Cyber Resilience: the evolution of cybersecurity beyond the technical

Navigating a Generational Digital Skills Crisis

The World Economic Forum’s Centre for Cybersecurity recently (Nov ’24) released a white paper called Unpacking Cyber Resilience. The goal of this paper is to redefine digital information security (currently called ‘cybersecurity’) beyond the technical box it currently sits in.

Digital transformation has forced unprecedented change in all aspects of our lives, yet digital literacy has remained at best an afterthought in education even as education systems across the world embrace mandatory eLearning and place students in online learning environments from the earliest grades. Our failure to recognize digital fluency as a foundational skillset has resulted in generational global digital skills crisis demonstrating shocking digital habits that are the main cause of an epidemic of cybersecurity breaches. Hiding cyber in a technical bubble is probably both a reaction and the result of this mess.

WEF’s opening remarks in the Unpacking Cyber Resilience white paper describe an expansion of cyber awareness using business language that many educators will use to say, ‘that’s not our job!’ (i.e.: training students for workplace readiness), but this digital illiteracy also damages our democracies by destroying our trust in institutions, creating disinformation echo-chambers that erode public discourse and also preventing us from accessing trustworthy news sources. Surely some of that is the job of public education?

“The digital transformation continuously reshapes and evolves businesses and governments. The primary goals and objectives of organizations are often supported by business processes that are critically reliant on digital technology, commonly without any analogue  alternativesWhile primary goals and objectives will differ between organizations, they will always  include the protection of critical service delivery, stakeholder confidence and the principle assets  that underpin value and position in the market. Achieving true cyber resilience is fundamentally a leadership issue, and is paramount to retaining shareholder value.”

– Executive Summary, Unpacking Cyber Resilience

Those ‘business processes’ underlie all aspects of modern life, including those in education. School boards call their operational network domains ‘corporate’ because it’s lifted from the same digital systems that support business and government. Educational operations aren’t digitally distinct from those in the public and private sectors, they’re the same technologies but with higher security needs because they collect the data of minors (and their families) on a massive scale. Putting employees and students onto these systems without teaching them fundamental digital literacy is akin to putting them in a car and hoping they’ll drive it without having an accident.


WEF’s efforts to reframe cybersecurity are important because there aren’t many aspects of our lives left that are independent from networked information technology. This dependence is absolute because the analogue processes that proceeded digitization have been jettisoned with a promise of cost savings. We live in a world run on ICT where almost no one understands ICT.

Cybersecurity is a particularly difficult nut to crack because it is an interdisciplinary field of study that exists within a larger framework of digital expertise that very few people possess. Cyber also suffers from being the edge of digital where zero days and emerging technologies can have devastating impact. Instead of building stable systems that then change slowly over time, cyber stares into the edge case abyss where you not only need deep digital fluency but also a willingness to step into the unknown.

If we address digital skills at all in education it tends to be a rote coding plug-and-play edtech solution. This one and done approach fails to recognize the complexity of digital literacy.


The Evolution of Digital Information Security


The idea that ‘cybersecurity’ was the final conception of this rapidly evolving field demonstrates a lack of understanding both in how new it is and how quickly its scope is changing. For a long time the cool kids on the West Coast hated the term cyber and created a lot of political tension in a field that was barely conceptualized. You know you’re in trouble when the people doing the thing can’t even agree on what to call it. If you take a step back and look at how things have evolved over the past four decades you begin to see the broad strokes of digital information security:

For many even what to call cybersecurity was a sticking point. The good news is that if you don’t like it now, it’s already moving on. From WEF’s Unpacking Cyber Resilience.


One of my favourite early graphics pushing back against the framing of cybersecurity as a purely technical field of study was this one:



Not because it’s complete, but because it reframes cybersecurity in a multi-dimensional manner. Through my coaching of student teams in cybersecurity I’ve found that a mix of talents is much more effective than a group of identical ‘head-in-the-machine’ types deep diving the technical. That skillset in cybersecurity could be parallelled by a lawyer or surgeon who is doing the point work but is surrounded by specialists with varying skillsets that allow the technical resolution of problems to happen. Can you imagine someone saying that the only people in the medical professions are surgeons, or the only legal professionals are lawyers? These more mature disciplines have a wider understanding of what’s necessary to do the work. Clinging to this lone haxor fixation has been one of the mechanisms used to keep cyber a male dominated profession for far too long.


You need team members with organization and communication skills or the technical discoveries get fumbled between detection and response. You also need researchers and admin who understand what everyone is doing so that they can provide resources where needed. Those skillsets are essential to a cybersecurity operation, even a predominantly technical one, but the world of digital information security has expanded far beyond even that scope.

I wrote about this a year ago in a Cybersecurity Secret Sauce post. At that point I was still arguing for better technical training in cyber, but that’s the tip of a digital skills iceberg that leans on abilities often ignored in STEM education. The creativity and self-direction demanded by the edge-case nature of cybersecurity is more often found in the arts. My strongest cybersecurity teams included a mix of students from a variety of disciplines, and the very best were also wildly neuro-diverse. Reframing the field to cyber resilience opens the door to those alternative and much needed talents.

Considerations of inclusion are often framed as charitable, but in this case diversity was a genuine performance enhancer, especially once I could convince non-technical students that they had a place on a national championship bound cybersecurity team. STEM education does a great job of selecting out creative thinkers early on. Hopefully reframing to cyber resilience ends this gatekeeping.


Cyber Resilience Reframing Digital Information Security


Multidisciplinary collaboration is a force multiplier well beyond blue teams doing competitive defensive work in capture the flag exercises. I should add here that no one should avoid a hackathon or cyber-defence competition because they are afraid they don’t have the hands-on technical skills to do the hacking for a couple of reasons:

CyberTitan Top Defenders in 2021 had
diverse 
and complementary skillsets.

1) The detective process for determining  damage from a cyberattack is remarkably intuitive and the best way to learn it is to watch someone who has developed this intuition display it.


2) If you have half a dozen haxors all digging into a hacked system and attempting repairs at the same time you have chaos, so it’s typical to have one operator in the system while others support them. Again, think of the operator as a surgeon with a team of supporting talents around them and you begin to see how even technical cyber needs diversity.

Even in technical cybersecurity team based/complimentary skillsets are the norm. Attempting to solve the global cybersecurity skills gap by minting as many hands on cyber-operators as you can misunderstands the needs of the field, especially with the onset of AI automating basic tasks.

Cyber resilience recognizes the diversity of expertise needed to create functional digital information security. Another example of this expansion is in international collaboration. You can’t work across languages and cultures without being eye to eye on the technical aspects. The work I’ve done this fall around cyber diplomacy both in DC and the DR have shed light on this emerging field and the importance of us understanding the same terminology. You’d think this is how things are done but training is often rolled out by insular regional interests who (incredibly) often lack an understanding of the subject and don’t give much thought to national let alone international collaboration. You can’t work together defending against cyber attacks when you don’t share common understandings. The work Global Affairs Canada has done in providing internationally recognized industry certifications for developing countries is a great example of this in action.

Hundreds of people from dozens of countries all working
together on cyber resiliency at the GFCE annual meeting
in Washington DC in September, 2024 (I’m on the left).

From talking to the newly minted director of cyber at GAC to presenting on emerging technology disruptions in cyber internationally, I’m more aware than ever of the challenges in creating global connections encouraging cyber resilience. Unless we align our terminology and technical awareness we cannot communicate and collaborate effectively. In our one sided world of digital defence where they only have to get it right once but we have to get it right every time, this is a recipe for disaster. Without collaboration and cooperation there is no way organizations can defend against the asymmetrical nature of cyber attacks, the largest of which have the funding of nation states behind them. 



Hope For The Future


Locally, I hope that reframing cybersecurity to cyber resilience means more leaders begin taking it more seriously, especially in education. But even cyber resilience remains problematic because it is hidden inside a larger digital literacy crisis that has grown to such a degree that many in education ignore it rather than recognize the cross curricular damage it is doing, not to mention the societal damage it is doing to our democracies.

Nationally, I hope that cyber resilience creates more diverse pathways into the field. I would love to see the absurdly privileged ‘comp-sci degree’ base expectations disappear (this is the equivalent of saying everyone who works in the field of law has to be a lawyer). Cyber resilience isn’t for specialists, it’s for everyone and I hope this reframing encourages more diverse skillsets to engage with it.

Internationally, cyber resilience is where emerging fields like cyber diplomacy and multi-country partnerships grow. If we want the benefits of digital transformation to be available to everyone while relaxing the grip of surveillance capitalists and ensuring our democracies are functional, critically looking at how we compartmentalize digital literacy and opening them up to reinterpretation is essential. Digital technology is only accelerating and clinging to old frameworks makes no sense.




NOTES

The idea that we can resolve a lack of cyber skills when they hide within a much larger digital illiteracy crisis has caused a lot of frustration in cyber training. Teaching information security awareness when users lack basic digital skills is akin to attempting to teach Shakespeare to people who can’t read.


Rather than base your cyber stance on this impossible situation and watching training fail to stop the vast numbers of breaches digital ignorance causes, reframing cyber resilience through a human risk management lens reveals a more effective tactic. If people are the weakest link (and they are), don’t expect their illiteracy to be an easy fix. Leveraging a wider human risk management approach lets you ensure safety regardless of how digitally clueless your users are.


“In 2024, the idea of human risk management shifted from concept to reality as frustrated CISOs looked for solutions beyond security awareness and training to make real change.”


The EU isn’t hanging around:  The Cyber Resilience Act

from Blogger https://ift.tt/GEjouO0
via IFTTT

Tiger, or not to Tiger, that is the question: Triumph 955i Winter To Do List

 Problems

Yes, I’m swearing at it.

  • The idle control problem has returned (stalling)
  • This is happening with no errors in the computer (all sensors working then?)
  • Fuelly smell (leak? mixture too rich, but with no errors?)
  • Poor starting is new (takes many attempts – might be a wiring issue?)
  • Triumph not supporting the bike any more with parts or service
  • Not a popular model/make, even finding used parts a challenge
  • I’m told that this wasn’t a bike built to last (with the two above points this is problematic)
  • New throttle cable may not be adjusted correctly

Recent Attempts to fix

  • new throttle and clutch cables
  • balanced throttle bodies and checked valve clearances in the summer
  • cleaned the relays under the seat and it started easier (but still not on the button as it used to)

Winter Targets

  • recheck all the possible points of failure

  • valves
  • check throttle position sensor
  • check fuel pump (but then do what? Fuel Pump Factory pump replacement – but where to find the filter? Quantum Fuel Systems kit comes with one.
  • throttle bodies balanced
  • throttle cable adjusted
  • replace all fuel o-rings and check for seal
  • clean all wiring connectors
  • double check all connectors for tightness/connection
  • torque set everything with easy reach
  • follow the book and keep it tight to spec (don’t do any of it from memory)
  • Only change the oil (less than a 1000k on it since last change) if everything else is promising (saving myself $120+ in the process)

Goal

  • Resolve starting issues
  • Resolve fueling issues
  • Stabilize the bike and sell it (?)
  • What might change my mind:
  • understanding the ongoing fueling headaches
  • understanding whether they are fixable with the resources I have
  • determining if ongoing ownership is worth the hassle
  • If viable, consider the 2001 low mileage bike
  • Upgrade the headlamps to LED
  • Ride the bike to the usual 5k+ kms next summer or
  • Sell it for what I purchased it for 8+ years ago


  • If the Tiger problems are diagnosable (ie: it’s not of an age that it’s simply falling to pieces) and solvable with the resources I’ve got, aim at 100k by end of 2025. If it’s too ‘disposable’ and unsupported, move it on to someone with the time and patience to deal with it.

    $1900 in Windsor. $1500 for the bike and another $300
    to get a van to go get it? If the Tiger warrants long term
    ownership then this move makes sense. It has <30k on it!
    What do I hope? I can find the time to make it viable and ride it until it’s the last one on the
    road in Canada. If that happens picking up the parts bike from Windsor makes sense. Perhaps I could park it in the shed and only go to it when I need parts.

    The alternative is to let the bike I’ve put the most miles on and have owned the longest go. My already limited brand loyalty has been stretched to breaking by the lack of support from Triumph. The Tiger replaced a 22 year old Kawasaki 1000GTR/C10 that I had no trouble finding parts and even service for. In between I had a ’97 Fireblade that Honda was happy to support, but not so for Triumphs that were built up to only a few years ago.

    I’d like to spend my riding years riding more than spannering. The C14/1400GTR has been dependable and with my various adjustments on it I’m still finding that I’m learning about it, though its road focus means I can’t trail ride like I do on the Tiger. With the Tiger gone my accidental Kawasaki fixation (I don’t go looking for them, they seem to appear when I need them to), I’m tempted to see if a KLR650 would do the dual sporting I’m missing on the Concours. It would certainly be more off road friendly than the heavier, fragile, unsupported Tiger.

    Other options could be a Royal Enfield Himalayan, Tenere 700 or CRF 300 Honda (though they aren’t good with bigger riders, which I am). The KLRs are plentiful, not overly expensive and well understood as the model has been going forever. I’ve also got a Kawasaki dealer 10 minutes from the house (as opposed to the 2+ hours for Triumph).


    The long bomb would be going in a completely different direction and getting something like a Moto Guzzi V85TT, though that puts me back into potentially fragile, poorly supported European manufacturer territory (they sure are pretty though). If I’m looking for a bike to put miles, it probably isn’t that one. Perhaps when I’m riding less one will find a spot in the garage.
    This winter will answer this existential question:


    Tiger, or not to Tiger? That is the question.

    Whether ’tis nobler in the mind to suffer

    The slings and arrows of outrageous mileage,

    Or to take arms against a sea of manufacturer unsupported troubles

    And by opposing end them.

    from Blogger https://ift.tt/Gvm7WrH
    via IFTTT

    The Organization of American States’ Carribean Regional Cybersecurity Symposium DR 2024

    *** Simposio de Ciberseguridad de la OEA

    Cyber Pirates of the Caribbean.
    Sorry, couldn’t help myself.

    In September I got an invite to sit on a panel at the GFCE’s annual meeting. Then the Organization of American States got in touch and asked if I’d sit on their emerging tech panel at the regional pre-meeting. I guess that went well because they then asked if I’d be willing to cover for their quantum cyber specialist who couldn’t make a Cybersecurity Symposium in the Dominican Republic at the end of the month. My approach to this sort of thing is to always say yes; that’s how I found myself in Ghana last year.


    Most people think of Punta Cana and an all inclusive week on a resort when it comes to the Dominican Republic, but I was headed to Santo Domingo which can be a bit rough around the edges. It was an intense week of coming to understand the cybersecurity needs of a region facing the results of climate instability head on while also rapidly developing their digital economy.


    Our panel was set to go on the first day, which was good – I like to get them done sooner. Co-panelist Heather happened to be coming in on a flight right behind mine so we met at the airport and shared a cab across the city to the hotel. Having not eaten since 5am, I sat in the empty hotel restaurant and ate a poor club sandwich that cost an eye watering $30USD while wondering what I was doing here. There is nothing like hunger and exhaustion to make you doubt yourself.


    I finally got into the room and collapsed for a couple of hours and awoke feeling more like my usual, confident self; food and rest resolves most anxiety. I went for a wander around the hotel and found Heather on the pool deck watching the sun going down (dramatic sunsets in the DR). She works in AI research and we had a good chat about how it’s being used in cybersecurity and both left with enough context to take on the panel in the morning.

    Our moderator got switched right before the event but Donavon was agile, knowledgeable and did a great job chasing down themes as they came up rather than following a script. The conversation dove into AI but also left space for IoT and quantum in a cyber context.

    I came away from the GFCE event in DC earlier in the month cognisant of the need to keep technical detail out of these kinds of high level talks, especially if you’re talking to most of the people in the room through a translator. The technical side of cyber isn’t necessarily what you need to focus on because it doesn’t really change how most people interact with it. An easier to grasp example might be to ask if you need to have a strong understanding of the metallurgy involved in casting your car’s engine in order for you to drive it. This isn’t to say you need to simplify the the point of absurdity, but getting into the technical weeds tends to be an academic back-patting exercise rather than being helpful to the audience.


    On this panel (as I’ve done in all of them), I don’t pretend I’m something I’m not. I’m a teacher, an I.T. technician and a cyber operations instructor and often refer to anecdotal cyber teaching situations to land a point. People seem to appreciate this approach because presenting material as a teacher is something everyone can relate to, and there is enough intellectual intimidation in cyber as it is. There is also enough marketing misinformation that a clear eyed, educationally focused approach resonates.

    Our talk mainly focused on artificial intelligence but quantum did get some airtime, though many questions (as at the GFCE) orbited the complexities of trying to teach cybersecurity. As mentioned at the Serious Play Conference in August, teaching a subject that few people have the basic digital media literacy to even contextualize is a challenge. The fear that arises from this ignorance is real and makes teaching cyber especially difficult.

    I’m always conscious of the Canadian perspective I bring to an international event like this. Canada seldom participates at the international cybersecurity events I’ve attended. We fund a lot of them (including this one), but finding Canadians willing to make the trip and talk the talk seems difficult. I was the only Canadian on any of the panels at this one too though I’m hoping to change that. If international cooperation is about relationships, having Canadians talking at events like these is paramount.

    When asked about IoT threats I brought up two Canadian instances that resonated with the room (I was asked about them repeatedly across the week). One was my visit to the Canadian Institute for Cybersecurity in Fredericton last spring which included a look at their IoT lab. The curiosity this generated has me wondering if an OAS event in Fredericton at UNB wouldn’t go amiss. Does Canada ever host these things?

    The second Canadian cyber challenge was the rash of car thefts Canada is experiencing. It’s tempting to define this under traditional criminal activity but these are new vehicles with ‘state of the art’ electronics that are being hacked, making this an IoT cyber problem. When you know enough about cybersecurity you start to think differently about how it’s integrated into your day to day life. My cunning solution is to drive manual vehicles that are ‘pre-smart’. They’re unhackable and also undrivable for most thieves. If you don’t expect technology to do everything for you, you’re not beholden to its weaknesses.

    With our panel in the rearview, I made it a point of understanding the context through which Caribbean and Latin American states are tackling cybersecurity. Our very nice hotel provided bottled water because you’re not supposed to drink what comes out of the taps. It’s astonishing to me that people without available drinking water are going after digital transformation and the cybersecurity that enables it, but if you want to participate in the 21st Century economy that’s the price of admission. Perhaps digitization will solve the water problem too.

    One of the first speakers at this event did a deep dive into misinformation and how it is generated using the latest in deepfake technology. Extremists are using this tech in propaganda campaigns. The corrosive effect this has on our shared media is interesting. I had a number of chats with Daniel throughout the conference and discovered that his motivating interest is in the nature of online communities and how they work in terms of social norms and expectations. This kind of decentralized, narrow (as opposed to broad) band media transmission is becoming the new norm, yet no one seems to be teaching how it is influencing society in media theory classes. It’s something I want to go after in terms of updating digital media education in Canada.


    The theme of the symposium was, DisruptX:Redefining the future of cybersecurity in Latin America and the Caribbean”, so many of the talks revolved around the impact A.I. is having in cybersecurity. As in most places, it’s a force leveller. People writing phishing emails now write with perfect grammar and spelling, and don’t use form letters anymore because AI can generate targeted, articulate messages specifically for individuals. This enabling of cyber criminals by automated systems targets our existing cyber-illiteracy, but that’s just the tip of the iceberg. Automated malware as a service can be purchased by anyone who can turn a computer on. The days of technically talented hackers are far behind us as AI serves to elevate anyone looking to cause problems through online communications.

    To further complicate the landscape, you’ve got state actors (including world superpowers) performing offensive cyber operations against governments, businesses and even individuals. At this cost-no-object end of the spectrum you’ve got cyber militaries operating on budgets in the billions possibly taking aim at your company or government.  If you’re a developing economy with minimal digital infrastructure, how do you possibly keep it secure against that? The short answer is you don’t, sometimes you just get pwned.


    OK, so what do I do, you ask? You’ve got a couple of options when it comes to protecting your internet facing systems (in this case critical systems that make society work and provide things like electricity):


    1) Put money up front building the most secure network you can, but this requires talented people who are in short supply (the cyberskills shortage isn’t just happening in Canada). It also means paying up front for something that hasn’t happened yet, and isn’t can’t be guaranteed secure no matter what you throw at it. The case for preemptive cyber capacity building remains a struggle and not just in the Caribbean, it’s a problem in Canada too.

    2) The other option is to design full backup systems so you can recover when the inevitable happens, but this too requires technical talent, forethought and a willingness to invest in the future – all aspects of cyber that humans everywhere struggle with.
    Like the GFCE event in Washington, a lot of time was given to thinking about governance and policy. These frameworks are vital, especially if we want to push back against the human nature that isn’t likely to invest in anything precautionary, but the nature of the cyber means also needing to be proactive and agile because of the asymmetrical nature of the threats. 
    I hope there is room in policy and governance to ensure that there are resources left over to support this kind of agility. This work often happens in companies and government agencies rather than in university research labs and needs to be more accessible to the people on the ground doing the work. So much of the research funding in Canada is tied to post-secondary institutions. Agile action research in cyber by practitioners rather than academics is essential if we’re to retain any ability to deal with emerging threats in a timely fashion.
    This confusion around the nature of cybersecurity (is it an apprenticeable skillset or an academic pursuit?) is another one of those evolving understandings still somewhat out of focus as we come to understand what cybersecurity it. It was nice to see one of my favourite cyber graphics come up in one of the first RICET education talks reminding everyone that cyber is a complete field of study ranging from apprenticelike hard technical roles to academic legal and human facing work in subjects ranging from HR to education.
    Like any other field of study, cybersecurity is full of nuance.


    *** Extracurriculars

    Fascinating conversations and an opportunity to network without a schedule or talking points. These ‘extracurricular’ evening events are often the most informative!

    The conference had a couple of extracurricular events where I often hear the most enlightening things. A delegation from the South Pacific was attending this event with the thinking they they are facing many of the same challenges that the Caribbean states are. Tim from the Cook Islands and I had many great talks about the sudden change they are going through. About two weeks before the conference Elon flipped a switch and suddenly everyone on the islands could afford high speed internet for the first time through Starlink. The rest of us have been in the digital pot as the heat has been slowly turned up over the past two decades and don’t realize it’s boiling. Can you imagine going from 90’s dial up to 2024’s AI/social media/fake-news cyber-nightmare in one week? Tim’s managing the IT there. Someone should be writing a book about this time travelling digital experiment.
    The fortress in colonial Santo Domingo at sunset. The DR’s relationship with its past, like Canada’s, is complicated and unfinished.

    On the final evening they took us out to the colonial tourist area and a look around Fortaleza Ozama. Being me, I found watching the chaos of the evening commute around the castle distracting. Like the evening social the night before, this was an opportunity to chat with people working in cyber from many different perspectives. I’d run into Franklin from Suriname who I’d met in Ghana last year and we picked up right where we’d left off. Suriname is about to go through some dramatic changes.

    When you find yourself having a drink with the head of Mastercard’s security division and the entourage from Columbian cyber, you wonder how you got here. Tim from Cook Island’s wife messaged him asking what he was up to now. His response was, ‘I’m drinking rum at a castle at sunset!” Indeed.

    The trip included a projection onto the fortress of the DR’s history. It reminded me of the projection show they were doing on the Houses of Parliament in Ottawa a few years ago and raised some interesting questions about how digital is insinuating itself into island life.
    The seemingly incongruous VR experience at the fortress was complimented by animated digital projections throughout, to the point where it was easy to forget you were in a centuries old fortress, which is the point of being there, isn’t it?  A few times in the conference the corrosive effect of AI on regional culture was noted (AI’s fixation on large datasets tends to stamp out anything but the biggest producers of data). I suspect digitization (itself a byproduct of globalization) has a generally corrosive effect on people’s ability to be where they are. We spend an awful lot of our time taking photos to share online instead of being where we are (like the ones in this post? -ed).


    *** RICET

    The final day switched gears and became RICET, the Regional Initiative for Cybersecurity Education and Training, put on by the OAS and Florida International University. This focus on education and training is essential if we’re to establish sustainable and effective cybersecurity.
    I’ve said it before and I’ll say it again, the vast majority of cyber incidents are the result of human failure. No matter how you want to frame it, our current cyber woes arise from a multi-generational failure to develop effective digital media literacy of which cybersecurity is perhaps the most interdisciplinary and complex because it’s all about the edge cases. You can’t hack something you don’t fundamentally understand.
    We’ve been fixated on coding as a solution to the digital skills crisis, but digital media literacy is about much more than coding. In cyber you need flexible, stochastic approaches with familiarity across a much wider range of digital technology. I’ve met too many compsci specialists who are sidelined by simple technical issues to believe that this is the epitome of digital literacy. I also heard the dreaded term ‘digital native‘ during some of these talks, but I’m not going to get into that nonsense again here. 
    RICET panels talked about the usual worries around the lack of talent, though like everyone else they spent much of the time on bandaid solutions like adult retraining instead of looking at strategic fixes like implementing nationwide cyber skills talent discovery and development in public schools that would not only address the user negligence problem, but would also resolve our cyber-professional shortage.
    We’ll never resolve this global digital skilling failure with stop gap solutions. We need both short term and long term strategies, but like the funding for seemingly obvious things like network security and data backups, getting anyone to fund that future is a struggle.
    Watching these earnest cyber developers working on shoestring budgets trying to make this work while Canadians literally watch drinkable water go down the toilet has me wondering why we face so many of the same challenges they do. On my way back home I messaged a colleague in cyber education and lamented the fact that cyber expertise in Canada seems to be more about marketing than it does cybersecurity. I summarized the problem with genuine cyber-education in simple terms: there’s no money in it.  That observation extends to cyber in general. One of the reasons for the high burnout rate is asking the people who know what they’re doing to do it without needed resources.
    I enjoyed learning about the regional challenges being faced in the Caribbean, but what always surprises me about these glimpses into international cybersecurity is just how similar the problems we all face are. In a discipline where the bad guys only have to get it right once but the defenders have to get it right every time, the only hope for cybersecurity professionals is to develop connections, build international cyber-diplomacy and work together. Circling the wagons and sharing intelligence, tools and best practices is the only advantage we have against the cyber pirates (it’s ok, I’m bringing it back) that surround us.  This event was a prime example of that kind of networking. I hope to be a part of future ones.

    Winging out of Santo Domingo at sunrise on Delta’s A320 Airbus. What a beautiful country. Wish I’d had the opportunity to see more of it…

    The Bermuda Triangle on a sunny Friday morning in October.

    from Blogger https://ift.tt/l2Ycv4b
    via IFTTT

    SMART Adventures and Off Road Performance Dirtbikes

     Over the long weekend I got out to SMART Adventures again for my yearly knobbly tire exercise. If you’ve read TMD you’ll know I’ve tried to off road in South Western Ontario, but got stick for riding on hydro cuts and farmland and generally got nimbied right out of dual sport ownership. SMART is my release valve while thinking of ways to escape living in the one part of Canada that doesn’t make off road riding easy.


    If I lived anywhere else I’d have picked up the DR650 I found on a farm a couple of years ago and that would be my dedicated off road machine. My neighbor picked up a new Tenere 700 and I’ve long had my eye on Honda’s CRF300 Rally – both of those would do the trick, though after this weekend I’m thinking a dirt focused specialist might be the way. 

    Last year’s SMART was an apex experience for both Max and I as we got advanced individual instruction on the off road vehicles of our choice, I even got to ride an electric machine! This year we’d planned to meet with friends at Horseshoe Resort and that gave us a discount opportunity with SMART, so I signed everyone up for the busy Saturday afternoon on the long weekend.


    I initially went out on the Kawasaki I rode last year, but the gear shifter had been banged about by a pervious rider and it wouldn’t go into gear, so I got to switch to a Yamaha WR250F with upside down forks, high compression and proper brakes. I’d never been bothered with any of that and always thought a trail focused machine would be what I’d get as a pure dirt bike, but this Yamaha changed my mind.



    Unlike the 230 I started off on or the Honda and Kawasaki 250s I rode last time, the Yamaha demands more but rewards you for it. If you can appreciate the difference between an appliance car and a sports car you can understand the difference here too. Those upside down shocks will get you across pretty much everything with incredible feel, and the brakes are precision tools, but it was the engine that took me to my next level, and eventually let me slip the surly bonds of earth and fly (!).

    Trail bikes tend to be tuned for torque low down without worrying about stalling. This higher compression motor needs more revs, but when it comes on song (the exhaust snarls when you get there), it’ll pull you up any hill or over any obstacle. If you’re riding over whoops, it’ll get both wheels off the ground too.

    This turned out to be just the bike I needed just as I needed it because I probably wasn’t skilled enough to appreciate it before now.  SMART put me with Adam, the brother of my instructor from last year, who did a great job of testing my limits without overwhelming me. We covered a lot of miles through the fall woods. That’s a SMART hack: if you know what you’re doing say you’re ‘expert’ on the intake form. If gets you out of the kids-who-think-they-can catagory and lets you focus on improving your craft, usually one-on-one with an instructor.



    The Kwak wasn’t up for it, but that gave me a chance to explore the competition ready Yamaha…

    Passed these guys while out on the trail – that’s the dream setup.

    Adam and I got deep into the forest – he’s the red smudge down the trail that I’m keeping up with (because he kepts slowing to check on me). Every 10-15 minutes we’d stop and talk about technique, and then go exercise the talk.

    Everyone had a good day out. The girls got out in a side by side and discovered that off roading in one of these is well within their skillsets and not at all uncomfortable. The only complaint came from Max who wanted a more extreme ATV experience as he’s now expert in that. Next time he’ll be sure to stress that he wants to be in the advanced group.


    That Yam is the bomb! It’s on my wishlist now.

    from Blogger https://ift.tt/YEGRg6H
    via IFTTT

    Taking a 955i Tiger from Triumph Engineers to Vintage Ownership

     I’m bound and determined to keep the old Tiger in motion. Triumph has abandoned me in
    terms of parts support, but there is another way and Classic Bike Magazine shows you how to find it. I used to depend on Practical Sports Bikes for keeping these pre-classics in motion, but they killed it.


    Rick Parkington writes a lot about the transition from standard manufacturer supported bike ownership to vintage bike ownership, but what he’s really on about is keeping a bike in motion when the plug-and-play relationship with modern bike parts isn’t an option any more. For a modern Triumph that happens about 20 years after they build it (I’ve had older Kawasakis and Hondas that kept providing parts, but I digress).

    The biggest thing to get your head around is being ready to find alternatives that meet the needs you’re facing rather than following the manual and hoping for parts to arrive that you can swap in. One of my issues on a 90k+ bike is slack in the machine. The throttle stop has worn down over the many miles so I’ve been playing with putting a spacer nut on there.

    When I had it apart today I used the grinder to try two different cuts of nut to get my idle back to where it should be. The middle one gives me perhaps a mm of recovered space on the pin that catches the throttle when it returns to idle at a point that doesn’t make the engine struggle.


    Another one of those vintage approaches is around battling fasteners. You can never assume something will come off as it should. In this case the fastener on the throttle casing on the handlebar creates swear words.


    While I had it apart today I put in two new cables (throttle and clutch). Thanks to Rogx in Germany (who are still producing new cables for the 955i Tiger which was popular in Germany), I got two new cables with hardware and it arrived early and with no headache (love dealing with Germans!).

    The clutch cable was fraying by the transmission so it was well past time. My thought is that if this one lasts as long as the first one (over 90k), then I’ll be happy. I ran both cables next to the existing ones to get the runs right and then removed the old ones afterwards. It was a satisfying Sunday afternoon in the garage.

    No complaints (other than Triumph not supporting its own machines when they are less than 20 years old). These cables both did over 90k in brutal Canadian temperature changes.

    A satisfying Sunday afternoon getting the Tiger sorted. I think another couple of hours and I’ll have it back in motion for the end of the riding season here.

    I wrote this as I was catching up on the Indonesian Grand Prix in MotoGP after a crazy (but awesome) week at work. I lost Marc after the Valentino incident back in 2015, but I’m starting to find my Marquez fandom again…

    from Blogger https://ift.tt/M3bR2L6
    via IFTTT

    The Global Forum for Cybersecurity Excellence (GFCE)

     I got an invite to speak on a panel at the Global Forum for Cybersecurity Excellence‘s Annual Meeting last week. It was my first time in DC since I went on a trip there with Air Cadets in the 1980s, so it was an exciting prospect. More so when I saw it was going to be taking place in the Organization of American States’ building.

    Attending these things is a high wire act for me as it looked like I was going to have to self fund my way there, but then the OAS’s Cybersecurity directorate got in touch and asked if I’d sit on one of their emerging technology panels for the region of the Americas pre-GFCE meeting too, so I managed to get hotel and flights covered.

    I got in on Sunday and my hotel was in Georgetown, so I got out and about and soaked up some Washington area history – the place is thick with it! 

    That night I met up with Dr Juan from Mexico who I did a presentation with in June and we enjoyed some Potomac wings at the local Irish pub (as you do) and caught up. The last time I’d seen him was as we passed through US customs on our way back from Ghana last year so we had a good chat. The opportunity to solidify these connections was impressed upon me as an important consideration later in the week. Never underestimate the appreciation inherent in making an effort to see people live, especially post-pandemic.

    Day 1

    The next morning, after breakfast at the Fairmont (!), we walked to the Organization of American States building only to discover it was the wrong one. We ran into Alex from Ghana who was on the OAS panel with me later that morning and he knew where we needed to go, so we all backtracked four blocks ot where we should have been in the first place.

    I got there sweaty (DC got up to about 30°C each day) but cooled off and our talk that morning about emerging technology impacting cybersecurity was wide ranging. Kerry-Ann, our moderator, surprised me with a question about how approaching cyber challenges as a technician gives me a different (and valuable thanks to how she framed the question) insight into the rapidly changing state of things.

    Talking to engineers and the legal experts doing policy is one thing, but talking to the trades people who do the operational work of keeping the lights on does offer an interesting angle. I’d been expecting to talk about quantum technology emergence, but an opportunity to talk about the value of hands-on, applied skills in the field was appreciated and well received.

    Many of the panels focused on the clear and present danger in cyber at the moment: artificial intelligence. From the automation of big data analysis that humans never excelled at on the defensive side to how criminals are leveraging GenAI to produce customized phishing material well beyond grammatically incorrect emails (stretching to include deepfake video, voice, photos and other digital media), these talks were designed to assist policy makers with understanding what has come out of Pandora’s box of AI.

    One theme that resonated with me was how people don’t want deep technical explanations of these emerging technologies. What they want is an easy to grasp explanation of how these technologies will affect the digital spaces they work in. This remains a problem in cybersecurity and an even bigger one in the quantum world I just finished my secondment. The urge for academics to obfuscate and complicate their explanations of these rapidly emerging technologies doesn’t make them ideally suited for presenting on them, especially to the operations and policy people who are entirely focused on real world impacts and couldn’t care less how the maths goes.

    I’ve gotten a lot of static for how I’ve simplified deep technical details in quantum in order to get concepts across, but you honestly don’t need to start neck deep in linear algebra any more than you need to have knowledge of the metallurgy involved in casting your car’s engine in order to drive it. Guess what background is really helpful in bridging this information divide: 22+ years as a teacher! Early in my career I came across a quote that described teachers as, “public facing intellectuals” and took that to mean we’re not about ivory towers and knowing more and more about less and less, but about democratization of knowledge. Part of that comes with knowing what to keep out of the mix in order to keep people engaged.

    My age is also handy. Being a genuine digital immigrant who remembers a time before personal computers and the internet (I got my first PC, a Vic 20, in 1979 when I was 10), I have a big picture outlook that those who have always lived in this chaos find helpful. My other secret weapon is a university background focused on thinking and communications (philosophy & English).

    After the OAS event we had an evening meet and greet at the Museum of the Americas right behind the main building, which had a permanent collection of powerful pieces looking at colonialism and culture. Upstairs they had a Spanish diaspora collection featuring the people who fled Spain during the Franco period; powerful stuff.

    At the meet and greet I got to introduce Juan to Michelle and Nina from CyberLite, one of my favourite international cyber education organizations. We did an around the world webinar with them for Safer Internet Day in February, but it’s always nice to see people in 3d rather than on a screen, and introductions like this are what GFCE is all about.
    A good example  of this networking was running into Christina from Global Affairs Canada. From our talks I’ve come to understand the complexities and difficulties of international cyber policy. I’m also particularly aware of how important it is to shed better light on the work our federal government does internationally. Some of this needs to be kept on the down low for security reasons, but much of it (and especially on the diplomacy side) needs more media coverage so Canadians better understand the work that their representatives are doing on their behalf. Being purely insular and defensive doesn’t work in sport and it won’t work in cybersecurity either. If we can help other countries develop better cyber capacities, we all win, and that starts by developing trust..

    Day 2

    The next day we were up early again and this time took an Uber to the right building (kind of, it still took us to the wrong one first), and began the Global Forum for Cybersecurity Expertise Annual Meeting.
    Our panel came up quickly and Juan brought in a fantastic angle focusing on the Global South and the formation of a ‘quantum divide’ that will, like the digital one, further separates developed countries from everyone else. I’ve seen this happening with tightening restrictions on public facing quantum education resources. In some cases this may be under the auspices of national security, but the end result remains: countries that have the resources to develop quantum technologies will have capabilities that the others can only dream of.
    After our panel, which was quantum focused and couldn’t have happened without a secure internet because our moderator was virtual in Europe and one of the Panelists was in Central America, I showed Juan the William Gibson quote about the future already being here, but not evenly distributed.The idea of a growing quantum divide is another indicator of the state of maturity of rapidly improving quantum computers. I’m motivated to continue building ‘technology literacy for all’ which includes quantum and AI because no one should make the technologies that have the best chance of saving ourselves from ourselves proprietary. I also have a nagging urge to help everyone reach their maximum potential regardless of how much they have in their bank accounts.
    The end of day event on day two was both fantastic (it was a retirement party for founding
    GFCE president, Chris Painter), but also profoundly insightful. When someone with extensive, top draw international research resources tells me that they aren’t worried about AI taking us down because climate collapse will get us first, I listen. Moments like this make me vividly aware of just how fragile the house of cards we’re standing on is.

    This observation wasn’t helped by the book that a colleague suggested that I’m two-thirds through. The idea of long term thinking in a world that only rewards short term gain is a challenge, but the most recent chapter is about how all civilizations collapse. Historically this happened regionally (Roman Empire, etc), but the global civilization we’ve build this time is going to crash harder, and when it collapses we’re going to be wishing we had made some of Asimov’s Foundations in order to recover more quickly (assuming we don’t make our only habitable planet uninhabitable in the process). That’s the thing about attending a GFCE event – it makes you reflect on the big things.

    Day 3

    All of the delegates from dozens upon dozens of countries coming together in DC to make digital transformation secure and accessible to everyone.
    Day three began with the women in cybersecurity breakfast. The moderator at our table told hair raising stories of her being the first female cohort in engineering in South Africa and the overt sexism they faced. I told them about Canada’s tragic history with this kind of sexism, which the table found astonishing – Canada is considered forward thinking until we’re a bit more forthcoming about the dark currents in our history. I also told the story of the quiet sexism that made founding the first all-female cybersecurity team in our school so difficult. It amazes me that half our population still experiences these systemic prejudices and that equality isn’t something we’ll get to before the 22nd Century.

    These GFCE events are thick with insights and opportunities that lift your head out of your personal context and prompt you to consider the big problems we face. I’ve tried to cover the main pieces here, but there are so many more that I’m still subconsciously noodling on.

    The emerging tech panel on AI towards the end of the day was another of those eureka moments. The policy expert from France’s advanced technologies department had a good response to my question about how we devise policy for near future AIs that will have the agency and resources to ignore them, not out of spite, but because even considering them isn’t in their programming. She referenced the US Section 230 law that let social media run rampant and pointed out that if we recognized this cautionary tale we’d be able to better direct AI use now. A sharp response, but I think the AI horses are out of the barn and will shortly have the capabilities to do real damage to our digital infrastructure. I remain curious as to when AI policy to try and restrict development turns into defensive policies designed to mitigate the damage that self-directed AIs will do to our piecemeal digital infrastructure.

    I ended the event having lunch with Abdul, my swimming buddy from Accra, and Juan, my co-conspirator. What do you talk about at a Nigerian/Canadian/Mexican table? Abdul told me he is in ‘legacy mode’, which is a great way of framing your closing professional years. I enjoyed our talks in the pool at Accra City Hotel because Abdul always seems to see beyond the horizon. Taking a minute to soak up that wisdom is never wasted time. He was going to see his friend’s grave and visit his cousin after the event. These seemingly technical meetings can be profoundly human, if you let them be.

    We wrapped up our time at the OAS HQ, but we weren’t quite done yet. At the museum event Monday night we met a Spanish attaché and that prompted an invite to the embassy for a Wednesday evening networking event. It was a short walk from the hotel and I talked to a lot of people but really got into it with Jose Manuel who runs telecoms and startups in Spain including a new one that helps you park your boat in a marina you haven’t visited before. We also had a good chat about the innovative quantum key distribution research he is a part of. I’m hoping to follow up and develop some transatlantic partnerships to move us all forward there.

    ***
    I must have covered 20+kms on foot over the week (in dress shoes!), but I have no regrets about the schlepping or having to self fund some of this. Hope is hard to find in 2024, but the GFCE exhales it like plants give off oxygen. Just as Ghana did last fall, my mind is left turning over the complex challenges and opportunities that this meeting highlighted. If you’re looking for organizations that improve your practice, expand your context, and challenge you to take on the seemingly insurmountable global issues we face, meeting the OAS and experiencing my second GFCE event has done just that.
    DC looking like a post card on the ascent out of Reagan Airport.

    Just over 500kms as the crow flies from DC, I was back in The Six before I knew it!

    from Blogger https://ift.tt/nCpglAM
    via IFTTT

    The Serious Play Conference and a Canadian Solution to Cyber-Education in Canada

    The Serious Play Conference took place in August at University of Toronto’s Mississauga (Erindale) campus. Even though I’d fallen off the end of my secondments, gamification has also been a central tenant of my teaching practice and I’ve been actively researching cyber-education using immersive simulations for the past four years, so I took this opportunity to present what I’d found.

    Paul Darvasi runs this conference. I met him last summer when we did a quantum training week together at UBC in hopes of building a quantum game that takes the academic privilege out of how the subject is presented. That hasn’t yet come to be, but I did manage to recently get our quantum arcade idea funded (from Finland because finding that kind of support for emerging technology education in Canada isn’t easy). Canada likes to be surprised by emerging technology in education rather than getting in front of it.



    Games have played a central role in my life. I got into Dungeons & Dragons in a big way in my teens and my first long distance road trips were with friends to GENCON in Milwaukee in the late 1980s (where I got to play a tournament round of D&D with Gary Gygax!!!). As a result my teaching practice has always been informed by those early years dungeon mastering. If I have an opportunity to create a simulation or immersive gaming experience in my classroom, I’ll go out of my way to arrange that rather than falling back on worksheets of one way knowledge transmission. My experience has shown me that suspension of disbelief can be a powerful learning tool if the gamified learning experience is pedagogically viable.

    My presentation at Serious Play was specifically about how immersive simulation can help learners tackle subjects that might scare them into disengagement. By using suspension of disbelief, subjects like cybersecurity can be approached without out the risk aversion prompted by worries about breaking technology almost no one understands because we seem to have given up on modern media literacy about two decades ago.

    I’ve put students on Field Effect’s Cyber Range in classrooms across Canada. In some cases they were competitive CyberTitan teams containing students with the top 1% of digital skills in the country, but in most cases it was with the other 99% who had never touched cybersecurity at any time in their learning journey. With the right scaffolding and support even the newest of n00bs can get their hands dirty iteratively learning essential cyber skills in this digital sandbox:

    Engaging Canadian education with cybersecurity remains an uphill struggle, but cyber sandboxes like Field Effect’s Cyber Range offer a solution.

    The Serious Play Conference had a wide range of educators working in digital and analogue simulation across a staggering range of subject areas. From museums engaging patrons to a think tank designing war games for the Canadian Forces, it was a tour de force of what immersive simulation and gaming can do to engage and teach in pretty every learning context.

    I was absolutely thrilled to learn that our all Canadian made simulation that offers a key to cyber-education – one that is more advanced than the systems we use when our CyberTitans take part in CyberPatriot south of the border because it allows for interactive networking between virtual machines instead of just putting students into isolated desktop VMs – won the gold medal for K12 immersive learning simulation.


    ICTC and Field Effect have worked hard to get this world class immersive learning opportunity in front of Canadian students. The trick now, as it has always been, is to get insular Canadian education systems who have taken a head-in-the-sand approach to cyber education to pick up this federally funded, world-class tool we’ve built and use it to get past their own fear and ignorance and begin teaching essential defensive 21st Century digital skills.

    ***

    Sign up for CyberTitan, Canada’s national student cybersecurity competition, is open until October. Teams of girls and other under represented groups in the field are fully funded. The early rounds are on individual virtual machines through CyberPatriot in the US, but if you push on you eventually get to Field Effect’s Cyber Range and get a taste of the future of cyber-education.


    Check out the interactive team signup map here. You can ask yourself questions like, why one of Canada’s smallest provinces (New Brunswick) has more student teams than Ontario and Quebec combined, or wonder why Saskatchewan and Nova Scotia have no teams at all. Perhaps they don’t use the internet?


    The vast majority (over 90%) of cyber attacks on Canadian systems depend on user ignorance and lack of education to succeed. We can’t build a secure Canada if oblivious Canadians keep opening all the doors. You don’t have to pretend it isn’t happening, it can start here:

    Join the competition and sign up student teams of 4-6.
    There are middle and high school divisions and community groups are also welcome to participate.

    from Blogger https://ift.tt/bvC65Z9
    via IFTTT

    Turtles all the way Down

    I tried to get AI in front of Ontario teachers at
    the ECOO Conference in 2019, but it was a
    pretty empty room.

    I’ve been working with generative artificial intelligence with students in my computer technology program since 2018 when we were fortunate to get a new grade 9 whose dad was on the team that brought IBM Watson to Jeopardy. That got us connected to IBM cloud and building AI chatbots five years before the “AI revolution” everyone has been caught out by.

    That wasn’t our first point of contact with AI though. I’d been keeping an eye on AI dev as far back as 2015 because we launched our gamedev course in ’15 and getting handle on building intelligent responses to player actions in our games immediately became our biggest challenge. Thanks to Gord and IBM we were able to get our juniors familiar with AI prior to asking them to take on significant software engineering challenges with it in the senior grades.

    I presented on AI use in the classroom at the ECOO conference pre-COVID in fall of 2019. Gord from IBM even came all the way down to Niagara Falls to offer world class suppport. The room was all but empty:

    This is how many Ontario educators (already interested in edtech because this is ECOO!) you get in an introduction to gnerative AI in 2019 (yes, it was four in an otherwise empty room). Ahead of our time (again)? Four years later it’s an emergency and suddenly there are education AI experts everywhere. I wonder where they were in 2019.

    If you ever wonder why education always seems two steps behind emerging technologies that will have profound impacts on classrooms, here’s a fine example. Except you won’t even see four people sitting in an empty room in 2024 because all edtech conferences like ECOO focused on teacher technology integration have evaporated in Ontario.

    ***

    OK, so I’ve been banging my head against pedagogically driven AI engagement in education for almost a decade only to see it swamp an oblvious education system anyway, so what’s happening now? I’m ressearching the leading edge of this technology to see if we can’t still rescue a pedagogically meaningful approach to it.

    In the summer Katina Papulkas from Dell Canada put out a call for educators interested in action research on AI use in learning. I’ve been talking to Aman Sahota and Henry Fu from Factors Education over the past year looking for an excuse to work on something like this, so I pitched this idea: De-blackboxing AI technology and using it to understand how it works.

    Our plan is to use the Factors AI engine that Henry himself has built and Aman administrates to build custom data libraries that will support an AI agent that will interact with students and encourage them to ask questions to better understand how generative AI works. As mentioned before on Dusty World, GenAI isn’t intelligent and it’s important that people realize what it is and how it works to demystify it and then apply it effectively. Getting misdirected by the marketing driven AI tag isn’t helpful.

    So far we’ve built modules that describe the history and development of AI, how AI works and the future of AI. In the process of doing this I’ve come across all sorts of public facing research material that breaks down generative AI for you (like Deep Learning from MIT Press), but it’s technically dense and not accessible to the casual reader.

    During the last week of August Factors had a meeting with interested educators through UofT OISE (their AI system came out of the OISE edtech accelerator). I demonstrated in the presentation how the AI engine might be used to break down a complex article for easier consumption through agent interaction. The example was WIRED’s story on how Google employees developed the transformers that moved generative AI from a curiosity to real world useful in the late teens. I picked this one because it explains some of what happens in the ‘blackbox’ that AI is often hidden in.

    With some well crafted prompting and then conversational interaction, students can get clear, specific answers to technical details that might have eluded them in the long form article. The reading support side of GenAI hasn’t been fully explored yet (though WIRED did a recent interesting piece on cloning famous authors to become AI reading buddies as you tackle the classics which is in the ballpark).

    What have I learned from working directly with building an AI library of data and then tuning it? AI isn’t automatic at all. It demands knowledgable people providing focus and context to aim it in the right direction and maximize productive responses with users. An interesting example of this was finding documents that provided focused data on the subjects we wanted the AI to respond to. When I couldn’t find specific ones Henry suggested using Perplexity, an AI research tool that coalates online sources and then gives you concise summaries along with a bibliography of credible sources.

    I thought I was being perverse asking them to design an AI that expalins AI using AI, but Henry’s always a step ahead. He wants to use an AI to build a library of information to feed the AI engine that then uses AI to interact with the user… about AI. It’s turtles all the way down!

    from Blogger https://ift.tt/MB3gxQ4
    via IFTTT

    It’s a War Out There

    In the beginning of July the Communications Security Establishment (CSE-CST) produced two news briefs that many Canadians remain oblivious to. On July 9th a warning was published describing a Russian government backed foreign interference project that uses artificial intelligence to create false social media output from many different countries designed as propaganda for Russian state interests. By using these tools Russia hopes to direct national discourse in democratic countries, including Canada, in its favour.

    The day before, on July 8th, CSE posted a warning about Chinese state sponsored cyber intrusions across public and private networks in many countries, including Canada, designed to give the Peoples Republic access to sensitive state and industry data. What is most concerning about these warnings is that they aren’t unique, they aren’t even rare.

    We have come to depend on networked digital information in all aspects of our lives. For many this means social media on their phones, but our dependence on networked digital information runs far deeper than that. Essential systems like the power grid and water supply (and regular classroom activities) are managed through networked digital systems, as are our supply chains. This offers us tremendous opportunities for efficiency and oversight, but it also brings with it the danger of cyber-attack, and not by the stereotypical lone hoodied hacker.

    Incredibly, in 2024 most Canadian schools do not teach any cybersecurity education at all. With the exception of New Brunswick there is no curriculum in Canada that even mentions cybersecurity. This has put us in a difficult situation as Canada faces a generational shortage of cyber-talent. But the real danger isn’t our failure to get students interested in working in the field, it’s the apathy and  ignorance Canadians seem to revel in.

    The vast majority of successful cyber-attacks depend on user ignorance to find a way in. Canadian defensive technologies are world class, but if the people using them are dangerously oblivious, that’s where the opportunity for abuse lies, which is why Russian and Chinese government organizations are focusing their attention there. If you want to destabilize a democracy, you create division in its people, and with most people going online wearing a blind fold of apathetic ignorance, it’s the easiest opportunity.

    If you provided your military with state-of-the-art weapons but didn’t train any of them in how to use them, you wouldn’t have a very effective fighting force, yet that is how we approach cyber-readiness in Canada. Connected digital technologies have become central to most aspects of life, yet the vast majority of Canadians take no responsibility for the dangers these digital opportunities present.

    Meanwhile, countries with vested interests in Canadian destabilization have created enormous offensive cyber-attack groups. China’s offensive cyber military arm – just their offensive cyber personnel – number more than the entire Canadian Armed Forces. But the threat doesn’t end there. In addition to large cyber-military capabilities, many foreign powers have also hired private companies to conduct foreign cyber-espionage. If you think the threats we face online are lone hackers trying to make a buck or two you’ve failed to grasp how cyber operations have evolved in the past decade.

    Allied Western powers have built defensive systems in partnership with industry, but our ability to perform cyber-attacks on the scale that Russia and China do is anything but equal. If this were a ‘hot’ war the map would be dominated by those countries while Western responses are minimal in response. Unlike a conventional war, there would be no lines with safe zones behind them. In cyber-warfare you see malevolent skirmishes happening in every region of Canada; nowhere is safe because connected infrastructure is everywhere.

    Around the edges of these state sponsored cyber-attacks partner organizations are leveraging similar tools for cyber-crime, often in an effort to fund the state sponsored attacks. The ransomware attack your company just paid to try and resolve may well be going to fund the next round of state sponsored digital violence.

    Thinking that this is all someone else’s problem is one of Canada’s greatest weaknesses. ‘Loose lips sink ships’ was a common reminder during World War Two. It reminded people that you never knew who is listening and that your blabbing may well get people killed. The Twenty-First Century equivalent is ‘careless clicks can hack everything you depend on.’ Not as catchy, but terrifying.

    One of the scariest parts of attending a cybersecurity conference is listening to the people trying to hold Canada together talking about how razor thin that line is. I’ve heard people who are defending against these wildly asymmetrical attacks say things like, “I’m amazed the lights are still on”, and “in the next five years we will have a cyber-attack that takes out critical infrastructure for weeks at a time.”  Perhaps when we’re all sitting in the cold and dark wondering what happened we’ll also start to wonder why we didn’t so something about it when we had the opportunity.

    Saying it’s a war out there isn’t hyperbole. Thanks to artificial intelligence many cyber attacks have become fully automated. These A.I. automated attacks iterate their approaches allowing even the most digitally illiterate criminals access to leading edge cyber incursion tools, and many foreign powers are more than happy to support that chaos for their own ends.

    What’s a democracy to do? Start taking cyber-education and digital citizenship seriously. Instead of graduating students that only add to the cyber skills gap, we should be making all students (and the families they come home to every day) aware of this secret war we’re all on the battlefield of every time we pick up a device and access the interwebs. How many times have you amplified a social media post that may well have been written by a Russian A.I. bot with the intent to damage Canadian interests? Time to stand up to this hidden war.

    I presented on using state of the art cloud based cyber simulation to teach essential cyber skills at the Serious Play Conference at UofT Mississauga this month. We have the tools to address the cyber-literacy gap in Canada and make our country cyber-secure, we just have to make using them in classrooms a priority.

    You can sign up for CyberTItan now – it’s Canada’s biggest student cybersecurity competition. There are divisions for middle and high school students and youth groups can all join up. Teams are 4-6 students and you learn real world defensive cyber skills. Support is also provided if you need mentors. www.cybertitan.ca


    Want to read more?

    Why State-Sponsored Cyber Attacks are a Global Threat

    It’s not human error if it’s wilful ignorance.

    Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure

    National Cyber Threat Assessment 2023-2024

    Cyber Operations Tracker

    The Cost of a Breach: 10 Terrifying Cybersecurity Stats Your MSP’s Customers Need to Know


    from Blogger https://ift.tt/c2Ib8Kg
    via IFTTT

    Under Dark Skies Chapter 4

    Chapter 4. Previous chapters can be found in previous posts. 

    British Expeditionary Force
    Monday, May 13th, 1940
    Reims Aerodrome – Northern France

     

    As was so often the case, Bill was
    back in Scotland in the Trials. He was exhausted and the bike was hanging
    together by a thread, but neither of them were going to stop. The smell of the
    ancient mud and heather from highland moors filled his nose, then suddenly he
    was in the pub in Fort William, and everyone was cheering as they hung his
    medal above the bar. The backslapping turned to slaps. In an instance he was
    back home in Norfolk, fired for taking the week off to compete and looking at
    an RAF poster.

    “All I’ve got to give you is blood,
    toil, sweat and tears,” it said, and then he was laying in his bunk, grey
    morning light filling the room. Bill was the only one in the NCO bunky, but
    next door in the common room the radio was turned up. Through the static came a
    familiar voice.

    “We have before us an ordeal of the
    most grievous kind. We have before us many, many long months of struggle and of
    suffering,” static surrounded Churchill’s familiar voice.

    Bill swung his legs over the edge of
    the bunk and slipped on his boots. In the common room half a dozen junior NCOs
    were sitting at the table listening to the radio.

    “…what is our policy? I can say: It
    is to wage war, by sea, land and air, with all our might and with all the
    strength that God can give us; to wage war against a monstrous tyranny, never
    surpassed in the dark, lamentable catalogue of human crime,” Churchill
    continued. He sounded like he was warming to his subject and the words were
    rolling out of him like thunder.

    The men in the room were motionless,
    hanging on every word.

    “…what is our aim? I can answer in
    one word: It is victory, victory at all costs, victory in spite of all terror,
    victory, however long and hard the road may be; for without victory, there is
    no survival.”

    “Quite,” Sergeant Michaels said,
    taking a sip of his tea.

    Bill walked over to the pot and poured
    himself a cup and leaned back against the wall to listen.

    “… I feel sure that our cause will
    not be suffered to fail among men. At this time, I feel entitled to claim the
    aid of all, and I say, ‘come then, let us go forward together with our united
    strength.’” There was a silence at the end of the speech before the announcer
    cut in explaining that this had been recorded this morning in an emergency
    meeting of Parliament.

    Bill looked around the room.
    Everyone was stony faced. The radio announcer suggested that Churchill had
    forced Parliament to open for that speech.

    “Is Churchill Prime Minister now?”
    Bill asked.

    “He got the job last Friday, mate,”
    Michaels laughed. “Where have you been?”

    “In Belgium,” Bill replied absently,
    sipping his tea.

    The junior NCOs exchanged glances.

    “Why on earth would you want to go
    there?” Michaels asked.

    “Someone asked me to give them a
    hand blowing up a bridge,” Bill replied. He was still a bit foggy after the
    long sleep.

    “Did you manage it?” Michaels asked,
    sharing an incredulous look with the other NCOs.

    “One less bridge for Gerry to supply
    petrol over,” Bill repeated what he’d said to Grimes the evening before.

    “Meet any Germans?”

    “A few too many, actually.”

    “Right, give us the details!”

    “I was the rabbit; I made a
    distraction and drew them away so the demolition boys could finish the job.”

    “Jolly good, Corporal,” Michaels
    raised his mug.

    “How are things here?” Bill asked.

    “Lost three Hurricanes over the
    weekend. Another two are on fire outside this morning, but the weather’s closed
    in so hopefully we’ll have a day or two to get ourselves sorted.”

    “Are we winning?” Bill asked,
    looking at the white faces.

    “If we’re not, we’re making them pay
    for each step,” Corporal Allings said. The other men in the room murmured in
    agreement.

    “Bloody right,” Bill replied,
    raising his cup to the room of tired men. “Want to see the latest in Nazi
    fashion?”

    Everyone’s eyes lit up, so Bill put
    down his mug and dug the SS uniform out of his barracks box. Laying it out on
    the table it was a grand looking thing, though a bit grotty from the long ride.
    Say what you will about Nazis, but they design smashing uniforms.

    “This is SS, isn’t it?” Allings
    asked, running a finger over the shoulder badges.

    “It is,” Bill replied, “it’s a
    Scharführer SS uniform. They told me the equivalent of a sergeant.”

    The men looked over the uniform with
    interest. After months in country this was the first time any of them had seen
    an enemy uniform up close.

    “Got the hat with it?” Rawlings
    asked.

    “Just the big stormtrooper helmet,
    but I left it with the bike.”

    “BMW R12?” Corporal Smith asked.
    He’d been one of the first to take the two-wheel training and had gotten into
    motorcycling magazines since.

    “Yep, boxer twin, telescopic forks.
    It handled better than it should have and flatters the rider. If you’re ever
    being chased by one you want to get a move on, or they’ll catch you up.”

    “Did they let you hang on to it?”

    “No,” Bill said with some regret. “I
    had to leave it on the grounds of a Belgian castle.”

    “It happens,” Michaels laughed.

    Someone had gotten a tray of bread
    and bacon from the mess and were putting together sandwiches with the tea. Bill
    fell in with them for breakfast. After such a mad weekend it was nice to see
    familiar faces and chat.

     

    Even
    with the weather closing in the airfield was a constant buzz of activity. So
    many planes weren’t returning or were landing in pieces that it was becoming
    obvious to everyone at Champagne-Reims that things weren’t going well. Being
    centralized with bomber squadrons made the members of Seventy-Three aware of
    just how badly things were getting as the bomber crews were constantly being
    swapped for fresh faces.

    Bill sorted out the bikes and then
    lent a hand moving fuel bowser around. Midafternoon, under low cloud and heavy
    drizzle, he was filling up a bowser when the drone of German bombers sent
    everyone into a frenzy. Bombs started dropping across the airfield, concussing
    the air, and flattening the wet grass with each explosion. Bill kept the spigot
    on. If one landed on the trench you were in you were done anyway, and
    Hurricanes couldn’t intercept if they were empty. The raid had been well timed
    as most of the squadron had just returned from patrol after the morning rain
    had lifted.

    No buildings were hit but two of the
    runways were damaged. Ten minutes later they were being filled. Bombing was an
    inexact science. It did more damage to morale than the apparatus of war,
    perhaps that was reason enough to do it.

    Bill finished the refill and
    navigated the heavy lorry over the rutted earth, staying clear of where the
    planes taxied and took off. Pulling up to the squadron’s line of Hurricanes,
    pilots were either jumping out of their planes to take a comfort break before
    going up again or were necking a sandwich and a mug of tea, often both. The
    ground crews swarmed around the bowser, running lines out to the nearest plane
    and began refueling. Bill climbed out of the cab and stepped aside. Nothing
    worse than a bystander in the way.

    “Corporal Morris,” Flight Sergeant
    Grimes was striding across the wet grass towards him. “Got a minute?”

    “Yes, Flight,” Bill replied, wiping
    his hands on a rag, and walking over to meet him.

    Grimes glanced around to make sure
    they were out of earshot, but everyone was too busy to listen in any case.

    “Bit of bad news,” Grimes began
    quietly. “We’ve lost an entire squadron of Battles in one go. They went down at
    the Belgian border just northeast of Sedan in the Ardennes.”

    “The Germans hold Sedan, don’t
    they?”

    Grimes nodded, “They’re well behind
    enemy lines. At least two of the planes landed with full crews. They managed to
    radio in before going down.”

    Grimes was poker faced which left
    Bill wondering what the ask was.  Grimes
    seemed to be struggling with it himself.

    “The squadron senior NCO is an old
    friend,” Grimes finally continued. “He’s taking this badly. They’ve already
    lost their entire squadron once before and this one will break them. They need
    a win. I thought you might be able to think of something.”

    “How many crews are we talking
    about?” Bill asked.

    “Two-Two-Six had all six of their
    Fairies on a bombing raid near Les Mazures on the Meuse River. If they all
    survived it would be eighteen men, but that’s an optimistic estimate.”

    As ridiculous as the question was,
    Bill was already trying to work out how to do it.

    “In a pinch, that Citroën TUB could
    hold that much weight. It wouldn’t be comfortable, but it’d hold them,” he
    finally replied.

    “It’s not an order,” Grimes said,
    “but if you’re willing to try and get them, we have coordinates that’ll get you
    close.”

    “I don’t want to see that many
    airmen left behind,” Bill replied. “I’ll do what I can.”

    “Thank you, Corporal. Good luck,”
    Grimes turned and walked briskly back to the temporary HQ.

     

    With the rest of the squadron doing
    double duty to keep planes in the air, Bill was able to run around behind the
    scenes putting together a plan with notes heavily cribbed from Biffy’s bridge
    adventure. He fueled up the Citroën and the Tiger and took everything else out
    of the nondescript civilian van. It would make him invisible, but the real
    trick was to avoid any German entanglements, he knew a man who might help with
    that.

    Bill rode the Tiger around the
    perimeter of the massive aerodrome to the main French HQ. It was lunch time so
    hopefully he’d be able to find Pierre in the officer’s mess. Stepping in from
    the rain, he brushed himself off and looked around. Several French officers had
    stopped eating and were looking at the damp RAF corporal standing in the door.
    From the back of the room by the window a familiar voice rang out.

    “Corporal Morris!” Pierre stood up
    smiling with a wave. “Join me!”

    Bill smiled back in relief. He’d
    gotten the distinct feeling that he was about to be yelled at in French.
    Walking past the annoyed stares, he took the empty seat across from Pierre.

    “You look worried,” Pierre noted
    over a meal that put the RAF mess to shame. “Want some coffee?”

    “Yes please,” Bill replied,
    shivering from the damp.

    Pierre filled a porcelain cup with
    spectacular smelling coffee. Fighting a war in your own country had its perks.

    “What can I do for you, damp
    Corporal?” Pierre asked, handing him the cup.

    Bill took a sip and then looked
    Pierre in the eye.

    “We lost an entire squadron of
    Fairey Battles this morning. They’ve gone down in the Ardennes northeast of
    Sedan.  My Flight Sergeant is wondering
    if I can go get them.”

    “That’s thirty kilometres the wrong
    side of the German line,” Pierre said, “and a lot of people to try and fit on
    the back of a motorbike.”

    “I’ve got a civilian Citroën TUB
    that should hold them,” Bill replied.

    “Of course you do.”

    “What I’d really like to do is avoid
    any enemy entanglements. Do you have any idea where they’re concentrated up
    there?”

    Pierre took a sip of coffee and gave
    it some thought.

    “I can find you some of the latest
    reconnaissance from the area, but they won’t be happy to see an RAF enlisted
    man in there. Wait in the Quartier General front office. Tell them Captain
    Clostermann has asked for you and they should leave you alone.”

    “Thanks, Pierre.”

    Both men drained their coffees and
    stood up. Bill followed Pierre out of the officer’s mess as many eyes followed
    them.

    The Quartier General was a permanent
    building with heat, which Bill found magical after a winter living in various
    forms of temporary shelter. The officious git at the front desk could speak
    English but was determined not to. Bill finally got a dismissive gesture
    towards chairs in the lobby and went and sat in one. Pierre appeared a few
    minutes later with a notebook full of scribbled details. He sat down next to
    Bill in the waiting area and started a rapid fire debrief.

    “Most of the German activity is on
    the east side of the Meuse. That river, eh? They have a major supply line
    running down the road from Hargnies that we’ve been trying to hit for the past
    week, but they provide strong air cover over it. Maybe head north to Vervins
    and then come in from that way, you’re only likely to meet light patrols. Their
    main push is into Sedan and then south.”

    Pierre hesitated, closing the
    notebook, “Just because they are looking the other way doesn’t mean this will
    work William. Are you sure you have to do this?”

    Bill smiled tightly, “I don’t have
    to do anything, but I don’t want people feeling hopeless and that’s how things
    are starting to get over our way. If I can nip in and get a few boys back home,
    it’ll help.”

    Pierre nodded, “Bonne chance, mon
    ami.”

    They stood together and shook hands.

    “I’ll pop by later in the week and
    tell you how it went,” Bill smiled.

    “I’m sure you will,” Pierre replied,
    though the worried look in his eyes didn’t go away.



     

    With everyone running about putting
    their planes back together again, the barracks and mess were empty. Bill ate
    alone before dinner was scheduled. The ceiling had dropped to only a few
    hundred feet making visibility poor and grounding the planes, it was going to
    be a cold, damp evening. After getting food into him, Bill filled a thermos
    with tea and put together a sandwich to bring along. As everyone else was
    coming in for dinner, Bill headed out into the rain. The Citroën had
    non-descript grey paint that faded into the wet landscape. It was going to be
    such a handful unloaded that driving it in the wet made Bill distinctly
    uncomfortable. That’s when inspiration struck. Why not put a bike in it and
    ride back? If he vacated the van and let the aircrew drive it back, more of
    them would fit in the van.

    The obvious choice was the only
    non-RAF bike he had: Louis Jeanin’s Tiger. The brace of Nortons and the lone
    Triumph were all sitting under a dripping tarpaulin. The Tiger was still
    cooling from the ride over to Pierre. Bill eased it out from under the tarp and
    rolled it over to the van. Dragging a plank from the bike shed and setting it
    as a ramp, he pushed the Tiger up into the van and tied it to the side with
    bits of rope. If the Citroën stopped bouncing about so much, he might not end
    up in a ditch.

    With another couple of hours until
    dark, Bill shut the doors and double checked that the radiator was full, and
    that the engine had oil. He also went over everything with an oil can and
    checked and filled the tyres. The strange layout of the TUB made this a bit of
    an adventure but knowing where everything was seemed prudent, though doing it
    half under a tarp in pouring rain wasn’t fun. 
    Watching Biffy check the details and put his bridge demolition plan
    together had given Bill some idea of how to ensure success when a job had so
    many potential surprises.

    As everyone else went back to
    putting their planes back into service, Bill hit his bunk and tried to sleep.
    He must have had a kip because the next thing he remembered was the sound of
    the other junior NCOs coming in after a long day on the field. He sat up and
    began putting his civilian clothes on. When he came through out of uniform the
    conversation around the card table stopped.

    “That looks like trouble,” Michaels
    observed, putting his cards down.

    “Off to see if I can bring some
    Fairey Battle crews back,” Bill replied, snagging a mug, and filling it from
    the ever-present tea pot.

    “Long way to go?” Michaels asked.

    “Ardennes,” Bill said, sipping his
    tea.

    “Isn’t it full of Nazis?” Allings
    asked with a look of concern.

    “That’s the tricky bit,” Bill
    replied, draining the tea.

    “What’s the plan?” Michaels’
    curiosity mirrored the room’s.

    “Drive the Citroën van up there.
    Pretend I’m French and hope any Germans I ran into aren’t because my French
    won’t take it, find the crews, hand them the van and then ride back providing
    cover.”

    “Think it’ll work?” Michaels asked.

    “I’m about to find out,” Bill
    smiled, pulling on his dark blue fishing gansey and stepping out into the rainy
    night.

    The hand knitted fisherman’s gansey
    was a gift given to him the day before he enlisted. It was a reminder of
    someone special at home, and it was remarkably good at repelling water, which
    would be handy tonight. She’d made it in her family pattern, and it was a
    unique thing. In the uniformed world of war, he had little chance to wear it.

    The TUB fired up even though it had
    been sitting in the wet. As weird as the van was, you had to admire the
    engineering. Bill looked over his shoulder. The Tiger crouched in the back of
    the van staring back intently with its slotted black out headlamp. The chance
    to ride it again, this time possibly in anger, sent a thrill up Bill’s spine.

    He put the van in gear and bounced
    over the rutted, wet field toward the gate. If they gave him any stick, he’d
    have them contact Grimes, but the bored French MP at the gate gave him a wave
    when he pulled up and he was through into the kind of darkness you only find in
    the countryside at night in the rain.

    With
    the Tiger in the back the Citroën was manageable. Bill made good time north
    through the weather which was more tedious than terrifying. He pulled into
    Signy-l’Abbaye, on the edge of the Ardennes Forest just before midnight and
    turned off the lights. Sedan was east of him, and Pierre’s notes had suggested
    that this was where all the German attention was. He hadn’t seen another
    vehicle on the road having stuck to small back roads all the way up.

    Using a torch, he scanned the map.
    Les Mazures was a village deep in the forest just west of the Meuse River, the
    same waterway they’d crossed in Belgium, but down here it was a much smaller
    river. With the rain and now a forest, Bill couldn’t have asked for better
    cover, but good cover also meant poor sight lines. He could easily round a
    corner to discover a hundred Nazis having dinner.

    He
    turned the headlamps on and put the TUB into gear before rolling under the
    deeper shadows of the trees. The road followed a tributary that would
    eventually feed the Meuse. The running water was producing its own mist,
    cutting visibility even further. He passed through Villaine, another forested
    village where all the cottages and shops were dark, but on the outskirts, he
    saw a light ahead and pulled off the road onto a dirt path and turned
    everything off.

    Looking at his map again by
    torchlight, he was less than ten miles from where the Fairey crews had gone
    down. As he double checked the map a heavy-duty vehicle rumbled past on the
    road behind him. The lightless TUB sitting in the shadows hadn’t drawn any
    attention. That had been a big, military lorry, possibly a troop carrier. A
    familiar sound followed as a pair of sidecar outfits passed by, and then Bill’s
    heart jumped in his chest, the mechanical groan of a treaded tank was getting
    louder.

    Staring at the rear-view mirror,
    Bill sat motionless in the shadows. He’d seen tanks but never up close, he was
    in the wrong branch of the service for that sort of thing. A Panzer heaved into
    view behind him, making quick progress down the country road. It had a bright
    spotlight on it that was scanning the forest. Bill could make out the manned
    heavy machine gun mount on top next to the spotlight. That gun would turn his
    van into Swiss cheese in seconds. The light swept across the Citroën as the
    Panzer rolled down the road, but it didn’t hesitate; a nondescript French
    delivery van was the best possible camouflage.

    Behind the Panzer another large
    lorry passed and finally something smaller, maybe one of those little square
    Kübelwagens he’d seen at the Luxembourg border last week. Was that only last
    week? As the convoy of mechanized soldiers thundered into France unimpeded,
    Bill’s heart started to slow down. The dirt road continued into the forest
    ahead. He’d intended to fire up the TUB and drive hard into the woods had they
    stopped, but his civilian camouflage and going to ground had done the trick.

    He gave it a minute more and then
    started up the van and backed it out onto the road. The pavement was in rougher
    shape after being churned up by the Panzer, so slow and steady it was. Knowing
    that mechanized unit was blocking their way out was something to keep in mind.
    Along with the heavy machinery, there must have been dozens of men in those
    vehicles.

    Chapter 5 can be found here.

    from Blogger https://ift.tt/oNFj8Kd
    via IFTTT