New UK.gov cyber-security standard puts MANAGERS in firing line

Here's an opportunity

for those peddling secure operating systems.

AIMemo from/for Offices and Officers of CyberIntelAIgent Security and Virtual Protection ..... MuI7

Gov seeks views on private sector rules.

The UK government is seeking to hear from businesses that would be interested in submitting evidence to help form a new "organisational standard" for cyber security.

Rules for and/or from the private sector on a new "organisational standard" for cyber security? Oh, FFS, wise up and smell the Java/Cocoa, Crashed Test Dummies. There aint no stinkin' rules other than screw your neighbour better than they have ever been screwed before …. and in so doing, make a packet and a bundle for all who would be highly supportive of the pleasure, although it can be even simpler than that whenever they would be unable to do anything to stop anything considered worth doing.

You just don't quite get it and IT yet, do you? Things have changed …. and governments aren't in control of anything, and most certainly not in that very private, and even as needs must oft, and even always, pirate sector, for they just aint fit for future purpose with the personnel they have in dummy elected offices.

And y'all can crow and cry about it and try to deny that as much as you like, but that be the gospel and Global Operating Devices honest truth clearly shared. Get used to it and be prepared for CHAOS to reign in the place of rules and madness and mayhem, ignorance and arrogance.

And you do know what CHAOS can do both for real, practically, and virtually for the surreal and sublime, don't you, or haven't you been paying attention to wall that which you have been told all these years?

Here's an opportunity .... for those peddling secure operating systems. ... Ole Juul Posted Thursday 7th March 2013 07:46 GMT

Quite so, old bean, and a golden opportunity it be too, with the very best providers very careful and discerning about who they supply their intellectual property to, because it can be so catastrophically dangerous to recipients if abused and used wrongly and badly.

Although, having said all of that, it would be more than just nice to be proven wrong and find out that there may be an effective few in active government who be quick learners and willing to embrace the new age and follow new protocols and principals with novel and noble principles, but I aint holding my breath a'waiting for that to happen or make itself known.

CESG

The Defence sector has a bunch of standards we have to follow. (eg JSP440), plus a quango to approve applications etc, (CESG). I don't understand why UK.GOV aren't chatting to those guys.

(All defence IT systems are supposed to be pen. tested and must be accredited)

We have two 'cyber-security' workstreams

One aimed at achieving compliance with government standards, which keeps a significant bureaucracy lucratively employed, but does nothing to mitigate the real-world risks we face. The other, carried out by practical people with a clue, is aimed at giving us some real protection against those threats.

Years of experience says this new government initiative will make the situation worse

Cyber = fail

Use of the word "cyber" in this context shows that this initiative is merely american-infected security theatre.

There is already ISO2700x and PCIDSS. What does this add?

Safeguard Proprietary Information

It is time to end the indiscriminate use of the Internet for information the organization cannot afford to lose and doesn’t know how to protect. It is time to ask acquisition program managers and industry executives to exercise due diligence and to supply evidence of safeguarding proprietary information based on rational conditions for Internet use and various degrees of urgency. What are the pre-conditions for using the Internet?

Acquisition program managers and enterprise executives have a duty and responsibility to safeguard the proprietary information under their control from the clear and present danger associated with Internet use. Accordingly, an organization should not use the Internet for data or information it cannot afford to lose or cannot protect. If it decides to do so in the presence of the known risks, it must be prepared to accept the consequences for stepping over the red line.

Internet availability is a live connection or pathway to the Internet open to Cyber attacks accompanied by known weaknesses, vulnerable attributes, unresolved outcomes, persistent bad actors, and unresolved consequences. The organization that explicitly assesses the rational conditions for Internet use, follows the rules and conditions governing rational use of the Internet by staying within the lines of the truth table of rational conditions; decides to accept the risk of Internet use due to urgency whether vital, necessary or desirable; and rationally accepts the consequences governing use of the Internet beyond the red line is an accountable organization to be admired.