#lecs

[evaksbinder]

An Archive of Our Own, a project of the Organization for Transformative Works

This week’s theme is non-evak-centric fics. Today’s post is by Kathi. If you like this fic, please consider leaving it a comment/kudos!

take only what you need - lecs (Vilde-centric character study w/ Isak & Vilde friendship and Eva/Vilde; 2k words)

isak valtersen has never been on her radar. part 2 of my character studies (i guess) of isak and vilde and their unlikely friendship. vilde pov.

Kathi’s ramblings:

Great characterization of Vilde; her voice is spot on, a perfect mix between a little tactless and doubting of herself and always trying to do the right thing; Vilde’s character development feels very true to her and is allowed to unfold slowly

Her friendship with Isak is lovely; parallels their struggles perfectly

Beautiful writing that is simple, but heart-wrenching

Note: Technically this is part 2 of a series, but it can be read as a standalone!

Kathi’s favorite lines:

“Yeah. Like. You ever feel like if your life has just one tiny crack… everything else in it will just-“ she swipes her hand through the air, knocking some coats off the pile. “Shatter?” He just stares and she leans heavily against the pile of coats and closes her eyes, feeling so heavy and tired tired tired. She slips away with the feeling of being lifted, weightless, Isak’s voice in her ear, warm breath on her skin. “All the time.”

[lecsbusiness-blog]

LECS, pioneer and top manufacturers of electrical control panels, injection moulding, switchgear components, cable harness and other electrical products to various industries.

[jmess-6841]

Group Think

Richard gave an example of a time he caught himself out in a group think scenario. Whilst he was still fairly junior, he attended a dinner with some senior colleagues and found himself not being able to voice his opinions when he wanted to disagree, and when he would laugh along at jokes even if they weren’t funny.

Group think refers to a situation when you value group membership and harmony, over getting things done right. You don’t want to be the one everyone dislikes and talks about behind your back. This is extremely applicable in the real world, and I am certain everyone has found themselves in at least one group think scenario throughout their lives. 

In small contexts it may seem harmless, but this basic human condition can lead to large (often ethical) consequences when left unchecked. The Bay of Pigs incident is often cited as a prime example of group think. The invasion plan was "uncritically accepted” and when others attempted objection, the Kennedy team essentially ignored these objections, continuing to believe in the morality of their plan. Eventually those who objected minimised their own doubts, performing “self-censorship”. “The Kennedy team failed to question the CIA about its false assumptions, including the ineffectiveness of Castro's air force, the weakness of Castro's army, and the inability of Castro to quell internal uprisings”. 

Here, group think occurred due to Kennedy’s position of power, with those below him not questioning his authority. As well as himself abusing his power, knowing those below him would be affected by group think and obey his command. It would’ve worked out if perhaps Kennedy’s plan was a good one, yet his lack of revision of the plan resulted in a massive tragedy. As a political leader, Kennedy would’ve evaluated his alternatives in regard for the possible political consequences, especially with the desire to avoid damage to reputation. With the US being a strong capitalist country, and communist Cuba lying so close, it was a direct threat to the country. As such, with self-interest at heart, it’s not surprising the plan went ahead unchecked, with Kennedy going as far as trying to hide US involvement. 

Following the invasion, it was believed Kennedy would eventually allow the American military to intervene in Cuba on their behalf, however it was evident he had reservations about explicitly involving the US from the start. 

Whether or not he really did only had his own intentions at heart I can’t say for sure, but knowing that there was a lack of revision in the plan, dismissal of outside opinion, and his attitude after the fact, leads me to believe there wasn’t enough effort placed in for him to have truly cared about the cause. 

Preventing Group Think

As a leader, avoid stating own preferences when assigning tasks

Allow for others to come up with their own ideas first

Encourage group members to remain critical.

Don't discourage dissent or challenges to the prevailing opinion

Assign at least one individual to take the role of the "devil's advocate"

Discuss the group's ideas with a 3rd party to get impartial opinions

[jmess-6841]

Defending vs Protecting

Throughout the case studies this term, I’ve always found it much easier to think of ways to attack, rather than to defend. I think a concept from this week is going to help. 

Rather than considering how best to defend against attacks, we should consider how to protect our largest assets. 

Previously, when thinking of defending, I was thinking of ways the enemy could attack us and how we’re going to prevent those attacks. But not once did I ever think about what we are actually protecting here. It’s important to understand that we cannot defend against every attack, and there will always be the potential to be breached, but if we can place our efforts into protecting what is most valuable to us, then we can say we put in our best efforts and did all we could. It would be embarrassing to land in a scenario wherein we’ve put multiple defences in place broadly across our entire system, only to be attacked at a point we had seemingly forgotten about and one of our greatest assets came loose as a result of something that could’ve been prevented if we had targeted our defences.

Consider if we were protecting files on a computer system. We could set up a really strong encryption system such that breaking into the system is difficult, protecting all our files at once, even the trash can files. Or, we can assess which files are most important to us, create physical copies (either on paper, on a removable device, or even not at all), and erase them from the system. Of course, we should not do this for all the files, only our most important ones, as leaving the attacker with nothing after breaking into our system (yes I’ve assumed they were able to bypass our really strong encryption system), would draw suspicion. 

Note that specialising defences does not necessarily mean we are going to increase defence by stationing 100 men outside a room or encrypting a file 100 times - this would actually just raise more suspicion. The only foolproof way to protect an asset, is to destroy it. Protecting cash? Spend it. Protecting data? Erase it. Although most of the time this is unplausible, and of course there are many other strategies out there for protecting your asset. The main idea though, is that we know what our assets are. 

How to assess our assets;

1. Regularly survey the values of the people involved in what we are protecting 2. Develop a sensible plan 3. Periodically revise the current list of assets

Specialised defence is always stronger than general defence. It even sounds better. And if attacks can be targeted, why can’t defences?

[jmess-6841]

Sila

Sila (real name protected for privacy purposes), a guest speaker, came in to speak today about bias in evidence, in context of the medical field. She noted the two main types of bias;

Observation bias

Relating to day-to-day experiences unconsciously influencing your decision-making

Eg. A doctor choosing not to prescribe a drug due to seeing his partner’s own reactions to that drug

Systemic bias

Influenced by entities who just want the outcome to go in one direction; Unconscious conscious decision making (if that makes sense)

Commercial entities will push their bias in order to make profits

Eg. A director of a pharmaceutical company offering to purchase lunch for a doctor to gain their favour in recommending their brand to patients

Studies have shown a $20 lunch has a measurable impact (approx. 5x increased likelihood) on a doctor prescribing that company’s drug over competitors’

Apparently, R&D costs < Marketing costs for drug companies

What was interesting to me, was how security concepts were very relevant and could be related back to this. Systemic bias proves this entire system is vulnerable to attack, wherein it is easier to target single points (individual doctors) rather than the entire system (the medical field itself). 

This made me think about the times a doctor had prescribed me pharmaceuticals of a specific brand. I always assumed it was because it would just make it easier for me to find what I needed (rather than having to decide a brand for myself), or because it was the most effective, yet now I am beginning to question the veracity of this. This brings back the idea of never trusting anyone, and conducting your own research on a topic before coming to a conclusion. Next doctor’s trip I will definitely be questioning their integrity (but subtly of course, can’t have my doctor disliking me, especially when she’s jabbing me with a flu shot).

Truly no offence to Sila, I just feel I should question everything, but another point I came up with was after seeing Sila’s determination to be uninfluenced by systemic bias and towards her perspective. Who is to say Sila is not in fact biased herself on her viewpoint? Consider if there arose a scenario Sila were deemed not important enough to be a point of attack for these pharmaceutical companies, therein would lie a bias against them, and hence jealousy a motive to take them down - an inherent human weakness. Leading on from this, there is also the hard to get scenario, wherein Sila is actively, publicly against companies’ influences to increase their motivation to take her down, offering her larger bribes than a $20 lunch.

I always try to see the best in people and so I also question whether profits aside, some companies really do have their customers’ best interests at heart. If a company were finding their product to be more effective than competitors’ but were having issues gaining market power, this would be a legitimate reason to place bias within the system. However after witnessing so many companies do the same with only profits in mind, Sila has been put off the idea all together. 

Once again, no discredit to Sila’s professionalism here, I do believe that she has the patients’ best interests at heart and is working hard to eliminate these biases within the workplace and I am grateful for it. It wouldn’t make any sense for her to act in the ways as described above as she would only discredit herself, I just thought it’d be good practice for the weekly case studies to try and consider an opposing perspective. I’m wishing her the best of luck in her fight against bias!

[jmess-6841]

Brute Force Domain

When I think of brute force, I immediately link it to being equivalent to the worst case scenario, in which we must try every possible combination. Richard brought up a good point in that brute forcing does not necessarily mean going over every possible combination, rather, we should consider a brute force domain. 

This is actually a concept we apply unconsciously everyday. When we are looking for a matching pair of socks in the morning, we know we don’t need to search our entire house, but rather, just our sock drawer. Whilst shopping, you wouldn’t search the entire store if looking for some shoes, you would only search the shoes section (although I personally am guilty of searching the entire store anyway, especially if online). When we are looking for an open entry to a building, we don’t need to search buildings next door to us, we only search the building we’re trying to get into. 

The only issue with considering a brute force domain, is if we are missing information, leading us to choose an incorrect domain (normally not large enough). Consider the above scenarios again. What if we couldn’t find a sock to match ours because that particular sock had fallen into the the abyss of disappeared laundry? Or if it had been placed into a different drawer by mistake. What if due to some shoddy web design, some shoes available weren’t listed in the shoes section (actually a very common scenario), or there were items ‘in the back’ yet to be brought out. And what if we were unaware that the building next door actually had a corridor leading into the building we wanted to enter. 

When our domain is off, we can brute force and still never reach a solution. This is why the worst case is that we should search all possible inputs, but brute forcing does not necessarily mean it is the worst case. In fact, sometimes brute forcing can be the only approach (eg. one time pads), hence being the best case.

In security, or rather, in insecurity, being able to find a smaller brute force domain than the worst case, would make cracking much more efficient. Of course, this is extremely difficult, especially when considering things such as cracking SHA256, but I doubt it is truly impossible. In the future, we might have some serious advantages in the exploits department (wait but this would actually be bad so don’t do research, or, research only for preventative measures!).

[jmess-6841]

Control Structures

An interesting point brought up this week was the idea that a single point of failure reduces frequency of corruption but increases impact. 

Consider the Bell LaPadula command structure. This is a control structure set up as a military hierarchy, wherein say, messages flow from the bottom and are passed upwards between the ranks, before they are able to reach the head of command. The person at the top of the hierarchy now becomes a source of failure, because to attack the entire structure, would only require attacking the head of command, as they have the authority of all those below them. 

An advantage of this structure is that if corruption arises within the hierarchy, it is difficult for them to achieve much due to their lack of power individually. Where the issue arises however, is if the top of the pyramid is compromised. This is what is meant by increased impact. If the highest authority is taken down or goes rogue, the entire thing falls. 

On the other hand, consider Ancient Greek/Roman separation of powers listed here: https://jmess-6841.tumblr.com/post/185902718904/separation-of-power

By dividing power into separate entities, the goal is to avoid a single person/group holding autocratic power. As a result, the existence of a single point of failure is minimised, and attacking a single branch would not result in a downfall of the entire system.

However, when power is divided in this way, it is important that the separated groups effectively communicate with each other, and work as a team to solve issues. It is only in this way, that a division of power becomes an effective solution. Unfortunately for the Greeks and Romans, this was difficult due to many conflicts of interest between groups. This and other factors led to their eventual downfall.

[jmess-6841]

Data Centres

When Richard tasked us with finding the location of some data centres, I didn’t think this would be a topic of interest. I Imagined myself going on a wild goose chase all over Google maps not really finding anything specific. 

I began with Google’s data centres. To my shock (and horror), I instantly found the location of all(?) their data centres, with exact longitude/latitude coordinates! https://en.wikipedia.org/wiki/Google_data_centers

I searched up Facebook data centres and got pretty much the same thing. This article here, even talks about some of the technicalities within their centres: https://code.fb.com/data-center-engineering/data-centers-2018/

This concerns me extremely. To have the exact locations of where millions (probably billions) of people’s data is stored makes me massively anxious. Single points of failure all around the world are now created, and  an attacker doesn’t need to track down where to attack. I’m just really surprised not many efforts have been put in place to prevent this sensitive information from getting out. Especially since services such as Google Maps are owned by Google, you’d think it wouldn’t be too much work to obstruct the satellite view of their own facilities. 

But on the other hand, this also reassures me. Because of this fact, I know these companies aren’t relying on security by obscurity to keep themselves safe. Security by obscurity is the weakest form of security, where security arises from keeping things a secret. This was the most important point from last week’s discussion of Kerckhoff’s Principles, that you should never rely on security by obscurity.

Whatever mechanisms these companies have going on within their facilities, I pray they are strong enough to ward off attackers.