I recently had a chat with Hannah Betts about national data sovereignty and AI sovereignty. I’m sceptical about much of the discussion about this topic. Mostly because there is very little evidence that it is a real (rather than theoretical) problem, and because most of the responses confuse the physical location of the data with the jurisdiction that applies to that data. But recent events with Anthropic and Fable have forced me to rethink this.
Author: Doug Newdick
The CSRB, Microsoft, China and You
What does the recent report on Microsoft security mean?
In May-June 2023 a hacking group affiliated with the Chinese Ministry of State Security (known as Storm-0558) breached the email of several of Microsoft’s customers including the US State Department, the US Department of Commerce, several UK government organisations as well as customers in other countries. They also compromised the personal email accounts of key individuals involved in US relations with China.
The New NIST Cyber Security Framework Is Coming
We think that the new version of NIST’s Cyber Security Framework is a significant improvement. There’s one big change, but it is the lots of little changes that add up to a massive overall improvement. New Zealand organisations will still need to do some work to plug some of its idiosyncratic gaps, however.
ISO 27001 Audits Made Easy…Sort Of
Our clients pay us to give them good security advice. And there is nothing like taking your own advice and seeing how well that goes. So, a couple of years ago we decided to eat our own dog-food and go for ISO 27001 certification. This is an internationally recognised way to demonstrate that you have good security. We’ve recommended it to a number of our customers, and we’ve helped several gain it.
We had several things we wanted to achieve with this:
This Phrase in a Government RFP Fills Me with Dread
Government agencies use the phrase "Must comply with the NZISM" in their RFPs when they don't know what to say about security. There is a better way.
On Scooters and Stale Audits
Bear with me for a bit. When my son started intermediate school he wanted to scoot there. He had a flash scooter, so we got him a padlock and insisted he use it. Over the next few weeks we checked that this was happening. 6 months later we discovered that his padlock had seized up and he couldn’t use it. I reached for that old NZ standby – CRC – and got it working again.