Risk & Cybersecurity

Work / Life Balance

I have always struggled to balance work and life. Many years ago I realized I wasn’t so much struggling to achieve an effective balance,...

Delivering Security at Scale: From Artisanal to Industrial

Maturing a security program in any type of organization is not just to increase specific control effectiveness but also to increase its...

You Only Get 3 Metrics - Which Ones Would You Pick?

Just over a year ago I put out this blog post on the 10 fundamental (but really hard) security metrics. Since then I’ve discussed this...

The Illusion of Choice : A Review

In the last post we talked about the challenges and opportunities of using individual and organizational incentives to ensure effective...

People and Security Incentives

Force 6 : People, organizations and AI respond to incentives and inherent biases but not always the ones we think are rational. //...

Handling Complexity

Force 5 : Complex Systems break in Unpredictable Ways // Central Idea: While component level simplicity is vital, seeking to eliminate...

Fighting Security Entropy

Force 4 : Entropy is King // Central Idea: Adopting a control reliability engineering mindset by continuous control monitoring is...

Attack Surface Management

Force 3 : Services want to be on // Central Idea: Take architectural steps to inherently reduce your attack surface - don’t just rely...

Software Security is More than Vulnerabilities

Force 2 : Code wants to be wrong // Central Idea: Shift from a pure focus on only reducing security vulnerabilities towards increasing...

Data Security and Data Governance

Force 1: Information wants to be free // Central Idea: Shift from perimeter based surveillance and tactical blocking to data governance...

The 6 Fundamental Forces of Information Security Risk

I first posted this as a Twitter thread in 2019. These forces still seem very much current - perhaps even more so. It is interesting to...

Ceremonial Security and Cargo Cults

There is a lot of conventional security that is based on established ceremonies and an unquestioning faith that if we keep doing these...