The NZ politicians and news media are updating us daily on selected COVID-19 statistics (metrics), particularly concerning NZ of course but also the global situation. Countries with the largest numbers (regardless of which metric) are naturally media-fodder. It's fair to ask, though, what all these numbers mean, why we should care about them, and why they  are being reported rather than others. As with information risk and security metrics, there are various audiences of the metrics with numerous concerns, objectives, purposes, uses for or interests in them e.g. : Those actually managing the national response, day-by-day, need to know how they are doing relative to their plans and intentions, and how they might improve Central and local government politicians giving oversight and direction to the response ... with a keen eye on their popular standing, given that an election is in the offing (unless deferred) ... plus administrators in the civil service The Treasury and Inland Reven...

Our "broadband" is gradually becoming narrower by the day as an increasing number of Kiwis on staycation are working from home, downloading/watching videos, playing online games or whatever. Normally I listen to online music stations while working and I still can: thanks to bufferuffering and the relatively little bandwidth required, streaming audio still works OK ... but instead I'm listening to my music CDs for a change, figuring there are those out there who need the Interweb bandwidth more than me. Besides which, I like my CDs and it's easy to skip the duff tracks. 

Yesterday I wrote about exploiting/making the most of opportunities that arise in a crisis. Here's an example - using COVID-19 as an analogy to help explain a concept. A question came up on the ISO27k Forum about how to handle 'primary and secondary assets' in the risk assessment processes described by ISO/IEC 27005. This is my response ... Primary assets (business processes and activities, information) … usually the core processes and information of the activity in the scope” [ ISO/IEC 27005:2018 section B.1.2] are the focal point: that’s what we need to protect. However, in order to do that, we also need to take care of other matters, including the supporting/enabling information systems, networks etc . Those have some  intrinsic value ( e.g . used but now redundant servers can be upgraded, redeployed, sold or scrapped) but their main value relates to their roles in relation to the primary assets. A topical analogy is “health” – an asset we all need to protect. For vi...

With a bit of lateral thinking, there are ways to hook-in to and even exploit the COVID-19 brouhaha. More time for reflection is one of the advantages of the lockdown, for some of us at least.  Many organizations, for instance, have sent out customer comms about what they are doing to maintain services during/despite the pandemic. Although most are matter-of-fact and boring (maybe not even branded), some are more creative and engaging, even acknowledging that COVID is not going to blow over in a couple of weeks. Most are generic, superficial and bland, often supplier-focused, whereas some are personalised, unique, detailed and customer-focused. Most appear to be one-off broadcasts, hurriedly cobbled together by teams immersed in the chaos and confusion, then slowly refined and authorized. Not many that I've seen so far even hint that there might be more to come. The odd tinge of humour is welcome.   Unlike the vast majority of incidents and crises, a global incident such ...

I said yesterday that we've identified our home essentials - things such as food, fuel, booze, the web etc . - and stocked up accordingly, like any sensible family would do. Those are the thing we all  need . Pretty obvious really and not particularly interesting. But what about the things we don't need? What would we rather not have during this pandemic, or in general?  While painstakingly giving my chisels a long -overdue regrind and manual sharpen in the man-shed, I came up with the following A-to-Z list. These are the things I can do without : Accidents Aches & pains Alzheimer's Armed forces Authorities Bad backs Bad breath Bad debts Bad decisions Bad design Bad dreams Bad engineering Bad habits Bad health Bad memories Badges & thumbs-up Badness generally Bias Bramble Breakages Briscoes sales Broken promises Cancer Cheating Classrooms Climate change Coffins Compliance enforcement Concerts Constraints Crappy software & patching Criminals Crises Crowds Cruises...

From midnight last night, New Zealand is now at civil emergency "stage 4", which means all except essential services personnel are supposed to stay isolated at home for about a month. The official NZ government list of essential services appears to have been finalised and published hastily. Naturally, 'the authorities' consider themselves essential as overnight we've become a police state: police and courts are working through the lockdown, albeit providing limited services, health and immigration/customs services too. What will happen as their workers are or suspect themselves to be infected with coronavirus is unclear at this point. Presumably they have contingency plans, plus controls to limit the spread of infection within police stations, court houses, hospitals, customs halls, mail sorting offices etc.  ... but staffing and service problems are entirely possible as the lockdown continues. Since they aren't entirely self-contained , there's also a se...

I bumped into an insightful piece by Jeff Immelt 'Lead through a crisis'  yesterday. This paragraph really caught my eye:  I agree there are material differences between us in how we react under pressure, differences that are exaggerated during a crisis.  The same applies to social groups and families as well as work teams: some of us are (or at least give the appearance of being) fully on top of things, some are 'coping', some are struggling, and some are in turmoil, overwhelmed by it all. The current situation reminds me of the  Kübler-Ross  grieving curve . Here's a version I've used to help explain our emotional responses to traumatic events such as information security incidents and changes: In any group of people, there will be individual differences e.g. in the rate at which we go through the process, the depth of the 'pit of despair', and the symptoms we show of our inner turmoil.   Also, the curve is figurative, not literal, so the shape and de...