 |
| Image from Pixabay |
The
blog from two weeks ago, about Gyro Gearloose, resulted in a question from a
loyal reader: I have downloaded the manual for my new car, but I still don't
understand what all the buttons and lights are for. Am I more of a Gyro
Gearloose or a Donald Duck? Genius or klutz?
An
interesting question. In my argument I indicated that from a security
perspective it is extremely useful to read manuals. This of course also applies
to a car: if you don't know how to turn on the lights, things start to get
dangerous around dusk. And if the red engine management light comes on, it is
useful to know that you shouldn’t continue driving home. But of course there
are also less important buttons and lights. Moreover, it is quite difficult to
learn all that stuff from a book. You miss the look and feel of the dashboard.
The
more complex the machine, the more difficult this becomes. My son is currently in
pilot training. Before he was allowed to take to the air, he received a few
months of theory lessons. There the students learn, for example, what happens
when you turn or pull the yoke: a flap goes up on one wing, down on the other, the
rudder does something and the elevator may also come to action. If you have to
learn something like this from a book, it is difficult because you do not see
the instruments in front of you and you do not experience the consequences of
your actions. In theory exams, students must demonstrate that they know how a
flying machine works. As if you have to explain, before your first driving
lesson, that the left and right wheels move synchronously when you turn the
steering wheel, but that the turning speeds of the left and right wheels
differ.
An
important learning principle is training on the job: learning to deal with
something while you are doing it. Driving lessons work like this, and
fortunately aspiring pilots actually take to the air eventually, for example to
experience first-hand what happens if you fly too slowly (the plane will fall
out of the sky) and of course, to learn what to do. For the same reason I once
took an antiskid course; reading what to do if your car skids is completely
different from experiencing and feeling it. I remember an exercise where a
moving plate in the ground whipped the rear of the car, causing the car to veer
off course. Before the exercise, the instructor taught us not not brake. And
what do you do the first time? You hit the brakes. Which causes the car to
spin. After this experience you know what to expect and you can deal with the
situation much more rationally: do not brake, but instead release the
accelerator, press the clutch and steer in the right direction.
Information
security also needs practice. It is easier to recognize a phishing email or
text message if you have seen a few of them, along with hints that could have
helped you unmask the message. But should we also practice something as big and
drastic as a ransomware attack? Of course! Obviously, you don't have to
organize a real infection for this; you can do a table top exercise, with the
right people at the table. Our business continuity management colleagues have
often organized similar exercises, helping crisis managers and other
stakeholders to understand what to do in a crisis.
Am I
more of a Gyro or more of a Donald, Angela wondered. I replied that most of us
are a Gynald or a Doro: hopefully not as clumsy as Donald Duck and probably not
as brilliant as Gyro Gearloose, but somewhere in between. Because as Gynald or Doro
you cannot take in everything at a glance, it is important that you realize
that you have to prioritize: in the car it is more important to know how to
operate your headlights than to know how to replace the bulbs. By the way, I
did that last weekend and I can report that you almost have to be a Gyro to do
that. But usually I am a Gynald. And you, dear Angela, probably go through life
like a Doro. But rest assured: practice makes perfect.
And in the big bad world...
- you should restart your phone once a week.
- the Dutch NIS2 law has been delayed by at least six months. [DUTCH]
- an internet provider had to replace the routers of hundreds of thousands of customers due to a malware attack.
- it is wise to check with the police whether your data has been stolen. [DUTCH]
- an international police coalition is working together against cybercrime in Operation Endgame.
- This article from Europol gives a little more information about Operation Endgame.
- the largest botnet of all time has been rolled up.
- the Dutch Data Protection Authority will supervise the Tax Administration. [DUTCH]
- This ransomware makes good use of BitLocker.
- you’d better stay away from this pirated version of MS Office.
- a VPN is not a panacea.
.jpg)
