Security

A friend who was at HackIT 2026 in Firenze sent me a photograph of a printed handout. Two pages, a bit creased, a faint smear of something on the second one. It was the material for a workshop called Imagining collectivity under oppression, run on the Friday afternoon in Sala M by two people going by Alecs and webbie. I did not attend. So I am reviewing a piece of paper, which is worth saying out loud: a workshop is the room and the people in it, not the script. Most of what follows is about the script. By the end, that gap might be the whole point. ...

Bestuurlijke instrumenten beoordelen toestanden. Een toets, accreditatie of kader stelt vast of iets op een bepaald moment in de juiste staat verkeert, en ontleent zijn waarde aan de aanname dat die toestand stabiel blijft tot het volgende toetsmoment. Dat werkt zolang de eigenschap waar het om gaat berust op een stabiel object: iets dat zich laat aanwijzen, vastleggen en opnieuw onderzoeken. Veel eigenschappen waar beslissingen uiteindelijk over gaan, gedragen zich anders. Ze liggen niet besloten in een object, maar ontstaan in een proces, verhouding of gebruik. En die houden niet stil voor de meting. Dan komt een instrument niet tot een verkeerde conclusie, maar meet het een ander soort eigenschap dan de relevante. Niet omdat het slecht ontworpen is, maar omdat het aangrijpt op iets anders dan waar de relevante eigenschap ontstaat. ...

The usual way of reading the contest over resources is to look at where they are. Whose ground holds the oil, the gas, the rare earths, the cobalt. On that picture power follows the deposit, and the country sitting on the richest seam holds the strongest hand. It is the picture behind a great deal of the current talk about resource grabs, and it is wrong in a way that the talk mostly misses. ...

Everyone knows by now that Europe is rearming. That part is easy to write and carries almost nothing, because “investing in defence” survives any amount of vagueness. The interesting reading sits a little lower down, in the documents that have to name things: how much money, raised in what way, spent on what, through which legal route, under whose command. Those are harder to write and harder to take back, because somebody has to act on them. Read side by side, they sketch a shape, and the shape says more than the announcements do. ...

A policy speech says what an institution wants to be seen wanting. A procurement document records what it has agreed to pay for. The two are not the same, and the gap between them is usually the more interesting reading. A press release costs nothing to write and binds no one. A call for tender names a budget, a deadline, a set of deliverables and a contract that someone will sign and then have to deliver against. Intentions are cheap. Commitments leave a paper trail, because somebody has to do the work and somebody has to account for the money. ...

Er is een gewoonte in detection engineering die een organisatie tijd kost om af te leren. Een team kijkt naar de waarschuwingen, de dashboards en de dekkingsrapporten, en beschouwt die als de plek waar detectie gebeurt. Dat is niet zo. Het is de plek waar detectie zichtbaar wordt. Het werk dat bepaalt of er iets te zien valt, gebeurde veel eerder en veel stiller, toen iemand koos wat er gelogd werd. Zonder vastgelegde gebeurtenis genereer je geen waarschuwing. De prijs van een ontbrekende log betaal je pas tijdens een incident, wanneer blijkt dat het spoor nooit heeft bestaan. ...

The stability of dysfunction Many discussions of large systems quietly assume that a stable system is a healthy one, and an unstable system is a sick one. Complex systems tend to violate that intuition. They can remain operational for a very long time without becoming any healthier, and they possess several mechanisms that let them do so. Normalisation is one of those mechanisms. It is not the whole story. The whole story, if there is one, is that persistence and health are different properties, and large systems are often much better at achieving the first than the second. ...

Most organisations think they have a threat model. What they usually have is a historical artefact: a snapshot of how the environment looked on the day several people sat in a room with diagrams, coffee, and varying levels of optimism. The session happens. Assets are mapped. Threats are identified. Risks are scored. A document is produced. The document is reviewed, approved, uploaded somewhere nobody voluntarily visits, and occasionally resurrected during audits or post-incident archaeology. ...

There’s a fundamental problem with learning operational technology security: the things you need to test are the things you absolutely must not break. This creates what educational theorists call “a bit of a pickle” and what facility operators call “no, you’re definitely not touching the production turbines with your laptop.” It’s rather like learning to defuse bombs. The theory is straightforward, the practise is somewhat more stressful, and mistakes tend to be memorable for everyone in the vicinity. In OT security, mistakes might not result in explosions (usually), but they can shut down production, trigger safety systems, or cause equipment damage. These outcomes are suboptimal for learning environments and remarkably unpopular with operations teams who prefer their turbines spinning at correct speeds rather than serving as expensive educational exhibits. ...

Organisations invest heavily in procedures, certifications, and standards. Yet whether those investments deliver results depends on something far less tangible: human relationships. As organisations become more distributed and interdependent, seeing and strengthening these connections becomes critical to resilience. The hidden architecture of trust Without trust, perfectly drafted policies and shiny certificates become little more than beautifully formatted PDFs. In networks where multiple organisations or teams rely on each other to deliver quality services, trust determines whether processes work in practice or collapse under miscommunication. ...