-
Complexity: enemy of Security
There is a lot to be said for the old maxim of KISS: “Keep It Simple, Stupid”. The complexity of modern systems often masks flaws that the creators of those systems do not notice, especially when several separate systems interact in complex ways. But someone may find them eventually, and if you’re lucky then it…
-
Key (un) Safes
You may have seen a few previous articles of mine on locks; this and this talk about one type of mechanical keysafe. This talks about master keying systems and their inherent vulnerabilities. I find locks fascinating from an information point of view. And today I’m looking at the human side of these common devices. You’ll…
-
What is “Cyber Assurance”?
This is something I’m often asked about. The literal answer is simple, but not terribly helpful: it’s the process of providing assurance that an organisation’s digital assets are secure from threats. So what is “Assurance”? I tend to describe it thus: “Assurance is the difference between thinking you know something, and actually knowing it –…
-
Novel Training Techniques: Public Key Exchanges
I’ve run a few training courses with novel techniques for getting memorable lessons across. Here’s another. Nancy Pierpan: You trust me. Why on earth would you trust me? Johnny Worricker: Because that’s the job. Deciding whom to trust. That’s what the job is. — Page 8 Knowing whom to trust is difficult. If it wasn’t,…
-
“Mine is the last voice that you will ever hear. Don’t be alarmed.”
Ongoing events in supply-chain subversion involving high explosives, coupled with other world events, have awakened many Cold War memories for me. And here’s another one that has bubbled up to the surface: the quotation that is the title of this article. It appeared on some of the (many) mixes & remixes of Frankie Goes To…
-
Supply-Chain Subversion
How well do you know your supply-chains? It was only a couple of days ago that I was commenting online about supply chain assurance. And now, today, we have a real and dramatic demonstration of what a supply-chain attack can achieve. Maybe it will encourage some better consideration of supply-chain risks throughout industry. All sorts…
Proudly powered by WordPress