Risk & Cybersecurity

Sep 25, 20214 min read

Cyber Deterrence : A Simple Perspective

Cyber deterrence is a topic that comes in and out of vogue. It is widely studied but often misunderstood. It also suffers tremendously...

Sep 12, 20218 min read

If Accounting were like Cybersecurity

It has always struck me how well the field of finance and more specifically accounting has done to standardize on its terms. This...

Aug 27, 20213 min read

Risk Management is not only about Reducing Risk - Updated

This is an update from a post of a couple of years ago prompted by some recent observations from a few different organizations. It seems...

Aug 14, 20219 min read

Risk = Hazard + Outrage

There are four major insights that, above all others, have influenced my approach to security and risk management over the past decades....

Jul 30, 20217 min read

CISO: Archeologist, Historian or Explorer?

We talk about attackers being the enemy. Sometimes we talk about insider threats. But one of our biggest enemies is pernicious...

Jul 16, 20218 min read

Cybersecurity - The Board's Perspective

How Boards, especially public company Boards, oversee cybersecurity is a crucial but difficult topic. This previous post discussed how...

Jul 3, 20216 min read

Cybersecurity and the Curse of Binary Thinking

Working in information/cybersecurity and technology risk is a fascinating and challenging career, as I’ve covered here. There is, mostly,...

Jun 19, 20217 min read

The Actual Cybersecurity Workforce Challenge

We continuously hear about the millions of unfilled cybersecurity roles, although I’ve yet to see a study that actually supports that...

Jun 5, 20216 min read

Relationship Management for the InfoSec Program

A key part of any security leader's role is relationship management. In my experience this is another one of those leadership skills that...

May 22, 20212 min read

Segmentation Technologies / Zero Trust

I first came across the notion of doctrine vs. structure in this depiction about the relative positioning of tanks from some blog or...

May 13, 20211 min read

Cloud Security

In a few of my posts I've talked about the economy of scale of the cloud is fundamentally changing the game of security. The pace of...

May 8, 20217 min read

Is Complexity the Enemy of Security?

One of the many pieces of accepted wisdom in information/cybersecurity is that complexity is the enemy of security. But is it? You...