Greetings! Sorry not to be more substantive lately - saving my energy for RSA, which I leave for TONIGHT. OOF! :) Wanted to share 3 interesting posts from today, in case you missed them...
1) The DNI Email: @jack_daniel comments on receiving an email from the Director of National Intelligence on the released torture memos. I got one, too. Current theory is that they sent it to the RSA press or attendee list. Did you get an email with it, too? Interesting...
2) Lindstrom's Confused Again: Old buddy Peter Lindstrom posted about risk today, but I'm not sure his post makes much sense. Sure, the first bit on likelihood seems right - probability of bad stuff happening is indeed rather important for risk assessment/calculation. However, he goes on to say "...we often suggest that in order to quantify risk we must quantify our consequences as well, but this isn’t the case. Since we are identifying unwanted outcomes anyway, in many cases we implicitly understand the value or loss involved..." which makes me wonder, Is this really true? I'm not sure that we do implicitly understand losses very often. In fact, I'd say that this is one of the core cognitive dissonances with infosec: people really truly do not implicitly (or fundamentally) understand the consequences that stem from their actions online. Think about it. :)
3) Facebook's "Democracy Theater": As suspected, Facebook's new rules have been released and they're really no better than the last go-round. The difference? People now think that things are better. However, according to Light Blue Touchpaper, they're not. Oh, sigh.
If you're coming to RSA, hope to see you next week! I'll be in ABA meetings Sat/Sun, bouncing around Monday, largely free Tuesday, reception-hopping Wednesday, rolling (Gracie Jiu-Jitsu) with @jeremiahg and @Beaker Thursday, and so on. w00t! :)
