Painted, Not Photocopied Cybersecurity Memes From the Kingdom
Phishing, passwords, ransomware, AI agents and the naming of enemies. Objections by the Fool. Illumination by the Page. Neither of them was asked.
The Fool supplies the objection and the Page supplies the gold leaf. They began without permission, which is how the court learns of most things, and have not been stopped because nobody can establish whose task stopping them was.
Each comes in a larger copy, square and near enough three hundred lines to the inch at the size of a postcard, which is enough for a slide, a newsletter or a small print for a wall that has earned one.
Take them. Pin one to a noticeboard where the person who opened a temporary rule in 2019 will have to walk past it. Unaltered, unsold, and otherwise unconditional.
Opened for one afternoon by somebody in a hurry who has since left the company. The ticket is closed. The rule is not.
It has a capital, a number and a punctuation mark, exactly where the policy said to put them. So does everybody else's.
Access granted for a trial is rarely taken back, because nobody wishes to be the one who slowed the machine down.
Urgency and authority both stop people checking, which is why the request that cannot possibly wait is the one that can.
Every firm names what it finds, none can overrule another, and the intruder is the only party present who is not confused.
Every night, faithfully, for six years. The restore was tested once, in principle, at a meeting.
There is no S in IoT. That is the joke and it is also the summary: sold on the strength of an app, shipped with a default password, supported until the manufacturer loses interest, and sitting on the same home network as everything else you own.
Why it is always DNS: it turns names into addresses, it is touched by everyone and owned by nobody, and it is the first thing worth checking and the last thing anyone checks. The firewall gets blamed first because it is the one with a name.
This is a scream test, and it works, which is the problem. It is what you are left with when nothing was written down and the one person who knew has since left. Needing it is the finding, not the method.
Zero trust is an architecture, not a purchase, and least privilege is most of it. It is also the one control that is always somebody else's turn to give up, so the keyring never gets smaller on its own.
Train people hard enough to report phishing and they will report everything, including the things you needed them to read. The court counts this as a success.
The longer versions
All 16 chronicles →Each of these happened at greater length, with witnesses, and was written down. There are 16 such records. The Royal Armoury issues some of it as posters, for noticeboards belonging to people who have stopped expecting better, and the crown keeps its Cybersecurity Awareness Month material in one place for whoever has been handed October.
The terms of issue
Free to use unaltered: at work, in a classroom, in a newsletter, on any noticeboard that will have them. Not for resale. The credit is already printed on the thing, so there is nothing for you to add.
That is the whole treaty. The crown's lawyers are disappointed by its brevity and have been informed that the matter is closed.
Requests, questions and corrections reach the court at [email protected].
More will follow. The court fails at new things reliably and has never once been short of material. The Fool has reserved judgement on whether any of it is satire, at length, in writing, unprompted. He considers the words the important half. The Page has not been asked.