Risk & Cybersecurity

People and Security Incentives

Force 6 : People, organizations and AI respond to incentives and inherent biases but not always the ones we think are rational. //...

Handling Complexity

Force 5 : Complex Systems break in Unpredictable Ways // Central Idea: While component level simplicity is vital, seeking to eliminate...

Fighting Security Entropy

Force 4 : Entropy is King // Central Idea: Adopting a control reliability engineering mindset by continuous control monitoring is...

Attack Surface Management

Force 3 : Services want to be on // Central Idea: Take architectural steps to inherently reduce your attack surface - don’t just rely...

Software Security is More than Vulnerabilities

Force 2 : Code wants to be wrong // Central Idea: Shift from a pure focus on only reducing security vulnerabilities towards increasing...

Data Security and Data Governance

Force 1: Information wants to be free // Central Idea: Shift from perimeter based surveillance and tactical blocking to data governance...

The 6 Fundamental Forces of Information Security Risk

I first posted this as a Twitter thread in 2019. These forces still seem very much current - perhaps even more so. It is interesting to...

Ceremonial Security and Cargo Cults

There is a lot of conventional security that is based on established ceremonies and an unquestioning faith that if we keep doing these...

Simple Ways to Communicate Successes

It’s that time of year when you’ve inevitably written notes to your organization and leadership about all your team’s achievements over...

Dangerous Embedded Assumptions

There is a notion I keep coming back to thanks to this article from a few years ago. The essence is that there are things that have...

The Uncanny Valley of Security - Updated

Since I first wrote this post 2 years ago I keep seeing it reinforced. The basic premise is that, sometimes, advanced levels of security...

A New Way to Think : Review

I typically don’t do book reviews, but this book was impressive and it resonated with many information security and risk management...