Loading ...-
-
-
BlogInfoSec.com Sponsors
-
BlogInfoSec.com Partners
Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.
-
Qualified Writer?
Please contact us at: authors@bloginfosec.com -
Columnists
Categories
Translations
English • العربية • Български • Català • Česky • Cymraeg • Dansk • Deutsch • Ελληνικά • Español • فارسی • Français • हिन्दी • Hrvatski • Íslenska • Italiano • עברית • Latina • 한국어 • Magyar • Nederlands • 日本語 • Norsk (Bokmål) • Polski • Português (brasileiro) • Română • Русский • Slovenščina • Srpski • Svenska • Suomi • Tagalog • Türkçe • Українська • 中文 / 漢語Blogroll
-
Recent Comments
- Russell Handorf on Attack Visualizations Using GraphViz and Google Earth
- Travis Schack on Attack Visualizations Using GraphViz and Google Earth
- John Wheeler on Governance, Risk Management, Compliance (pt. 1): Form over Content?
- Matt Barney on Corporate Governance: A Dirty Word or a Dirty Job?
- Jens on The Difference between Quantitative and Qualitative Risk Analysis and Why It Matters (Part 1)
- Security Breaches News Commentary Solutions / Workarounds Virtual Trust Privacy Industry Commentary featured spotlight Awareness / Education Conferences / Events / Meetups Uncategorized Policies and Procedures Vulnerability Commentary FUD Theater CISO skills Forensics / Incidents Exploit Code / Malware Social Engineering CISO Encryption Phishing Viruses / Worms Legal & Regulatory Issues Penetration Testing Vulnerability Disclosure Tools risk management metrics Patching hackers awareness Security CISO savvy identity management incident risk Coding Securely / SDLC ROI leadership Information security training security awareness awareness training IDM disaster recovery business continunity contingency plans Jobs in Information Security education governance malware application security facebook self-awareness GLBA Gramm-Leach-Bliley agility HIPAA network assessment perimeter vulnerability assessment data breach notification laws data breaches identity theft PCI Budgeting for Security Reverse Engineering Books on InfoSec Interviews bloginfosec Annoucements ROSI soft skills Wireless Wireless Security Wireless Discussion Wireless Vulnerability Discussion Wireless Client SPAM end-point security successful behaviors No Tech Hacking Johnny Long awareness instruction hash algorithms digital signature compliance SB 1386 counterfeit fake equipment counterfeit equipment nation states FBI KPMG FFIEC COBIT ISACA government CIA triad data classification honeypot honeynet Risk Analysis Privacy Rights Clearinghouse breach incidents malicious insider business OWASP Gramm-Leach-Bliley Act law FUD process lifecycle reputational risk sarbanes-oxley SOX
© 2008 BlogInfoSec.com. All rights reserved.
|
Privacy
|
Terms of Service
Information and Disinformation: Thoughts on other’s assumptions
Since I have been publishing online, it is interesting to note how beliefs separate from Truth. It’s really interesting to see what assumptions people make when judging things. Let me give two examples via other people’s quotes:
Someone posted a link to my paper on reputational risk on Schneier’s website. It was later commented on in the same thread:
It’s funny that this person cites WEIS and their work “diffusing more broadly”. Perhaps this is true now because the rate of breach announcements are commonplace, but not when I wrote the paper in June/August of 2005. I hadn’t heard of WEIS then. I came up with the idea because I was tracking stocks in my personal portfolio. I also work at a bank where finance and the stock market are discussed openly. When the Citibank breach was announced in 2005 I made the connection. And, here is another connection I made: do you know how many companies (audit and compliance firms, software vendors) threaten institutions that if they do not do x, y and z it will lead to compromise which will lead to reputational damage? It’s a major FUD selling point! (Notice the emphasis on will, not may.) So, I asked myself if this was really true. And if so, wouldn’t the marketplace tell us? That’s how I thought of the idea… But I guarantee you, it was not through WEIS.
On the recent paper I co-authored on Virtual Trust, a blogger writes:
It funny it me to have it characterized in this fashion. The interview questions were developed for a real (not a mock) AT&T interview. The initial interview, where the questions came from, did not happen but I went back to talk about enabling for a different interview noted on my blog here. This other interview involved different questions than the questions published in the paper.