RISK & CYBERSECURITY

I’ve given variants of this talk at a few events in 2024 and received a lot of requests for the slides and a blog post. So here we go. ...

I managed to keep up the pace of 1 post every 2 weeks throughout 2024. Just when I think I might be running out of ideas, and the backlog...

Every few months some association or other learned group of professionals makes a fresh call to action for cybersecurity regulatory...

If you work for a large organization, especially public or otherwise regulated companies, then you may well have faced the prospect of...

It’s puzzling that there aren’t more articles comparing and contrasting wildlife hunting techniques with cyber threat hunting, or maybe...

This is the second of two posts about interviews (the first post is here ). In this one I’ll focus on interviewing candidates and the...

This is the first of two posts about interviews. In this one I’ll focus on interviewing for a role. In the next one we’ll look at how to...

I wrote the original version of this post over 4 years ago. In revisiting this it is interesting to note that not much has actually...

If we are to keep advancing the fields of information / cybersecurity, technology risk management and resilience then we need to apply...

Security training is often considered a bit of a waste of time. Maybe this is unfair, but unsurprising in the face of the worst forms of...

One of the many paradoxes of security is that when you have invested appropriately (sometimes at significant expense) and you have less...

Several years after writing the first version of this blog I still see a repeated pattern of problematic events attributed to human...

When you strip away all the fluff, security succeeds when: You are moving quicker than attackers - mitigating specific attacks ahead of,...

We’re getting it wrong on the messaging for incentives to do security - and people are pretending it’s landing when it isn’t. There are 5...

A major success marker of great security leaders and their teams is one simple prioritization technique: the ability to know what needs...

There are many well known, so called, laws of technology. Moore’s law being particularly emblematic. Let’s look at some of them and see...

A few weeks ago The White House published our PCAST report on cyber-physical resilience. Thank you for all the positive reactions to...

We still have plenty of open problems in information and cybersecurity (InfoSec). Many of these problems are what could easily be classed...

Each year, DevOps Research and Assessment (DORA) within Google Cloud publishes the excellent State of DevOps report. The 2023 report...

As we start out, or even when entering a new stage of our careers, we realize the need to be connected to a professional community. For...