3 ms·

Friendly reminder that it's recommended to document it in an encrypted file in the event that your mistakes may have regulatory, compliance, or legal consequenc

Friendly reminder that it's recommended to document it in an encrypted file in the event that your mistakes may have regulatory, compliance, or legal consequences. An advice from a mentor of mine when I first started my journey in reputation management, plausible deniability has saved me and my clients on numerous occasions.

jka 5y ago
Without mentioning any of the incidents involved, could you link to one of the rules mentioned that discouraged documentation of technical mistakes? (my guess is that those may have been written at a point in time during which it did make sense to prevent publication/knowledge of mistakes like that - I'm wondering whether that remains a good policy nowadays, when risk-reduction can often benefit from information-sharing, even around failures and errors)
Havoc 5y ago
> regulatory, compliance, or legal consequences. Encryption won't save you from any of that. >plausible deniability has saved me and my clients on numerous occasions. right...OK maybe it will if that's how it is employed. Quite risky though. Encrypting stuff & "forgetting" the password versus say shredding evidence isn't that far apart.
- gruez 5y ago
  > right...OK maybe it will if that's how it is employed. Quite risky though. Encrypting stuff & "forgetting" the password versus say shredding evidence isn't that far apart. Disagree. Shredding evidence is an active action that can be used to establish guilt. Forgetting a password requires none of that.
- BeFlatXIII 5y ago
  Shredding a pile of evidence is legally actionable. Shredding any documents left laying about after one week every week is a standard security process.
spaetzleesser 5y ago
I work in a regulated industry and I try to keep all problems as open and widely known as possible. There are others who like to keep everything secret which has led to known problems not being fixed for a long time. I am just a small engineer but this strategy seems to have worked in my small area. We are finally following industry standards, pentesting gets done (some people still resist though. They think it's better not to know about problems) and in general things don't get ignored anymore.

jka 5y ago

Without mentioning any of the incidents involved, could you link to one of the rules mentioned that discouraged documentation of technical mistakes? (my guess is that those may have been written at a point in time during which it did make sense to prevent publication/knowledge of mistakes like that - I'm wondering whether that remains a good policy nowadays, when risk-reduction can often benefit from information-sharing, even around failures and errors)

Havoc 5y ago

> regulatory, compliance, or legal consequences. Encryption won't save you from any of that. >plausible deniability has saved me and my clients on numerous occasions. right...OK maybe it will if that's how it is employed. Quite risky though. Encrypting stuff & "forgetting" the password versus say shredding evidence isn't that far apart.

gruez 5y ago
> right...OK maybe it will if that's how it is employed. Quite risky though. Encrypting stuff & "forgetting" the password versus say shredding evidence isn't that far apart. Disagree. Shredding evidence is an active action that can be used to establish guilt. Forgetting a password requires none of that.
BeFlatXIII 5y ago
Shredding a pile of evidence is legally actionable. Shredding any documents left laying about after one week every week is a standard security process.

spaetzleesser 5y ago

I work in a regulated industry and I try to keep all problems as open and widely known as possible. There are others who like to keep everything secret which has led to known problems not being fixed for a long time. I am just a small engineer but this strategy seems to have worked in my small area. We are finally following industry standards, pentesting gets done (some people still resist though. They think it's better not to know about problems) and in general things don't get ignored anymore.