rorykoehler

This was exactly my thought too. The numbers they quoted in the Europol press conference are a drop in the ocean.

Each control is a tree. You have to work through it one by one but as you do that you will find many of them (50% would not be unusual) are not applicable to your business. The standard is basically a guide rail. There are things that aren’t in it, there are things that are in it but are not relevant and there are also things that are outdated and/or against prevailing industry best practices.

Common in Ireland and the UK. E.G. https://www.quora.com/Why-do-you-have-to-depress-the-clutch-...

Depress too. Depress the brake the example.

It's hard to implement if you are doing machine to machine automation (for example SFTP over SSH).

That's why I recommend to start with a external consultancy until you are mature to bring it in house.

I have to work with both constraints and I find accessibility standards to be easier to align with as they can become part of the SDLC pipeline (like code level testing). Securities' scope is far more all encompassing. The hard part for accessibility generally comes down to ensuring that people don't forget they need to think about it when they are designing features and especially changes.

The list is pretty short compared to the audits we do every year or two. I've spent the last few years getting my company up to standard and this is the (simplified version of the) process we undertook.

1. Do an initial internal audit against a (few) known security standard(s) that are relevant to your org (ISO27001, NIST, PCI etc).

2. Create a System Security Plan document that outlines what your intended security posture is for each control in the standard you are following and also recording what your current posture is. Record evidence in this document too (screenshots etc) along with an caveats and mitigations.

3. Once you have the results create a Security Risk Management Plan (SRMP) with a risk register annex for an itemised record of gaps. This document should outline what gaps you have and categorise according to the the risk they represent for your company using the risk matrix https://en.wikipedia.org/wiki/Risk_matrix

4. Once you have the SRMP you can create a roadmap starting with the highest risk items and working down. It might take years for you to get to a good point but at least this process will focus efforts and give you a plan to tackle what seems like an insurmountable volume of work.

If you read this comment and thought "We should do this" I highly recommend to contract in a security consultancy to act as your organisations CISO to help you with this process. They will provide experience, structure and knowledge that is no doubt missing from your org. Rating risks can be non-intuitive for example.

Argentina should lease their waters to a country with the means to defend them.

I don’t understand this perspective. It’s getting clearer by the day that trying to appease China will come at a far greater cost than virtually any other approach.

I've been working remote for over a decade and if/when I go to the office I basically get nothing done. It's great for morale and building relationships but for all individual contribution work it's awful.

I always use them as a guide for what we should talk about first to then give them our own internal rating. Typically vuln criticality is very system specific.

It’s nearly always as simple as this. I got flamed on here for suggesting that Twitter just needs to follow NIST or similar standards to avoid the hack they had last year instead of hitting expert security researchers.

The world will reorganise after this for sure.

Trump dug his own grave. He is the boy who cried Wolf.

Tbf independent researchers got us to the point we are having this discussion. We just took a detour because the institutions failed us.

It was obvious wmd angle was bs from the start. The was never any concrete evidence for it. None. It just appeared out of thin air. Hearsay. It was also obvious that the lab leak hypothesis is worth investigating because there is active documented research on these viruses happening there. I don’t think they are comparable.

Please share

China should have shut down international flights. Instead they shut down internal travel and happily exported the virus to the world. They have lost the last bit of good will I had for them and I suspect this is a sentiment shared the world over. The WHO are also complicit.

You’re right but it kind of renders copyright law to be another elitist construct. I wonder if there are lawyers or organisations who take up these types of cases to negate the behaviour you have outlined. Would EFF for example find it in conflict with their mission?

That’s a pretty interesting thought experiment. How likely is it to burn bridges with a multibillion dollar corp by taking them to court to protect your IP? They might even respect you for it. Most likely the people working there will move on eventually and especially if they are responsible for IP theft that results in a heavy legal bill. Companies sue each other over ip all the time and then still do business with each other. I’m also assuming OP’s bridges with the persons directly responsible are already burnt. So which bridges exactly are being protected?

Absolutely spot on. Who on Earth would downvote this?

Are there no legal recourse options for breaking the license so blatantly?

I was under the impression you also got a dividend/basic income of a few thousand a year like in Alaska?

Middle class are the richer cohort of working class but they are still poor. We have a capitalist system. Unless you don’t have to trade time for money (ie are wealthy) you are poor. You might have a nice lifestyle but you have zero flexibility and options.

What about travelling has identity verification built in? It’s just an arbitrary rule in both examples.

Do you get payments from the Statoil?

You get the money from other places than income tax on the poor

Things need to be maintained. Public HDB housing from the 1970s in Singapore is as good if not better than the new builds going up here in Germany. Destitution is not a moving goal post. You need adequate food, water, housing, healthcare, education and security. This is what UBI has to cover. If private housing is soaking it all up through rent seeking then it can be solved via rent controlled public or public/private (like Singapore’s hdb) housing schemes. You want more then you have to work for it.

There are no hard rules on structure of other programs in relation to ubi. It would be foolish to remove support for special needs etc. Unemployment benefits, public pensions etc can go away but the rest must be looked at on a case by case basis.