Newsletter — whence cybersecurity and trust?
It’s an author’s worst nightmare. You write a book, it’s complete and just about to be published. So you ask a few people for a review — it would be nice to get some positive words on the back and, frankly, you want a bit of a stroke. So you send off the manuscript to a trusted party… and they come back and say it’s all rubbish. Stop the world, go and sit in a darkened room and hope it all goes away.
And yes, it happened to me when I wrote a short book on information security architecture. The trouble with it is, it suggests that you need to create an architecture for information security: this approach flies in the face of (some) cyber-thinking, which starts from the point of view that any notion of perimeter security should be consigned to the past.
It’s not bad thinking, indeed, it is highly valid. Google have adopted an approach for their own internal systems that encrypts every communication, based on the assumption that no system can be secure. At the same time however, try walking into Google’s buildings and see how far you get. As with so many things in life, absolute positions generally end up tempered when they hit reality.
Cybersecurity best practice really only needs five rules.
1. It’s all about the data. Which means understanding it before you can protect it.
2. It’s a board-level choice. It can’t be delegated away, outsourced or otherwise.
3. It’s about understanding the whole picture. Which means architecture.
4. It’s impossible to protect everything. Which means being able to react.
5. It’s never done. And why would it be, if technology keeps changing.
Obviously, there’s a great deal of devil in the detail but if organisations could only get their heads around the above, we would all save so much time and effort. These rules should be as prevalent as ‘don’t run with scissors’, but while they are not, we reiterate (and indeed write books about) them. And, as an aside, security vendors are stuck with scare-story marketing, not because they want to be forever spelling doom, but because it’s the only thing that works. Ho, hum, and on we go.
To whit, some articles from this week.
Cybersecurity should be a board room topic
A global survey by Allianz has found that cybersecurity is now the number two global business risk, up from fifteenth position 5 years ago. Number one is business continuity, which is a bit of a circular argument of course — a threat to business is not being able to do business? But perhaps organisations are finally getting the message.
Trust in media is collapsing. Is that such a bad thing?
Imagine my delight when I found publication of fake news was illegal during the French revolution, with the obvious consequences. Incidentally, if you want a positive story about the impact of technology its ability to democratise data distribution, execution by guillotine continued well into the 20th century, but it was the arrival of film recording that led to its demise. Turns out the mob thing quickly loses its sparkle if you’re not there.
Extra-curricular: how not to write a biography
In other news (which is semi-curricular, to be fair), I gave a talk on this subject to the Gloucestershire Society of Authors group this week. I’m reminded of Christopher Norris’ response when I went on one of my usual existential rants about whether I was actually an author, or ‘just’ a writer. “Oh, you’re definitely an author,” he sad. “But you’re not an auteur…”
On that note and until next time, Jon