3 factors affecting group intelligence The first was the average social perceptiveness of the group members;Â The second factor we found was the evenness of conversational turn taking; You will very surprised to find out the third.Â
As CSA chapter chair, I has been asked many times about what is cloud computing? 3M AVS is one excellent example of cloud, with the following characteristics usage-based, the user only pay on each image analysed deliver via Internet (remotely), the image is processed remotely access to expertise, ordinary users and SME could access to 3M research …
I talked about browser based security last week. As we have more and more cloud or web delivered applications, the browser is playing an important role. Most (if not all) user interaction in browser are programmed via javascript. With Cloud Computing, client side script will be playing a ever more important role. The data security and data …
After last post on browser based security, a few people asked how CSP works. Basically, it is a contract between a web server and the client (i.e. the browser). The browser (being a client) is basically executing everything send to it by the web server. This is very risky when the web server is comprised (that is what happen …
Since I moved from an internal IT Risk manager to a security consulting firm, I have been involving in different discussions on web application security. These experiences made me think that browsers are not a security software and its design has little security consideration. Missing security features in browser is one of the root cause …
An interesting article: http://www.computerworlduk.com/news/security/3406221/dutch-government-let-law-enforcement-hack-foreign-computers/ Dutch Minister of Security and Justice Ivo Opstelten outlined the government’s plan to draft a bill in upcoming months that would provide law enforcement authorities with new investigative powers on the internet. The proposed legislation would create an incentive for governments to keep software vulnerabilities secret because they would need to exploit …
Dutch Minister of Security’s plan starts digital arms race Read More »
that increasing privacy settings may actually produce what they call an “illusion of control” for social-network users.
WSJ runs a great article on issues with FB current privacy position. It seems FB position themselves as a repairing mechanics not as a professional architect when they work on privacy controls.Â
The newspaper story started with an example of involuntary disclosure of sexuality when a teenage joined a chorus FB group. Her parents was informed about her sexuality via FB. The reporter Geoffrey A. FOWLER then explained some inevitable change to privacy: “For much of human history, personal information spread slowly, person-to-person if at all.”; “Personal worlds that previously could be partitioned—work, family, friendships, matters of sexuality—become harder to keep apart.” ;”Facebook is committed to the principle of one identity for its users.” ; “increasing privacy settings may actually produce what they call an “illusion of control” for social-network users.”Â
After reading this article, I noticed that although FB is responsive in fixing the technical issue, they did not discuss how they design and verify privacy BEFORE launch. Millions of FB users do the test for FB for free. The largest software testing I ever know. FB improves their system after their user already suffered the misbehave of their system.Â
Privacy settings affect every user and FB should design each new function or each disclosure with systematic impact analysis. There should be a clear document listing how each activities is displayed to friend and the public. FB should notify the user community what impact a new system feature will bring to such disclosure.Â
The idea that we letting FBÂ continuously fixing their system scares me. Privacy should start with impact analysis and robust testing before thing happen.Â
Â
Â
Â
Â
Â
Â
Â
The daily work as information security practitioner is rather a chaotic one. The challenges has nothing to do with the zero-day attack that may happen any second or project deadlines. After more than 12 years of experiences as auditor, security manager and security consultant, I found the security domain is growing exponentially as user and …