Cybersecurity

Nov 307 min read

Regulatory Harmonization - Let’s Get Real

Every few months some association or other learned group of professionals makes a fresh call to action for cybersecurity regulatory...

1,312 views

Nov 213 min read

Risk Appetite and Risk Tolerance - A Practical Approach

If you work for a large organization, especially public or otherwise regulated companies, then you may well have faced the prospect of...

5,723 views

Oct 197 min read

Threat Hunting: Real World vs. Cyber World

It’s puzzling that there aren’t more articles comparing and contrasting wildlife hunting techniques with cyber threat hunting, or maybe...

1,512 views

Oct 517 min read

Job Interviews: Part 2 Conducting the Security Interview - The Big 10

This is the second of two posts about interviews (the first post is here ). In this one I’ll focus on interviewing candidates and the...

3,709 views

Sep 2111 min read

Job Interviews: Part 1 Acing the Security Interview - 10 Top Tips

This is the first of two posts about interviews. In this one I’ll focus on interviewing for a role. In the next one we’ll look at how to...

3,676 views

Sep 78 min read

6 Truths of Cyber Risk Quantification

I wrote the original version of this post over 4 years ago. In revisiting this it is interesting to note that not much has actually...

5,630 views

Aug 246 min read

Ethics and Computer Security Research

If we are to keep advancing the fields of information / cybersecurity, technology risk management and resilience then we need to apply...

531 views

Aug 1016 min read

Security Training & Awareness - 10 Essential Techniques

Security training is often considered a bit of a waste of time. Maybe this is unfair, but unsurprising in the face of the worst forms of...

7,275 views

Jul 135 min read

Why Good Security Fails: The Asymmetry of InfoSec Investment

One of the many paradoxes of security is that when you have invested appropriately (sometimes at significant expense) and you have less...

3,762 views

Jun 2910 min read

Human Error

Several years after writing the first version of this blog I still see a repeated pattern of problematic events attributed to human...

1,907 views

Jun 155 min read

Going Faster: Isochrones and “Time to Hello World”

When you strip away all the fluff, security succeeds when: You are moving quicker than attackers - mitigating specific attacks ahead of,...

1,267 views

Jun 18 min read

Incentives for Security: Flipping the Script

We’re getting it wrong on the messaging for incentives to do security - and people are pretending it’s landing when it isn’t. There are 5...

4,172 views

May 184 min read

The Crucial Test of Security Leadership: A-grades vs. Pass/Fail

A major success marker of great security leaders and their teams is one simple prioritization technique: the ability to know what needs...

2,424 views

Apr 2010 min read

Security and Ten Laws of Technology

There are many well known, so called, laws of technology. Moore’s law being particularly emblematic. Let’s look at some of them and see...

4,232 views

Apr 66 min read

A Letter from the Future

A few weeks ago The White House published our PCAST report on cyber-physical resilience. Thank you for all the positive reactions to...

4,828 views

Mar 2310 min read

InfoSec Hard Problems

We still have plenty of open problems in information and cybersecurity (InfoSec). Many of these problems are what could easily be classed...

4,218 views

Mar 96 min read

DevOps and Security

Each year, DevOps Research and Assessment (DORA) within Google Cloud publishes the excellent State of DevOps report. The 2023 report...

2,137 views

Feb 2413 min read

The Power of Community: 5 Steps to Fast-Track Your InfoSec Career

As we start out, or even when entering a new stage of our careers, we realize the need to be connected to a professional community. For...

2,627 views

Feb 105 min read

The 80 / 20 Principle

Ever since I first became familiar with the 80/20 principle, and other circumstances marked by Pareto distributions, I began to see...

3,271 views

Jan 135 min read

Best Security Movies (and some that haven’t been made yet)

Everyone has their list of favorite security movies and I bet some are on everyone’s list. There’s also a set of movies that aren’t...

1,476 views

RISK & CYBERSECURITY

Thoughts from the Field

Subscribe for updates.