Posts by Darth Poundshop

Re: Here we go again

Yes and no. It can be done honestly - in effect, our IG Team ask something like 'can you give us evidence of patching and update regime working'. IT, quite honestly, then supply them with the requested evidence. The auditors then check the IG Toolkit submission against the provided real-world activities and Behold! It's a Pass!

However, if IG came to IT and asked, 'can you give us evidence of where you're patching and update regime is catastrophic', IT would be able to supply this just as easily.

In short, auditing is not pentesting, they're all just looking where the light is.

Re: Phishing Emails

The theory, at least in part, is that we collect phishing emails to try and monitor the volumes or patterns of attacks, whether any particular person or department is being targeted, whether there is any useful information in the headers (e.g. one time we were able to let an IT company know that one of their servers had been compromised) and pass the information to the police as evidence. Also, we can use the email dialogues, between scammer and victim, in our training.

Of course, this being a department within a well known public body, where IT Managers are not chosen either by IT expertise or management skills, the above theory and actual practice seldom coincide.

Yep

The actual recipe for AI is 10% statistics, 20% snake oil and 970% media hype.

Also, trying to apply 3 or 4 ridiculously simple laws (wishes, more accurately) to autonomous systems won't work, whether they're a robot, a corporation or any other kind of complex cybernetic entity - "Hey, petrochemical corporation - don't harm humans or by your inactions allow harm to come to humans".

Yeah, that'll work.