RISK & CYBERSECURITY

There is a lot of conventional security that is based on established ceremonies and an unquestioning faith that if we keep doing these...

It’s that time of year when you’ve inevitably written notes to your organization and leadership about all your team’s achievements over...

There is a notion I keep coming back to thanks to this article from a few years ago. The essence is that there are things that have...

Since I first wrote this post 2 years ago I keep seeing it reinforced. The basic premise is that, sometimes, advanced levels of security...

I typically don’t do book reviews, but this book was impressive and it resonated with many information security and risk management...

Some of you in the US, and maybe others, might be familiar with the ongoing, somewhat self-deprecating, Jeff Foxworthy skit of “You might...

How much of your work that you would like to describe as a “grand” challenge is really more of a “grind”? As an industry we like to talk...

Which part of the security community are you in? Often, when one part of the security community talks about the overall community they...

Since I first wrote this back in 2021 (titled "CISO: Archeologist, Historian or Explorer?") it seems ever more true that complex and...

In this, fourth and final post in the series of Crucial Questions I’m going to focus on those from governments and regulators. This...

In this, third in a series of Crucial Questions posts I’m going to focus on the questions from CISOs and security teams. This builds on...

In the last post I covered the crucial questions from Boards and executives. Here I will cover the questions I’m asked by CIOs, CTOs and...