Testing FastGoods’ MFA, both ways
Applied to Nordic Phone’s rule ‘MFA for CRM and email’: design test = inspect the identity-provider configuration, effectiveness test = sample 25 logins from the log. The effectiveness test would catch admin or legacy logins that skip MFA, which the design test alone misses.
Sized to 25 people, owned by the operations lead, reviewed yearly.
Applied to Nordic Phone (35 staff): I used three messages (Report button, MFA by default, check ID), measured click rate, reporting rate and time to report, and owned it by the Operations Manager. Staff who register subscriptions needed their own topic (ID fraud), like finance in this example
Knowing is not the same as doing.
For AutoRisk, employees might know how to recognise phishing but still click suspicious links when they are busy. I think short exercises would be more useful than only giving them a presentation once a year.
a vulnerability can also be interpreted as the absence of a control
Applied to Nordic Phone’s R3: ‘no MFA, limited monitoring, low phishing awareness’ rewritten as missing controls 8.5, 8.16 and 6.3 gave a direct to-do list (gaps 1–3). This turned a vague ‘weak authentication’ risk into three owned actions.
Work can be delegated; responsibility for the outcome cannot.
AutoRisk depends on external services like FINN.no and Statens vegvesen. If one of these services has problems, customers may not receive correct reports. Even though AutoRisk does not control those services, it still needs a plan for handling the situation.
Documentation is the control that makes a control survive its author.
This could be a problem for AutoRisk if only one developer knows how an important system works. If that person leaves, the company might struggle to fix problems. Writing down the process would make it easier for someone else to take over.
Add context with initial prompts
通过提供初始提示，开发者可以为模型提供上下文，这对于构建交互式应用至关重要。
The `create()` function's optional options object also takes a `signal` field
使用signal字段可以优雅地取消正在进行的API调用，这是编写健壮代码的一个重要实践。