Shortform

Dean Valentine

This is a special post for quick takes by Dean Valentine. Only they can create top-level comments. Comments here also appear on the Quick Takes page and All Posts page.

I don't think it's possible for mere mortals to use Twitter for news about politics or current events and not go a little crazy. At least, I have yet to find a Twitter user who regularly or irregularly talks about these things, and fails to boost obvious misinformation every once in a while. It doesn't matter what IQ they have or how rational they were in 2005; Twitter is just too chock full of lies, mischaracterizations, telephone games, and endless, endless, endless malicious selection effects, which by the time you're done using it are designed to appeal to whichever reader in particular you are. It's just impossible to use the site as people normally do and also practice the necessary skepticism about each individual post one is reading.

FWIW I would agree that Twitter is probably at least slightly bad for almost everyone. Those who are reasonable on Twitter are probably only so because they're even more reasonable in other fora.

Edit: Bad in the particular way being discussed. It can be good in other ways, like learning new information about the world.

7Dean Valentine1y

The purpose of these audits is not generally to verify with certainty that you're doing everything you say. That would be very hard, maybe impossible. Mostly you fill out a form saying you're doing X. If it turns out later after a breach you weren't doing the stuff you claimed to do during the audit, you're sued. We're doing a PoC right now for a company with >400,000 employees. I am not their security team, and we haven't sold yet, but on our end everything we've run into is normal procurement BS. The main thing that happens as you start to sell to larger customers is that you have to fill out a lot of forms saying your product does not use slave labor and such.

2Max H1y

The "you're sued" part is part of what ensures that the forms get filled out honestly and comprehensively. Depending on the kind of audit you do, the actual deliverable you give your auditor may just be a spreadsheet with a bunch of Y/N answers to hundreds of questions like "Do all workstations have endpoint protection software", "Do all servers have intrusion detection software", etc. with screenshots of dashboards as supporting evidence for some of them. But regardless of how much evidence an external auditor asks for, at large companies doing important audits, every single thing you say to the auditor will be backed internally with supporting evidence and justification for each answer you give. At a bank you might have an "internal audit" department that has lots of meetings and back-and-forth with your IT department; at an airline it might be a consulting firm that you bring in to modernize your IT and help you handle the audit, or, depending on your relationship with your auditor and the nature of the audit, it might be someone from the audit firm itself that is advising you. In each case, their purpose is to make sure that every machine across your firm really does have correctly configured EDR, fully up to date security patches, firewalled, etc. before you claim that officially to an auditor. Maybe you have some random box used to show news headlines on TVs in the hallways - turns out these are technically in-scope for having EDR and all sorts of other endpoint controls, but they're not compatible with or not correctly configured to run Microsoft Defender, or something. Your IT department will say that there are various compensating / mitigating controls or justifications for why they're out of scope, e.g. the firewall blocks all network access except the one website they need to show the news, the hardware itself is in a locked IT closet, they don't even have a mouse / keyboard plugged in, etc. These justifications will usually be accepted unless you g