does not have the key, he cannot hand it over, no matter how angry a government or law enforcement agency becomes.

Managing your key yourself makes things a lot more complex and you also get less value for your money, because the cloud supplier cannot provide certain functionality because they cannot read the data (think of all kinds of statistics that would be quite interesting to your organization). If you do it all yourself and get fewer functions, that will make a difference in the price, I hear you think. That's right, but in exactly the wrong direction: it will become alarmingly more expensive, as we experienced in a recent tender.

There may be no or fewer Security (b)logs appearing in the coming weeks due to a conference and days off/holiday.

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• the major cloud suppliers are doing more on security under political pressure.
• Apple has secretly adjusted your privacy settings.
• you are responsible for any ChatGPT wisdom you disperse. [DUTCH]
• policymakers should go on a business trip to China to learn how we do not want to deal with biometrics.
• Facebook gives in to pressure from governments and turns a blind eye to disinformation.
• TikTok (of all things) has exposed a disinformation network.
• the very same TikTok doesn’t do anything about an account doxing random people.
• Delivery robots are also very useful for the police, because they film their surroundings non-stop.
• Bing Chat shows toxic ads.
• a zero day vulnerability is an urgent reason to update your software.
• some zero days are worth a lot of money.
• Some European countries advocate allowing spyware on journalists' phones.
• As a cybercriminal, you must of course have your own information security in order.
• the Ukrainian government has published a report on Russia's cyber tactics.