01 March 2023

昨天看到一个技术报告,说,过去很多工业设备都是“Insecure by Design”,即设计上就是有不安全的功能,比如允许无授权地下载执行代码,使用明文密码之类的。在进行信息安全认证的时候,又因为标准本身的模糊不清,导致厂商和认证机构有各自有独特的解读( idiosyncratic interpretations ):

Many security standards use opaque definitions. For example, the IEC 62443 Security Assurance Levels are defined to correspond to attacker classes of increasing sophistication. This sophistication, however, is defined in very generic and opaque terms such as ‘moderate resources’, ‘sophisticated means’ and ‘IACS specific skills.’ These terms, when left vague and unquantified, lend themselves to idiosyncratic interpretations more reflective of the auditor’s perceptions and expectations than of a product’s security posture. (LABS 2022)

这里,我们遇到一个比较长的单词: idiosyncratic 意思是独特的、怪癖的。

这个词由 idio + syncratic 组成。idio 来自拉丁语 idios 自己的、个人的。而 syncratic 则是来自希腊语 synkrasis 混合物。合起来就是自己个人独特的混合的。

比如 C++ 2020 (ISO/IEC 2020) 标准里也提到:Implementations can provide additional execution policies to those described in this standard as extensions to address parallel architectures that require idiosyncratic parameters for efficient execution. 针对 C++ 标准库的算法函数,并行计算需要独特的参数以提高执行效率。

Elizabeth C. Hirschman and Morris B. Holbrook (Hirschman and Holbrook 1982) 引用了 Commonality and Idiosyncracy in Popular Culture: An Empirical Examination of the ’Layers of Meaning’ Concept. 这里用了单词的名词形式,即独特风格之意思。

References

Hirschman, Elizabeth C., and Morris B. Holbrook. 1982. “Hedonic Consumption: Emerging Concepts, Methods and Propositions.” Journal of Marketing.
ISO/IEC. 2020. “ISO/IEC 14882:2020: Programming Languages - c++.”
LABS, VEDERE. 2022. “OT:ICEFALL - the Legacy of ‘Insecure by Design’ and Its Implications for Certifications and Risk Management.” Forescout Technologies, Inc.