Leadership
I’m sitting here drinking a cup of tea and thought I’d jot down some of the things I tend to think about. I figured this might help people consider aspects of “cyber” that they might not have considered before.
Read more “CYBER CYBER CYBER – What cyber means for the world in the modern age”
Education
Everyone these days seems to rush towards “the solution”, well as someone who now has few years under their belt, I’d advise people slow down a little and think about their business requirements, outcomes, current state, and constraints. Significantly as well think about how a service will run over a period, not just how to buy it and “fling it into production”.
Read more “Stop rushing for “the solution”!”
Leadership
Ok this isn’t my normal jam, normally I’d just write something that’s hopefully good advice/practise and that would be that. But today let’s try something different!
This was inspired by a twitter convo which evolved into this: https://twitter.com/UK_Daniel_Card/status/1522138771789123584?s=20&t=dL9OkicTY2Orj5hfBtDvVQ
So… what are some cyber security myths that ended up being good practise or “good advice”? Well here’s what I came up with, supported by some awesome cyber community people!
Read more “Security Myths and Bad Advice”
Education
My focus normally is on business to business (B2B) environments and “Enterprise” computing and cyber security. However, I’ve been known to venture into the consumer world from time to time. I wondered whether people would be interested in exploring with me what cyber security in the consumer world look like?
Last week I set on an adventure to see what “hacking” myself might look like. I’m thinking that there might be more to this than a fleeting glance at Instagram hacking and a bit of fun on twitter with alts. Maybe we need to look at consumer security and how/if we have got a good user experience in this space?
Read more “Real World Consumer Cyber Security”
Leadership
Yesterday I was asked about “attack volumes” I see in the PwnDefend HoneyNet and it reminded me about what people think an “ATTACK” is and therefore spring my brain into thinking about how we as an industry communicate. Far too often I see “number of ATTACKS” being used my marketing/sales etc. where the numbers are simply ridiculous and not reflective of how offensive cyber operations actually work.
Let’s look at some examples:
Read more “Cyber Events vs Incident vs Attack”“Gov. Greg Abbott warns Texas agencies seeing 10,000 attempted cyber attacks per minute from Iran”
Gov. Greg Abbott – article in the Texas Tribune by CASSANDRA POLLOCK
Leadership
I thought it would be fun to explore what people do with regards to Cyber Securityleadeship, budgets, contraints and realities of business change. So here’s a blog post to supliment my thread on twitter:
please note: the list below is based on experiance, it’s also a list I made whilst drinking about half a cup of tea so it’s not complete or “the answer” it’s just some observations about an approach I advocate.
Read more “Tabletop: “you have 400 servers; 800 users and your cyber security budget is 100K…. what do you do?””
Leadership
I’ve been travelling to different organisations and visiting different networks for a while and whilst each organisation is unique (they really are) their operating models, technology challenges and weak security postures generally aren’t as unique as the organisational itself.
One thing that does spring to mind however is that there is a massively common pattern we find with organisations.
One thing that is common though, is that all of this tends to link to financial investments, so executives and boards usually have some idea if they are spending or not in this space, what they commonly don’t have a good view on is they getting what they “thought they were buying”. Sadly, too often what they assumed was “in the box” with the “IT provision” with regards to quality and cyber security just simply isn’t the case. Everything is fine, until you look… then it’s less than fine! So, what can we do about it?
Read more “Why do “we” suck so badly at digital security ?”
Leadership
This post stated out as a technical post about commonalities found in the field that vary based on business operating model, IT capability and vectors used by threat actors. Whilst writing this it led more into business leadership, governance and investment risks. How do these two subjects’ interface? Well to be honest they are the same thing from a different lens.
In this post we are going to look at:
Guides
Ok so this isn’t just for CISO’s but it’s a tool to help organisations think more holistically about cyber security and some of the foundational elements required to align cyber security capabilities with the business.
Read more “CISO – Getting Started Tool”
Defense
Ok this is not a small subject areas and it’s not a HOW TO guide but it should at least give you some ideas for tools to deploy and areas to check that are abused by Ransomware gangs and ATPs etc. Thanks to people who contributed!
This is not everything but it’s some common low hanging weaknesses:
Read more “Rapid Active Directory Hardening Checklist”