6 days ago5 minScenario Planning - The Best Technique You Might Not Be UsingScenario planning is one of the most underutilized techniques in security. Which is surprising given how effective it is in [good] corpor...
Nov 156 min12 Step Guide on Escalating Risk and Security Issues Escalating issues is part of the foundation of any good risk and security program. Unfortunately, human nature is such that most people a...
Nov 84 minPrinciples for Cybersecurity Metrics“For every metric, there should be another ‘paired’ metric that addresses adverse consequences of the first metric.” - Andy Grove We talk...
Nov 17 minThe Uncanny Valley of Security (or Why We Might Never Finish Anything)The uncanny value is a famous term in robotics. It is used to describe how we accept robots that don’t attempt to look too human, but, a...
Oct 254 minCybersecurity Macro Themes for the 2020’s - UpdatedThere will be 6 major themes that differentiate great security programs, products, features and processes. These are different from overa...
Oct 183 minWhy Cybersecurity Budget Benchmarks are a Waste of TimeI have built up a disdain for cybersecurity budgeting benchmarks. To be fair, there are some good attempts amid a sea of haphazard approa...
Oct 132 minVulnerability Management - UpdatedIt still surprises me that much of the tone of vulnerability management is about patch/bug fix vs. detecting broader configuration and ar...
Oct 104 minBuilding Balanced Security Teams: The Rule of ThirdsAs an industry we spend a lot of time talking about workforce development and skills shortages. We tend not to talk about how to organize...
Oct 44 minSecurity for More than Security’s Sake - The Need for Adjacent BenefitsTruly excellent security programs deliver more than security risk mitigation. I know it is kind of ridiculous to say that when doing the ...
Sep 275 minThe Most Important Mental Models for CISOs - Simple Steps for Outsize EffectsThere are lots of problem solving techniques across many fields. These are often represented as mental models or behavioral short-cuts. H...
Sep 203 minThe Rising Tide and the Case for Security OptimismContinuing with the theme of raising the baseline by reducing the cost of control we can see the next logical progression is that the fas...
Sep 134 minRaise the Baseline by Reducing the Cost of ControlOne of the most successful techniques for enterprise security in many organizations is to create a universal baseline of controls that ap...