RISK & CYBERSECURITY

It has always struck me how well the field of finance and more specifically accounting has done to standardize on its terms. This...

This is an update from a post of a couple of years ago prompted by some recent observations from a few different organizations. It seems...

We talk about attackers being the enemy. Sometimes we talk about insider threats. But one of our biggest enemies is pernicious...

Working in information/cybersecurity and technology risk is a fascinating and challenging career, as I’ve covered here. There is, mostly,...

We continuously hear about the millions of unfilled cybersecurity roles, although I’ve yet to see a study that actually supports that...

I first came across the notion of doctrine vs. structure in this depiction about the relative positioning of tanks from some blog or...

In a few of my posts I've talked about the economy of scale of the cloud is fundamentally changing the game of security. The pace of...

One of the many pieces of accepted wisdom in information/cybersecurity is that complexity is the enemy of security. But is it? You...

This is my list of favorite books across the various professional disciplines I’m interested in. I have a set of favorite books that are...

There is a seminal paper in finance by Charles Ellis called the The Loser’s Game which, in simple terms, foretells the move from active...

The concept of return on investment (ROI) for security has bugged me for a long time. Not because it isn’t a laudable goal. Of course,...

This is the second part of the post from 2 weeks ago, which explored research challenges in Info/Cybersecurity related to systems:...

This is the first of a two part post on research challenges centered on systems, computer science and engineering research challenges....

Many years ago I wrote down a list of the drivers that create information / cyber-risk or that otherwise compel the need to mitigate this...

I can’t recall having seen an overview of a systematized privilege management program. There are lots of great articles on specific...

Security ratings services tend to be loved or loathed. Loved if you consume them and it makes your job easier, especially if you have no...

The success of a security program is largely determined by how well it is integrated into the fabric of the organization, in terms of...

Over the years I've noted the behaviors I’ve seen from consistently successful people. In this context I define success as a balance of...

Scenario planning is one of the most underutilized techniques in security. Which is surprising given how effective it is in [good]...

“For every metric, there should be another ‘paired’ metric that addresses adverse consequences of the first metric.” - Andy Grove We talk...