 |
| Image from Pixabay |
Professor
Barnabas was kind enough to lend me his time machine. I take you back to the
1990s and we land at the Walterbos campus in Apeldoorn, the Netherlands, at the
time the only location in this city where we had an office. The two highrise
buildings were not yet there, nor were the underground passages – if you wanted
to get from one building to the other, you had to go outside.
The
company restaurant, which at the time we simply call the canteen, was located
where tower H now stands, next to building G. The canteen had a tiled floor and
a wooden ceiling; the laths were half an inch apart and above them was black
cloth. At a certain point, that ceiling was replaced by a smooth, closed
ceiling. It looked fresh, but had an unpleasant side effect: the acoustics of
the canteen had deteriorated enormously. In the old situation, the sound was
partly absorbed by the open ceiling, now everything was reflected. The canteen
had become very noisy and that was certainly not pleasant.
A
while later the floor was fitted with carpet tiles. I don't actually know
whether that was an acoustic measure or whether this adjustment was planned
anyway, but I always suspected that this was intended to compensate for the
damage caused. The problem, which was caused by the adjustment of the ceiling,
was solved on the floor. And it worked. But how well thought-out are carpet
tiles in a canteen? Spilled tomato soup on a tiled floor is no problem. It
becomes an ugly stain on carpet.
Back
to the recent past. Last summer it was very hot, on occasion. So hot that the
equipment in a technical room on our floor had a hard time. Such areas are
equipped with additional access security – only authorized personnel can enter.
But because melting equipment was not such a good idea, they had a mobile air
conditioner brought in and placed in the doorway. The warm air from the
technical room was blown into the office space. Problem solved. Or was it?
Followers
of outside-the-box thinking may love those carpet tiles and the air conditioner.
I personally tend more to solve problems where they arise. Poor acoustics due
to a closed ceiling? Do something about the ceiling. Overheated technical room?
Provide cooling inside that room. Especially if an outside-the-box
solution has unpleasant side effects, such as a stained floor in the canteen.
Or how about compromising the security of a technical room, in combination with
heating up an office space which already was quite hot?
If
the ideal solution is not quickly available, I understand why an alternative is
chosen. But if you introduce new risks, you must take compensatory measures.
Once upon a time, at that old Walterbos campus, summer also got just too hot.
Then the doors of the computer center were opened, and a security guard was
stationed at each door. No one was sitting at the open door on our floor. The irony
of this happening where the security team is located...
Sometimes
you cannot avoid solving problems somewhere other than at the source. Suppose
your organization wants to put data in the cloud. But because that is someone
else's computer, you see unauthorized access to your data as a risk, partly due
to the fine American legislation and the fact that you almost by definition do
business with the US when you go to the cloud (remember, this blog post comes
to you from Europe). Then you can only do one thing: protect your data in such
a way that it is of no use to anyone who gets their hands on it. Encrypt your
data, and do so in such a way that no one except your organization has the key.
If the cloud supplier does not have the key, he cannot hand it over, no matter
how angry a government or law enforcement agency becomes.
Managing
your key yourself makes things a lot more complex and you also get less value
for your money, because the cloud supplier cannot provide certain functionality
because they cannot read the data (think of all kinds of statistics that would
be quite interesting to your organization). If you do it all yourself and get
fewer functions, that will make a difference in the price, I hear you think. That's
right, but in exactly the wrong direction: it will become alarmingly more
expensive, as we experienced in a recent tender.
There may be no or fewer Security (b)logs appearing in the
coming weeks due to a conference and days off/holiday.
And in the big bad world...
This section contains a selection of news articles I came across in the
past week. Because the original version of this blog post is aimed at readers
in the Netherlands, it contains some links to articles in Dutch. Where no language
is indicated, the article is in English.
- the major cloud suppliers are doing more on security under political pressure.
- Apple has secretly adjusted your privacy settings.
- you are responsible for any ChatGPT wisdom you disperse. [DUTCH]
- policymakers should go on a business trip to China to learn how we do not want to deal with biometrics.
- Facebook gives in to pressure from governments and turns a blind eye to disinformation.
- TikTok (of all things) has exposed a disinformation network.
- the very same TikTok doesn’t do anything about an account doxing random people.
- Delivery robots are also very useful for the police, because they film their surroundings non-stop.
- Bing Chat shows toxic ads.
- a zero day vulnerability is an urgent reason to update your software.
- some zero days are worth a lot of money.
- Some European countries advocate allowing spyware on journalists' phones.
- As a cybercriminal, you must of course have your own information security in order.
- the Ukrainian government has published a report on Russia's cyber tactics.
